diff --git a/server/drivers/antigravity.test.ts b/server/drivers/antigravity.test.ts
index 6b8e73c517..19f88e284d 100644
--- a/server/drivers/antigravity.test.ts
+++ b/server/drivers/antigravity.test.ts
@@ -4,7 +4,7 @@
 //
 // The fake CLI is a shebang script Windows cannot exec directly;
 // spawnCli resolves it to `node <script>`, so these run everywhere.
-import { chmodSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { chmodSync, existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -12,8 +12,16 @@ import { afterEach, beforeEach, describe, expect, it } from "vitest";
 
 import { ensureDirs } from "../config.ts";
 import type { ProviderInstance } from "../contracts.ts";
+import { SPAWNED_PROXIES } from "../proxy-paths.ts";
 import { recordEvents, type EventRecorder } from "../testing/events.ts";
-import { AntigravityDriver, readAntigravityModelCatalog, STATIC_ANTIGRAVITY_MODELS } from "./antigravity.ts";
+import {
+  ANTIGRAVITY_COMPUTER_MCP_KEY,
+  AntigravityDriver,
+  antigravityComputerMcpServer,
+  ensureAntigravityComputerMcp,
+  readAntigravityModelCatalog,
+  STATIC_ANTIGRAVITY_MODELS,
+} from "./antigravity.ts";
 
 const FAKE_CLI = join(dirname(fileURLToPath(import.meta.url)), "..", "testing", "fake-agy-cli.ts");
 
@@ -198,3 +206,384 @@ describe("Antigravity snapshot", () => {
     }
   });
 });
+
+describe("Antigravity computer MCP config", () => {
+  const configPath = (home: string) => join(home, ".gemini", "config", "mcp_config.json");
+  const readConfig = (home: string) => JSON.parse(readFileSync(configPath(home), "utf8"));
+  const boxIntegrations = {
+    computer: {
+      kind: "box" as const,
+      boxId: "bx_1",
+      token: "box-tok",
+      control: { url: "http://127.0.0.1:9/control", token: "ctl-tok" },
+    },
+  };
+  const boxEntry = () => antigravityComputerMcpServer(boxIntegrations)!;
+
+  it("builds the cloud-box spec on the shared computer proxy (never path-resolved locally)", () => {
+    expect(antigravityComputerMcpServer(boxIntegrations)).toEqual({
+      command: process.execPath,
+      args: [SPAWNED_PROXIES.computer],
+      env: {
+        ELECTRON_RUN_AS_NODE: "1",
+        OGB_BOX_ID: "bx_1",
+        OGB_BOX_TOKEN: "box-tok",
+        OMB_CONTROL_URL: "http://127.0.0.1:9/control",
+        OMB_CONTROL_TOKEN: "ctl-tok",
+      },
+    });
+  });
+
+  it("passes a Local VM / VPS stdio connection through unchanged, and yields null without a computer", () => {
+    expect(
+      antigravityComputerMcpServer({
+        localComputer: { command: "/opt/cua", args: ["--mcp"], env: { CUA_SOCKET: "/tmp/cua.sock" } },
+      }),
+    ).toEqual({ command: "/opt/cua", args: ["--mcp"], env: { CUA_SOCKET: "/tmp/cua.sock" } });
+    expect(antigravityComputerMcpServer({})).toBeNull();
+    expect(antigravityComputerMcpServer(undefined)).toBeNull();
+  });
+
+  it("upserts only its own key — the user's servers and unknown top-level keys survive", () => {
+    const home = mkdtempSync(join(tmpdir(), "omb-agy-mcpcfg-"));
+    try {
+      mkdirSync(join(home, ".gemini", "config"), { recursive: true });
+      writeFileSync(
+        configPath(home),
+        JSON.stringify({
+          mcpServers: { "sqlite-helper": { command: "sqlite-mcp-server", args: ["/db"] } },
+          futureTopLevelKey: { keep: true },
+        }),
+      );
+      ensureAntigravityComputerMcp(boxEntry(), { HOME: home });
+      let config = readConfig(home);
+      expect(config.mcpServers["sqlite-helper"]).toEqual({ command: "sqlite-mcp-server", args: ["/db"] });
+      expect(config.futureTopLevelKey).toEqual({ keep: true });
+      expect(config.mcpServers[ANTIGRAVITY_COMPUTER_MCP_KEY]).toEqual(boxEntry());
+
+      // A later turn on a different computer overwrites the key in place.
