Uindow
NPM · @UINDOW/CLI · SCANNED SEP 20
Real signed-browser automation for AI agents, over a local stdio MCP server.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security100
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- No production dependencies, so there is no dependency health to assess. View diagnostics → Pass
Provenance & Transparency100
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to uindow/uindow). View diagnostics → Pass
- Clear OSI-approved license (Apache-2.0).Pass
- Actively maintained (last published 7 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability64
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 8079 tokens (~212/item across 38 items; 38 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management87
- Stability observed for 26 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
- Structured output schemas are declared (61% of tools); any adoption earns full credit.Pass
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 3 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "agent_delete" implies "delete" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
- An AI judge read all 39 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities60
- Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28. See how to fix → Fail
How do I install the Uindow MCP server?
Uindow runs locally as an npm package, launched with npx -y @uindow/cli. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · @uindow/cli
claude mcp add uindow-uindow -- npx -y @uindow/cli
{
"mcpServers": {
"uindow-uindow": {
"command": "npx",
"args": [
"-y",
"@uindow/cli"
]
}
}
} {
"servers": {
"uindow-uindow": {
"command": "npx",
"args": [
"-y",
"@uindow/cli"
]
}
}
} codex mcp add uindow-uindow -- npx -y @uindow/cli
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"uindow-uindow": {
"type": "local",
"command": [
"npx",
"-y",
"@uindow/cli"
],
"enabled": true
}
}
} openclaw mcp add uindow-uindow --command npx --arg -y --arg @uindow/cli
mcp_servers:
uindow-uindow:
command: "npx"
args: ["-y", "@uindow/cli"] {
"McpServers": {
"uindow-uindow": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"@uindow/cli"
]
}
}
} assistant mcp add uindow-uindow -t stdio -c npx -a -y @uindow/cli
{
"mcpServers": {
"uindow-uindow": {
"command": "npx",
"args": [
"-y",
"@uindow/cli"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 20 Sept 26 +3
- Stability: fail → 0.87 functional
- 19 Sept 26 +6
No change was recorded against any check on this day. Stability & Change Management went from 25 to 65.
- 17 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 18 to 22.
- 15 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 12 to 15.
- 13 Sept 26 +16
- Malware scan: unverified → pass ▲ security
- 12 Sept 26 −18
- Malware scan: pass → unverified ▼ security
- Stability: fail → unverified ▼ security
- Known CVEs: pass → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- Capabilities: fail → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Dependency health: pass → unverified ▼ functional
- Schema quality: Schema quality not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet. functional
- Package version: 0.0.150 → 0.1.12 functional
- Package version: 0.1.10 → 0.1.12 functional
- Package version: 0.1.10 → 0.1.11 functional
- 8 Sept 26 +2
- Security disclosure: unverified → pass ▲ functional
- 7 Sept 26 −1
- Security disclosure: pass → unverified ▼ functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Analysed npm/@uindow/cli@0.1.12
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | npm |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | uindow/uindow |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/uindow/uindow/.github/workflows/release.yml@refs/heads/main |
| Rekor log index | 2805382911 |
| Predicate type | https://slsa.dev/provenance/v1 |
| Subject digest | sha512:ea67d89264cf166c5979697b67d2b6e467e256c24ae8974c17e8f84c91001ce351861938406ed92af0373667069ba8d4b3d45ec9b7c4aca5cc2bad44e |
Background: How many MCP packages publish verified provenance →
Dependencies 0 packages
| Packages resolved | 0 |
|---|---|
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
agent_create ~113
Create agent Add a new agent with the specified name. A maximum of 9 agents can exist at a time; creating a 10th agent will fail. The name is trimmed and truncated to 64 characters. Use the `agent_list` tool to fetch all available agents and their indexes. Returns: A unique `index` from 1 to 9, which is used to identify this agent with various tools.
| Name | Type | Req | Description |
|---|---|---|---|
| agentName | string | yes | Agent name; between 3 and 64 characters after trimming |
No output schema declared.
No examples provided.
agent_delete ~59
Delete agent Delete an agent from the list. Use the `agent_list` tool to fetch all available agents and their indexes. Returns: `True` on success, `false` on failure
| Name | Type | Req | Description |
|---|---|---|---|
| index | integer | yes | One-based agent index |
No output schema declared.
No examples provided.
agent_execute ~330
Execute code in an agent Execute asynchronous JavaScript code in the agent and forward the returned value. Remember to use `return` as your last statement; for example: `return await $.navGetTitle();`. The code runs safely outside the browser, so it has no access to window, document, cookies, or other DOM APIs. It can only use plain JavaScript and the dollar sign ($) object to perform the kinds of actions a regular user can perform - navigate, click, scroll, read text, save files, and so on. **Before running this tool, you must first make sure the agent has been stopped using the `agent_status` and `agent_stop` tools**. **Never run this tool without first using the `app_docs` tool twice**: once to list all SDK methods, and again to query the specific methods you intend to use, including their detailed arguments and examples. **You must never wrap your code in an async IIFE** (immediately invoked function expression) because all code blocks in Uindow, both functions and FSM states, are already asynchronous JavaScript. Use the `agent_list` tool to fetch all available agents and their indexes. Use the `app_docs` tool to query the available dollar sign ($) methods and properties for use in the `code` argument of this tool. Returns: Any value returned by the executed code.
| Name | Type | Req | Description |
|---|---|---|---|
| code | string | yes | Plain async JavaScript code snippet; for example: `return await $.navGetUrl();` |
| index | integer | yes | One-based agent index |
No output schema declared.
