# Cua Spaces

> Source: https://aiwiki.ai/wiki/cua_spaces
> Updated: 2026-10-21
> Categories: AI Agents, AI Tools & Products, Developer Tools
> License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) - attribute to "AI Wiki (aiwiki.ai)"
> Cite as: AI Wiki. "Cua Spaces." aiwiki.ai, 21 Oct 2026. https://aiwiki.ai/wiki/cua_spaces
> From AI Wiki (https://aiwiki.ai), the free encyclopedia of artificial intelligence. Reuse freely with attribution.

Cua Spaces is a desktop application and software interface for giving [AI agents](https://aiwiki.ai/wiki/ai_agents) access to computers supplied by their operator. A Space can be a virtual machine, a container or an existing computer's desktop. People can watch the desktop, intervene in an agent's work and share access. Cua supplies the management software and an optional connection relay, rather than renting the computers.[1][2]

The product is part of the `trycua/cua` project, alongside Cua Driver, Lume and Cua Bench. These components have different roles and licenses. Cua Spaces itself is source-available under FSL-1.1-MIT; it should not be described as an entirely MIT-licensed product.[3][4]

## Components and scope

| Component | Role | Licensing distinction |
| --- | --- | --- |
| Cua Spaces app | Desktop interface for Spaces, streams, sharing and agent workflows | FSL-1.1-MIT |
| `cua-spacesd` | Service on the destination computer for processes, files, desktop access and related features | FSL-1.1-MIT |
| Generic Cua SDK and CLI | Client-side orchestration and interfaces for sandboxes and Spaces | MIT; individual features can require a Spaces service or extension |
| Cua Driver | Tools for inspecting and operating applications and browsers | MIT core; optional components have their own terms |
| Lume | Local macOS and Linux virtual machines on Apple Silicon | MIT |
| Cua Bench | Task and evaluation tooling for computer-use agents | MIT; the separately named Cua Driver Bench is FSL-1.1-MIT |

The repository's licensing inventory identifies the Spaces app bundles, their bundled Spaces-specific CLI build, Keyvault, Teleport, Volume and media implementations as FSL components. The generic SDK's MIT license does not relicense these implementations. Under the FSL terms, permitted uses include internal use, while competing commercial products or services are restricted. Each software version gains an additional MIT license on the second anniversary of its availability.[3][4]

## Computers and deployment

Spaces supports several arrangements. The distinction concerns both who runs the machine and how the client reaches it.[2][5]

| Arrangement | Computer and connection |
| --- | --- |
| Local | A container or VM runs on the current computer |
| Direct | An already-running destination is registered by address and token, including addresses reachable through a private network |
| Another owned computer | An enrolled Mac, Linux machine or Windows PC supplies access through the relay or a direct connection |
| Operator's cloud account | AWS EC2, Google Cloud Compute Engine or Modal provides the compute, billed to that account |

Local operation does not require a Cua account. Direct connections also avoid the hosted relay. Relay hosting uses an outbound connection, so the computer need not expose an inbound port. A host registered through account-based setup keeps its machine-specific token rather than an account credential that can administer every other computer.[2][5]

The installation guide lists macOS 26 or later, Windows on x64 or Arm in preview, and Ubuntu 24.04 on x64 or arm64 as the supported Linux package. Other Linux distributions and desktops are described as untested. These are application requirements, not a claim that every guest operating system runs on every host.[6]

Local runtime selection is separate: containers use Docker or Podman, optionally with gVisor; VMs can use QEMU; macOS VMs use Lume on Apple Silicon. The runtime guide warns that cross-architecture emulation can be slow and that macOS containers are unsupported. Cloud-created resources incur provider charges even when the Cua plan is free.[7]

## Agent and developer interfaces

[Claude Code](https://aiwiki.ai/wiki/claude_code), [OpenAI Codex](https://aiwiki.ai/wiki/openai_codex), [Cursor](https://aiwiki.ai/wiki/cursor) and other supported agents connect through Cua's skills and [Model Context Protocol](https://aiwiki.ai/wiki/model_context_protocol) server. Their tools can create Spaces, execute commands, transfer files, inspect available tools and obtain desktop streams. Read-only permissions can limit an agent that only needs to inspect a Space.[8]

