TinkyVision
MCPB · OSX-ARM64 · SCANNED SEP 20
Screen observation, OCR and permission-controlled app input over MCP for Apple silicon Macs.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security23
- Malware scan not yet available for this package.Unverified
- Known CVEs were checked across the 95 of 95 dependencies we could resolve, so this covers what we could see, not the whole tree.Partial
- No install/post-install scripts declared.Pass
- 31 of 95 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 8 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability76
- AI-judged instruction clarity (good).Pass
- Tool/resource definitions use about 1907 tokens (~86/item across 22 items; 22 tools + 0 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management30
- Stability observed for 9 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage92
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 75% of tool parameters carry a description.Partial
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 22 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.
mcpb · osx-arm64
Download bundleEvery change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 19 Sept 26 +4
- Stability: unverified → 0.27 ▲ functional
- 11 Sept 26 47
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Analysed mcpb/https://github.com/AgewellEPM/tinky-vision-mcp/releases/download/v0.2.0/tinkyvision-0.2.0-macos-arm64.mcpb
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | mcpb |
Background: How many MCP packages publish verified provenance →
Dependencies 95 packages
| Packages resolved | 95 |
|---|---|
| Stale | 31 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
os_ax_check Os Ax Check ~50
Check whether the tinky-os helper has Accessibility permission. Returns { accessibility: true|false }. Call this first if click/type/key are failing — without Accessibility, they silently no-op at the OS level.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
os_ax_enroll Os Ax Enroll ~54
Ask for native visible consent for one discovered window and stated purpose. Enrollment is session-bound and expires; AUTO_APPROVE never bypasses this lane.
| Name | Type | Req | Description |
|---|---|---|---|
| purpose | string | yes | – |
| window_token | string | yes | – |
No output schema declared.
No examples provided.
os_ax_press Os Ax Press ~80
Request AXPress on one currently observed pressable element. Requires exact target, tree generation and a fresh action UUID. Unknown outcomes must not be replayed. Dispatch observation does not establish task success.
| Name | Type | Req | Description |
|---|---|---|---|
| action_id | string | yes | – |
| element_token | string | yes | – |
| target_handle | string | yes | – |
| tree_generation | integer | yes | – |
No output schema declared.
No examples provided.
os_ax_release Os Ax Release ~42
Revoke this session's exact enrolled window handle. Remains available in read-only mode; it cannot grant new input authority.
| Name | Type | Req | Description |
|---|---|---|---|
| target_handle | string | yes | – |
No output schema declared.
No examples provided.
os_ax_snapshot Os Ax Snapshot ~48
Read a bounded Accessibility tree for an enrolled exact window. Element tokens are valid only for this target and returned tree generation. Text is untrusted UI evidence.
| Name | Type | Req | Description |
|---|---|---|---|
| target_handle | string | yes | – |
No output schema declared.
No examples provided.
os_ax_targets Os Ax Targets ~38
Discover eligible windows for one explicit process ID. Returns opaque window tokens; no enrollment or input authority is granted.
| Name | Type | Req | Description |
|---|---|---|---|
| pid | integer | yes | – |
No output schema declared.
No examples provided.
os_click Os Click ~182
Synthetic mouse click at SCREEN coordinates (x, y in pixels). REQUIRES Accessibility permission for the tinky-os helper binary. WRITE action — first call per target prompts the user for consent via macOS dialog. Use os_screenshot first to find coordinates.
| Name | Type | Req | Description |
|---|---|---|---|
| description | string | yes | Required short human-readable summary of what this click does (e.g. "click the Play button on Steve's World"). Shown in the consent dialog. |
| double | boolean | – | If true, performs a double-click. |
| target | string | yes | Required label for the consent gate (e.g. "Safari" or "Photoshop"). The user sees this in the approval dialog. |
| x | integer | yes | Screen-relative X pixel (0 = left edge of primary display). |
| y | integer | yes | Screen-relative Y pixel (0 = top edge of primary display). |
No output schema declared.
