hypruse

Package (pypi 0.11.0)

uvx hypruse

Or add to your MCP client config:

{
  "mcpServers": {
    "hypruse": {
      "command": "uvx",
      "args": [
        "hypruse"
      ],
      "env": {
        "HYPRUSE_SCREENSHOT_MODE": "<YOUR_VALUE>",
        "HYPRUSE_READONLY": "<YOUR_VALUE>",
        "HYPRUSE_CONFINE": "<YOUR_VALUE>",
        "HYPRUSE_AUTH_GUARD": "<YOUR_VALUE>",
        "HYPRUSE_STRICT": "<YOUR_VALUE>",
        "HYPRUSE_MARK": "<YOUR_VALUE>",
        "HYPRUSE_CLIPBOARD": "<YOUR_VALUE>",
        "HYPRUSE_JOURNAL": "<YOUR_VALUE>",
        "HYPRUSE_JOURNAL_MAX_BYTES": "<YOUR_VALUE>",
        "HYPRUSE_JOURNAL_TEXT": "<YOUR_VALUE>",
        "HYPRUSE_DRYRUN": "<YOUR_VALUE>"
      }
    }
  }
}

• HYPRUSE_SCREENSHOT_MODE — How captures are returned: 'file' writes to XDG_RUNTIME_DIR and returns the path, 'image' returns the image inline. Use 'image' for clients that render MCP images but cannot read files, such as Claude Desktop.
• HYPRUSE_READONLY — Set to 1 to expose only the observation tools (desktop, screenshot, zoom, ui, marks, binds, wait_for). The agent can see and narrate but cannot click, type, or launch.
• HYPRUSE_CONFINE — Restrict input to a scope of windows and refuse everything outside it: 'launched' (only windows hypruse opened this session), 'class:firefox,kitty', or 'workspace:3,special:notes'. Unset means no confinement.
• HYPRUSE_AUTH_GUARD — Refuse to click or type into system authentication dialogs (polkit, keyring prompts). On by default; 'strict' also refuses password fields in ordinary windows; 0 disables it.
• HYPRUSE_STRICT — Set to 1 to refuse to act when the cursor or focused window moved since hypruse's last action, so the agent must re-read the desktop before retrying.
• HYPRUSE_MARK — Set to 1 to make the agent's presence legible: tag every window it opens 'hypruse-owned' and flash an on-screen notice when it opens a window or captures the screen.
• HYPRUSE_CLIPBOARD — Set to 1 to register the opt-in clipboard tool (never in read-only mode). Off by default because clipboards hold passwords.
• HYPRUSE_JOURNAL — Record every tool call, refusals included, as one NDJSON line: 1 writes to XDG_STATE_HOME/hypruse/journal.ndjson, or give a path. Read it back with 'hypruse journal'. Off by default.
• HYPRUSE_JOURNAL_MAX_BYTES — Rotate the journal once it reaches this size, keeping one previous generation alongside it. Set 0 to never rotate.
• HYPRUSE_JOURNAL_TEXT — Set to 1 to record typed and copied text in the journal verbatim instead of as a length plus digest. Off by default because keystrokes are passwords; needed only to replay typing.
• HYPRUSE_DRYRUN — Set to 1 for a rehearsal: every acting tool validates its arguments and runs every trust guard, then reports what it would have done and delivers no input.