No examples provided.
agent_list ~97
List agents Get the list of agents that can perform tasks on this machine. Each agent is assigned a unique `index` from 1 to 9, which is used to identify the agent when issuing commands. You may use this list to map an agent's name to its `index` when a user refers to an agent by name, and to check whether the agent is currently executing a task. Returns: List of agents
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| value | array | yes | List of agents |
No examples provided.
agent_logs ~244
Get agent logs Output agent logs generated since the last `agent_logs` tool call. Logs are output as lines of text with the following structure: `[info/success/warning/error] {multi-line message} ({date and time})`. Example: `[info] state: Testing $.sleep (12/12/2020, 10:10:00 PM)` **Logs are present in the `content` value of the MCP tool response, not in `structuredContent`**. The structured content part of the response is an object representing the current agent status: either `stopped`, `paused`, or `running`. *Recommendation*: call `agent_logs` in a loop until the returned status is `stopped` or `paused`. Use the `agent_status` tool to get only the agent status object (without the latest logs). Use the `agent_list` tool to fetch all available agents and their indexes. Use the `agent_start` tool to start or unpause the agent as needed. Use the `agent_stop` tool to stop the agent as needed. Returns: Agent status object
| Name | Type | Req | Description |
|---|---|---|---|
| index | integer | yes | One-based agent index |
| Name | Type | Req | Description |
|---|---|---|---|
| statusCode | integer | yes | Agent status code: -1 (stopped), 0 (paused), 1 (running) |
| statusLabel | string | yes | Agent status as plain English text |
No examples provided.
agent_results_get ~147
Get latest results Fetch the results from the most recent call to either `agent_start` or `agent_execute`. Results are populated only when `$.ioOutput*()`, `$.ioSave*()`, or similar SDK methods are invoked correctly with the appropriate output keys. Outputs declared using `src_output_*` tools are rendered as form elements in the Results tab. Use the `agent_list` tool to fetch all available agents and their indexes. Use the `app_docs` tool to look up *ioOutput* and *ioSave* methods for arguments lists and examples. Returns: List of outputs and their values
| Name | Type | Req | Description |
|---|---|---|---|
| index | integer | yes | One-based agent index |
| Name | Type | Req | Description |
|---|---|---|---|
| value | array | yes | List of outputs and their values |
No examples provided.
agent_screenshot ~131
Grab agent screenshot Capture a PNG screenshot of the current web page directly as a Base64-encoded string. No need to set up a file output for this agent. It works even if the agent is already executing another task. Use the `agent_list` tool to fetch all available agents and their indexes. Use the `agent_viewport` tool to capture a text version of the viewport if your model does not support images. Returns: PNG screenshot, an object with { mimeType: "image/png", data: "base-64 string" }
| Name | Type | Req | Description |
|---|---|---|---|
| index | integer | yes | One-based agent index |
No output schema declared.
No examples provided.
agent_settings_get ~129
Get settings Fetch the input configurations that will be used by the `$.ioInput*()` SDK methods when starting this agent with `agent_start`. The inputs declared using `src_input_*` tools are rendered as form elements in the Settings tab. Use this tool to get all input keys and their current values as configured by the user. At most 5000 rows will be returned for *table* inputs. Use the `agent_list` tool to fetch all available agents and their indexes. Returns: List of inputs and their values
| Name | Type | Req | Description |
|---|---|---|---|
| index | integer | yes | One-based agent index |
| Name | Type | Req | Description |
|---|---|---|---|
| value | array | yes | List of inputs and their values |
No examples provided.
agent_settings_set ~252
Update settings Set the value of an input declared with the `src_input_set_*` tools. The value type is resolved from the input's own definition, so pass the natural value for that input: - boolean -> `true` or `false` - int -> `42`, or `[1, 2, 3]` if *isList* is `true` - string -> `"foo"`, or `["foo", "bar"]` if *isList* is `true` - files -> array of **absolute file paths** - table -> array of row objects keyed by the input's *columns* Use the `agent_list` tool to fetch all available agents and their indexes. Use the `src_keys_list` tool with section *srcInputs* to get all input keys. Use the `src_input_get` tool to inspect an input's declared type. Returns: Extended list of inputs and their values
| Name | Type | Req | Description |
|---|---|---|---|
| index | integer | yes | One-based agent index |
| key | string | yes | Input key, lowercase 1 to 32 alphanumeric characters or dashes |
| value | – | yes | Input value; must match the type declared for this input |
| Name | Type | Req | Description |
|---|---|---|---|
| value | array | yes | Extended list of inputs and their values |
No examples provided.
