github Rust analyzed · update queued e1c57f6

bigduu/Nova

github

Give an LLM agent control of the macOS desktop — a single self-contained Rust binary (no Python/JS stack) that speaks MCP: screenshots, Set-of-Mark targeting, Apple Vision OCR, mouse & keyboard.

maintainer
bigduu
license
MIT
first seen
2026-06-10
last seen
2026-07-25
releases · 30d
0
short id

Drift inferred · capture-to-capture

tool count over time

06-11 06:12 now
5t
9t
capabilities 9 tools
transport stdio · http counts 9 tools · 0 res · 0 prompts permission surface via README inference

tools

  • ax_activate

    Activate an exact actionable node from a fresh ax_read; rejects stale snapshot IDs and reports route=ax\

  • ax_read

    Canonical ax:read: read semantic labels, text, values, roles, actions, state, and optional bounds through macOS Accessibility or Windows UIA, without a screenshot. Returns an ephemeral snapshot/node p

  • batch_actions

    Run a sequence of input actions in one call.

  • click_mark

    Compatibility action for the latest numbered mark; prefer generation-safe ax_activate.

  • ocr

    Recognize on-screen text via Apple Vision (on-device, no model files). Returns each text line with a clickable center — read *and* click text on canvas/Electron/game surfaces where marks are empty. CJ

  • read_ui

    Compatibility alias backed by the same ax_read traversal and cache generation.

  • screenshot

    Capture the whole display or a single window= — use for layout, icons, colors, images, canvas, and visual verification after semantic/OCR paths.

  • wait

    Pause for a specified number of seconds.

  • zoom_region

    Magnify a rectangle of the last screenshot at native resolution — reads small targets on surfaces with no Accessibility tree.

skills & danger signals github-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit e1c57f6 · analyzer v28 · 1w ago

skills & prompt files 1

code evidence vv0.2.1 · github-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 72

filesystem 2

  • fs bigduu-Nova-e1c57f6/npm/bin/nova.js :11 const fs = require("fs");
  • fs bigduu-Nova-e1c57f6/npm/install.js :14 const fs = require("fs");

shell / exec 2

  • shell bigduu-Nova-e1c57f6/npm/bin/nova.js :14 const { spawnSync, execFileSync } = require("child_process");
  • shell bigduu-Nova-e1c57f6/npm/install.js :20 const { execFileSync } = require("child_process");

network 1

  • net bigduu-Nova-e1c57f6/npm/install.js :17 const https = require("https");

install hooks 1

  • postinstall bigduu-Nova-e1c57f6/npm/package.json :23 node install.js

declared dependencies 15

  • rmcp@1.7
  • axum@0.8
  • tokio-util@0.7
  • tokio@1
  • image@0.25
  • base64@0.22
  • serde@1
  • serde_json@1
  • schemars@1
  • libc@0.2
  • thiserror@2
  • tracing@0.1
  • tracing-subscriber@0.3
  • clap@4
  • anyhow@1