trycua/cua is a toolkit for building and testing AI agents that operate computers by seeing screens, clicking controls, and typing across operating systems and virtual machines. It serves agent developers, benchmark authors, and teams generating training data for computer-use models. Catalogue add-ons provide ways to operate Cua drivers and related agent workflows.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add trycua/cua --skill cua-spacesgit clone --depth 1 https://github.com/trycua/cuaWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/trycua/cua/cua-spaces)<a href="https://agentmods.dev/skills/trycua/cua/cua-spaces"><img src="https://agentmods.dev/badge/skills/trycua/cua/cua-spaces/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/trycua/cua/cua-spaces"><img src="https://agentmods.dev/badge/skills/trycua/cua/cua-spaces.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00102 | $0.01150 |
| Opus 5.5 | $0.00041 | $0.00460 |
| Sonnet 5.5 | $0.00020 | $0.00230 |
| Haiku 4.5 | $0.00010 | $0.00115 |
Grade C, and why
cua-spaces scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 15d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
`curl -fsSL https://cua.ai/install.sh | sh -s -- -y --select spaces,host --no-onboarding`. Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
`curl -fsSL https://cua.ai/install.sh | sh -s -- -y --select spaces,host --no-onboarding`. How it starts
The opening of the file, as written. The whole thing — 88 lines — stays where its author put it; the contents beside it link to each section on GitHub.
cua Spaces
Spaces are exposed as MCP tools by the cua MCP server (cua mcp). If the
tools below are missing, ask the user to run cua agents setup or
cua auth login.
Get a Space
| Tool | Use |
|---|---|
list_spaces |
See the Spaces you can use. Start here. |
create_space |
A new Space: on = local (free, the user's machine), cloud (metered), or host:<name> (one of the user's machines set up with cua host setup); reuse: true returns a reachable one first. |
add_space / remove_space |
Register an existing machine by URL and token, or forget one without deleting it. |
delete_space |
Delete a Space's sandbox and stop metering. |
stop_space / start_space |
Turn a local Space (or one your machines provide) off and back on: suspended or stopped, as power in list_spaces says. |
Prefer an existing Space. A cloud Space costs money: delete the ones you created when the task ends.
Work in it
| Tool | Use |
|---|---|
space_bash |
Run a shell command (space, command, optional timeout). |
space_write |
Write text to a file. |
upload / download |
Copy files or folders in and out. |
send_file |
Drop a host file into the Space's Downloads (sha256 verified). |
list_tools / call_tool |
Reach MCP services running inside the Space. |
Show it to the user
| Tool | Use |
|---|---|
open_space_viewer |
Open the full desktop viewer. |
show_space_pip / hide_space_pip |
Picture-in-picture on the user's screen. |
list_space_windows / stream_space_window |
Show one window from the Space. |
stream_endpoint |
Get a ticketed media URL for the desktop or a window. |
Agents, apps and network
| Tool | Use |
|---|---|
agent_capabilities |
Which agent harnesses the Space supports. |
agent_start |
Start an agent run (space, agent, prompt). |
agent_status / agent_message / agent_stop / agent_list |
Follow, steer and stop runs. |
teleport_manifest |
Preview what moving an app session would copy. |
teleport_app |
Move a signed-in app session (tabs, profile) into the Space. |
hotspot_start / hotspot_status / hotspot_stop |
Share the host's network with a Space. |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 15d ago First seen · 88 lines · 102 tokens per session scan C b5062c0eff3a
cua-spaces is a skill published in the GitHub repository trycua/cua (29,970 stars, last pushed today), licensed MIT. It adds 102 tokens to every session and 1,150 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it C with 2 findings (downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-02.
Other skills, from other repositories
protected-vercel-deployments
Access and test Vercel deployments protected by Vercel Authentication, SSO, or Deployment Protection with agent-browser. Use when a preview or production URL redirects to a Vercel login page, returns a protection 401 or 403, or needs short-lived Trusted Sources OIDC authentication instead of a static bypass secret or…
vercel-sandbox
Run agent-browser + Chrome inside Vercel Sandbox microVMs for browser automation from any Vercel-deployed app. Use when the user needs browser automation in a Vercel app (Next.js, SvelteKit, Nuxt, Remix, Astro, etc.), wants to run headless Chrome without binary size limits, needs persistent browser sessions across…
agentcore
Run agent-browser on AWS Bedrock AgentCore cloud browsers. Use when the user wants to use AgentCore, run browser automation on AWS, use a cloud browser with AWS credentials, or needs a managed browser session backed by AWS infrastructure. Triggers include "use agentcore", "run on AWS", "cloud browser with AWS"…
interactive-login
Log a CLI in with a browser/device-code flow (aws sso, gh, glab, gcloud, …) and save the result to the keychain so later commands can request it through execute.credentials.
peekaboo
Use Peekaboo for macOS screenshots, Accessibility inspection, and background app/window/UI automation, including fallback computer use when the primary tool cannot handle an authorized task.
lovable
Lovable MCP tool usage — deploy projects, message agent, test with agent-browser. Minimize credits by delegating to local repo.