trycua/cua is a toolkit for building and testing AI agents that operate computers by seeing screens, clicking controls, and typing across operating systems and virtual machines. It serves agent developers, benchmark authors, and teams generating training data for computer-use models. Catalogue add-ons provide ways to operate Cua drivers and related agent workflows.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add trycua/cua --skill cua-volumegit clone --depth 1 https://github.com/trycua/cuaWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/trycua/cua/cua-volume)<a href="https://agentmods.dev/skills/trycua/cua/cua-volume"><img src="https://agentmods.dev/badge/skills/trycua/cua/cua-volume/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/trycua/cua/cua-volume"><img src="https://agentmods.dev/badge/skills/trycua/cua/cua-volume.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00114 | $0.00992 |
| Opus 5.5 | $0.00046 | $0.00397 |
| Sonnet 5.5 | $0.00023 | $0.00198 |
| Haiku 4.5 | $0.00011 | $0.00099 |
Grade A, and why
cua-volume scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 76 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Cua Volume
One versioned volume per user. Every write is a new version; deletes keep history. The same files appear on the user's Mac (Finder) and in every Space, within seconds.
Where it is
| Where you run | Path |
|---|---|
| A Linux Space | /volume (or ~/Cua Volume when /volume is absent) |
| A macOS Space | ~/Cua Volume |
| No mount (Windows for now, or the Space has none) | use the volume_* tools below |
Check that it is mounted, not just present: mountpoint -q /volume on Linux,
ls ~/"Cua Volume" on macOS. A /volume holding only
CUA-VOLUME-UNAVAILABLE.txt (read-only) is not the volume: the file says
why (for example, a container without /dev/fuse). If it is not mounted, use
the tools; nothing written to an unmounted folder is saved.
Layout and what you may do
| Folder | You (an agent in a Space) |
|---|---|
public/ |
read only: shared reference from the user |
agents/<you>/ |
read and write: your home (memory, outputs/, inbox/) |
spaces/<this space>/ |
read and write: this Space's scratch and outputs |
| another agent's home, another Space | not visible; ask with volume_request_access |
Put results the user should see in agents/<you>/outputs/ (or this Space's
folder) and tell them the path. A refused write means the folder is not
yours: do not retry elsewhere to get around it, ask.
Tools (the cua MCP server)
| Tool | Use |
|---|---|
volume_ls, volume_read, volume_write |
The same files without the mount; each file's sync state |
volume_delete, volume_history, volume_restore |
Where offered: delete, old versions, restore one |
volume_request_access |
Ask the user for more (a folder, r or rw, and why); they approve in Cua |
volume_sync_status |
Sync health, each device's last sync, your files still uploading, conflicts |
Inside a Space these tools answer from the user's machine, so they show its view of sync, not only this Space's.
Sync and conflicts
- A file another device just wrote can take a few seconds to arrive. Before
relying on one, check
volume_sync_status:feedislive(syncing),off(storage on this machine only: nothing to wait for) oroffline(the bucket is unreachable, seelast_error: say so rather than trust a stale file).devicesshows when each device last synced. volume_lsandvolume_readmark a file withsyncwhen it matters:pending_upload(not yet stored, other devices cannot see it yet),conflict(a write lost to a later one; kept atconflict_path),conflict_copy, andwritten_bywhen another device wrote it last.- Your own writes through the mount upload when you close the file (or after a moment without writes). Close files before telling the user they are ready.
- When two devices change the same file, the later write wins and the other
is kept next to it as
name (conflict from <device> <date>).ext. Nothing is lost. Do not delete a conflict copy yourself: tell the user, or merge the two into the current file if the task asks for it.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago Changed · +3 lines 22b23baf354b
- 13d ago First seen · 73 lines · 114 tokens per session scan A 7602573a6a21
cua-volume is a skill published in the GitHub repository trycua/cua (29,746 stars, last pushed today), licensed MIT. It adds 114 tokens to every session and 992 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-02.
Other skills, from other repositories
unprocessed-ingest
A workflow for processing files from an `unprocessed/` folder, including screen recordings, exported conversations, notes, PDFs, and images. It moves information through raw and wiki stages.
obsidian
Obsidian vault: search/read/write notes, backlinks, Bases, Canvas.
docx
Create, read, edit, review, redline, comment on, merge, audit, render, and verify .docx Word documents, including layout-sensitive and OOXML-level work.
vellum-memory-v3-migration
One-time migration of an existing memory-v2 concept corpus into the memory-v3 section-grain "wiki" — topical articles with a stand-alone lead and queryable sections — with loss-proof staging, assistant-reviewed authoring, and a retrieval-eval gate before cutover.
vellum-memory-v2-migration
Perform a one-time migration from memory v1, to memory v2, which was introduced in 0.8.0.
chat-complex-documents
Chat with and search your complex documents — ask questions, extract tables and fields, and get answers grounded in the source. Connects the hosted Unstructured Transform MCP server to parse, structure, and enrich PDFs, Word/Excel/PowerPoint, images, scanned files, emails, and 60+ other formats into clean, AI-ready…