Linux MCP Server
Enables AI-driven control of Linux desktop environments, allowing for file system management, application launching, clipboard interaction, and system notification handling.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@Linux MCP ServerList the files in my Documents folder and read the contents of notes.txt"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Linux MCP Server
AI-driven Linux desktop control via Model Context Protocol.
Overview
Linux MCP Server exposes Linux desktop operations (file management, app control, clipboard, notifications) as MCP tools. AI assistants can use these tools to perform actions on behalf of the user.
Related MCP server: D-Bus MCP Server
Architecture
AI Assistant (Claude, Ollama, etc.)
│
│ MCP (HTTP+SSE)
▼
Linux MCP Server (Python)
│
├── Safety Layer (Safe/Elevated/Blocked permissions)
│
└── Tools: file_read, app_launch, clipboard, notificationsSecurity Model
Level | Description | Example |
SAFE | No confirmation needed | Read files, launch apps, clipboard |
ELEVATED | Requires user confirmation | Write files, run shell commands |
BLOCKED | Never allowed | sudo, kernel access |
All AI-initiated actions are logged to an audit trail.
Quick Start
Installation
pip install linux-mcpRun
# Set compositor auth key (optional but recommended)
export LINUX_MCP_COMPOSITOR_KEY="your-secret-key"
# Start the MCP server
linux-mcpConnect to Claude Desktop
Add to ~/.claude-desktop-config.json:
{
"mcpServers": {
"linux-desktop": {
"command": "uvx",
"args": ["linux-mcp"],
"env": {
"LINUX_MCP_COMPOSITOR_KEY": "your-secret-key"
}
}
}
}Available Tools
File Operations
file_read- Read file contentsfile_list- List directoryfile_write(ELEVATED) - Write files
App Control
app_launch- Launch applications
System
clipboard_read- Read clipboardnotification_send- Send notificationssettings_get/settings_set- System settings
Development
# Clone and install
git clone https://github.com/YOUR_USER/linux-mcp.git
cd linux-mcp
pip install -e ".[dev]"
# Run tests
pytest tests/ -v
# Run in dev mode
python -m linux_mcpLicense
MIT
Available Tools
6 toolsapp_launchC
Launch a desktop application by name
| Name | Required | Description | Default |
|---|---|---|---|
| app_name | Yes | Application name (e.g., 'firefox', 'gnome-terminal') |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description carries full burden. States only the action intent without disclosing execution semantics (async vs sync, error behavior, window management, or privilege requirements).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Extremely terse at 6 words. Front-loaded with action verb. Efficient but arguably too lean given the lack of annotations and behavioral disclosure.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Minimal viable documentation for a single-parameter tool. Lacks coverage of execution side effects and error states that would be expected given zero annotation coverage and no output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with the parameter fully described via examples. Description adds no additional parameter context beyond what the schema provides, which warrants the baseline score.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clear specific verb ('Launch') and resource ('desktop application'), with mechanism clarification ('by name'). Distinguishes implicitly from sibling file/clipboard/notification tools, though lacks explicit differentiation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use versus alternatives, error handling, or prerequisites. Fails to mention that the application must be installed/available or what happens if the name is invalid.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
clipboard_readB
Read current clipboard contents
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden but fails to disclose return format (text/binary/object), error conditions (empty clipboard), or permission requirements.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence with no extraneous text. Appropriate length for a simple parameterless tool—every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Adequate for basic identification but incomplete regarding output format. Without an output schema, the description should indicate what data structure or type is returned (string, object, etc.).
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Zero-parameter tool with 100% schema coverage (empty object). Baseline score applies as the description correctly implies no arguments are needed.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb (read) and resource (clipboard contents), distinguishing it from sibling file_read and app_launch tools. However, 'contents' is vague regarding data type/format returned.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance provided on when to use this versus alternatives (e.g., when clipboard contains a file path vs using file_read directly) or prerequisites like clipboard permissions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
file_listC
List directory contents
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Directory path |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full disclosure burden but reveals nothing about behavioral traits: output format (array of strings vs objects?), error conditions (permission denied, path not found), or whether the operation is read-only.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Extremely brief (3 words) and front-loaded with the verb. However, brevity crosses into under-specification—lacking the substance needed to distinguish from siblings or explain behavior, which costs points in a completeness context.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 1-parameter tool with no output schema and zero annotations, the description is insufficient. It omits critical context like return value structure, pagination for large directories, or symlink handling that an agent needs to invoke and process results correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% ('path' is well-described as 'Directory path'), establishing a baseline of 3. The description adds no additional parameter context (e.g., whether absolute or relative paths are preferred), but is not required to given complete schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'List directory contents' is minimal and approaches tautology, restating the tool name 'file_list' with slight expansion. It fails to specify scope (e.g., recursive vs. shallow, hidden files) or clearly differentiate from sibling 'file_read' (which reads file contents vs. listing them).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance provided on when to use this tool versus alternatives like 'file_read'. Does not mention prerequisites like path existence or permissions needed to list the directory.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
file_readB
Read contents of a file
