# TinkyVision (mcpb · osx-arm64)

Screen observation, OCR and permission-controlled app input over MCP for Apple silicon Macs.

- Trust score: 51/100 (low)
- Change this week: +4
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-09-20

## Components

- mcpb · `osx-arm64`: 51/100 (this document), [markdown](https://verifymcp.io/servers/agewellepm-tinkyvision/https-github-com-agewellepm-tinky-vision-mcp-releases-download-v0-2-0-tinkyvisio.md), [page](https://verifymcp.io/servers/agewellepm-tinkyvision/https-github-com-agewellepm-tinky-vision-mcp-releases-download-v0-2-0-tinkyvisio)

## Channel facts

- Registry: `mcpb`
- Package: `https://github.com/AgewellEPM/tinky-vision-mcp/releases/download/v0.2.0/tinkyvision-0.2.0-macos-arm64.mcpb`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-09-20.

- **Supply Chain Security**: 23/100
  - Malware scan not yet available for this package.
  - Known CVEs were checked across the 95 of 95 dependencies we could resolve, so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - 31 of 95 dependencies flagged as unhealthy.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 8 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 76/100
  - AI-judged instruction clarity (good).
  - Tool/resource definitions use about 1907 tokens (~86/item across 22 items; 22 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 30/100
  - Stability observed for 9 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 92/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 75% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - All 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.
  - An AI judge read all 22 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

- Download bundle: `https://github.com/AgewellEPM/tinky-vision-mcp/releases/download/v0.2.0/tinkyvision-0.2.0-macos-arm64.mcpb`

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-09-19 (score 51, +4)

- [functional improvement] Stability: unverified → 0.27

### 2026-09-11 (score 47)

First indexed and scored.

## MCP tools (22)

### `os_ax_targets` (~38 tokens)

Os Ax Targets

Discover eligible windows for one explicit process ID. Returns opaque window tokens; no enrollment or input authority is granted.

Input parameters:

- `pid` (integer, required)

### `os_ax_enroll` (~54 tokens)

Os Ax Enroll

Ask for native visible consent for one discovered window and stated purpose. Enrollment is session-bound and expires; AUTO_APPROVE never bypasses this lane.

Input parameters:

- `purpose` (string, required)
- `window_token` (string, required)

### `os_ax_snapshot` (~48 tokens)

Os Ax Snapshot

Read a bounded Accessibility tree for an enrolled exact window. Element tokens are valid only for this target and returned tree generation. Text is untrusted UI evidence.

Input parameters:

- `target_handle` (string, required)

### `os_ax_press` (~80 tokens)

Os Ax Press

Request AXPress on one currently observed pressable element. Requires exact target, tree generation and a fresh action UUID. Unknown outcomes must not be replayed. Dispatch observation does not establish task success.

Input parameters:

- `action_id` (string, required)
- `element_token` (string, required)
- `target_handle` (string, required)
- `tree_generation` (integer, required)

### `os_ax_release` (~42 tokens)

Os Ax Release

Revoke this session's exact enrolled window handle. Remains available in read-only mode; it cannot grant new input authority.

Input parameters:

- `target_handle` (string, required)

### `os_screenshot_image` (~59 tokens)

Os Screenshot Image

Capture the screen or one app window and return an MCP image directly to the connected AI client. The image may be sent to the client model provider. Requires Screen Recording permission.

Input parameters:

- `bundleId` (string): Optional macOS application bundle identifier.

### `portal_state` (~64 tokens)

Portal State

Read the GhostBridge handoff phase plus active right-portal session identity, source kind, lifecycle/health, frame freshness, focus owner, cursor/keyboard capture, pressed input state, and TinkyStream paths. Read-only. Use this before reasoning about or controlling the portal.

### `portal_snapshot` (~79 tokens)

Portal Snapshot

See the active GhostBridge workspace through its verified composed left+right frame or TinkyStream full physical frame. The composed image is SHA-256 matched to atomic metadata and returned with session health/freshness. Read-only.

Input parameters:

- `lane` (string): composed = exact left+right compositor; full = TinkyStream physical capture. Defaults to composed.