The SDK can use an embedded runtime or connect to a shared `cua daemon`. The app, CLI and SDK use a common local registry, so a Space created programmatically can also appear in the application. Python uses the `cua` package; TypeScript uses `@trycua/cua`, including its Spaces interfaces. The repository also contains Rust interfaces and Swift examples; the October 21, 2026 repository README marks the Swift and Kotlin bindings as not yet released.[2][9][10]

The default SDK walkthrough creates the Linux desktop image `ghcr.io/trycua/linux:24.04` in a local container. Its example runs a command, takes a screenshot and queries the guest's windows, with a container engine and about 4 GB of free memory required.[9]

Creating a sandbox does not by itself supply every desktop feature. An arbitrary image can expose declared services without `cua-spacesd`; shell, files, streaming, presence, Teleport and agent-run features depend on that service. Missing capabilities produce explicit errors. The service uses Cua Driver for input rather than implementing a separate input system.[11][12]

Agents can also run inside a Space as detached, long-lived threads. These runs can survive disconnection of the client. Their authentication is consequential: the documented start mechanism can copy the selected harness's credential file into the guest, and provider keys may be supplied to the run. A Space is therefore an environment receiving delegated authority, not simply a view-only video stream.[8]

## Desktop interaction and sharing

Spaces combines remote desktop viewing with processes, file operations and [computer use](https://aiwiki.ai/wiki/computer_use). Participants can have separate presence cursors, and a person can take over the desktop while an agent is working.[1][12]

The sharing guide distinguishes viewers from editors. Viewers can watch and participate in presence, but cannot use keyboard input, shell, files or MCP operations; editors receive those controls. The destination's `cua-spacesd` enforces the role. Removing a participant or changing a role closes existing streams. An editor can use accounts already signed in within that Space.[13]

In the sharing guide checked October 21, 2026, sharing with other people is restricted to members of the same team. The guide says earlier shares outside a team were stopped. This is more restrictive than the pricing page's Free-plan card, which still lists sharing with named people; that card alone should not be read as confirmation that an individual Free account can currently share.[13][14]

### Teleport and Keyvault

Teleport prepares supported applications inside a Space and can transfer selected files and application state. Support is application- and platform-dependent: the catalog distinguishes full support, installation only and unsupported combinations. A consent screen identifies the installations, files and state that would leave the source computer.[15]

For browsers, session cookies, saved passwords and history are separate opt-ins. Moving a signed-in session transfers authority to use the relevant accounts. It is not merely moving a browser window, and unsupported encrypted credentials are not necessarily transferable.[15]

Keyvault stores session items and saved passwords encrypted on disk. By default, use requires approval; unlocking an item or establishing an unattended rule broadens what can happen without another prompt. Site-login tools return the outcome rather than the password, but an agent can use the resulting authenticated session in the Space. Two-factor authentication prompts still require a person.[16]

### Persistent agents and storage

Persistent agents have named homes in Cua Volume, allowing memory and outputs to survive replacement of their Space. The daemon restores a home for a run and saves changes after a turn. Routines can start turns without the app being open; a busy or paused agent skips a scheduled slot.[17]

Cua Volume provides versioned storage with separate public, agent-home and per-Space areas. Broader access requires a grant, and the documented default guest view cannot read another agent's home. This storage policy does not isolate agents sharing a desktop's operating-system account: the persistent-agent guide explicitly warns that agents in one Space share that account and can require separate Spaces for file isolation.[17][18]

## Security and data handling

The default hosted relay terminates TLS and can inspect session data while forwarding it, including the screen, shell output, files and input. Cua states that the relay does not store this traffic. Transport encryption to the relay is therefore different from end-to-end encryption against the relay operator.[19]

An optional WireGuard-based mesh is documented as beta and off by default. When enabled at both ends, it encrypts the session between the device and destination. Its `prefer` mode can fall back to the ordinary HTTPS relay path; `require` refuses that fallback. Browser viewers and clients without mesh support still use the HTTPS path.[19]

Teleport bundles can be sealed to a pinned guest key. Older images without that capability require an explicit risk acknowledgement over a relayed connection. Directly typing a Keyvault password through the relayed site-login path is gated but not yet sealed under that mechanism. Local and direct Spaces have no Cua relay in their path.[19]

Host access is also platform-dependent. macOS needs Screen Recording and Accessibility grants. The Windows host operates within an interactive signed-in, unlocked session rather than controlling the lock screen. On Linux, the supported `.deb` installs the system confirmation integration; the portable AppImage runs without its browser sandbox and cannot provide sharing or Keyvault.[5][6]

