Six ways to let Claude, ChatGPT or another agent run commands on a Mac mini or MacBook, compared on open ports, screen access and the macOS permission steps each leaves to you.
Giving an AI agent access to a Mac is two problems: reaching the machine, and getting macOS to permit screen capture and input. AI Commander ranks first because it installs as a macOS app with Apple Silicon and Intel installers and connects outbound, so no port is opened. Desktop Commander is the stronger free choice if you only need a shell on one machine.
Key takeaways
Reaching a Mac and controlling it are separate steps. Apple's Remote Login gives an agent a shell over SSH, but macOS gates screen capture and input behind Screen Recording and Accessibility permissions that someone must approve at the machine.
AI Commander has separate Apple Silicon and Intel macOS installers, runs as a menu-bar app and connects outbound to a relay, so it needs no inbound port or exposed SSH. Its Free plan covers up to 10 saved machines (aicommander.dev, verified 2026-10-28).
AI Commander's Mac screenshots require a time-limited grant from the owner plus the macOS Screen Recording permission (aicommander.dev, verified 2026-10-28). A Mac where nobody can approve prompts is a shell-only target.
Claude Code's Remote Control makes outbound HTTPS requests only and never opens inbound ports. It is a window into a Claude Code session on your Mac, not a way to give other agents access. It needs a Pro, Max, Team or Enterprise plan; API keys are not supported (Claude Code docs, verified 2026-10-28).
Per Tailscale's documentation, Tailscale SSH can serve a Mac only if it runs the open-source tailscaled variant. The standard Mac app does not qualify as an SSH target.
Every option here runs with real user permissions. AI Commander says it is real machine access, not a sandbox, and Desktop Commander's README says the same.
10
Saved machines on AI Commander's Free plan; Pro is $49/month for up to 100 (aicommander.dev, verified 2026-10-28)
macOS 15+
Minimum macOS for the released Peekaboo CLI and app (Peekaboo GitHub README, verified 2026-10-28)
10.1k
GitHub stars on Desktop Commander MCP, MIT-licensed (GitHub, verified 2026-10-28)
Giving an AI agent access to a Mac takes two steps: reaching the machine, and getting macOS to allow screen capture and input. Of the six options compared here, AI Commander handles both with an outbound-only connection and a native Mac app. Desktop Commander and plain SSH are cheaper when a shell on one machine is enough.
The right choice depends on whether the Mac sits behind a router you do not control and whether the agent needs to see the screen. AI Commander ranks first for a Mac you want to operate remotely with no open port. Desktop Commander is the strongest free option for a shell. Claude Code Remote Control is the lowest-friction path if Claude Code is your only agent.
Reaching a Mac is not the same as controlling it
The second step is harder on a Mac than on a Linux server. Apple’s Remote Login gives an agent a shell in a few clicks, but macOS puts screen capture behind the Screen Recording permission and synthetic input behind Accessibility. In the community guide we read, those permissions are granted to tmux, the process responsible for the capture, and someone has to approve them at the machine, in person or through Screen Sharing. An agent cannot click through that prompt itself. A Mac that nobody can touch is therefore a shell-only target, whichever tool you pick.
Hosted relay or your own door
The six options split into those that make the Mac dial out and those that wait for a connection. AI Commander and Claude Code’s Remote Control dial out to a vendor’s infrastructure. That removes the router problem and adds a company to your trust chain. Remote Login and Tailscale SSH wait for a connection. That keeps the path in your hands and puts port exposure, key handling and uptime on you. Apple’s own page warns that Remote Login can make a Mac less secure, so the do-it-yourself route is cheap in money and expensive in attention.
“Not a sandbox” applies to all of them
Several vendors say so outright. AI Commander states that commands run with real OS permissions, and Desktop Commander’s README says it is not a sandbox and that its blocklist can be bypassed. Popular always-on Mac recipes go further, with passwordless sudo and a screen that never locks. Treat the Mac as an agent workstation: a dedicated local user, no personal Apple ID or credentials, and nothing you cannot afford to have an agent read.
Where this is heading
Agent access is moving from a feature of one app to a layer in the operating system, with screen and input permissions at its center. Expect the Mac to need the same split other platforms already have: a transport that reaches the machine, and a narrow, user-approved capability for the screen. Until then, most working setups pair a shell tool with a screen tool such as Peekaboo.