agent_start ~223
Start agent Start or unpause the agent and run the source code (to which users may refer to as a module) as defined using the `src_*` tools. The purpose of the source code is to provide permanence and safe transferability for automations. If you wish to execute SDK methods on the fly (without saving them), call the `agent_execute` tool instead. Use the `agent_list` tool to fetch all available agents and their indexes. Call the `agent_status` tool from time to time or use the `agent_logs` tool to check execution progress. Use the `src_export` tool to review the complete module source code before executing it. Use the `agent_settings_set` tool to set the values for all inputs before running this tool. Use the `agent_results_get` tool to fetch the captured outputs after running this tool. Returns: `True` if the agent was started (it had previously been stopped or paused), `false` if it was already running.
| Name | Type | Req | Description |
|---|---|---|---|
| index | integer | yes | One-based agent index |
No output schema declared.
No examples provided.
agent_status ~104
Get agent status Check whether the agent is currently executing a task. Use the `agent_logs` tool to get the agent status object and the latest logs. Use the `agent_list` tool to fetch all available agents and their indexes. Use the `agent_start` tool to start or unpause the agent as needed. Use the `agent_stop` tool to stop the agent as needed. Returns: Agent status object
| Name | Type | Req | Description |
|---|---|---|---|
| index | integer | yes | One-based agent index |
| Name | Type | Req | Description |
|---|---|---|---|
| statusCode | integer | yes | Agent status code: -1 (stopped), 0 (paused), 1 (running) |
| statusLabel | string | yes | Agent status as plain English text |
No examples provided.
agent_stop ~79
Stop agent Stop the agent and return control back to the user or AI assistant. Use the `agent_list` tool to fetch all available agents and their indexes. Returns: `True` if the agent was stopped (it had been running or paused), `false` if it was already stopped.
| Name | Type | Req | Description |
|---|---|---|---|
| index | integer | yes | One-based agent index |
No output schema declared.
No examples provided.
agent_update ~83
Update agent Update an agent's name. The name is trimmed and truncated to 64 characters. Use the `agent_list` tool to fetch all available agents and their indexes. Returns: `True` on success
| Name | Type | Req | Description |
|---|---|---|---|
| agentName | string | yes | Agent name; between 3 and 64 characters after trimming |
| index | integer | yes | One-based agent index |
No output schema declared.
No examples provided.
agent_viewport ~262
Scan agent viewport Get a structured list of the HTML elements currently visible in the agent's viewport. This is a lightweight, text-based alternative to `agent_screenshot` for text-only AI models. The first entry is always a synthetic `<viewport>` entry describing the page and the viewport itself. Its `x`, `y`, `width` and `height` are the viewport box that every other entry's coordinates are relative to, and its scroll values describe how far the viewport is scrolled and how much content lies outside it. The remaining entries are ordered by how likely they are to be worth acting on rather than by document position. Use the `agent_list` tool to fetch all available agents and their indexes. Use the `app_docs` tool with query set to "doQuery" and maxResults set to 10 to learn more about the available DOM inspection methods. Use the `agent_execute` tool to with `$.do*` methods to perform deeper DOM inspection. Returns: List of DOM elements visible in the viewport
| Name | Type | Req | Description |
|---|---|---|---|
| index | integer | yes | One-based agent index |
| maxResults | integer | – | (optional) Maximum number of results between 1 and 512; defaults to `256` |
| Name | Type | Req | Description |
|---|---|---|---|
| value | array | yes | List of DOM elements visible in the viewport |
No examples provided.
app_docs ~290
Query SDK documentation **Never attempt to guess arguments!** Always call the `app_docs` tool again with **query** set to the method or property you are about to use. This retrieves its full argument details and available code examples, which are usually complete Uindow modules exported in YAML format. Get the full list of available dollar sign ($) object properties and methods, or search for a particular method. Results are sorted in ascending order based on how closely the query string matches the beginning of the paragraph. Use these dollar sign ($) object properties and methods in pure JavaScript **code** blocks when calling `agent_execute` or `src_code_set`. Returns: Documentation for a dollar sign ($) object property or method in Markdown format, or a list of all available dollar sign ($) object properties and methods in Markdown format.
| Name | Type | Req | Description |
|---|---|---|---|
| maxResults | integer | – | (optional) Maximum number of results (number between 1 and 10). Increase this value to fetch more results, potentially at the expense of context memory. |
| query | string | – | (optional) Case insensitive search query. If omitted, this tool returns the list of available dollar sign ($) object properties and methods. No wildcards or regex are allowed, but you can search for… |
No output schema declared.
