CUA Computer Use Runtime 100/100

Is CUA Computer Use Runtime safe to install?

SaferSkills independently audited CUA Computer Use Runtime (Plugin) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

README.md · 1 file

README.md25.6 KB · Markdown

<h1 align="center">DeepChat - Open-Source Local-First AI Agent Desktop Client</h1>

DeepChat is an open-source, local-first AI agent desktop client with rich agent capabilities, designed around the Tape.systems philosophy, with support for MCP, Skills, ACP, and remote control integrations for messaging apps.

<div align="center"> <a href="./README.zh.md">中文</a> / <a href="./README.md">English</a> / <a href="./README.jp.md">日本語</a> </div>

📑 Table of Contents

📑 Table of Contents
🚀 Project Introduction
💡 Why Choose DeepChat
🔥 Main Features
📼 Tape & Trace
🧠 Skills Support
🧩 ACP Integration (Agent Client Protocol)
📡 Remote Control
🤖 Supported Model Providers
Compatible with any model provider in OpenAI/Gemini/Anthropic API format
🔍 Use Cases
📦 Quick Start
Download and Install
Configure Models
Start Conversations
💻 Development Guide
Install Dependencies
Start Development
Build
👥 Community \& Contribution
⭐ Star History
👨‍💻 Contributors
📃 License

🚀 Project Introduction

DeepChat is a powerful open-source, local-first AI agent desktop client that brings together models, tools, Skills, agent runtimes, Tape, and long-running sessions in one desktop app. Whether you're using cloud APIs like OpenAI, Gemini, Anthropic, or locally deployed Ollama models, DeepChat delivers a smooth user experience.

DeepChat's sessions and agent processes follow the Tape.systems philosophy: keep the process, so context, tool calls, requests, and results stay recoverable, traceable, and inspectable. It also provides strong MCP support, installable Skills, ACP agent integration, and remote control for Telegram, Feishu/Lark, QQBot, Discord, WeChat iLink, and other messaging workflows.

💡 Why Choose DeepChat

Compared to other AI tools, DeepChat offers the following unique advantages:

Local-First Agent Desktop Client: Run DeepChat agents, ACP agents, and remote-ready bots in one local app
Tape.systems Philosophy: Preserve recoverable session history, trace request context, and inspect token budgets when agent work gets complex
Skills That Travel: Install, import, export, and enable reusable Skills per conversation for code review, documents, frontend work, Office/PDF tasks, and more
Native ACP Integration: Run ACP-compatible coding and task agents as first-class entries in the model selector
Strong MCP Support: Support Resources, Prompts, Tools, multiple transports, inMemory services, and one-click installation
Remote-Ready Workflows: Control DeepChat sessions from Telegram, Feishu/Lark, QQBot, Discord, and WeChat iLink
Unified Multi-Model Management: One application supports mainstream cloud LLMs and local Ollama models, eliminating the need to switch between multiple apps
Privacy-Focused: Local data storage and network proxy support reduce the risk of information leakage
Business-Friendly: Embraces open source under the Apache License 2.0, suitable for both commercial and personal use