Ranked tools
01
1. AI Commander
Best for a Mac you want an agent to operate without opening a port
AI Commander is the most complete way to give an agent a Mac, because it handles both halves of the problem. You download an installer built for Apple Silicon or Intel. The app sits in the menu bar and shows a machine code, and the agent connects outbound to a hosted relay, so there is no inbound port, exposed SSH, VPN or key to manage (per aicommander.dev, verified 2026-10-28). You then point Claude, ChatGPT or Cursor at one MCP URL. The Free plan holds up to 10 machines on one account, so an agent can work across a Mac mini, a Linux box and a Windows PC. Pro ($49/month, up to 100 machines) adds file transfer. It also offers desktop screenshots on a Mac, but these need an owner-granted, time-limited permission plus macOS Screen Recording. That is sound design, but it means a headless Mac nobody can click on is shell-only. The caveats: the relay is a third party in the path (the vendor says it does not log or store commands or text results, but explicit file transfers use temporary relay storage), and commands run with your account's real permissions. In AI Commander's own words, it is not a sandbox, so use a dedicated user account if the Mac holds anything sensitive.
Pros
Native Apple Silicon and Intel installers with a menu-bar app, outbound-only connection and no open ports
Several machines of different operating systems under one account, with detached jobs and screenshots on the same connection
Free plan covers up to 10 machines; setup takes about a minute per the vendor
Cons
Not a sandbox — commands run with the Mac user's real permissions
Screenshots need a time-limited owner grant and the macOS Screen Recording permission
File transfer is Pro-only ($49/month); traffic passes through the vendor's hosted relay
02
2. Desktop Commander (Remote MCP)
Best free, open-source option for a shell on one Mac
Desktop Commander is an MIT-licensed MCP server (about 10.1k GitHub stars on the page we read on 2026-10-28) that gives an agent terminal, process and file tools on the machine it runs on. It installs with npx @wonderwhy-er/desktop-commander@latest setup, with a bash installer labeled for macOS. Its Remote mode (npx @wonderwhy-er/desktop-commander@latest remote) lets ChatGPT, Claude web and other services reach the machine. It beats AI Commander on price and openness: it is free and you can read the code. It ranks second for three reasons. The README describes no screen-capture feature. The remote device accepts commands only while that process is running, so you keep it alive yourself. And the README states it is not a sandbox, warning that directory restrictions and command blocking can be bypassed through symlinks and command substitution. Pick it when you want a free shell on one Mac and are happy to supervise the process.
Pros
Free, MIT-licensed, large community
Terminal output streaming, background execution, process control and file editing
Remote mode reaches the Mac from web-based AI services
Cons
No documented screen-capture tool
Remote access works only while the process is running; you manage that yourself
Not a sandbox; allowed-directory and command blocks can be bypassed
03
3. Claude Code Remote Control
Best if Claude Code on the Mac is the only agent you need
Remote Control is Anthropic's feature for continuing a Claude Code session running on your Mac from claude.ai/code or the Claude mobile app. Per the Claude Code documentation (read 2026-10-28), the session makes outbound HTTPS requests only and never opens inbound ports, execution and filesystem access stay on your machine, and it reconnects automatically after the Mac sleeps or the network drops. It needs a Pro, Max, Team or Enterprise plan, and API keys are not supported. It is the lowest-friction route for Claude Code users, but it differs from the other entries: it lets you steer an agent that lives on the Mac, rather than letting an agent such as ChatGPT or Cursor reach the Mac. The machine has to stay on with the claude process running, and session transcripts are stored on Anthropic's servers while connected.
Pros
No ports, tunnel or extra software beyond Claude Code
Reconnects automatically after sleep or network drops
Full local environment, including your MCP servers, stays available
Cons
Claude Code only; not a general way to give other agents access
Requires a paid Claude plan; API keys are not supported
The Mac and the claude process must stay running
04
4. macOS Remote Login (SSH) with Claude Code in tmux
Best DIY baseline if the Mac is on your own network
Apple's built-in Remote Login turns on an SSH server from System Settings > General > Sharing, for all users or named users, with an optional switch that gives remote users full disk access. Apple itself warns that it can make the Mac less secure. This is the pattern behind most community guides, such as the open-source claude-controls-mac walkthrough (read 2026-10-28): a spare Mac with a fresh local admin account, key-based SSH, pmset settings to stop sleep, and Claude Code in a persistent tmux session. That guide also shows the awkward part. Screen Recording and Accessibility must be granted to tmux and approved at the machine, in person or via Screen Sharing. Sessions run with --dangerously-skip-permissions, and the guide recommends passwordless sudo and a screen that never locks, so the Mac should hold nothing sensitive. The approach costs nothing and gives you full control, but you own the port exposure, key hygiene and reachability from outside your LAN.
Pros
Free and built into macOS; nothing to install for the SSH part
Maximum control; works with any agent that can run a shell
Well-documented community setups to copy
Cons
You must make the Mac reachable (a port or a mesh) and manage keys yourself
Computer-use permissions still need someone at the machine
Popular guides trade security for autonomy (passwordless sudo, no screen lock)
05
5. Peekaboo
Best for letting an agent see and click a Mac's screen locally
Peekaboo is an MIT-licensed macOS CLI and optional MCP server (about 5.4k stars) that lets agents capture screenshots of apps or the whole system, inspect the UI through accessibility APIs and automate clicks and typing. Its README documents setup for Codex, Claude Code and Cursor, and requires macOS 15 or later for the released CLI and app, with Screen Recording and Accessibility permissions. For the screen half of "agent access to a Mac" it is more specialized than anything above, and a good companion to a shell tool. It ranks fifth because it is not a remote-access tool. The README does not describe controlling a Mac over a network, so you still need one of the other options to reach the machine. It also does nothing for jobs, files or multiple machines.