No examples provided.
app_start ~69
Start application If Uindow is already running, silently return `false`. Otherwise, download the required version of Electron.js and Uindow as needed, launch the Uindow application, and return `true`. Returns: `True` if the app was launched, `false` if it was already running
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
app_status ~40
Get application status Check whether Uindow was installed and started on this computer. Returns: `True` if the app was started, `false` otherwise
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
app_stop ~70
Stop application If Uindow was already stopped, or the quit signal could not be delivered, return `false`. Otherwise, issue a quit signal, wait for the app to exit gracefully, and return `true`. Returns: `True` if the app was stopped, `false` otherwise
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
src_code_get ~163
Module: get state or function code Fetch the source code for this finite-state machine (FSM) state, or function. Use the `agent_list` tool to fetch all available agents and their indexes. Use the `src_keys_list` tool with section *srcStateMachine* to get all state keys. Use the `src_keys_list` tool with section *srcFunctions* to get all function keys. Use the `app_docs` tool to look up any dollar sign ($) methods used in the returned code. Returns: Source code object
| Name | Type | Req | Description |
|---|---|---|---|
| index | integer | yes | One-based agent index |
| key | string | yes | State or function key, lowercase 1 to 32 alphanumeric characters or dashes |
| section | string | yes | Module section |
| Name | Type | Req | Description |
|---|---|---|---|
| code | string | yes | State or function code |
| key | string | yes | Sanitized state or function key, lowercase 1 to 32 alphanumeric characters or dashes |
No examples provided.
src_code_set ~480
Module: set state or function code Set the source code for a finite-state machine (FSM) state (*srcStateMachine*) or a function (*srcFunctions*). **You must never wrap your code in an async IIFE** (immediately invoked function expression) because all code blocks in Uindow, both functions and FSM states, are already asynchronous JavaScript. For *srcStateMachine*: When using the `agent_start` tool, the first defined state is executed. Jump to another state by returning an object with the `next` and `args` keys. Example: `return { next: "another-state-key", args: ["foo", "bar"] }` The new state can access the passed arguments through the `$.args` property. The FSM stops when the last executed state no longer returns an object with a *next* property. A maximum of 64 states can be defined. For *srcFunctions*: Call a function from a state or another function using the *$.fn* SDK method. To learn more about *$.fn*, use the `app_docs` tool with "$.fn" as *query*. Pass arguments as an array; for example: `await $.fn("function-key", ["foo", "bar"])`. The function reads them through the `$.args` property, which is always an array. Unlike FSM states, a function's return value has no special role and does not trigger any state transition. A maximum of 128 functions can be defined. You must always use the returned *key* property, as it has been sanitized and checked for uniqueness. Use the `agent_list` tool to fetch all available agents and their indexes. Use the `src_keys_list` tool with the same *section* to get all existing keys. Use the `app_docs` tool to view available SDK methods for the *code* argument. Use the `src_sample` tool to better understand how the FSM, functions and IO interact. Returns: Updated state or function
| Name | Type | Req | Description |
|---|---|---|---|
| code | string | yes | Source code, up to 5120 characters long |
| index | integer | yes | One-based agent index |
| key | string | yes | State or function key, lowercase 1 to 32 alphanumeric characters or dashes |
| section | string | yes | Module section |
| Name | Type | Req | Description |
|---|---|---|---|
| code | string | yes | Source code |
| key | string | yes | Sanitized state or function key, lowercase 1 to 32 alphanumeric characters or dashes |
No examples provided.
src_export ~193
Module: get source (yaml) Export the agent's source as a YAML string. The source is always an object with these keys: *srcStateMachine*, *srcFunctions*, *srcInputs*, and *srcOutputs*. To edit these properties, you must use the appropriate tool: - *srcStateMachine* and *srcFunctions*: use the `src_code_*` tools - *srcInputs*: use the `src_input_*` tools - *srcOutputs*: use the `src_output_*` tools Use the `agent_list` tool to fetch all available agents and their indexes. Use the `src_sample` tool to better understand how the FSM, functions and IO interact. If the user asks to save this automation/module as a file, please use the ".js.yaml" extension. Returns: Agent source code in YAML format
| Name | Type | Req | Description |
|---|---|---|---|
| index | integer | yes | One-based agent index |
No output schema declared.
No examples provided.
src_input_get ~95
Module: get input Fetch the definition for this input. Use the `agent_list` tool to fetch all available agents and their indexes. Use the `src_keys_list` tool with section *srcInputs* to get all input keys. Returns: Input definition
| Name | Type | Req | Description |
|---|---|---|---|
| index | integer | yes | One-based agent index |
| key | string | yes | Input key, lowercase 1 to 32 alphanumeric characters or dashes |
Structured output declared, but exposes no named fields.
No examples provided.
src_input_set_bool ~305
Module: set boolean input Define a *boolean* input that can be configured manually in the *Settings* tab or via the `agent_settings_set` tool. If an input with this key already exists, it will be converted to a *boolean* input with the specified properties. Boolean inputs can act as UI controls when used as dependencies for other non-boolean inputs. If a boolean input is configured to `false` - that is, its checkbox in the *Settings* tab is unchecked - any dependent inputs will be hidden from the application's *Settings* tab. You must always use the returned *key* property, as it has been sanitized and checked for uniqueness. Use the `agent_list` tool to fetch all available agents and their indexes. Use the `src_keys_list` tool with the *srcInputs* section to get all input keys. Use the `src_sample` tool to better understand how the FSM, functions and IO interact. Use the `agent_settings_set` tool to set the values for this and other inputs before using the `agent_start` tool. Returns: Input definition
| Name | Type | Req | Description |
|---|---|---|---|
| desc | string | – | (optional) Boolean input description, up to 512 characters |
| index | integer | yes | One-based agent index |
| key | string | yes | Boolean input key, lowercase 1 to 32 alphanumeric characters or dashes |
| name | string | yes | Boolean input name, 1 to 32 characters |
| Name | Type | Req | Description |
|---|---|---|---|
| desc | string | yes | Input description |
| key | string | yes | Sanitized input key, lowercase 1 to 32 alphanumeric characters or dashes |
| name | string | yes | Input name |
| type | string | yes | Input type |
No examples provided.
