Cua: Cross-OS Computer Use and Virtualization Platform
Scale computer-use 2.0 with open-source drivers, cross-OS fleets, and benchmarks.
- Source repo
- trycua/cua
- Stars
- ★ 30k
- Last updated
- today
- License
- MIT
- Primary language
- Rust
- FA score
- 0/100 · Major gaps
At a glance
- How it runs
- Works with
- Platform-specificClaude Code
- Cost
- Free tier plus a paid hosted plan
- Setup effort
- Medium · a few setup steps
- You'll need
- Typical use
- A developer uses Cua Drivers with Claude Code to let a coding agent operate native macOS apps in the background, such as testing a GUI application.
- Not a fit if
- Teams that must run fully offline without any cloud service
- Users on non-Apple-Silicon hardware who need local macOS VMs
- Commercial teams that cannot accept AGPL-3.0 third-party license obligations
- Source review
- 0/100 · Major gaps 8 safety controls not found
What does this agent do, and when should you use it?
Cua is an open-source toolkit for building and evaluating AI agents that operate desktop applications. It comprises four main components: Cua Drivers provide background GUI automation on macOS, Windows, and Linux, allowing agents to control native apps without stealing the cursor or focus; Cua Sandbox offers isolated VM/container sandboxes across multiple operating systems (Linux, macOS, Windows, Android) via a unified API; Cua Bench provides benchmarks and RL environments such as OSWorld, ScreenSpot, and Windows Arena; and Lume manages macOS/Linux VMs on Apple Silicon using Apple's Virtualization.Framework. The project is MIT-licensed and includes CLIs, an MCP server, and a Python SDK.
Cua enables computer-use agents by: using Cua Drivers to operate native desktop apps in the background on macOS, Windows, and Linux (click, type, verify), with integration via CLI and MCP server for clients like Claude Code, Cursor, and Codex; using Cua Sandbox to spin up ephemeral sandboxes of VMs or containers, providing shell execution, screenshots, mouse/keyboard control, and mobile gesture APIs; using Cua Bench to run standardized benchmarks and export trajectories; and using Lume to create and manage macOS/Linux VMs with unattended installation.
- A developer uses Cua Drivers with Claude Code to let a coding agent operate native macOS apps in the background, such as testing a GUI application.
- A data scientist creates a Cua Sandbox to run an isolated environment of any OS for automated data scraping or UI testing scripts.
- An AI researcher uses Cua Bench to evaluate their own agent on OSWorld or ScreenSpot benchmarks and export trajectories for training.
- A system administrator uses Lume to quickly deploy macOS VMs on Apple Silicon Macs for testing or CI.
- An automation engineer uses Cua's multi-OS support to run Windows-specific apps in a Windows sandbox while controlling from Linux.
How do you install or deploy this agent?
Installation varies by component:
- Cua Drivers (macOS/Linux): run bash -c "$(curl -fsSL https://cua.ai/driver/install.sh)"; Windows (PowerShell): irm https://cua.ai/driver/install.ps1 | iex.
- Cua Sandbox: pip install cua (requires Python 3.11+).
- Cua Bench: clone repo and use uv tool install -e ..
- Lume: run bash -c "$(curl -fsSL https://cua.ai/lume/install.sh)".
How do you use this agent?
For Cua Drivers, after install, follow the post-install instructions (see docs for driving your first app). For Cua Sandbox, use Python:
from cua import Sandbox, Image
async with Sandbox.ephemeral(Image.linux()) as sb:
result = await sb.shell.run("echo hello")
screenshot = await sb.screenshot()
await sb.mouse.click(100, 200)For Lume, create and run a macOS VM:
lume ipsw
curl -L "$(lume ipsw | tail -n 1)" -o ~/Downloads/macos-tahoe.ipsw
lume create macos-tahoe --ipsw ~/Downloads/macos-tahoe.ipsw --unattended tahoe
lume run macos-tahoeWhat are this agent's strengths and limitations?
- Background operation of native apps without stealing cursor/focus, enabling multitasking agents.
- Unified API across macOS, Windows, Linux, and Android reduces cross-platform complexity.
- Includes benchmarks and RL environments for evaluating and training agents.
- Leverages Apple Virtualization.Framework for near-native performance in macOS VMs.
- macOS VM management relies on Apple Silicon (hardware constraint), limiting usability on other hardware.
- Windows support depends on PowerShell and possibly sandbox configuration; Wayland support is limited to specific compositors with explicit limits.
- Cloud services (cua.ai) are commercial; local QEMU path requires self-managing resources.
- Some components (e.g., cua-agent's omni option) depend on third-party licenses (AGPL-3.0), which may affect compliance.
How does this agent compare with similar options?