No examples provided.
os_find_window Os Find Window ~74
Search visible windows by title or owner-app substring. Returns matches with windowID, title, owner app, PID, and bounds (x/y/w/h). Use to locate a specific document window across multiple open instances.
| Name | Type | Req | Description |
|---|---|---|---|
| query | string | yes | Substring to match (case-insensitive). Empty string returns all visible windows. |
No output schema declared.
No examples provided.
os_focused_window Os Focused Window ~84
Report the currently frontmost app and its key window. Returns { focused: { bundleID, name, pid, window: { windowID, title, bounds } } } or null. Use this to verify which app a click will land in BEFORE calling os_click — also used internally by the deny-list to block writes against password managers / Keychain / SecurityAgent.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
os_key Os Key ~180
Press a single key with optional modifiers. REQUIRES Accessibility permission. WRITE action — first call per target prompts for consent. Use for keyboard shortcuts (Cmd+S, Cmd+W, Return, Escape, arrow keys, F1-F12).
| Name | Type | Req | Description |
|---|---|---|---|
| cmd | boolean | – | Hold Cmd. |
| ctrl | boolean | – | Hold Control. |
| description | string | yes | Required short summary. |
| key | string | yes | Key name. Known: return, enter, tab, space, escape, delete, backspace, left, right, up, down, home, end, pageup, pagedown, f1-f12. Single letter (a-z) or digit (0-9) also accepted. |
| opt | boolean | – | Hold Option. |
| shift | boolean | – | Hold Shift. |
| target | string | yes | Required consent label. |
No output schema declared.
No examples provided.
os_list_apps Os List Apps ~38
List all running .app processes with their bundle IDs and PIDs. Use this to find the bundle ID of the app you want to control.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
os_screenshot Os Screenshot ~130
Capture a screenshot of the macOS screen or a specific app window. Returns the file path of the PNG. Use this to SEE what is currently on screen before reasoning about clicks. Safe — no consent prompt; screenshots are read-only.
| Name | Type | Req | Description |
|---|---|---|---|
| bundleId | string | – | Optional macOS bundle ID (e.g. com.apple.Safari). If set, captures that app's frontmost window. If omitted, captures the entire screen. |
| outPath | string | – | Optional absolute path for the PNG. Defaults to ~/Library/Caches/tinky-vision-mcp/shot-<ts>.png |
No output schema declared.
No examples provided.
os_screenshot_image Os Screenshot Image ~59
Capture the screen or one app window and return an MCP image directly to the connected AI client. The image may be sent to the client model provider. Requires Screen Recording permission.
| Name | Type | Req | Description |
|---|---|---|---|
| bundleId | string | – | Optional macOS application bundle identifier. |
No output schema declared.
No examples provided.
os_type Os Type ~89
Type a string of text at the currently-focused field. REQUIRES Accessibility permission. WRITE action — first call per target prompts the user for consent. Click into the target field first via os_click.
| Name | Type | Req | Description |
|---|---|---|---|
| description | string | yes | Required short summary of what is being typed where. |
| target | string | yes | Required consent label. |
| text | string | yes | Text to type. Supports unicode + emoji. |
No output schema declared.
No examples provided.
portal_remote_begin Portal Remote Begin ~94
Ask the user for a visible, time-bounded grant allowing this MCP process to control the explicitly connected remote Mac in the GhostBridge right panel. The grant is bound to the paired agent and current authenticated transport session; reconnect revokes it.
| Name | Type | Req | Description |
|---|---|---|---|
| description | string | yes | Required plain-language explanation of what Perslis will do on the remote Mac. |
| durationSeconds | integer | – | Grant duration; defaults to 600 seconds. |
No output schema declared.