src_input_set_files ~349
Module: set files input Define a *files* input that can be configured manually in the *Settings* tab or via the `agent_settings_set` tool. If an input with this key exists, it will be changed to a *files* input with these properties. You must always use the returned *key* property, as it has been sanitized and checked for uniqueness. Use the `agent_list` tool to fetch all available agents and their indexes. Use the `src_keys_list` tool with section *srcInputs* to get all input keys. Use the `src_sample` tool to better understand how the FSM, functions and IO interact. Use the `agent_settings_set` tool to set the value for this and other inputs before using the `agent_start` tool. Returns: Input definition
| Name | Type | Req | Description |
|---|---|---|---|
| depKey | string | – | (optional) Files input is visible only if the user enabled the boolean input with this key |
| desc | string | – | (optional) Files input description, up to 512 characters long |
| extensions | array | – | (optional) List of allowed file extensions without leading dots; example: ["png", "gif", "jpeg"] |
| index | integer | yes | One-based agent index |
| key | string | yes | Files input key, lowercase 1 to 32 alphanumeric characters or dashes |
| max | integer | – | (optional) Files input maximum file size in MB |
| min | integer | – | (optional) Files input minimum file size in MB |
| multiple | boolean | – | (optional) Select multiple files; default `true` |
| name | string | yes | Files input name, 1 to 32 characters |
| Name | Type | Req | Description |
|---|---|---|---|
| depends | string | – | Key of the boolean input this setting depends on |
| desc | string | yes | Input description |
| extensions | array | yes | Allowed file extensions |
| key | string | yes | Sanitized input key, lowercase 1 to 32 alphanumeric characters or dashes |
| max | integer | – | Maximum file size in MB |
| min | integer | – | Minimum file size in MB |
| multiple | boolean | – | Select multiple files |
| name | string | yes | Input name |
| type | string | yes | Input type |
No examples provided.
src_input_set_int ~362
Module: set integer input Define an *integer* input that can be configured manually in the *Settings* tab or via the `agent_settings_set` tool. If an input with this key exists, it will be changed to an *integer* input with these properties. You must always use the returned *key* property, as it has been sanitized and checked for uniqueness. Use the `agent_list` tool to fetch all available agents and their indexes. Use the `src_keys_list` tool with section *srcInputs* to get all input keys. Use the `src_sample` tool to better understand how the FSM, functions and IO interact. Use the `agent_settings_set` tool to set the value for this and other inputs before using the `agent_start` tool. Returns: Input definition
| Name | Type | Req | Description |
|---|---|---|---|
| def | integer | – | (optional) Integer input default value |
| depKey | string | – | (optional) Integer input is visible only if the user enabled the boolean input with this key |
| desc | string | – | (optional) Integer input description, up to 512 characters long |
| index | integer | yes | One-based agent index |
| isList | boolean | – | (optional) Accept a list of max. 128 integers from the user; default `false` |
| key | string | yes | Integer input key, lowercase 1 to 32 alphanumeric characters or dashes |
| max | integer | – | (optional) Integer input maximum value |
| min | integer | – | (optional) Integer input minimum value |
| name | string | yes | Integer input name, 1 to 32 characters |
| options | array | – | (optional) Restrict integer input to these values only; max. 32 options |
| Name | Type | Req | Description |
|---|---|---|---|
| default | integer | – | Default value |
| depends | string | – | Key of the boolean input this setting depends on |
| desc | string | yes | Input description |
| isList | boolean | yes | Input value is an array |
| key | string | yes | Sanitized input key, lowercase 1 to 32 alphanumeric characters or dashes |
| max | integer | – | Maximum value |
| min | integer | – | Minimum value |
| name | string | yes | Input name |
| options | array | – | Input options |
| type | string | yes | Input type |
No examples provided.
