winapp CLI is a command-line tool for Windows application development that manages SDKs, app identity, manifests, certificates, packaging, and build tools. It helps developers using frameworks such as .NET, Win32, CMake, Electron, or Rust access Windows-native development capabilities. The catalogue add-ons provide agent workflows for using the CLI.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add microsoft/winappCli --skill winui-devtoolsgit clone --depth 1 https://github.com/microsoft/winappCliWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/microsoft/winappcli/winui-devtools)<a href="https://agentmods.dev/skills/microsoft/winappcli/winui-devtools"><img src="https://agentmods.dev/badge/skills/microsoft/winappcli/winui-devtools/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/microsoft/winappcli/winui-devtools"><img src="https://agentmods.dev/badge/skills/microsoft/winappcli/winui-devtools.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00078 | $0.02613 |
| Opus 5.5 | $0.00031 | $0.01045 |
| Sonnet 5.5 | $0.00016 | $0.00523 |
| Haiku 4.5 | $0.00008 | $0.00261 |
Grade A, and why
winui-devtools scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 186 lines — stays where its author put it; the contents beside it link to each section on GitHub.
If you can't run winapp yourself (no shell, or the command is denied), give the user the exact winapp devtools / winapp run command(s) that would answer their question instead of only reasoning from source. Say which values you read from source and which only the running app can confirm.
Start with the target
Use winapp ui and the winapp-ui-automation skill for general Windows UI
Automation: actions, screenshots, waits and accessibility across app frameworks.
DevTools is for WinUI 3 XAML trees/source, bindings and dependency-property
diagnosis or edits. Both tools accept an element's AutomationId as its selector,
so an AutomationId from winapp ui works in winapp devtools and the aid=
shown by DevTools works in winapp ui invoke/click. Generated selectors (slugs,
handles) belong to one tool; copy a fresh one from that tool's inspect or
search.
winapp run .
For a WinUI project this starts DevTools with its in-app toolbar and waits for the app
(it is off in CI, with --no-launch, --without-alias or --on sandbox, and for
folders, .cs files and non-WinUI projects; pass --devtools on there). Let the user
leave comments there:
turn on Comments in the toolbar, click an element, type, press Enter (Shift+Enter for a
new line), or click the next element to save and move on. Select element opens the
DevTools window on the element the user clicks. Ctrl+Shift+F12 moves keyboard
focus to the toolbar (showing it if the user hid it), and Esc returns it. Use a second terminal for commands, or add --detach
to return to the terminal with the app still running and its PID printed.
Use an exact PID with -a when multiple apps are attached.
Never stop another app automatically to make a rebuild succeed.
--json is optional output formatting for structured consumers, not the default
agent workflow. It does not hide the overlay. Use --devtools headless for an
authorized headless inspection launch: nothing is drawn in the app, and
Ctrl+Shift+F12 brings up the toolbar. --devtools off runs without DevTools; don't
change the user's default (winapp config set run.devtools) unless they ask.
For a script, capture $run = winapp run . --devtools on --detach --json | ConvertFrom-Json,
then use winapp devtools inspect -a $run.ProcessId. After the human leaves a comment, follow
the comment workflow below.
If attachment succeeds but the overlay reports a missing XAML resource/type,
see visual UI prerequisites;
do not mistake unavailable visual UI for failed protocol attachment.
Packaged aliases are prepared automatically in the staged manifest, not manually
authored in the source manifest. When DevTools starts by default and how to choose,
including dotnet run's -p:WinAppRunDevTools, is in
Turn DevTools on or off.
Do not adopt a different running instance when launch fails. Attaching to an existing app is explicit and headless by default:
winapp devtools list --include-available
winapp devtools attach --pid <pid> --source-root <project folder>
--source-root gives the app its project folder, so in-app comments go to the same store
as with winapp run; an app started without winapp run has none. list and attach
only take WinUI 3 apps.
Late attach cannot provide startup-only binding hooks or missing XAML source
information. Obtain permission before launching, injecting into, or mutating
an app; do not use an unrelated running app as a test fixture.
Live commands require an attached target. Only after injection is authorized,
use --attach with an explicit target to attach as part of a live command.
Choosing a PID or HWND alone never authorizes injection.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 186 lines · 78 tokens per session scan A fc0cd1414641
winui-devtools is a skill published in the GitHub repository microsoft/winappCli (1,321 stars, last pushed yesterday), licensed MIT. It adds 78 tokens to every session and 2,613 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-17.
Other skills, from other repositories
quicker-run
Use when running or debugging Quicker actions via qkrpc MCP (not editing program body).
code_explorer
Explores the repository to locate primary source files, coupled UI components, and test files for bug reports or feature requests.
test-failure-explorer
Import and query an existing Vitest 3.2 JSON report to explore test failures, file-level errors and original diagnostic evidence.
feedback
Skill "feedback" from Hmbown/Codewhale, covering feedback, when to use, setup, workflow and non-goals.
session-investigator
Investigate fast-agent session and history files to diagnose issues. Use when a session ended unexpectedly, when debugging tool loops, when correlating sub-agent traces with main sessions, or when analyzing conversation flow and timing. Covers session.json metadata, history JSON format, message structure, tool…
smiles-validation
Strict SMILES validation, structural comparison, and modification verification. Catches invalid LLM-generated molecules.