+      ensureAntigravityComputerMcp(
+        { command: "/opt/cua", args: ["--mcp"], env: { CUA_SOCKET: "/tmp/cua.sock" } },
+        { HOME: home },
+      );
+      config = readConfig(home);
+      expect(config.mcpServers[ANTIGRAVITY_COMPUTER_MCP_KEY].command).toBe("/opt/cua");
+      expect(config.mcpServers["sqlite-helper"]).toEqual({ command: "sqlite-mcp-server", args: ["/db"] });
+      expect(config.futureTopLevelKey).toEqual({ keep: true });
+    } finally {
+      rmSync(home, { recursive: true, force: true });
+    }
+  });
+
+  it("starts fresh from malformed JSON instead of failing the turn", () => {
+    const home = mkdtempSync(join(tmpdir(), "omb-agy-mcpbad-"));
+    try {
+      mkdirSync(join(home, ".gemini", "config"), { recursive: true });
+      writeFileSync(configPath(home), "{{{ not json");
+      ensureAntigravityComputerMcp(boxEntry(), { HOME: home });
+      expect(readConfig(home).mcpServers[ANTIGRAVITY_COMPUTER_MCP_KEY]).toEqual(boxEntry());
+    } finally {
+      rmSync(home, { recursive: true, force: true });
+    }
+  });
+
+  it("restricts the token-bearing config directory and file to the current user", () => {
+    if (process.platform === "win32") return;
+    const home = mkdtempSync(join(tmpdir(), "omb-agy-mcpperms-"));
+    try {
+      const directory = dirname(configPath(home));
+      mkdirSync(directory, { recursive: true, mode: 0o755 });
+      writeFileSync(configPath(home), "{}\n", { mode: 0o644 });
+
+      ensureAntigravityComputerMcp(boxEntry(), { HOME: home });
+
+      expect(statSync(directory).mode & 0o777).toBe(0o700);
+      expect(statSync(configPath(home)).mode & 0o777).toBe(0o600);
+    } finally {
+      rmSync(home, { recursive: true, force: true });
+    }
+  });
+
+  it("preserves concurrent config edits while restoring only its own MCP entry", () => {
+    const home = mkdtempSync(join(tmpdir(), "omb-agy-mcpconcurrent-"));
+    try {
+      const restoreNewFile = ensureAntigravityComputerMcp(boxEntry(), { HOME: home });
+      const concurrentlyCreated = readConfig(home);
+      concurrentlyCreated.mcpServers["external-helper"] = { command: "external-mcp" };
+      concurrentlyCreated.futureTopLevelKey = { keep: true };
+      writeFileSync(configPath(home), JSON.stringify(concurrentlyCreated));
+
+      restoreNewFile();
+      expect(existsSync(configPath(home))).toBe(true);
+      let restored = readConfig(home);
+      expect(restored.mcpServers[ANTIGRAVITY_COMPUTER_MCP_KEY]).toBeUndefined();
+      expect(restored.mcpServers["external-helper"]).toEqual({ command: "external-mcp" });
+      expect(restored.futureTopLevelKey).toEqual({ keep: true });
+
+      const originalEntry = { command: "user-owned-mcp", args: ["--serve"] };
+      writeFileSync(
+        configPath(home),
+        JSON.stringify({ mcpServers: { [ANTIGRAVITY_COMPUTER_MCP_KEY]: originalEntry } }),
+      );
+      const restoreExistingEntry = ensureAntigravityComputerMcp(boxEntry(), { HOME: home });
+      const concurrentlyEdited = readConfig(home);
+      concurrentlyEdited.mcpServers["another-helper"] = { command: "another-mcp" };
+      writeFileSync(configPath(home), JSON.stringify(concurrentlyEdited));
+
+      restoreExistingEntry();
+      restored = readConfig(home);
+      expect(restored.mcpServers[ANTIGRAVITY_COMPUTER_MCP_KEY]).toEqual(originalEntry);
+      expect(restored.mcpServers["another-helper"]).toEqual({ command: "another-mcp" });
+    } finally {
+      rmSync(home, { recursive: true, force: true });
+    }
+  });
+
+  it("a computer-less turn removes only its own key, and never creates the file just to remove", () => {
+    const home = mkdtempSync(join(tmpdir(), "omb-agy-mcprm-"));
+    try {
+      // No file at all: removal is a no-op, not an empty file in the user's home.