src_input_set_string ~367
Module: set string input Define a *string* input that can be configured manually in the *Settings* tab or via the `agent_settings_set` tool. If an input with this key exists, it will be changed to a *string* input with these properties. You must always use the returned *key* property, as it has been sanitized and checked for uniqueness. Use the `agent_list` tool to fetch all available agents and their indexes. Use the `src_keys_list` tool with section *srcInputs* to get all input keys. Use the `src_sample` tool to better understand how the FSM, functions and IO interact. Use the `agent_settings_set` tool to set the value for this and other inputs before using the `agent_start` tool. Returns: Input definition
| Name | Type | Req | Description |
|---|---|---|---|
| def | string | – | (optional) String input default value |
| depKey | string | – | (optional) String input is visible only if the user enabled the boolean input with this key |
| desc | string | – | (optional) String input description, up to 512 characters long |
| index | integer | yes | One-based agent index |
| isList | boolean | – | (optional) Accept a list of max. 128 strings from the user; default `false` |
| key | string | yes | String input key, lowercase 1 to 32 alphanumeric characters or dashes |
| max | integer | – | (optional) String input maximum length |
| min | integer | – | (optional) String input minimum length |
| name | string | yes | String input name, 1 to 32 characters |
| options | array | – | (optional) Restrict string input to these values only; max. 32 options of 32 characters each |
| Name | Type | Req | Description |
|---|---|---|---|
| default | string | – | Default value |
| depends | string | – | Key of the boolean input this setting depends on |
| desc | string | yes | Input description |
| isList | boolean | yes | Input value is an array |
| key | string | yes | Sanitized input key, lowercase 1 to 32 alphanumeric characters or dashes |
| max | integer | – | Maximum string length |
| min | integer | – | Minimum string length |
| name | string | yes | Input name |
| options | array | – | Input options |
| type | string | yes | Input type |
No examples provided.
src_input_set_table ~304
Module: set table input Define a *table* input that can be configured manually in the *Settings* tab or via the `agent_settings_set` tool. If an input with this key exists, it will be changed to a *table* input with these properties. You can define a maximum of 6 input tables. You must always use the returned *key* property, as it has been sanitized and checked for uniqueness. Use the `agent_list` tool to fetch all available agents and their indexes. Use the `src_keys_list` tool with section *srcInputs* to get all input keys. Use the `src_sample` tool to better understand how the FSM, functions and IO interact. Use the `agent_settings_set` tool to set the value for this and other inputs before using the `agent_start` tool. Returns: Input definition
| Name | Type | Req | Description |
|---|---|---|---|
| columns | array | yes | List of table columns; max. 6 columns of max. 32 characters each |
| depKey | string | – | (optional) Table input is visible only if the user enabled the boolean input with this key |
| desc | string | – | (optional) Table input description, up to 512 characters long |
| index | integer | yes | One-based agent index |
| key | string | yes | Table input key, lowercase 1 to 32 alphanumeric characters or dashes |
| name | string | yes | Table input name, 1 to 32 characters |
| Name | Type | Req | Description |
|---|---|---|---|
| columns | array | yes | Table columns |
| depends | string | – | Key of the boolean input this setting depends on |
| desc | string | yes | Input description |
| key | string | yes | Sanitized input key, lowercase 1 to 32 alphanumeric characters or dashes |
| name | string | yes | Input name |
| type | string | yes | Input type |
No examples provided.
src_keys_delete ~244
Module: delete item Delete this item, but first make sure it is no longer used by reading the full source code exported with the `src_export` tool. - For the *srcStateMachine* section, no state should still call `return { next: "this-state" }` - For the *srcFunctions* section, no state or function should still call `$.fn("this-function-key")` - For the *srcInputs* section, no state or function should still use `$.ioInput*("this-input-key")` - For the *srcOutputs* section, no state or function should still use `$.ioOutput*("this-output-key")` Use the `agent_list` tool to fetch all available agents and their indexes. Use the `src_keys_list` tool with the corresponding section to list all available items. Returns: Returns `true` if the item was found and removed, `false` otherwise
| Name | Type | Req | Description |
|---|---|---|---|
| index | integer | yes | One-based agent index |
| key | string | yes | Item key, lowercase 1 to 32 alphanumeric characters or dashes |
| section | string | yes | Module section |
No output schema declared.
No examples provided.
src_keys_list ~208
Module: list item keys Get a list of all keys defined in a module section. - For *srcStateMachine*: finite-state machine (FSM) states; the first state is executed when the agent starts. - For *srcFunctions*: functions that can be used in states and other functions with `await $.fn("function-key")`. - For *srcInputs*: inputs that can be configured with `src_settings_set` and read from states and functions with `$.ioInput*()`. - For *srcOutputs*: outputs that can be accessed with `src_results_get` and written to from states and functions with `$.ioOutput*()` and `$.ioSave*()`. Use the `agent_list` tool to fetch all available agents and their indexes. Use the `src_export` tool to review the complete module source code. Returns: List of keys in this section.
| Name | Type | Req | Description |
|---|---|---|---|
| index | integer | yes | One-based agent index. |
| section | string | yes | Module section. |
| Name | Type | Req | Description |
|---|---|---|---|
| value | array | yes | List of keys in this section. |
No examples provided.