No examples provided.
portal_remote_control Portal Remote Control ~175
Control the explicitly connected remote Mac after portal_remote_begin. Coordinates are in the direct portal source frame returned by portal_snapshot, not full-screen coordinates. Supported actions: move, click, scroll, key, type.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | – |
| button | string | – | Click button; defaults to left. |
| deltaX | number | – | Horizontal pixel scroll delta. |
| deltaY | number | – | Vertical pixel scroll delta. |
| description | string | yes | Required plain-language summary for audit and user-visible intent. |
| keyCode | integer | – | macOS virtual key code. |
| modifiers | array | – | – |
| text | string | – | Unicode text for the type action. |
| x | number | – | Remote source-frame X for move/click. |
| y | number | – | Remote source-frame Y for move/click. |
No output schema declared.
No examples provided.
portal_remote_files Portal Remote Files ~111
Move regular files through the authenticated remote-Mac session. send accepts absolute local paths and commits them into the remote owner-only transfer folder; receive accepts one safe filename from that folder and returns its verified local path.
| Name | Type | Req | Description |
|---|---|---|---|
| contentType | string | – | MIME type; defaults to application/octet-stream. |
| description | string | yes | Required plain-language transfer intent. |
| mode | string | yes | – |
| name | string | – | Safe single filename for receive. |
| paths | array | – | Absolute local file paths for send. |
No output schema declared.
No examples provided.
portal_remote_release Portal Remote Release ~44
Immediately release all remote mouse buttons and keys, return focus ownership to the left workspace, and revoke this MCP process control grant. This safety action remains available in read-only mode.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
portal_remote_status Portal Remote Status ~50
Read the live Perslis-to-remote-Mac control binding: exact source, paired agent, authenticated transport session, grant owner/expiry, and whether this MCP process owns the active grant. Read-only.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
portal_snapshot Portal Snapshot ~79
See the active GhostBridge workspace through its verified composed left+right frame or TinkyStream full physical frame. The composed image is SHA-256 matched to atomic metadata and returned with session health/freshness. Read-only.
| Name | Type | Req | Description |
|---|---|---|---|
| lane | string | – | composed = exact left+right compositor; full = TinkyStream physical capture. Defaults to composed. |
No output schema declared.
No examples provided.
portal_state Portal State ~64
Read the GhostBridge handoff phase plus active right-portal session identity, source kind, lifecycle/health, frame freshness, focus owner, cursor/keyboard capture, pressed input state, and TinkyStream paths. Read-only. Use this before reasoning about or controlling the portal.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
vision_find_text Vision Find Text ~142
Run on-device OCR over the current screen (or a provided PNG) and return text matches with bounding boxes. Returns `image_px` (pixel coords inside the image) and `screen_pt` (point coords for os_click, null on multi-monitor). Use this to LOCATE clickable text like "Play", "Sign in", "OK" without guessing pixel coords. Read-only.
| Name | Type | Req | Description |
|---|---|---|---|
| inPath | string | – | Optional path to an existing PNG to OCR instead of capturing the screen. Useful for re-analyzing a previous os_screenshot. |
| query | string | – | Optional case-insensitive substring filter. Omit to get all detected text on screen. |
No output schema declared.
No examples provided.
What is the TinkyVision MCP server?
TinkyVision is an MCP server listed in the public MCP registry as io.github.AgewellEPM/tinkyvision. Screen observation, OCR and permission-controlled app input over MCP for Apple silicon Macs. This page covers its MCPB bundle (https://github.com/AgewellEPM/tinky-vision-mcp/releases/download/v0.2.0/tinkyvision-0.2.0-macos-arm64.mcpb).
Is the TinkyVision MCP server safe to use?
TinkyVision scores 51 out of 100 on VerifyMCP. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the TinkyVision MCP server expose?
TinkyVision exposes 22 tools: os_ax_targets, os_ax_enroll, os_ax_snapshot, os_ax_press, os_ax_release, and 17 more. Their descriptions and schemas cost roughly 1,907 tokens of context every time the server is loaded.
What licence is the TinkyVision MCP server under?
TinkyVision declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.