+      ensureAntigravityComputerMcp(null, { HOME: home });
+      expect(existsSync(configPath(home))).toBe(false);
+
+      mkdirSync(join(home, ".gemini", "config"), { recursive: true });
+      writeFileSync(
+        configPath(home),
+        JSON.stringify({
+          mcpServers: {
+            "sqlite-helper": { command: "sqlite-mcp-server", args: ["/db"] },
+            [ANTIGRAVITY_COMPUTER_MCP_KEY]: boxEntry(),
+          },
+        }),
+      );
+      ensureAntigravityComputerMcp(null, { HOME: home });
+      const config = readConfig(home);
+      expect(config.mcpServers[ANTIGRAVITY_COMPUTER_MCP_KEY]).toBeUndefined();
+      expect(config.mcpServers["sqlite-helper"]).toEqual({ command: "sqlite-mcp-server", args: ["/db"] });
+    } finally {
+      rmSync(home, { recursive: true, force: true });
+    }
+  });
+
+  it("advertises computerMcp only on full-auto instances, and never localComputerMcp", async () => {
+    const fullAuto = await AntigravityDriver.create({
+      instanceId: "agy-caps-full",
+      displayName: undefined,
+      environment: {},
+      enabled: true,
+      config: { cli: FAKE_CLI, fullAuto: true },
+    });
+    const acceptEdits = await AntigravityDriver.create({
+      instanceId: "agy-caps-safe",
+      displayName: undefined,
+      environment: {},
+      enabled: true,
+      config: { cli: FAKE_CLI, fullAuto: false },
+    });
+    try {
+      expect(fullAuto.adapter.capabilities.computerMcp).toBe(true);
+      // accept-edits print mode auto-denies tools that would prompt, so a
+      // mount there could never fire — the capability must not be offered.
+      expect(acceptEdits.adapter.capabilities.computerMcp).toBe(false);
+      // The host desktop needs per-action human approval; print mode has no
+      // approval channel in any mode.
+      expect(fullAuto.adapter.capabilities.localComputerMcp).toBeUndefined();
+      expect(acceptEdits.adapter.capabilities.localComputerMcp).toBeUndefined();
+    } finally {
+      await fullAuto.dispose();
+      await acceptEdits.dispose();
+    }
+  });
+
+  it("uses the spawned CLI's HOME and restores the prior config when the turn exits", async () => {
+    ensureDirs();
+    chmodSync(FAKE_CLI, 0o755);
+    const home = mkdtempSync(join(tmpdir(), "omb-agy-mcpturn-"));
+    const dump = join(home, "mcp-at-spawn.json");
+    const original = JSON.stringify({ mcpServers: { "sqlite-helper": { command: "sqlite-mcp-server", args: ["/db"] } } });
+    mkdirSync(join(home, ".gemini", "config"), { recursive: true });
+    writeFileSync(configPath(home), original);
+    const instance = await AntigravityDriver.create({
+      instanceId: "agy-mcp-turn",
+      displayName: undefined,
+      environment: { HOME: home, FAKE_AGY_DELAY_MS: "100", FAKE_AGY_MCP_DUMP: dump },
+      enabled: true,
+      config: { cli: FAKE_CLI, fullAuto: true },
+    });
+    const recorder = recordEvents(instance.adapter);
+    try {
+      await instance.adapter.sendTurn({
+        threadId: "t-mcp-on",
+        text: "click things",
+        integrations: boxIntegrations,
+      });
+      // sendTurn resolves after the child is spawned; the write happens
+      // synchronously before that spawn, so this IS the spawn-time content.