🔥 Main Features

🤖 Local-First Agent Desktop Client
Select DeepChat, ACP, and remote-capable agents from one model-like entry point
Run long-lived sessions with project folders, permission modes, tool output, and resumable context
📼 Tape & Trace
Session Tape records structured work history for recovery, resume, and future agent memory flows
Trace previews show request sequences, provider/model metadata, Tape view manifests, included entries, and token budgets
🧠 Skills
Install Skills from folders, ZIP files, or URLs
Enable Skills per conversation so DeepChat can load task-specific instructions, references, and optional scripts
Import and export Skills with Claude Code, Codex, Cursor, Windsurf, GitHub Copilot, and other compatible tools
🤝 ACP (Agent Client Protocol) Agent Integration
Run ACP-compatible agents (built-in or custom commands) as selectable “models”
ACP workspace UI for structured plans, tool calls, and terminal output when provided by the agent
📡 Remote Control
Control DeepChat sessions from Telegram, Feishu/Lark, QQBot, Discord, and WeChat iLink
Bind remote endpoints to sessions, switch models, answer pending interactions, stop runs, and open desktop sessions remotely
🌐 Multiple Cloud LLM Provider Support: DeepSeek, OpenAI, Moonshot/Kimi, Grok, Gemini, Anthropic, and more
🏠 Local Model Deployment Support:
Integrated Ollama with comprehensive management capabilities
Control and manage Ollama model downloads, deployments, and runs without command-line operations
🚀 Rich and Easy-to-Use Chat Capabilities
Complete Markdown rendering with code block rendering based on industry-leading CodeMirror
Multi-window + multi-tab architecture supporting parallel multi-session operations across all dimensions, use large models like using a browser, non-blocking experience brings excellent efficiency
Supports Artifacts rendering for diverse result presentation
Messages support retry to generate multiple variations; conversations can be forked freely, ensuring there's always a suitable line of thought
Supports rendering images, Mermaid diagrams, and other multi-modal content; supports GPT-4o, Gemini, Grok text-to-image capabilities
Supports highlighting external information sources like search results within the content
🔍 Robust Search Extension Capabilities
Built-in integration with leading search APIs like BoSearch and Brave Search, allowing the model to intelligently decide when to search
Supports mainstream search engines like Google, Bing, Baidu, and Sogou Official Accounts search by simulating user web browsing, enabling the LLM to read search engines like a human
Supports reading any search engine; simply configure a search assistant model to connect various search sources, whether internal networks, API-less engines, or vertical domain search engines, as information sources for the model
🔧 Strong MCP (Model Context Protocol) Support
Full support for Resources / Prompts / Tools
Supports StreamableHTTP, SSE, Stdio, and other transports
Built-in Node.js runtime so npx/node-style services work out of the box
inMemory services for code execution, web information retrieval, file operations, and other common utilities
Clear tool-call display with parameter and return-data debugging
DeepLink support for one-click MCP service installation
💻 Multi-Platform Support: Windows, macOS, Linux
🎨 Beautiful and User-Friendly Interface, user-oriented design, meticulously themed light and dark modes
🔗 Rich DeepLink Support: Initiate conversations via links for seamless integration with other applications, including one-click MCP service installation.
🚑 Security-First Design: Chat data and configuration data have reserved encryption interfaces and code obfuscation capabilities
🛡️ Privacy Protection: Supports screen projection hiding, network proxies, and other privacy protection methods to reduce the risk of information leakage
💰 Business-Friendly:
Embraces open source, based on the Apache License 2.0 protocol, enterprise use without worry
Enterprise integration requires only minimal configuration code changes to use reserved encrypted obfuscation security capabilities
Clear code structure, both model providers and MCP services are highly decoupled, can be freely customized with minimal cost
Reasonable architecture, data interaction and UI behavior separation, fully utilizing Electron's capabilities, rejecting simple web wrappers, excellent performance

For more details on how to use these features, see the documentation index.

📼 Tape & Trace

DeepChat's session Tape follows the Tape.systems philosophy and keeps agent work recoverable and inspectable. Trace previews expose request sequences, provider/model metadata, Tape view manifests, included or excluded entries, and token budgets, making long-running agent sessions easier to debug and resume.

🧠 Skills Support

DeepChat Skills are designed to be compatible with the standard Agent Skills specification. A Skill can include task instructions, reference files, assets, and optional scripts, so DeepChat can act more like a domain specialist after it is enabled.

You can install Skills from folders, ZIP files, or URLs, and import/export them with Claude Code, Codex, Cursor, Windsurf, GitHub Copilot, Kiro, Antigravity, OpenCode, Goose, Kilo Code, and other compatible tools.

Built-in Skills cover generative art, code review, DeepChat settings, document collaboration, DOCX, frontend design, git commit messages, infographic syntax, MCP building, PDF, PPTX, Skill creation, Web Artifacts, and XLSX workflows.

Quick start:

Open Settings → Skills
Install or import a Skill
Enable it in conversations that need that capability

🧩 ACP Integration (Agent Client Protocol)

DeepChat has built-in support for Agent Client Protocol (ACP), allowing you to integrate external agent runtimes into DeepChat with a native UI. Once enabled, ACP agents appear as first-class entries in the model selector, so you can use coding agents and task agents directly inside DeepChat.

Quick start:

Open Settings → ACP Agents and enable ACP
Enable a built-in ACP agent or add a custom ACP-compatible command
Select the ACP agent in the model selector to start an agent session

To explore the ecosystem of compatible agents and clients, see: https://agentclientprotocol.com/overview/clients

📡 Remote Control

DeepChat can be controlled from messaging apps, so you can keep a session running even when you are away from the desktop. Configure remote channels under Settings → Remote.