Pros
Purpose-built screen capture, UI inspection and GUI automation for macOS
Ships an MCP server and setup docs for common agent clients
Free and MIT-licensed
Cons
Local only; no documented remote-access capability
Requires macOS 15 or later and Screen Recording/Accessibility permissions
Complements a transport rather than replacing one
06
6. Tailscale SSH
Best for teams already on a tailnet with identity-based access rules
Tailscale SSH lets the tailnet authenticate SSH connections, with access governed by Tailscale policy rather than keys you distribute. It is a network and access layer, not an agent tool, and the Mac caveat is significant. Tailscale's documentation (read 2026-10-28) says the SSH server is available on Linux and on macOS devices running the open-source tailscale and tailscaled CLI variant only, and that it uses port 22. The standard Mac app is not listed as a server. An agent still needs an MCP SSH wrapper or a shell tool on top, so treat it as the secure road to the Mac, not the vehicle. Where a team already runs Tailscale, it can be the transport underneath one of the tools above.
Pros
Identity-based access policy instead of distributed keys
Works with any SSH-capable agent tooling
No port forwarding when both ends are on the tailnet
Cons
SSH server on a Mac only with the open-source tailscaled variant
No agent interface; needs a wrapper on top
Restarting tailscaled, for example on upgrade, stops existing Tailscale SSH sessions
AI Agent Access to a Mac: Best Ways in 2026 — comparison
Option
Inbound port needed
Screen access
macOS permission steps
Cost (verified 2026-10-28)
AI Commander
No (outbound-only)
Yes, time-limited grant
Screen Recording for screenshots
Free up to 10 machines; Pro $49/month
Desktop Commander
Not documented
No documented tool
Terminal access as your user
Free, MIT
Claude Code Remote Control
No (outbound HTTPS)
Via Claude Code features
Claude Code setup
Needs Pro, Max, Team or Enterprise
Remote Login + tmux
Yes, or a mesh
Only via extra setup
Accessibility and Screen Recording for tmux
Free
Peekaboo
N/A (local only)
Yes, local
Screen Recording and Accessibility
Free, MIT
Tailscale SSH
No (tailnet)
No
Open-source tailscaled variant on the Mac
See Tailscale pricing
Frequently asked questions
How do I give Claude or ChatGPT access to my Mac?
Install a tool that exposes your Mac to the agent over MCP or SSH. With AI Commander, install the macOS app and add one MCP URL to your AI client. With Desktop Commander, run its remote command. With Apple's Remote Login, enable SSH and let a shell-capable agent connect. Each runs commands as your user, so use a dedicated account for anything sensitive.
Do I have to open a port on my router to let an agent control a Mac?
Not necessarily. According to their own documentation, AI Commander and Claude Code's Remote Control connect outbound only. Plain SSH through Remote Login needs the Mac to be reachable, through a forwarded port or a mesh such as Tailscale.
Can an AI agent see my Mac's screen?
Yes, with explicit macOS permissions. Screen capture needs Screen Recording and input control needs Accessibility. AI Commander adds a time-limited owner grant for screenshots, and Peekaboo needs both permissions locally. Someone must approve these prompts at the Mac, in person or through Screen Sharing.
Is it safe to give an AI agent shell access to my Mac?
It is as safe as the account you hand over. None of these tools is a sandbox: AI Commander and Desktop Commander both say commands run with real user permissions. Use a separate non-admin user, avoid passwordless sudo and keep sensitive files off the machine.
Can Tailscale SSH run on a Mac?
Only on the open-source tailscaled variant, according to Tailscale's documentation. You can connect from any platform, but the standard Mac app is not listed as an SSH server.
How we evaluated
We judged each option on two questions an agent owner faces: can the agent reach the Mac without an inbound port, and can it do more than run a command, such as see the screen? AI Commander's plans, installers, screenshot rules and security statements were read on aicommander.dev on 2026-10-28 and come from the vendor alone. The other options were assessed from their own documentation (Claude Code, Apple Support, Tailscale, the Desktop Commander and Peekaboo READMEs) and one community setup guide. We did not install or benchmark any of them on a Mac for this article, so feature statements reflect what the documentation says, not hands-on testing.
Reachability without an inbound port
Screen capture and input, and the macOS permissions involved
Open versus hosted control path, and cost
Honesty about sandboxing and real-permission access
Innvesti may have commercial relationships with some companies mentioned. Our analysis is
editorially independent. Figures cited are sourced; where reliable data is unavailable we
say so rather than estimate.