+      const mounted = readConfig(home);
+      expect(mounted.mcpServers[ANTIGRAVITY_COMPUTER_MCP_KEY]).toEqual(boxEntry());
+      expect(mounted.mcpServers["sqlite-helper"]).toEqual({ command: "sqlite-mcp-server", args: ["/db"] });
+      await recorder.until((e) => e.type === "turn.completed");
+      expect(JSON.parse(readFileSync(dump, "utf8")).mcpServers[ANTIGRAVITY_COMPUTER_MCP_KEY]).toEqual(boxEntry());
+      await expect.poll(() => readFileSync(configPath(home), "utf8")).toBe(original);
+    } finally {
+      recorder.stop();
+      await instance.dispose();
+      rmSync(home, { recursive: true, force: true });
+    }
+  });
+
+  it("serializes overlapping turns so each child sees only its own computer mount", async () => {
+    ensureDirs();
+    chmodSync(FAKE_CLI, 0o755);
+    const home = mkdtempSync(join(tmpdir(), "omb-agy-mcplease-"));
+    const firstDump = join(home, "first.json");
+    const secondDump = join(home, "second.json");
+    const first = await AntigravityDriver.create({
+      instanceId: "agy-mcp-first",
+      displayName: undefined,
+      environment: { HOME: home, FAKE_AGY_DELAY_MS: "150", FAKE_AGY_MCP_DUMP: firstDump },
+      enabled: true,
+      config: { cli: FAKE_CLI, fullAuto: true },
+    });
+    const second = await AntigravityDriver.create({
+      instanceId: "agy-mcp-second",
+      displayName: undefined,
+      environment: { HOME: home, FAKE_AGY_MCP_DUMP: secondDump },
+      enabled: true,
+      config: { cli: FAKE_CLI, fullAuto: true },
+    });
+    const firstRecorder = recordEvents(first.adapter);
+    const secondRecorder = recordEvents(second.adapter);
+    try {
+      await first.adapter.sendTurn({ threadId: "t-mcp-first", text: "first", integrations: boxIntegrations });
+      let secondSpawned = false;
+      const secondTurn = second.adapter.sendTurn({ threadId: "t-mcp-second", text: "second" }).then((result) => {
+        secondSpawned = true;
+        return result;
+      });
+
+      await new Promise((resolve) => setTimeout(resolve, 30));
+      expect(secondSpawned).toBe(false);
+      await firstRecorder.until((event) => event.type === "turn.completed");
+      await secondTurn;
+      await secondRecorder.until((event) => event.type === "turn.completed");
+
+      expect(JSON.parse(readFileSync(firstDump, "utf8")).mcpServers[ANTIGRAVITY_COMPUTER_MCP_KEY]).toEqual(boxEntry());
+      expect(JSON.parse(readFileSync(secondDump, "utf8"))?.mcpServers?.[ANTIGRAVITY_COMPUTER_MCP_KEY]).toBeUndefined();
+      await expect.poll(() => existsSync(configPath(home))).toBe(false);
+    } finally {
+      firstRecorder.stop();
+      secondRecorder.stop();
+      await first.dispose();
+      await second.dispose();
+      rmSync(home, { recursive: true, force: true });
+    }
+  });
+
+  it("reaps a child that hangs after result, restores the mount, and unblocks the next turn", async () => {
+    ensureDirs();
+    chmodSync(FAKE_CLI, 0o755);
+    const home = mkdtempSync(join(tmpdir(), "omb-agy-mcpreaper-"));
+    const firstDump = join(home, "first.json");
+    const secondDump = join(home, "second.json");
+    const first = await AntigravityDriver.create({
+      instanceId: "agy-mcp-zombie",
+      displayName: undefined,
+      environment: {
+        HOME: home,
+        FAKE_AGY_MCP_DUMP: firstDump,
+        FAKE_AGY_POST_RESULT_DELAY_MS: "10000",
+        FAKE_AGY_IGNORE_SIGTERM: "1",
+      },
+      enabled: true,
+      config: { cli: FAKE_CLI, fullAuto: true },
+    });
+    const second = await AntigravityDriver.create({
+      instanceId: "agy-mcp-after-zombie",
+      displayName: undefined,
+      environment: { HOME: home, FAKE_AGY_MCP_DUMP: secondDump },
+      enabled: true,
+      config: { cli: FAKE_CLI, fullAuto: true },
+    });
+    const firstRecorder = recordEvents(first.adapter);
+    const secondRecorder = recordEvents(second.adapter);