Supported channels include Telegram, Feishu/Lark, QQBot, Discord, and WeChat iLink. Remote endpoints can bind to one DeepChat session, then create new sessions, list and switch recent sessions, stop generation, open the current session on desktop, answer pending questions or permission prompts, switch models, and check runtime status.

Common commands include /start, /help, /pair, /new, /sessions, /use, /stop, /open, /pending, /model, and /status.

🤖 Supported Model Providers

<table> <tr align="center"> <td> <img src="./src/renderer/src/assets/llm-icons/deepseek-color.svg" width="50" height="50" alt="Deepseek Icon"> <a href="https://deepseek.com/">Deepseek</a> </td> <td> <img src="./src/renderer/src/assets/llm-icons/moonshot.svg" width="50" height="50" alt="Moonshot Icon"> <a href="https://moonshot.ai/">Moonshot</a> </td> <td> <img src="./src/renderer/src/assets/llm-icons/openai.svg" width="50" height="50" alt="OpenAI Icon"> <a href="https://openai.com/">OpenAI</a> </td> <td> <img src="./src/renderer/src/assets/llm-icons/gemini-color.svg" width="50" height="50" alt="Gemini Icon"> <a href="https://gemini.google.com/">Gemini</a> </td> </tr> <tr align="center"> <td> <img src="./src/renderer/src/assets/llm-icons/ollama.svg" width="50" height="50" alt="Ollama Icon"> <a href="https://ollama.com/">Ollama</a> </td> <td> <img src="./src/renderer/src/assets/llm-icons/qiniu.svg" width="50" height="50" alt="Qiniu Icon"> <a href="https://www.qiniu.com">Qiniu</a> </td> <td> <img src="./src/renderer/src/assets/llm-icons/newapi.svg" width="50" height="50" alt="New API Icon"> <a href="https://www.newapi.ai/">New API</a> </td> <td> <img src="./src/renderer/src/assets/llm-icons/grok.svg" width="50" height="50" alt="Grok Icon"> <a href="https://x.ai/">Grok</a> </td> </tr> <tr align="center"> <td> <img src="./src/renderer/src/assets/llm-icons/zhipu-color.svg" width="50" height="50" alt="Zhipu Icon"> <a href="https://open.bigmodel.cn/">Zhipu</a> </td> <td> <img src="./src/renderer/src/assets/llm-icons/ppio-color.svg" width="50" height="50" alt="PPIO Icon"> <a href="https://ppinfra.com/">PPIO</a> </td> <td> <img src="./src/renderer/src/assets/llm-icons/minimax-color.svg" width="50" height="50" alt="MiniMax Icon"> <a href="https://platform.minimaxi.com/">MiniMax</a> </td> <td> <img src="./src/renderer/src/assets/llm-icons/fireworks-color.svg" width="50" height="50" alt="Fireworks Icon"> <a href="https://fireworks.ai/">Fireworks</a> </td> </tr> <tr align="center"> <td> <img src="./src/renderer/src/assets/llm-icons/aihubmix.png" width="50" height="50" alt="AIHubMix Icon"> <a href="https://aihubmix.com/">AIHubMix</a> </td> <td> <img src="./src/renderer/src/assets/llm-icons/doubao-color.svg" width="50" height="50" alt="Doubao Icon"> <a href="https://console.volcengine.com/ark/">Doubao</a> </td> <td> <img src="./src/renderer/src/assets/llm-icons/alibabacloud-color.svg" width="50" height="50" alt="DashScope Icon"> <a href="https://www.aliyun.com/product/bailian">DashScope</a> </td> <td> <img src="./src/renderer/src/assets/llm-icons/groq.svg" width="50" height="50" alt="Groq Icon"> <a href="https://groq.com/">Groq</a> </td> </tr> <tr align="center"> <td> <img src="./src/renderer/src/assets/llm-icons/jiekou-color.svg" width="50" height="50" alt="JieKou.AI Icon"> <a href="https://jiekou.ai?utm_source=github_deepchat">JieKou.AI</a> </td> <td> <img src="./src/renderer/src/assets/llm-icons/zenmux-color.svg" width="50" height="50" alt="ZenMux Icon"> <a href="https://zenmux.ai/">ZenMux</a> </td> <td> <img src="./src/renderer/src/assets/llm-icons/github.svg" width="50" height="50" alt="GitHub Models Icon"> <a href="https://github.com/marketplace/models">GitHub Models</a> </td> <td> <img src="./src/renderer/src/assets/llm-icons/lmstudio.svg" width="50" height="50" alt="LM Studio Icon"> <a href="https://lmstudio.ai/docs/app">LM Studio</a> </td> </tr> <tr align="center"> <td> <img