### `portal_remote_status` (~50 tokens)

Portal Remote Status

Read the live Perslis-to-remote-Mac control binding: exact source, paired agent, authenticated transport session, grant owner/expiry, and whether this MCP process owns the active grant. Read-only.

### `portal_remote_begin` (~94 tokens)

Portal Remote Begin

Ask the user for a visible, time-bounded grant allowing this MCP process to control the explicitly connected remote Mac in the GhostBridge right panel. The grant is bound to the paired agent and current authenticated transport session; reconnect revokes it.

Input parameters:

- `description` (string, required): Required plain-language explanation of what Perslis will do on the remote Mac.
- `durationSeconds` (integer): Grant duration; defaults to 600 seconds.

### `portal_remote_control` (~175 tokens)

Portal Remote Control

Control the explicitly connected remote Mac after portal_remote_begin. Coordinates are in the direct portal source frame returned by portal_snapshot, not full-screen coordinates. Supported actions: move, click, scroll, key, type.

Input parameters:

- `action` (string, required)
- `button` (string): Click button; defaults to left.
- `deltaX` (number): Horizontal pixel scroll delta.
- `deltaY` (number): Vertical pixel scroll delta.
- `description` (string, required): Required plain-language summary for audit and user-visible intent.
- `keyCode` (integer): macOS virtual key code.
- `modifiers` (array)
- `text` (string): Unicode text for the type action.
- `x` (number): Remote source-frame X for move/click.
- `y` (number): Remote source-frame Y for move/click.

### `portal_remote_files` (~111 tokens)

Portal Remote Files

Move regular files through the authenticated remote-Mac session. send accepts absolute local paths and commits them into the remote owner-only transfer folder; receive accepts one safe filename from that folder and returns its verified local path.

Input parameters:

- `contentType` (string): MIME type; defaults to application/octet-stream.
- `description` (string, required): Required plain-language transfer intent.
- `mode` (string, required)
- `name` (string): Safe single filename for receive.
- `paths` (array): Absolute local file paths for send.

### `portal_remote_release` (~44 tokens)

Portal Remote Release

Immediately release all remote mouse buttons and keys, return focus ownership to the left workspace, and revoke this MCP process control grant. This safety action remains available in read-only mode.

### `os_screenshot` (~130 tokens)

Os Screenshot

Capture a screenshot of the macOS screen or a specific app window. Returns the file path of the PNG. Use this to SEE what is currently on screen before reasoning about clicks. Safe — no consent prompt; screenshots are read-only.

Input parameters:

- `bundleId` (string): Optional macOS bundle ID (e.g. com.apple.Safari). If set, captures that app's frontmost window. If omitted, captures the entire screen.
- `outPath` (string): Optional absolute path for the PNG. Defaults to ~/Library/Caches/tinky-vision-mcp/shot-<ts>.png

### `os_list_apps` (~38 tokens)

Os List Apps

List all running .app processes with their bundle IDs and PIDs. Use this to find the bundle ID of the app you want to control.

### `os_find_window` (~74 tokens)

Os Find Window

Search visible windows by title or owner-app substring. Returns matches with windowID, title, owner app, PID, and bounds (x/y/w/h). Use to locate a specific document window across multiple open instances.

Input parameters:

- `query` (string, required): Substring to match (case-insensitive). Empty string returns all visible windows.

### `os_click` (~182 tokens)

Os Click

Synthetic mouse click at SCREEN coordinates (x, y in pixels). REQUIRES Accessibility permission for the tinky-os helper binary. WRITE action — first call per target prompts the user for consent via macOS dialog. Use os_screenshot first to find coordinates.

Input parameters:

- `description` (string, required): Required short human-readable summary of what this click does (e.g. "click the Play button on Steve's World"). Shown in the consent dialog.
- `double` (boolean): If true, performs a double-click.
- `target` (string, required): Required label for the consent gate (e.g. "Safari" or "Photoshop"). The user sees this in the approval dialog.
- `x` (integer, required): Screen-relative X pixel (0 = left edge of primary display).
- `y` (integer, required): Screen-relative Y pixel (0 = top edge of primary display).

### `os_type` (~89 tokens)

Os Type

Type a string of text at the currently-focused field. REQUIRES Accessibility permission. WRITE action — first call per target prompts the user for consent. Click into the target field first via os_click.