+    try {
+      await first.adapter.sendTurn({ threadId: "t-mcp-zombie", text: "first", integrations: boxIntegrations });
+      await firstRecorder.until((event) => event.type === "turn.completed");
+      expect(readConfig(home).mcpServers[ANTIGRAVITY_COMPUTER_MCP_KEY]).toEqual(boxEntry());
+
+      let secondSpawned = false;
+      const secondTurn = second.adapter.sendTurn({ threadId: "t-mcp-after-zombie", text: "second" }).then((result) => {
+        secondSpawned = true;
+        return result;
+      });
+      if (process.platform !== "win32") {
+        await new Promise((resolve) => setTimeout(resolve, 2_500));
+        expect(secondSpawned).toBe(false);
+      }
+      await secondTurn;
+      await secondRecorder.until((event) => event.type === "turn.completed");
+
+      expect(JSON.parse(readFileSync(firstDump, "utf8")).mcpServers[ANTIGRAVITY_COMPUTER_MCP_KEY]).toEqual(boxEntry());
+      expect(JSON.parse(readFileSync(secondDump, "utf8"))?.mcpServers?.[ANTIGRAVITY_COMPUTER_MCP_KEY]).toBeUndefined();
+      await expect.poll(() => existsSync(configPath(home))).toBe(false);
+    } finally {
+      firstRecorder.stop();
+      secondRecorder.stop();
+      await first.dispose();
+      await second.dispose();
+      rmSync(home, { recursive: true, force: true });
+    }
+  }, 10_000);
+
+  it("force-reaps an interrupted child that ignores SIGTERM before result", async () => {
+    ensureDirs();
+    chmodSync(FAKE_CLI, 0o755);
+    const home = mkdtempSync(join(tmpdir(), "omb-agy-mcpinterrupt-"));
+    const readyFile = join(home, "ready");
+    const first = await AntigravityDriver.create({
+      instanceId: "agy-mcp-interrupted",
+      displayName: undefined,
+      environment: {
+        HOME: home,
+        FAKE_AGY_DELAY_MS: "10000",
+        FAKE_AGY_IGNORE_SIGTERM: "1",
+        FAKE_AGY_READY_FILE: readyFile,
+      },
+      enabled: true,
+      config: { cli: FAKE_CLI, fullAuto: true },
+    });
+    const second = await AntigravityDriver.create({
+      instanceId: "agy-mcp-after-interrupt",
+      displayName: undefined,
+      environment: { HOME: home },
+      enabled: true,
+      config: { cli: FAKE_CLI, fullAuto: true },
+    });
+    const secondRecorder = recordEvents(second.adapter);
+    try {
+      await first.adapter.sendTurn({ threadId: "t-mcp-interrupted", text: "first", integrations: boxIntegrations });
+      expect(readConfig(home).mcpServers[ANTIGRAVITY_COMPUTER_MCP_KEY]).toEqual(boxEntry());
+      await expect.poll(() => existsSync(readyFile), { timeout: 2_000 }).toBe(true);
+      await first.adapter.interruptTurn("t-mcp-interrupted");
+
+      let secondSpawned = false;
+      const secondTurn = second.adapter.sendTurn({ threadId: "t-mcp-after-interrupt", text: "second" }).then((result) => {
+        secondSpawned = true;
+        return result;
+      });
+      if (process.platform !== "win32") {
+        await new Promise((resolve) => setTimeout(resolve, 1_000));
+        expect(secondSpawned).toBe(false);
+      }
+      await secondTurn;
+      await secondRecorder.until((event) => event.type === "turn.completed");
+      await expect.poll(() => existsSync(configPath(home)), { timeout: 6_000 }).toBe(false);
+    } finally {
+      secondRecorder.stop();
+      await first.dispose();
+      await second.dispose();
+      rmSync(home, { recursive: true, force: true });
+    }
+  }, 10_000);
+});
diff --git a/server/drivers/antigravity.ts b/server/drivers/antigravity.ts
index 8867248176..1108ff712b 100644
--- a/server/drivers/antigravity.ts
+++ b/server/drivers/antigravity.ts
@@ -10,13 +10,22 @@
 // `request-review` auto-denies; `--dangerously-skip-permissions` (fullAuto)
 // approves everything. Real per-action approval cards are a future path via
 // native ACP (agy issue #31), which would reuse acp/core.ts like grok/gemini.
