Vindue control API
Loopback HTTP control API for the Vindue macOS window tiler.
Security model — no auth, by design. The server binds 127.0.0.1 only, allowlists the Host header (127.0.0.1/localhost — DNS-rebinding defense), and rejects any request carrying Origin or Sec-Fetch-Site headers: browsers always attach them, curl/scripts/MCP clients never do — so a web page cannot drive your windows. Anything that can run code as your user can use this API; it grants no new capability.
Served on api.port (default 47725). All endpoints take and return JSON; curl -d works without setting Content-Type. Errors are 400 + { "error": "…" }. The MCP endpoint (/mcp) shares this server — its tools delegate to the same handlers; see the MCP tools reference for that face.
Tiling requires the macOS Accessibility grant; the error says so when it is missing.
Contact Mike Sukmanowsky:
License MIT