Cua: Sandboxed Desktops and Drivers for Computer-Use Agents (GitHub, Scanned)

Cua is a toolkit for computer-use agents: AI agents that operate a desktop by looking at the screen and clicking and typing. The repository holds several products. Cua Driver lets an agent inspect and operate native apps and browsers on macOS, Windows and Linux through a CLI, MCP or SDKs, often in the background without moving your pointer. The cua CLI and SDK (Python, TypeScript, Rust) create local sandboxes, VMs and containers an agent can run in. Lume creates macOS and Linux VMs on Apple Silicon. Cua Bench builds tasks for evaluating agents, and Cua Spaces is a desktop app that gives agents full desktops on your Mac or machines you own.

It is on this list because running an agent against your real desktop is risky, and Cua's main idea is to give the agent its own machine instead. A disposable sandbox you can screenshot, script and throw away is a far safer place to let a model click around, and the driver works with Claude Code, Codex, Cursor and other MCP clients.

It is a large and fast-moving project, about 3.3 million lines across Rust, Python, TypeScript and Swift, with frequent releases. Licences are mixed: the libraries are MIT, but the Cua Spaces app is source-available under FSL-1.1-MIT, free for individuals with paid Pro and Teams plans. Spaces needs macOS 26 or later, and several older Python packages are marked deprecated, including cuabot, which the README says has known security issues and should be uninstalled.

• Repository: github.com/trycua/cua
• Licence: MIT (MIT License)
• Language: Rust. Stars: 31K. Forks: 2,268. Last push: Oct 26, 2026.
• Scan: safe, Oct 26, 2026, commit 4b84caa

Who it is for

Developers building or testing computer-use agents who want isolated desktops and sandboxes, and Claude Code or Codex users who want their agent to operate desktop apps through MCP.

Getting started

1. Install the cua CLI on macOS or Linux (Windows: irm https://cua.ai/install.ps1 | iex)

curl -fsSL https://cua.ai/install.sh | sh

2. Create a local Linux sandbox and run a command in it

cua sb create ubuntu --name dev && cua sb exec dev uname -a

3. Or install Cua Driver to let an agent operate your apps

/bin/bash -c "$(curl -fsSL https://cua.ai/driver/install.sh)"

All installers are shell or PowerShell scripts fetched from cua.ai and run as is; the repository holds their sources if you want to read them first. On macOS the main installer adds the Cua Spaces app by default; it asks first. A signed .dmg is also available from the GitHub releases.

Safety scan

We cloned trycua/cua at commit 4b84caa on Oct 26, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.

• The one secret hit, in scripts/cli-cast/record.py line 76, is the replacement string AKIAREDACTEDREDACTED in a function that scrubs AWS keys out of terminal recordings. It is not a key.
• Of 222 pattern hits, 140 are persistence: the Cua Spaces Mac app and its helper registering a LaunchAgent so the Spaces host starts at login, plus test fixtures that reference it. 63 are curl | sh one-liners for Cua's own installers in docs, tests and generated SDK comments. The base64 exec in cua-bench's remote.py and the PowerShell -EncodedCommand in libs/images/windows-2022/guest-exec.py encode commands sent into a sandbox or VM, and the /dev/tcp hit is a 3-second connectivity check against 1.1.1.1.
• Telemetry is on by default and sends usage events to PostHog's EU servers. Set CUA_TELEMETRY=0 or DO_NOT_TRACK=1, or turn it off in ~/.cua/config.toml; it is off automatically in CI.
• Four workflows use pull_request_target, but none checks out the pull request's code: two only post comments (the CLA check and a release reminder) and the contributor-attribution job checks out the trusted base commit. 179 of 268 third-party action uses are pinned to commits. Dependabot, security policy and contributing guide present.
• 644 known advisories across 63 lockfiles (38 critical). Most sit in examples, benchmark task apps, test fixtures and the docs site; the main Rust lockfiles (libs/cua and libs/cua-spacesd) carry 15 each, and 104 of the total have no severity rating. Two .ods spreadsheets in benchmark fixtures were flagged as archives; they are test documents.

What the scanner counted

The raw findings

Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.

By the numbers

Lines by language: Rust 1.3M, JSON 455K, Python 448.8K, TypeScript 396.8K, Swift 204.6K, Markdown 174.7K.

Questions

Is Cua free?

The libraries, CLI, Driver, Lume and Cua Bench are MIT-licensed and free. The Cua Spaces app is source-available under FSL-1.1-MIT and free for individuals, with Pro at $18 a month and Teams at $30 per seat a month.

Does Cua send data anywhere?

It sends usage telemetry to PostHog by default, which you can turn off with CUA_TELEMETRY=0 or DO_NOT_TRACK=1. Some features, such as reaching your own machines through the cua.ai relay, use Cua's servers by design. Local sandboxes and VMs run on your hardware.

Which AI agents can use Cua?

Cua Driver connects through MCP, a CLI or typed SDKs, and the docs cover Claude Code, Codex, Cursor and OpenClaw. You bring your own model; Cua provides the computer and the tools.

What do I need to run it?

The cua CLI and Driver run on macOS, Linux and Windows. Lume needs an Apple Silicon Mac, and the Cua Spaces app needs macOS 26 or later, or a Linux or Windows machine for its other builds.

This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.