Usage telemetry is enabled by default after its first-run notice. The current privacy guide says signed-in telemetry is linked to a pseudonymous account ID, rather than being wholly account-unlinked. It lists prompts, screenshots, file paths, URLs and Keyvault content among excluded payloads. Settings and `DO_NOT_TRACK=1` can disable usage telemetry; service records such as subscriptions are separate.[20]

## Plans and costs

The following prices and allowances are the documented October 21, 2026 snapshot. They pay for the application service, relay access and team features, not the operator's hardware, cloud resources or model-provider usage.[7][8][14][21]

| Plan | Monthly billing | Yearly billing | Live sessions | Remote hours per month |
| --- | --- | --- | --- | --- |
| Free | $0 | $0 | 2 | 20 |
| Pro | $18 per person | $180 per person | 5 | 200 |
| Teams | $30 per seat | $300 per seat | 5 per seat | 200 per seat, pooled |

The documentation defines a live session as a person or agent holding a relay stream open, such as a desktop, terminal or process stream. Direct connections do not consume relay hours. The plan guide says reaching the allowance produces a notice rather than immediately stopping Spaces. Teams adds team-owned computers, roles and device approval; SSO and audit export are marked as not yet included.[14][21]

## References

1. Cua. [Cua Spaces overview](https://cua.ai/docs/spaces). Accessed October 21, 2026.
2. Cua. [How Spaces works](https://cua.ai/docs/spaces/concepts/how-spaces-works). Accessed October 21, 2026.
3. Cua. [Component licensing inventory](https://github.com/trycua/cua/blob/15fa9a4c0cab48ca8a9a047685d3488ffb9ce4c6/legal/LICENSING.md). Revision `15fa9a4c0cab48ca8a9a047685d3488ffb9ce4c6`, accessed October 21, 2026.
4. Cua. [Cua Spaces Functional Source License](https://github.com/trycua/cua/blob/15fa9a4c0cab48ca8a9a047685d3488ffb9ce4c6/apps/cua-spaces/LICENSE). Accessed October 21, 2026.
5. Cua. [Add a computer](https://cua.ai/docs/spaces/guides/add-a-computer). Accessed October 21, 2026.
6. Cua. [Install Cua Spaces](https://cua.ai/docs/spaces/guides/install). Accessed October 21, 2026.
7. Cua. [Choose where sandboxes run](https://cua.ai/docs/cua-sdk/guides/local-runtimes). Accessed October 21, 2026.
8. Cua. [Connect your agent](https://cua.ai/docs/spaces/guides/connect-your-agent). Accessed October 21, 2026.
9. Cua. [Use Spaces from code](https://cua.ai/docs/spaces/guides/create-a-space-with-the-sdk). Accessed October 21, 2026.
10. Cua. [Project README](https://github.com/trycua/cua/blob/15fa9a4c0cab48ca8a9a047685d3488ffb9ce4c6/README.md). Accessed October 21, 2026.
11. Cua. [Create a Space](https://cua.ai/docs/spaces/guides/add-a-space). Accessed October 21, 2026.
12. Cua. [cua-spacesd service documentation](https://github.com/trycua/cua/blob/15fa9a4c0cab48ca8a9a047685d3488ffb9ce4c6/libs/cua-spacesd/README.md). Accessed October 21, 2026.
13. Cua. [Share a Space](https://cua.ai/docs/spaces/guides/share-a-space). Accessed October 21, 2026.
14. Cua. [Cua Spaces pricing](https://cua.ai/pricing). Accessed October 21, 2026.
15. Cua. [Teleport an app](https://cua.ai/docs/spaces/guides/teleport-an-app). Accessed October 21, 2026.
16. Cua. [Keyvault](https://cua.ai/docs/spaces/guides/keyvault). Accessed October 21, 2026.
17. Cua. [Persistent agents](https://cua.ai/docs/spaces/guides/persistent-agents). Accessed October 21, 2026.
18. Cua. [Cua Volume](https://cua.ai/docs/spaces/guides/cua-volume). Accessed October 21, 2026.
19. Cua. [What the relay can see](https://cua.ai/docs/spaces/guides/relay-security). Accessed October 21, 2026.
20. Cua. [Telemetry and privacy](https://cua.ai/docs/cua-sdk/concepts/telemetry). Accessed October 21, 2026.
21. Cua. [Plans and Teams](https://cua.ai/docs/spaces/guides/teams). Accessed October 21, 2026.