Comparable to Microsoft's OmniParser for UI parsing (integrated as an optional dependency in Cua), but Cua provides a full computer-use stack including drivers, sandboxes, and benchmarks. Compared to macOS virtualization tools like UTM, Lume focuses on native performance and unattended automation on Apple Silicon.
Key facts side by side with the most closely related agents.
| Agent | Source review | Form / cost | Stars | Updated | Language | Full support on |
|---|---|---|---|---|---|---|
| Cua: Cross-OS Computer Use and Virtualization Platform This agent | 0 · Major gaps | CLIFreemium | ★ 30k | today | Rust | Claude Code |
| Clawd Cursor | 74 · Some gaps | MCP serverFree + model costs | ★ 404 | today | TypeScript | Codex · Claude Code |
| AIHawk – AI Browser Agent | 59 · Major gaps | MCP serverFree + model costs | ★ 32k | 4d ago | TypeScript | Codex · Claude Code |
| Agent Swarm | 47 · Major gaps | Agent plugin / skillFree + model costs | ★ 904 | today | TypeScript | Codex · Claude Code |
How does FollowAgents rate this agent?
Why each dimension lost points
Insufficient evidence: The repository does not provide clear information on permission management, user confirmation, data flow transparency, sensitive data handling, dependency security, external effects, rollback, or source attribution. All criteria are unsupported, hence scored 0.
Insufficient evidence: No clear evidence for self-consistency, dependency availability, or failure messages. All criteria are unsupported, hence scored 0.
Insufficient evidence: No clear evidence for audience and scenarios, capability boundaries, trigger precision, or environment fit. All criteria are unsupported, hence scored 0.
Insufficient evidence: No clear evidence for information architecture, install notes, naming stability, examples and FAQ, known limitations, license, versioning, or maintenance responsibility. All criteria are unsupported, hence scored 0.
Insufficient evidence: No clear evidence for output usability, marginal value, or cost-benefit. All criteria are unsupported, hence scored 0.
Insufficient evidence: No clear evidence for claim traceability, cross-source corroboration, or fact-inference separation. All criteria are unsupported, hence scored 0.
- Not found in source: least-privilege scopingGrant only what the task needs: a dedicated account or read-only token, scoped to specific directories and repos.
- Not found in source: confirmation before actingTurn on (or add) a confirmation step before it acts, and try it in a sandbox or test environment before real data.
- Not found in source: data-flow disclosureWatch which external services it contacts (proxy or firewall logs) and keep sensitive data out until you know where it goes.
- Not found in source: sensitive-data handlingUse dedicated, low-privilege, revocable API keys — never production credentials — and keep secrets out of logs.
- Not found in source: dependency securityPin versions and run a dependency audit (npm audit, pip-audit) before installing; prefer running it in a container.
- Not found in source: disclosed external effectsEstablish which external systems it writes to, sends to or changes, and verify with test accounts or repos before production.
- Not found in source: rollback or recovery pathBack up first, or work on a git branch or snapshot, so its changes can be undone.
- Not found in source: verifiable attributionInstall from the official repo or registry and check the publisher and URL to avoid look-alike packages.
- The repository content is insufficient to support a comprehensive assessment of the Agent product; more source code and documentation are recommended.
- Publisher identity is unverified; do not infer reliability or safety based on brand.
Recent releases
Latest entries from the project's GitHub Releases. Notes are quoted from upstream as written, not rewritten or tested by FollowAgents.
-
bench-v0.3.1 cua-bench v0.3.1
Release notes excerpt
What's Changed * chore(main): release bench 0.3.1 by @cua-release-bot[bot] in https://github.com/trycua/cua/pull/5134 Full Changelog: https://github.com/trycua/cua/compare/sandbox-v0.9.1...bench-v0.3.1View on GitHub ↗ -
sandbox-v0.9.1 sandbox: v0.9.1
Release notes excerpt
Cua Sandbox 0.9.1 Summary This release includes 6 fixes. Fixes - post-launch CI follow-ups. ([#4405](https://github.com/trycua/cua/pull/4405)) - lock the cua SDK checkout at 0.3.1. ([#4593](https://github.com/trycua/cua/pull/4593)) - roll back partially opened tunnels. ([#5174](https://github.com/trycua/cua/pull/5174)) Thanks @GDemay. - report directory types in file listings. ([#5175](https://github.com/trycua/cua/pull/5175)) Thanks @GDemay. - stop Cua Cloud (on="cloud") with a clear "Cua Cloud has ended" error (CUA-1854). ([#5415](https://github.com/trycua/cua/pull/5415)) …View on GitHub ↗ -
cua-sdk-v0.5.0 cua SDK 0.5.0