src_keys_reorder ~212
Module: reorder item keys Reorder the items in a module *section*. - For *srcStateMachine*: the order matters; the first state is executed when the agent starts. - For *srcFunctions*: the item order does not matter; reorder for ease of debugging. - For *srcInputs*: each input item generates a UI element in the agent *Settings* tab; reorder for improved UX. - For *srcOutputs*: each output item generates a UI element in the agent *Results* tab; reorder for improved UX. Use the `agent_list` tool to fetch all available agents and their indexes. Use the `src_keys_list` tool with the corresponding section to list all available items. Use the `src_export` tool to review the complete module source code. Returns: Updated list of keys in this section
| Name | Type | Req | Description |
|---|---|---|---|
| index | integer | yes | One-based agent index |
| keys | array | – | New order of keys in this section |
| section | string | yes | Module section |
| Name | Type | Req | Description |
|---|---|---|---|
| value | array | yes | Updated list of keys in this section |
No examples provided.
src_keys_update ~176
Module: update item key Change this item's key to make the source code easier to understand. Please make sure to check and update references to this item by reading the full source code exported with the `src_export` tool. Use the `agent_list` tool to fetch all available agents and their indexes. Use the `src_keys_list` tool with the corresponding section to list all available items. Use the `src_export` tool to review the complete module source code. Returns: Updated key
| Name | Type | Req | Description |
|---|---|---|---|
| index | integer | yes | One-based agent index |
| newKey | string | yes | New key, lowercase 1 to 32 alphanumeric characters or dashes |
| oldKey | string | yes | Old key, lowercase 1 to 32 alphanumeric characters or dashes |
| section | string | yes | Module section |
No output schema declared.
No examples provided.
src_output_get ~95
Module: get output Fetch the definition for this output. Use the `agent_list` tool to fetch all available agents and their indexes. Use the `src_keys_list` tool with section *srcOutputs* to get all output keys. Returns: Output definition
| Name | Type | Req | Description |
|---|---|---|---|
| index | integer | yes | One-based agent index |
| key | string | yes | Output key, lowercase 1 to 32 alphanumeric characters or dashes |
Structured output declared, but exposes no named fields.
No examples provided.
src_output_set_bool ~236
Module: set boolean output Define a *boolean* output that can be viewed manually in the *Results* tab or via the `agent_results_get` tool. If an output with this key exists, it will be changed to a *boolean* output with these properties. *Boolean* outputs are rendered as simple green or red dots in the *Results* tab. You must always use the returned *key* property, as it has been sanitized and checked for uniqueness. Use the `agent_list` tool to fetch all available agents and their indexes. Use the `src_keys_list` tool with section *srcOutputs* to get all output keys. Use the `src_sample` tool to better understand how the FSM, functions and IO interact. Returns: Output definition
| Name | Type | Req | Description |
|---|---|---|---|
| desc | string | – | (optional) Boolean output description, up to 512 characters long |
| index | integer | yes | One-based agent index |
| key | string | yes | Boolean output key, lowercase 1 to 32 alphanumeric characters or dashes |
| name | string | yes | Boolean output name, 1 to 32 characters |
| Name | Type | Req | Description |
|---|---|---|---|
| desc | string | yes | Output description |
| key | string | yes | Sanitized output key, lowercase 1 to 32 alphanumeric characters or dashes |
| name | string | yes | Output name |
| type | string | yes | Output type |
No examples provided.
src_output_set_files ~383
Module: set files output Define a *files* output that can be viewed manually in the *Results* tab or via the `agent_results_get` tool. If an output with this key exists, it will be changed to a *files* output with these properties. *Files* outputs are used by all `$.ioSave*` SDK methods to store files on disk and display them in the *Results* tab. You must always use the returned *key* property, as it has been sanitized and checked for uniqueness. You can optionally hide the rendered file explorer for this output (*visible* set to `false`). Use tool `app_docs` with *query* set to "osFileGetUrl" to learn more about file URLs in output *table* rows. Use the `agent_list` tool to fetch all available agents and their indexes. Use the `src_keys_list` tool with section *srcOutputs* to get all output keys. Use the `src_sample` tool to better understand how the FSM, functions and IO interact. Returns: Output definition
| Name | Type | Req | Description |
|---|---|---|---|
| desc | string | – | (optional) Files output description, up to 512 characters long |
| extensions | array | – | (optional) List of allowed file extensions without leading dots; example: ["png", "gif", "jpeg"] |
| index | integer | yes | One-based agent index |
| key | string | yes | Files output key, lowercase 1 to 32 alphanumeric characters or dashes |
| max | integer | – | (optional) Files output maximum file size in MB |
| min | integer | – | (optional) Files output minimum file size in MB |
| name | string | yes | Files output name, 1 to 32 characters |
| visible | boolean | – | (optional) Show the files in the Results tab; default `true` |
| Name | Type | Req | Description |
|---|---|---|---|
| desc | string | yes | Output description |
| extensions | array | yes | Allowed file extensions |
| key | string | yes | Sanitized output key, lowercase 1 to 32 alphanumeric characters or dashes |
| max | integer | – | Maximum file size in MB |
| min | integer | – | Minimum file size in MB |
| name | string | yes | Output name |
| type | string | yes | Output type |
| visible | boolean | – | File explorer is visible in the Results tab for this output |
No examples provided.