Input parameters:

- `description` (string, required): Required short summary of what is being typed where.
- `target` (string, required): Required consent label.
- `text` (string, required): Text to type. Supports unicode + emoji.

### `os_key` (~180 tokens)

Os Key

Press a single key with optional modifiers. REQUIRES Accessibility permission. WRITE action — first call per target prompts for consent. Use for keyboard shortcuts (Cmd+S, Cmd+W, Return, Escape, arrow keys, F1-F12).

Input parameters:

- `cmd` (boolean): Hold Cmd.
- `ctrl` (boolean): Hold Control.
- `description` (string, required): Required short summary.
- `key` (string, required): Key name. Known: return, enter, tab, space, escape, delete, backspace, left, right, up, down, home, end, pageup, pagedown, f1-f12. Single letter (a-z) or digit (0-9) also accepted.
- `opt` (boolean): Hold Option.
- `shift` (boolean): Hold Shift.
- `target` (string, required): Required consent label.

### `os_ax_check` (~50 tokens)

Os Ax Check

Check whether the tinky-os helper has Accessibility permission. Returns { accessibility: true|false }. Call this first if click/type/key are failing — without Accessibility, they silently no-op at the OS level.

### `os_focused_window` (~84 tokens)

Os Focused Window

Report the currently frontmost app and its key window. Returns { focused: { bundleID, name, pid, window: { windowID, title, bounds } } } or null. Use this to verify which app a click will land in BEFORE calling os_click — also used internally by the deny-list to block writes against password managers / Keychain / SecurityAgent.

### `vision_find_text` (~142 tokens)

Vision Find Text

Run on-device OCR over the current screen (or a provided PNG) and return text matches with bounding boxes. Returns `image_px` (pixel coords inside the image) and `screen_pt` (point coords for os_click, null on multi-monitor). Use this to LOCATE clickable text like "Play", "Sign in", "OK" without guessing pixel coords. Read-only.

Input parameters:

- `inPath` (string): Optional path to an existing PNG to OCR instead of capturing the screen. Useful for re-analyzing a previous os_screenshot.
- `query` (string): Optional case-insensitive substring filter. Omit to get all detected text on screen.

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/agewellepm-tinkyvision/https-github-com-agewellepm-tinky-vision-mcp-releases-download-v0-2-0-tinkyvisio#diagnostics

## Score history

- 2026-09-20: 51
- 2026-09-19: 51
- 2026-09-18: 47
- 2026-09-17: 47
- 2026-09-16: 47
- 2026-09-15: 47
- 2026-09-14: 47
- 2026-09-13: 47
- 2026-09-12: 47
- 2026-09-11: 47

## Common questions

### What is the TinkyVision MCP server?

TinkyVision is an MCP server listed in the public MCP registry as io.github.AgewellEPM/tinkyvision. Screen observation, OCR and permission-controlled app input over MCP for Apple silicon Macs. This page covers its MCPB bundle (https://github.com/AgewellEPM/tinky-vision-mcp/releases/download/v0.2.0/tinkyvision-0.2.0-macos-arm64.mcpb).

### Is the TinkyVision MCP server safe to use?

TinkyVision scores 51 out of 100 on VerifyMCP. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the TinkyVision MCP server expose?

TinkyVision exposes 22 tools: os_ax_targets, os_ax_enroll, os_ax_snapshot, os_ax_press, os_ax_release, and 17 more. Their descriptions and schemas cost roughly 1,907 tokens of context every time the server is loaded.

### What licence is the TinkyVision MCP server under?

TinkyVision declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

## Links

- Repository: https://github.com/AgewellEPM/tinky-vision-mcp
- Changelog RSS feed: https://verifymcp.io/servers/agewellepm-tinkyvision/https-github-com-agewellepm-tinky-vision-mcp-releases-download-v0-2-0-tinkyvisio.xml
- Changelog JSON feed: https://verifymcp.io/servers/agewellepm-tinkyvision/https-github-com-agewellepm-tinky-vision-mcp-releases-download-v0-2-0-tinkyvisio.json
- HTML version of this page: https://verifymcp.io/servers/agewellepm-tinkyvision/https-github-com-agewellepm-tinky-vision-mcp-releases-download-v0-2-0-tinkyvisio