Qwen CUA Driver 0.7.3 Compatibility Checklist

#programming #ai #agents #security

Qwen CUA Driver 0.7.3 coordinate and payload compatibility checklist

Quick answer

Qwen released cua-driver-rs-v0.7.3 on July 21, 2026. This is the version of the computer-use driver vendored inside the Qwen Code repository, not “Qwen Code 0.7.3.” It ships cross-platform binaries and exposes two opt-in compatibility modes:

CUA_DRIVER_RS_COORDINATE_SPACE=1 converts model-facing coordinates to a normalized 0–1000 space. The default remains pixels, and CUA_DRIVER_RS_COORDINATE_SCALE can change the full scale.
MCP_MODEL_PAYLOAD_FILTER=1 reversibly rewrites configured terms in textual MCP responses, then decodes returned aliases when they come back to the same driver. The default remains unfiltered.

Do not enable both flags merely because they are new. First prove which coordinate contract your model actually follows and whether a model API route is rejecting accumulated text. Then run the five-case gate below on a disposable desktop session.

Who this is for

This guide is for developers connecting Qwen-VL, Qwen Code, Claude Code, Codex, Cursor, or another MCP client to a native computer-use driver on macOS, Windows, or Linux.

It complements the Chrome DevTools MCP debugging workflow for browser internals and the agent sandbox checklist for repository execution. A desktop driver adds a different boundary: screenshots, accessibility trees, coordinates, input events, application identities, and OS permissions.

What changed—and what did not

The release provides a signed and notarized universal macOS binary plus QwenCuaDriver.app. Linux and Windows artifacts are unsigned. The driver can be pinned and verified with:

CUA_DRIVER_RS_VERSION=0.7.3 /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/QwenLM/qwen-code/main/packages/cua-driver/scripts/install.sh)"
qwen-cua-driver --version
qwen-cua-driver list-tools

Relative-coordinate mode is designed for models that emit positions on a normalized grid. The official design converts normalized x values by screenshot width and y values by screenshot height, using 1000 as the default divisor. However, the same design records a real Qwen trace that followed the tool schema’s pixel wording correctly. Model family alone therefore does not prove that normalized mode is required.

The payload filter solves a separate compatibility problem. Some model routes may reject a request after configured terms appear in accumulated tool output. When explicitly enabled, the filter transforms textual response keys and values and reverses valid aliases on incoming driver arguments. It does not transform image or audio bytes, JSON-RPC routing fields, unrelated shell output, or values sent to another MCP server.

Decide before enabling a flag

Does a captured tool call use screenshot pixels?
├─ yes -> keep coordinate mode off
└─ no, it consistently uses a 0–1000 grid
   -> enable coordinate mode in a canary session

Does the API reject requests because a configured term appears in MCP history?
├─ no evidence -> keep payload filtering off
└─ reproducible rejection -> enable it only on the affected driver route

A suitable MCP configuration for a controlled canary is:

{
  "mcpServers": {
    "cua-computer-use-canary": {
      "command": "qwen-cua-driver",
      "args": ["mcp"],
      "env": {
        "CUA_DRIVER_RS_COORDINATE_SPACE": "1",
        "CUA_DRIVER_RS_COORDINATE_SCALE": "1000"
      }
    }
  }
}

Add MCP_MODEL_PAYLOAD_FILTER=1 only for a separately proven payload rejection. Changing two contracts at once makes failures harder to attribute.

Five-case rollout gate

Use a disposable test account and harmless target application. Keep production credentials and destructive controls out of reach.

Case	Probe	Pass condition
Baseline compatibility	Run initialize, tool discovery, one screenshot, and one safe click with both flags off	Tool schemas and results match the previous driver; the click lands correctly
Coordinate mapping	With normalized mode on, click four marked quadrants in two differently sized windows; repeat with the model’s actual scale	Each point lands inside its target; x and y do not swap or drift after resize
Mixed coordinate paths	Test an accessibility `element_index`, a direct click, a zoomed image, and `move_cursor` separately	Element targeting still works; zoom-space exceptions are not mistaken for the main 0–1000 grid
Payload round trip	With filtering on, exercise nested textual keys and values, an invalid alias, a key collision, and a returned application identifier	Configured terms disappear from model-facing text; valid aliases recover exactly; invalid/colliding input fails safely
Binary and restart integrity	Hash a screenshot before and after filtering, restart the MCP server, and repeat the canary	Image bytes are unchanged, settings remain explicit, and rollback restores the baseline immediately

For macOS, also verify the installed app’s signature and Screen Recording/Accessibility permissions. For Linux and Windows, record that the published artifacts are unsigned and apply your own checksum, provenance, or internal signing policy before wider distribution.

Record evidence, then promote

The official payload-filter change reports zero configured-term matches across 73,976 response bytes in a real driver session, while preserving default-off behavior and binary data. Treat that as upstream evidence, not a substitute for your own route, model, and application fixtures.

Use a compact rollout record:

Qwen CUA Driver canary
- driver version / artifact hash / OS:
- MCP client and model route:
- observed coordinate contract and scale:
- baseline click targets:
- normalized click error by window size:
- payload rejection reproduced before flag: yes/no
- text leak count / alias round-trip result:
- screenshot hash unchanged: yes/no
- rollback command and owner:

Promote only after the same fixture passes across restart and window resize. Keep one-click rollback by removing the environment flag and restarting the MCP process.

Common mistakes

Calling the release “Qwen Code 0.7.3” and implying the whole CLI changed versions.
Assuming every Qwen model emits 0–1000 coordinates without capturing a real tool call.
Mixing screenshot-local, screen-global, zoom-image, and accessibility-element coordinates in one assertion.
Treating reversible text rewriting as authorization, sanitization, or prompt-injection protection.
Expecting an alias passed to a shell or different MCP server to decode automatically.
Enabling both flags and upgrading the binary in one unobservable production change.

FAQ

Should Qwen-VL users always enable relative coordinates?

No. The mode exists for Qwen-VL computer-use flows, but the official design also documents a Qwen trace that followed pixel-based tool descriptions. Capture the model’s actual output and enable normalization only when the contract is consistently 0–1000.

Should the scale be 1000 or 999?

The driver defaults to 1000, while the design notes that different cookbooks have used both. Keep the scale explicit and run marked corner and quadrant tests instead of guessing.

Is MCP payload filtering a security boundary?

No. It is a route-compatibility transform for configured text. It does not inspect images, govern tool authority, remove prompt injection, or rewrite data emitted by unrelated tools.