+//
+// Computer use: agy has no per-turn MCP flag, so the bot's computer (cloud
+// box / Local VM / VPS) is mounted by upserting one key into the global
+// `~/.gemini/config/mcp_config.json` before each spawn — see
+// ensureAntigravityComputerMcp below. Full-auto instances only; the host
+// desktop stays off (no approval channel in print mode, ever).
 import { describeSpawnFailure, execCli, killCliTree, spawnCli } from "../procs.ts";
-import { mkdirSync, readFileSync } from "node:fs";
+import { chmodSync, existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
-import { join } from "node:path";
+import { dirname, join } from "node:path";
+import { z } from "zod";
 
 import { DATA_DIR, stripWorkspaceCredentialEnv } from "../config.ts";
+import { computerProxyEnv } from "../container-computer.ts";
 import { augmentedPath } from "../env-path.ts";
+import { SPAWNED_PROXIES } from "../proxy-paths.ts";
 import { injectedApiModel, mergeLocalInject } from "./local-inject.ts";
 
 import type { ChildProcess } from "node:child_process";
@@ -59,8 +68,8 @@ export const STATIC_ANTIGRAVITY_MODELS: ModelCatalog = {
   ],
 };
 
-function antigravityEnvironment(): NodeJS.ProcessEnv {
-  const env: NodeJS.ProcessEnv = { ...process.env, PATH: augmentedPath() };
+function antigravityEnvironment(overrides: NodeJS.ProcessEnv = {}): NodeJS.ProcessEnv {
+  const env: NodeJS.ProcessEnv = { ...process.env, PATH: augmentedPath(), ...overrides };
   // The harness process may hold workspace credentials injected by the
   // desktop shell. Antigravity uses its own login, so none belong in any of
   // its turn, snapshot, or helper children.
@@ -110,6 +119,166 @@ export function readAntigravityModelCatalog(env: Record<string, string | undefin
   return { default: STATIC_ANTIGRAVITY_MODELS.default, options };
 }
 
+// ── computer MCP mount ──────────────────────────────────────────────────
+// agy has no per-session MCP flag and no project-level MCP config: verified
+// against agy 1.1.19, whose embedded docs list exactly two locations — the
+// global `~/.gemini/config/mcp_config.json` and per-plugin files — and whose
+// `agy mcp list` ignores `.gemini/{settings,mcp_config}.json` in the cwd.
+// So the bot's computer is mounted by upserting ONE key into the global file
+// right before each spawn: every other byte of the user's config is
+// preserved, and a malformed file starts from a fresh object instead of
+// failing the turn (the ensureOpenCodeInjectModel discipline).
+export const ANTIGRAVITY_COMPUTER_MCP_KEY = "openmausbot-computer";
+
+export interface AntigravityComputerMcpServer {
+  command: string;
+  args: string[];
+  env: Record<string, string>;
+}
+
+// agy's MCP file is machine-global. Hold this lease for the complete child
+// lifetime so two Antigravity turns cannot see each other's computer tokens.
+let antigravityComputerMcpLease: Promise<void> = Promise.resolve();
+
+async function acquireAntigravityComputerMcpLease(): Promise<() => void> {
+  const previous = antigravityComputerMcpLease;
+  let unlock: (() => void) | undefined;
+  const current = new Promise<void>((resolve) => {
+    unlock = resolve;
+  });
+  antigravityComputerMcpLease = previous.then(() => current);
+  await previous;
+  let released = false;
+  return () => {
+    if (released) return;
+    released = true;
+    unlock?.();
+  };
+}
+
+// Lenient by design: keep every unknown key the user put in the file. A
+// present-but-wrong mcpServers (e.g. an array) fails the parse and is
+// rebuilt fresh — that file was already unusable to agy itself.
