Uindow — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Uindow (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<p align="center"> <a href="https://uindow.com/?ref=github"> <img src="https://uindow.github.io/img/github-banner.png"/> </a> </p>
Uindow drives a real, signed Chromium/Electron browser with genuine OS-level input - actual cursor movement, real keystrokes, and native file dialogs rather than synthetic page events. It runs entirely on your own machine and your own network, and every line of code it executes sits in plain sight in this repository.
Automate it three ways:
MCP server, so Claude, Cursor, VS Code, or any MCP-compatible assistant can list, create, and run automation agents directly. See Control Uindow from AI agents.
debug automations with ease. Auto-completion, code healing, JavaScript parsing, and linting are all built in.
npx (recommended)One command to fetch the CLI and launch the app:
npx -y @uindow/cli app:startOther lifecycle commands:
npx @uindow/cli app:status # check whether the app is running
npx @uindow/cli app:stop # stop the appClone the repository and launch the app directly from source.
git clone https://github.com/uindow/uindow.git uindow
cd ./uindow/
npm install
npm start#### What actually runs on your machine
Both options do the same minimal thing: they fetch the official, signed `Electron` binary (only if it isn't already on your machine) and tell Electron to load dist/run.js. That's the whole story - a genuine, trusted, signed Electron runtime executing code that is clearly visible to you in this repository. Nothing is hidden, obfuscated, or pulled in behind your back.
Prefer a packaged installer?
We build signed binaries for macOS, Windows, and Linux directly from the dist source, and host them on the Releases page (current and older versions).
The build tooling lives in this repository and does exactly one job: it archives the dist folder into app.asar. You can audit it and reproduce the build yourself.
In order to use the app, create a free account at Uindow and follow the on-screen instructions.
Uindow exposes a local Model Context Protocol server so any MCP-compatible assistant can drive web-automation agents directly - no glue code required. The server runs locally over stdio and is launched on demand with npx:
npx -y @uindow/cli mcpTools exposed: app_docs, app_start, app_stop, app_status, list, create, update, delete, start, stop, status, execute, logs.
Call list first to discover agent indexes.
All clients use the same launch command - npx -y @uindow/cli mcp - only the file location and the wrapping key differ.
Edit claude_desktop_config.json (Settings → Developer → Edit Config):
{
"mcpServers": {
"uindow": {
"command": "npx",
"args": ["-y", "@uindow/cli", "mcp"]
}
}
}Restart Claude Desktop. The Uindow tools appear under the tools (🔌) menu.
claude mcp add uindow -- npx -y @uindow/cli mcpEdit ~/.cursor/mcp.json (global) or .cursor/mcp.json (per project) - same shape as Claude Desktop:
{
"mcpServers": {
"uindow": {
"command": "npx",
"args": ["-y", "@uindow/cli", "mcp"]
}
}
}Create .vscode/mcp.json in your workspace (or run MCP: Open User Configuration for a global setup). Note the root key here is servers, not mcpServers:
{
"servers": {
"uindow": {
"command": "npx",
"args": ["-y", "@uindow/cli", "mcp"]
}
}
}Any client that speaks MCP over stdio works. Point it at the command npx with arguments -y @uindow/cli mcp.
You can run Uindow from any CI/CD pipeline or command-line interface.
npx -y @uindow/cli --helpAlternatively, you can use node dist/bin.js --help instead of npx @uindow/cli --help for a faster response.
USAGE
$ npx @uindow/cli <command> [options]
AVAILABLE COMMANDS
$ npx @uindow/cli mcp Run MCP server
$ npx @uindow/cli app:docs Fetch SDK documentation
$ npx @uindow/cli app:start Start application
$ npx @uindow/cli app:stop Stop application
$ npx @uindow/cli app:status Check application status
$ npx @uindow/cli list List agents
$ npx @uindow/cli create Create agent
$ npx @uindow/cli update Update agent
$ npx @uindow/cli delete Delete agent
$ npx @uindow/cli start Start agent
$ npx @uindow/cli stop Stop agent
$ npx @uindow/cli status Check agent status
$ npx @uindow/cli execute Execute code in agent
$ npx @uindow/cli logs Fetch agent logs
OPTIONS
--help Help menu for a specific command
--version Package versionAll commands that specify the @return tag in their description return valid JSON-formatted values.
Most people never open the SDK. There are three ways to build a module - reach for them in this order:
browser exactly as you normally would: point, click, scroll, upload and download files. The recorder turns your actions into JavaScript for you - deterministically, without any AI, and instantly. What you see is what you get.
your local AI agent over MCP and have it author the module on your behalf. Describe the outcome and let it produce the code for you. You're always in control of your automations, and you can use the included IDE to debug your code.
short, go straight to the source:
code hints, formatting and linting
For most people the learning curve is zero - the recorder is all you'll ever touch. And if you decide to go pro, it stays shallow: the SDK is there when you want it, not before.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.