src_output_set_int ~262
Module: set integer output Define an *integer* output that can be viewed manually in the *Results* tab or via the `agent_results_get` tool. If an output with this key exists, it will be changed to an *integer* output with these properties. *Integer* outputs are rendered as a line graph in the *Results* tab. You must always use the returned *key* property, as it has been sanitized and checked for uniqueness. Use the `agent_list` tool to fetch all available agents and their indexes. Use the `src_keys_list` tool with section *srcOutputs* to get all output keys. Use the `src_sample` tool to better understand how the FSM, functions and IO interact. Returns: Output definition
| Name | Type | Req | Description |
|---|---|---|---|
| desc | string | – | (optional) Integer output description, up to 512 characters long |
| index | integer | yes | One-based agent index |
| key | string | yes | Integer output key, lowercase 1 to 32 alphanumeric characters or dashes |
| max | integer | – | (optional) Integer output maximum value |
| min | integer | – | (optional) Integer output minimum value |
| name | string | yes | Integer output name, 1 to 32 characters |
| Name | Type | Req | Description |
|---|---|---|---|
| desc | string | yes | Output description |
| key | string | yes | Sanitized output key, lowercase 1 to 32 alphanumeric characters or dashes |
| max | integer | – | Maximum value |
| min | integer | – | Minimum value |
| name | string | yes | Output name |
| type | string | yes | Output type |
No examples provided.
src_output_set_string ~245
Module: set string output Define a *string* output that can be viewed manually in the *Results* tab or via the `agent_results_get` tool. If an output with this key exists, it will be changed to a *string* output with these properties. You must always use the returned *key* property, as it has been sanitized and checked for uniqueness. Use the `agent_list` tool to fetch all available agents and their indexes. Use the `src_keys_list` tool with section *srcOutputs* to get all output keys. Use the `src_sample` tool to better understand how the FSM, functions and IO interact. Returns: Output definition
| Name | Type | Req | Description |
|---|---|---|---|
| desc | string | – | (optional) String output description, up to 512 characters long |
| index | integer | yes | One-based agent index |
| key | string | yes | String output key, lowercase 1 to 32 alphanumeric characters or dashes |
| max | integer | – | (optional) String output maximum length |
| min | integer | – | (optional) String output minimum length |
| name | string | yes | String output name, 1 to 32 characters |
| Name | Type | Req | Description |
|---|---|---|---|
| desc | string | yes | Output description |
| key | string | yes | Sanitized output key, lowercase 1 to 32 alphanumeric characters or dashes |
| max | integer | – | Maximum string length |
| min | integer | – | Minimum string length |
| name | string | yes | Output name |
| type | string | yes | Output type |
No examples provided.
src_output_set_table ~269
Module: set table output Define a *table* output that can be viewed manually in the *Results* tab or via the `agent_results_get` tool. If an output with this key exists, it will be changed to a *table* output with these properties. You can use a maximum of 6 output tables. *Table* outputs are rendered as an interactive table in the *Results* tab. You must always use the returned *key* property, as it has been sanitized and checked for uniqueness. Use the `agent_list` tool to fetch all available agents and their indexes. Use the `src_keys_list` tool with section *srcOutputs* to get all output keys. Use the `src_sample` tool to better understand how the FSM, functions and IO interact. Returns: Output definition
| Name | Type | Req | Description |
|---|---|---|---|
| columns | array | yes | List of table columns; max. 6 columns of max. 32 characters each |
| desc | string | – | (optional) Table output description, up to 512 characters long |
| index | integer | yes | One-based agent index |
| key | string | yes | Table output key, lowercase 1 to 32 alphanumeric characters or dashes |
| name | string | yes | Table output name, 1 to 32 characters |
| Name | Type | Req | Description |
|---|---|---|---|
| columns | array | yes | Table columns |
| desc | string | yes | Output description |
| key | string | yes | Sanitized output key, lowercase 1 to 32 alphanumeric characters or dashes |
| name | string | yes | Output name |
| type | string | yes | Output type |
No examples provided.
src_sample ~154
Module: get sample (yaml) Get a fully functional Uindow module in YAML format. The module is always an object with these keys: *srcStateMachine*, *srcFunctions*, *srcInputs*, and *srcOutputs*. The sample illustrates the interactions between finite-state machine (FSM) states, functions, inputs, and outputs. It also shows how the *$.args* property can be used when passing arguments to FSM states and functions. Use the `app_docs` tool to look up any dollar sign ($) methods used in the returned code. Use the other `src_*` tools to author your own automation, which users may refer to as a module. Returns: Sample source code in YAML format
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
What is the Uindow MCP server?
Uindow is an MCP server listed in the public MCP registry as io.github.uindow/uindow. Real signed-browser automation for AI agents, over a local stdio MCP server. This page covers its npm package (@uindow/cli).
Is the Uindow MCP server safe to use?
Uindow scores 89 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Uindow MCP server expose?
Uindow exposes 38 tools: app_docs, app_status, app_start, app_stop, agent_list, and 33 more. Their descriptions and schemas cost roughly 7,824 tokens of context every time the server is loaded.
Is the Uindow MCP server still maintained?
Uindow is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the Uindow MCP server under?
Uindow declares the Apache-2.0 licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.