+const mcpConfigFileSchema = z.looseObject({
+  mcpServers: z.looseObject({}).optional(),
+});
+
+/** The computer MCP server for this turn, or null when the turn has none.
+ * Cloud boxes go through OpenMausBot's REST-to-MCP adapter (the same spec
+ * claude.ts and codex.ts build); Local VM and VPS connections arrive as a
+ * ready-made Cua Driver stdio command and pass through unchanged. */
+export function antigravityComputerMcpServer(
+  integrations: SendTurnInput["integrations"],
+): AntigravityComputerMcpServer | null {
+  const computer = integrations?.computer;
+  if (computer) {
+    const proxyEnv = computerProxyEnv(computer);
+    return {
+      command: process.execPath,
+      args: [SPAWNED_PROXIES.computer],
+      env: {
+        ELECTRON_RUN_AS_NODE: "1",
+        OGB_BOX_ID: proxyEnv.OGB_BOX_ID ?? "",
+        OGB_BOX_TOKEN: proxyEnv.OGB_BOX_TOKEN ?? "",
+        // who-is-driving endpoint, so a person taking the wheel in the
+        // panel pauses this bot's hands mid-turn
+        OMB_CONTROL_URL: proxyEnv.OMB_CONTROL_URL ?? "",
+        OMB_CONTROL_TOKEN: proxyEnv.OMB_CONTROL_TOKEN ?? "",
+      },
+    };
+  }
+  const local = integrations?.localComputer;
+  if (local) return { command: local.command, args: local.args, env: { ...local.env } };
+  return null;
+}
+
+/** Upsert (server) or remove (null) the openmausbot-computer entry in the
+ * global mcp_config.json. Only that one key is ever written; a turn without
+ * a computer removes it so a previous turn's mount cannot leak tools — or
+ * box/control tokens — into later turns or the user's own agy sessions. */
+export function ensureAntigravityComputerMcp(
+  server: AntigravityComputerMcpServer | null,
+  env: Record<string, string | undefined> = process.env,
+): () => void {
+  const home = env.HOME || env.USERPROFILE || homedir();
+  const path = join(home, ".gemini", "config", "mcp_config.json");
+  const existed = existsSync(path);
+  const original = existed ? readFileSync(path, "utf8") : null;
+  let config: z.infer<typeof mcpConfigFileSchema> = {};
+  try {
+    const parsed = mcpConfigFileSchema.safeParse(JSON.parse(original ?? ""));
+    if (parsed.success) config = parsed.data;
+  } catch {
+    // Missing or malformed user config — rebuild only what the mount needs.
+  }
+  const servers = { ...config.mcpServers };
+  // Nothing to remove and nothing to add: leave the user's file untouched
+  // (don't create or reformat it on every computer-less turn).
+  if (!server && !(ANTIGRAVITY_COMPUTER_MCP_KEY in servers)) return () => {};
+  if (server) {
+    servers[ANTIGRAVITY_COMPUTER_MCP_KEY] = { command: server.command, args: server.args, env: server.env };
+  } else {
+    delete servers[ANTIGRAVITY_COMPUTER_MCP_KEY];
+  }
+  const directory = dirname(path);
+  mkdirSync(directory, { recursive: true, mode: 0o700 });
+  chmodSync(directory, 0o700);
+  if (existed) chmodSync(path, 0o600);
+  const mounted = `${JSON.stringify({ ...config, mcpServers: servers }, null, 2)}\n`;
+  writeFileSync(path, mounted, { mode: 0o600 });
+  chmodSync(path, 0o600);
+
+  const hadOriginalEntry = ANTIGRAVITY_COMPUTER_MCP_KEY in (config.mcpServers ?? {});
+  const originalEntry = config.mcpServers?.[ANTIGRAVITY_COMPUTER_MCP_KEY];
+
+  // Restore exactly what was present before this turn when nobody else touched
+  // the file. A user's own agy process is outside our module-wide lease, so if
+  // it edited the config concurrently, preserve that edit and restore only our
+  // one key instead of replacing (or deleting) the whole file.