src="./src/renderer/src/assets/llm-icons/hunyuan-color.svg" width="50" height="50" alt="Hunyuan Icon"> <a href="https://cloud.tencent.com/product/hunyuan">Hunyuan</a> </td> <td> <img src="./src/renderer/src/assets/llm-icons/302ai.svg" width="50" height="50" alt="302.AI Icon"> <a href="https://302.ai">302.AI</a> </td> <td> <img src="./src/renderer/src/assets/llm-icons/together-color.svg" width="50" height="50" alt="Together Icon"> <a href="https://www.together.ai/">Together</a> </td> <td> <img src="./src/renderer/src/assets/llm-icons/poe-color.svg" width="50" height="50" alt="Poe Icon"> <a href="https://poe.com/">Poe</a> </td> </tr> <tr align="center"> <td> <img src="./src/renderer/src/assets/llm-icons/vercel.svg" width="50" height="50" alt="Vercel AI Gateway Icon"> <a href="https://vercel.com/ai">Vercel AI Gateway</a> </td> <td> <img src="./src/renderer/src/assets/llm-icons/openrouter.svg" width="50" height="50" alt="OpenRouter Icon"> <a href="https://openrouter.ai/">OpenRouter</a> </td> <td> <img src="./src/renderer/src/assets/llm-icons/azure-color.svg" width="50" height="50" alt="Azure OpenAI Icon"> <a href="https://azure.microsoft.com/en-us/products/ai-services/openai-service">Azure OpenAI</a> </td> <td> <img src="./src/renderer/src/assets/llm-icons/tokenflux-color.svg" width="50" height="50" alt="TokenFlux Icon"> <a href="https://tokenflux.ai/">TokenFlux</a> </td> </tr> <tr align="center"> <td> <img src="./src/renderer/src/assets/llm-icons/burncloud-color.svg" width="50" height="50" alt="BurnCloud Icon"> <a href="https://www.burncloud.com/">BurnCloud</a> </td> <td> <img src="./src/renderer/src/assets/llm-icons/openai.svg" width="50" height="50" alt="OpenAI Responses Icon"> <a href="https://openai.com/">OpenAI Responses</a> </td> <td> <img src="./src/renderer/src/assets/llm-icons/cherryin-color.png" width="50" height="50" alt="CherryIn Icon"> <a href="https://open.cherryin.ai/console">CherryIn</a> </td> <td> <img src="./src/renderer/src/assets/llm-icons/modelscope-color.svg" width="50" height="50" alt="ModelScope Icon"> <a href="https://modelscope.cn/">ModelScope</a> </td> </tr> <tr align="center"> <td> <img src="./src/renderer/src/assets/llm-icons/aws-bedrock.svg" width="50" height="50" alt="AWS Bedrock Icon"> <a href="https://aws.amazon.com/bedrock/">AWS Bedrock</a> </td> <td> <img src="./src/renderer/src/assets/llm-icons/voiceai.svg" width="50" height="50" alt="Voice.ai Icon"> <a href="https://voice.ai/">Voice.ai</a> </td> <td> <img src="./src/renderer/src/assets/llm-icons/vertexai-color.svg" width="50" height="50" alt="Vertex AI Icon"> <a href="https://cloud.google.com/vertex-ai">Vertex AI</a> </td> <td> <img src="./src/renderer/src/assets/llm-icons/githubcopilot.svg" width="50" height="50" alt="GitHub Copilot Icon"> <a href="https://github.com/features/copilot">GitHub Copilot</a> </td> </tr> <tr align="center"> <td> <img src="./src/renderer/src/assets/llm-icons/xiaomi.png" width="50" height="50" alt="Xiaomi Icon"> <a href="https://platform.xiaomimimo.com/#/docs/quick-start/first-api-call">Xiaomi</a> </td> <td> <img src="./src/renderer/src/assets/llm-icons/o3-fan.png" width="50" height="50" alt="o3.fan Icon"> <a href="https://o3.fan">o3.fan</a> </td> <td> <img src="./src/renderer/src/assets/llm-icons/novitaai.svg" width="50" height="50" alt="Novita AI Icon"> <a href="https://novita.ai/">Novita AI</a> </td> <td> <img src="./src/renderer/src/assets/llm-icons/astraflow.png" width="50" height="50" alt="Astraflow Icon"> <a href="https://astraflow.ucloud.cn/">Astraflow</a> </td> </tr> <tr align="center"> <td> <img src="./src/renderer/src/assets/llm-icons/anthropic.svg" width="50" height="50" alt="Anthropic Icon"> <a href="https://www.anthropic.com/">Anthropic</a> </td> <td> <img src="./src/renderer/src/assets/llm-icons/siliconcloud-color.svg" width="50" height="50" alt="SiliconFlow Icon"> <a href="https://www.siliconflow.cn/">SiliconFlow</a> </td> </tr>