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Absolute path to file |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description carries full burden. 'Read contents' implies a safe read operation but discloses nothing about encoding handling, binary vs. text modes, size limits, file locking, or error behaviors (404, permission denied).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Extremely concise at 4 words. Front-loaded with action first. No filler or redundant text. Every word earns its place despite minimal information content.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given single parameter with 100% schema coverage, description is minimally adequate for invocation. However, lacks critical context due to missing output schema: does not indicate return format (string, bytes, object) or content size limitations, which are essential for a read operation tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema has 100% description coverage ('Absolute path to file'), so baseline is 3. The description adds no additional parameter semantics beyond what the schema already provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States specific verb 'Read' and resource 'contents of a file', making the basic purpose clear. However, it does not differentiate from sibling clipboard_read (both read) or file_list (both file operations), though the distinction is inferable from the tool names.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides no guidance on when to use this vs. file_list (directory listing vs. content reading), vs. clipboard_read, or error conditions (permissions, missing files). No prerequisites or alternatives mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
file_writeC
Write content to a file
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Absolute path | |
| content | Yes | File content |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description carries full disclosure burden. 'Write' implies mutation but fails to specify destructive traits: overwrite behavior, directory auto-creation, encoding, or atomicity. Critical gaps for a file mutation tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence of four words is front-loaded and efficient, but borders on under-specification given the tool's destructive potential and lack of annotations. Appropriately concise structure, yet insufficiently sized for the complexity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Mutation tool with no annotations, no output schema, and undocumented behavioral edge cases (existing files, permissions). Description inadequate for safe agent operation; missing safety-critical context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with clear descriptions ('Absolute path', 'File content'). Description adds no semantic detail beyond schema baseline, but schema adequately covers both required parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States the verb (write) and resource (file) but provides minimal elaboration beyond the tool name 'file_write'. Does not differentiate from sibling 'file_read' or clarify write semantics (create vs overwrite).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Contains no guidance on when to use this tool versus siblings like 'file_read', or prerequisites like directory existence. No mention of overwrite behavior or error conditions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
notification_sendC
Send a desktop notification
| Name | Required | Description | Default |
|---|---|---|---|
| title | Yes | ||
| body | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotationsprovided, so description carries full burden. Fails to disclose whether this blocks execution, requires specific OS permissions, handles display duration, or returns success/failure indicators.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Extremely efficient at four words with no redundancy. Front-loaded with the action verb. However, excessive brevity given the lack of schema documentation and annotations leaves it underspecified.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Inadequate for a tool with zero schema descriptions and no annotations. Missing critical context: error conditions, display behavior, permission requirements, and parameter details needed for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema has 0% description coverage, requiring the description to compensate. Description omits semantics for 'title' and 'body' parameters (length limits, formatting support, required vs optional nature) despite being able to infer basic purpose from the tool name.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clear verb+resource ('Send a desktop notification') that distinguishes from file and clipboard siblings. However, lacks specificity about the notification mechanism (OS native vs in-app) or target user.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use versus alternatives (e.g., when to send a notification vs writing to a log file), prerequisites, or conditions where notifications might fail (permissions disabled, DND mode).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
6 tool updates
v0.1.0- First observed
app_launch - First observed
clipboard_read - First observed
file_list - First observed
file_read - First observed
file_write - First observed
notification_send
TDQS
Each tool has a clearly distinct purpose with no overlap: launching apps, reading clipboard, listing files, reading files, writing files, and sending notifications. An agent can easily distinguish between these functions without confusion.
All tool names follow a consistent snake_case pattern with clear verb_noun structure (e.g., app_launch, file_read, notification_send). There are no deviations in naming conventions across the set.
With 6 tools, this server is well-scoped for Linux desktop automation, covering key operations like file management, app launching, clipboard access, and notifications. Each tool earns its place without being excessive or insufficient.
The toolset covers core Linux desktop workflows effectively, including file operations, app interaction, and notifications. A minor gap exists in file management (e.g., no delete or move operations), but agents can work around this with the provided tools.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
Operate Linux, macOS and Windows from your LLM. Every action runs through an auditable allowlist.
Runtime permission, approval, and audit layer for AI agent tool execution.
Shared control plane for AI coding agents — tasks, memory, decisions, file locks. 12 tools.
Git-backed platform for skills, tools, and context for AI agents
Related MCP Servers
- AlicenseNot gradedqualityCmaintenanceEnables AI assistants to interact with native Linux desktop applications through AT-SPI2 accessibility interfaces. Provides semantic element targeting, natural language search, and automation capabilities (clicking, typing, keyboard shortcuts) across GTK, Qt, and Electron applications.6MIT
- AlicenseNot gradedqualityDmaintenanceBridges AI assistants to Linux D-Bus for system interaction, enabling clipboard, notifications, screenshots, and service discovery with configurable security levels.4MIT
- AlicenseNot gradedqualityCmaintenanceEnables AI agents to control Linux/X11 desktops by providing tools for taking screenshots, clicking, typing, and managing windows via AT-SPI and xdotool.3MIT
- AlicenseNot gradedqualityDmaintenanceEnables full Linux desktop control including windows, mouse, keyboard, clipboard, audio, screenshots, OCR, accessibility, and system management through MCP-compatible AI agents.1MIT
Appeared in Searches
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/Ronnietag/linux-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server