Ghost MCP server

Ghost

Verified control of the whole desktop, for agents and programs, on Windows and Linux. Ghost gives Claude Code, Codex, Cursor, any MCP harness, or a plain script the operating system's own control surface: the apps with no API, the windows, the shell, and the browser you are already logged into - in the background without taking your screen or cursor, with every action proven to have happened.

Like Playwright, but for the native desktop, and built for agents. Ghost does the perceiving, the acting, and the verifying; the model you are already running does any looking that is needed, so there is no vision API key to set.

One MCP surface, two engines: Win32 UI Automation on Windows, AT-SPI2 over D-Bus on Linux. The verbs, the locator tiers and the act-then-verify loop are written once and behave the same on both. Platform support · Linux setup

Why Ghost is different

use shortcuts inside an app while you keep working in another window - no focus steal, no cursor jump. It posts window messages to real controls and uses UI Automation patterns on windowless ones; most tools can only drive whatever is in the foreground. Since 0.19 this is a policy, not a preference: the focus policy defaults to background. Since 0.20 it is also constructive: anything Ghost starts (an app, a windowed browser) is born on a hidden desktop that has its own input queue and cannot take your foreground, and the ordinary verbs drive it there by window title. A call that truly has no background path fails naming the action instead of quietly taking the screen. Since 0.22 the policy is locked there: no tool call can raise it, so an agent cannot decide on its own to take your mouse. You can, by setting GHOSTFOCUSLOCK=off in the server's environment. And since 0.23 a window that grabs the foreground on its own - browsers do, on their own accessibility calls - is handed straight back, so your typing keeps going where you are looking. Measured on a real desktop with a person typing throughout: of roughly 490 keystrokes a run, zero to one reached the window the agent was driving. (how)

• Runs in the background, and that is enforced. An agent can click, type, and

agent named or launched and every window-scoped verb targets it by default. The human's foreground window is used only when nothing was ever anchored, and the response says so. Three weeks of real transcripts showed "element not found in the foreground window" as the top failure before this; it was the agent searching the window you had open.

• Never your window by accident. The session remembers the last window the

in one tab does not stall an instant query behind it, and a second Ghost process runs its own browser alongside the first without contending for the mouse.

• Many agents at once. Requests are dispatched in parallel, so a 15-second wait

stdio and audits every claim above against hard timing budgets, exiting non-zero if any of them does not hold on your hardware.

• Prove it on your machine. ghost verify drives the real MCP server over

value back) after acting and returns verified / focus_confirmed - never a blind ok:true. Agents fail by acting and not knowing if it worked; Ghost closes that loop.

• Every action is verified. Ghost re-checks the screen (or reads the control's

• **Drives apps

Shortened. The full README is on GitHub.