No glue code
Agents don’t screen-scrape a VM app or juggle shell scripts. They call create_vm, capture_screen, send_input, and run_in_guest directly against the component that owns the machines.
MCP in the hypervisor
Built in at the core, not bolted on.
SlateVM’s Model Context Protocol server lives inside the layer that owns the virtual machines. An AI agent gets the same authority as the person at the keyboard — and the same 46 tools on Mac, Windows, and Linux.
Why the hypervisor layer?
Real state
Answers come from the live VM lifecycle, not from guesses: running, installing, suspended, stopped — the same truth the app shows.
Long-running work
Slow operations return a job you can wait on, so an agent can create a VM, install an OS, and keep working without timeouts.
One contract
Identical on every host operating system.
Tool names, input schemas, results, and error codes are the same on a Mac, a Windows PC, and a Linux machine. When a host can’t do something — macOS guests outside a Mac, for example — the tool answers with a clear, documented error instead of a different API.
flowchart LR A["Your agent"] --> T["46 MCP tools"] T --> M["SlateVM on Mac"] T --> W["SlateVM on Windows"] T --> L["SlateVM on Linux"]
The loop
Observe → act → verify.
Observe
capture_screen and read_console_text show the guest exactly as it is; get_vm and wait_for_state report live state.
Act
send_input types, clicks, and drags; run_in_guest executes commands inside the guest; set_hardware and the network tools reshape the machine.
Verify
wait_for_text and a fresh capture confirm the result before the agent reports back or hands the machine to you.
Safety
Local, consented, scoped.
The MCP server listens only on your machine. Each AI client must be approved once in SlateVM before it can act, and you can reset approvals at any time. Quitting SlateVM ends all AI access.