</table>

Compatible with any model provider in OpenAI/Gemini/Anthropic API format

🔍 Use Cases

DeepChat is suitable for various AI application scenarios:

Daily Assistant: Answering questions, providing suggestions, assisting with writing and creation
Development Aid: Code generation, debugging, technical problem solving
Learning Tool: Concept explanation, knowledge exploration, learning guidance
Content Creation: Copywriting, creative inspiration, content optimization
Data Analysis: Data interpretation, chart generation, report writing

📦 Quick Start

Download and Install

You can install DeepChat using one of the following methods:

Option 1: GitHub Releases

Download the latest version for your system from the GitHub Releases page:

Windows: .exe installation file
macOS: .dmg installation file
Linux: .AppImage or .deb installation file

Option 2: Official Website

Download from the official website.

Option 3: Homebrew (macOS only)

For macOS users, you can install DeepChat using Homebrew:

brew install --cask deepchat

Configure Models

Launch the DeepChat application
Click the settings icon
Select the "Model Providers" tab
Add your API keys or configure local Ollama

Start Conversations

Click the "+" button to create a new conversation
Select the model you want to use
Start communicating with your AI assistant

For a comprehensive guide on getting started and using all features, please refer to the documentation index.

💻 Development Guide

Please read the Contribution Guidelines

Windows and Linux are packaged by GitHub Action. For Mac-related signing and packaging, please refer to the Mac Release Guide.

Install Dependencies

$ pnpm install
$ pnpm run installRuntime
# if got err: No module named 'distutils'
$ pip install setuptools

For Windows: To allow non-admin users to create symlinks and hardlinks, enable Developer Mode in Settings or use an administrator account. Otherwise pnpm ops will fail.

Start Development

$ pnpm run dev

Build

# For Windows
$ pnpm run build:win

# For macOS
$ pnpm run build:mac

# For Linux
$ pnpm run build:linux

# Specify architecture packaging
$ pnpm run build:win:x64
$ pnpm run build:win:arm64
$ pnpm run build:mac:x64
$ pnpm run build:mac:arm64
$ pnpm run build:linux:x64
$ pnpm run build:linux:arm64

For a more detailed guide on development, project structure, and architecture, please see the Developer Guide.

👥 Community & Contribution

DeepChat is an active open-source community project, and we welcome various forms of contribution:

Check the Contribution Guidelines to learn more about ways to participate in the project.

⭐ Star History

👨‍💻 Contributors

Thank you for considering contributing to deepchat! The contribution guide can be found in the Contribution Guidelines.

🙏🏻 Thanks

This project is built with the help of these awesome libraries and projects:

Vue
Electron
Electron-Vite
oxlint
Bub, whose tape model inspired DeepChat's session tape design. For the underlying tape architecture, visit tape.systems.

📃 License

LICENSE

CUA Computer Use Runtime— plugin

Is CUA Computer Use Runtime safe to install?

📑 Table of Contents

🚀 Project Introduction

💡 Why Choose DeepChat

🔥 Main Features

📼 Tape & Trace

🧠 Skills Support

🧩 ACP Integration (Agent Client Protocol)

📡 Remote Control

🤖 Supported Model Providers

Compatible with any model provider in OpenAI/Gemini/Anthropic API format

🔍 Use Cases

📦 Quick Start

Download and Install

Configure Models

Start Conversations

💻 Development Guide

Install Dependencies

Start Development

Build

👥 Community & Contribution

⭐ Star History

👨‍💻 Contributors

🙏🏻 Thanks

📃 License

Audit the pieces. Scan the whole. Decide.