Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add sonichi/sutando --skill macos-usegit clone --depth 1 https://github.com/sonichi/sutandoWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/sonichi/sutando/macos-use)<a href="https://agentmods.dev/skills/sonichi/sutando/macos-use"><img src="https://agentmods.dev/badge/skills/sonichi/sutando/macos-use/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/sonichi/sutando/macos-use"><img src="https://agentmods.dev/badge/skills/sonichi/sutando/macos-use.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00075 | $0.01091 |
| Opus 5.5 | $0.00030 | $0.00436 |
| Sonnet 5.5 | $0.00015 | $0.00218 |
| Haiku 4.5 | $0.00007 | $0.00109 |
Grade A, and why
macos-use scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 80 lines — stays where its author put it; the contents beside it link to each section on GitHub.
macos-use
Drive macOS applications from Claude Code via mediar-ai's mcp-server-macos-use. A Swift MCP server that wraps the macOS Accessibility API. Unlike Claude's built-in computer-use, this works in non-interactive mode (which is how Sutando's proactive loop and task bridge run), does not hold a machine-wide lock, and does not require a Pro/Max subscription.
When to use
- "Open Safari and navigate to github.com" — anything requiring real GUI interaction with an app
- "Click the Join button on the Zoom invite dialog"
- "Type this into the Discord message box"
- "Scroll the frontmost window to the bottom"
- Any task that currently falls back to AppleScript + Quartz mouse events in
src/inline-tools.ts
Prefer this skill over:
bash src/screen-capture.sh— that captures screenshots;macos-useactually interacts- AppleScript
tell applicationblocks — more reliable, better error handling cliclick— lower-level, no accessibility context- Claude's built-in
computer-use— that mode requires interactive sessions and holds a lock that contends with Sutando's own loop
Tools exposed
After install, these appear as mcp__macos-use__* in Claude Code:
| Tool | Parameters | Purpose |
|---|---|---|
open_application_and_traverse |
identifier (name/bundle ID/path) |
Launch or activate an app, return its a11y tree |
click_and_traverse |
pid, x, y |
Click at coordinates in a target app, return updated tree |
type_and_traverse |
pid, text |
Type into the frontmost element |
press_key_and_traverse |
pid, key |
Press a named key (Return, Tab, Escape, arrows, ...) |
scroll_and_traverse |
pid, direction, amount |
Scroll in a direction |
refresh_traversal |
pid |
Re-read the a11y tree without acting |
Every tool returns an accessibility-tree snapshot of the target app — structured UI elements with roles, titles, positions, and identifiers. No pixels. Model reasons over the tree, not over screenshots.
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 80 lines · 75 tokens per session scan A 1398b41e17a3
macos-use is a skill published in the GitHub repository sonichi/sutando (398 stars, last pushed today), licensed MIT. It adds 75 tokens to every session and 1,091 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
vellum-browser-use
Browse the web using assistant browser CLI commands.
restaurant-reservation
Book reservations on OpenTable or Resy with explicit confirmations.
browser-extension
The user's own running browser and their logins — paywalls, private dashboards, bot-checked sites, and every site they are already signed into. Reads any page as an accessibility tree and clicks, fills and types by element reference; screenshots, network, console, dialogs, device emulation. Chrome, Edge, Brave…
browser
Headless Playwright — an invisible throwaway browser nobody watches, for scripted runs. Chromium, Firefox or WebKit; stored credentials, multi-tab crawls, table and link extraction, network logs, page-to-PDF. Not the user's browser and never on screen.
web-search
Search the web and read web pages for current information, documentation, news, and research.
scrapling
A Python-based web-scraping workflow for fetching pages and extracting data, including pages that need JavaScript, login sessions, or protection handling. Web scraping means collecting information from websites by code.