UIInspect.MCP.Server 0.2.0

UIInspect MCP Server

UIInspect.MCP.Server is a consent-gated NuGet MCP server that gives AI agents semantic access to Windows applications through UI Automation 3 (UIA3). It discovers accessible application windows, returns bounded control trees, and performs deterministic actions against opaque element references instead of relying on screenshots or pixel coordinates.

The package runs as a local stdio server on .NET 10. WPF and WinForms are directly tested. Standard controls in WinUI, Avalonia, and .NET MAUI Windows applications may be reachable when they expose UI Automation providers, but those frameworks are not yet compatibility-certified.

Quick Install

Once the package is available on NuGet.org, click to install it in your preferred environment:

Note:

• These install links use the NuGet package identity UIInspect.MCP.Server and select the latest 0.* prerelease.
• The selected package must be available on NuGet.org. For an unpublished local build, expose the package directory as a NuGet feed and add --source <feed-path> to the dnx arguments.
• UIInspect is Windows-only and requires an interactive desktop.

Manual MCP configuration using NuGet:

{
  "mcpServers": {
    "uiinspect-mcp": {
      "type": "stdio",
      "command": "dnx",
      "args": [
        "UIInspect.MCP.Server@0.*",
        "--prerelease",
        "--yes"
      ]
    }
  }
}

Some clients use servers instead of mcpServers; only the outer property name changes.

The package build synchronizes this command to its exact version:

dnx UIInspect.MCP.Server@0.2.0 --yes

Requirements

• Windows 10 or Windows 11 with an interactive desktop.
• A .NET 10 SDK that provides dnx.
• UIInspect must run in the same Windows logon session as the target application.
• UIInspect must run at a sufficient integrity level for the target. A non-elevated server cannot automate an elevated application.

The MCP protocol owns stdout; server diagnostics are written to stderr.

What the package provides

• Top-level window discovery with process-instance identity and native window handles.
• A trusted, server-owned Windows approval dialog for each target process instance.
• Attach by process ID with an optional native window handle.
• Bounded, flattened UI Automation control-tree snapshots.
• Opaque, generation-scoped element references with explanatory semantic paths.
• Invoke, resolved click, ValuePattern set, SelectionItemPattern select, expand/collapse, and allowlisted logical-key actions.
• Password-element redaction and no control-value collection during inspection.
• Consent bound to the local stdio server principal, expiry and PID-reuse checks, rate limits, application-level append-only redacted JSONL auditing, and deterministic session cleanup.

The current package deliberately does not provide XAML source or visual trees, dependency properties, bindings, validation, DataContext or command diagnostics, hot reload, screenshots, OCR, overlays, recording/replay, arbitrary reflection, shell execution, generic property writes, or TCP transport.

Consent and security

UIInspect never treats an MCP request as user approval. The local user must approve the exact process instance and requested capabilities in a trusted Windows dialog before the server attaches.

Inspection, interaction, and keyboard access are separate capabilities. Request only the minimum needed for the task. Grants are short-lived and bound to the local stdio server principal, exact process identity, Windows session, and approved capabilities. Tool parameters cannot supply or override that principal.

Successful actions invalidate all current element references. Re-inspect before the next action so the server can semantically resolve the current UI rather than act on stale coordinates.

The default audit file is:

%LOCALAPPDATA%\UIInspect.MCP\audit\actions.jsonl

Set UIINSPECT_AUDIT_PATH for the MCP server process to use another location. Audit records exclude entered values, password content, clipboard data, screenshots, raw provider exceptions, and all keystrokes except the allowlisted logical key name. Appends are enforced at the application level; protect the audit directory with an ACL that grants access only to the server account and administrators.

See the complete security model for consent scopes, rate limits, audit contents, integrity boundaries, and the threat model.

MCP tools

Recommended workflow

1. Call uiinspect_discover_windows.
2. Identify the intended process and window using independently known application context.
3. Call uiinspect_request_consent with the minimum capabilities. The local user must approve the exact process instance.
4. Call uiinspect_attach.
5. Call uiinspect_inspect_tree with the smallest useful depth and node budget.
6. Select an element using its automation ID, control type, accessible name, patterns, and semantic path.
7. Prefer uiinspect_invoke, uiinspect_set_value (or its uiinspect_set_text alias), uiinspect_select_item, or uiinspect_expand_collapse. Use uiinspect_click only when the provider does not expose InvokePattern, and use uiinspect_send_key only when keyboard consent was granted.
8. Re-inspect after every successful action to obtain fresh element references.
9. Call uiinspect_close_session.

Treat pattern_not_supported, stale_element, target_changed, and consent_expired as safe terminal results for that attempt. Re-inspect or request fresh consent as indicated; do not fall back to blind input.

Package contents

The NuGet package contains:

• The uiinspect-mcp .NET tool and its runtime dependencies.
• .mcp/server.json MCP registry metadata.
• skills/uiinspect/SKILL.md with the safe agent workflow.
• This README and the detailed MVP behavior and boundaries.

The package uses ModelContextProtocol 1.4.1 and FlaUI 5.0 with UIA3.