+  let restored = false;
+  return () => {
+    if (restored) return;
+    restored = true;
+    let current: string;
+    try {
+      current = readFileSync(path, "utf8");
+    } catch (error) {
+      if (error instanceof Error && "code" in error && error.code === "ENOENT") return;
+      throw error;
+    }
+    if (current === mounted) {
+      if (original === null) {
+        unlinkSync(path);
+        return;
+      }
+      writeFileSync(path, original, { mode: 0o600 });
+      chmodSync(path, 0o600);
+      return;
+    }
+
+    // A malformed concurrent edit is not safe to rewrite. Leaving a stale
+    // OpenMausBot entry is preferable to destroying bytes we cannot interpret.
+    let currentJson: unknown;
+    try {
+      currentJson = JSON.parse(current);
+    } catch {
+      return;
+    }
+    const parsed = mcpConfigFileSchema.safeParse(currentJson);
+    if (!parsed.success) return;
+    const currentConfig = parsed.data;
+    const currentServers = { ...currentConfig.mcpServers };
+    if (hadOriginalEntry) currentServers[ANTIGRAVITY_COMPUTER_MCP_KEY] = originalEntry;
+    else delete currentServers[ANTIGRAVITY_COMPUTER_MCP_KEY];
+    writeFileSync(
+      path,
+      `${JSON.stringify({ ...currentConfig, mcpServers: currentServers }, null, 2)}\n`,
+      { mode: 0o600 },
+    );
+    chmodSync(path, 0o600);
+  };
+}
+
 function decodeConfig(raw: unknown): AntigravityConfig {
   const o = (raw ?? {}) as Record<string, unknown>;
   if (o.cli !== undefined && typeof o.cli !== "string") {
@@ -146,7 +315,8 @@ export const AntigravityDriver: ProviderDriver<AntigravityConfig> = {
 
   async create(input: DriverCreateInput<AntigravityConfig>): Promise<ProviderInstance> {
     const { instanceId, config } = input;
-    const catalogEnv: Record<string, string | undefined> = { ...process.env, ...input.environment };
+    const env = antigravityEnvironment(input.environment);
+    const catalogEnv: Record<string, string | undefined> = env;
     let models = STATIC_ANTIGRAVITY_MODELS;
     const refreshModels = async () => {
       try {
@@ -160,6 +330,8 @@ export const AntigravityDriver: ProviderDriver<AntigravityConfig> = {
     const listeners = new Set<RuntimeEventListener>();
     // one active turn per thread; a second send while busy is a caller bug
     const active = new Map<string, { stop: () => void; turnId: string }>();
+    const pending = new Set<string>();
+    let disposed = false;
     // every live agy child, tracked independently of `active`: a child can
     // hang AFTER emitting `result` (so it's already removed from `active`), and
     // dispose()/stopAll() must still be able to reap it. Removed on process exit.
@@ -195,7 +367,9 @@ export const AntigravityDriver: ProviderDriver<AntigravityConfig> = {
 
     const sendTurn = async (turn: SendTurnInput) => {
       const { threadId } = turn;
-      if (active.has(threadId)) throw new Error("a turn is already running on this thread");
+      if (disposed) throw new Error("Antigravity instance is disposed");
+      if (active.has(threadId) || pending.has(threadId)) throw new Error("a turn is already running on this thread");
+      pending.add(threadId);
       const turnId = newId();
 
       // Default cwd to a per-thread workspace under DATA_DIR — deliberately
@@ -206,7 +380,12 @@ export const AntigravityDriver: ProviderDriver<AntigravityConfig> = {
       // one workspace dir. replace() already keeps a UUID unique and safe.
       const tag = threadId.replace(/[^\w-]/g, "");
       const workspace = join(DATA_DIR, "workspaces", tag);
-      mkdirSync(workspace, { recursive: true });
+      try {
+        mkdirSync(workspace, { recursive: true });
+      } catch (error) {
+        pending.delete(threadId);
+        throw error;
+      }
       const cwd = turn.cwd ?? workspace;
 
       // prompt is passed as the `--print` argv value: agy does NOT read the
@@ -222,6 +401,9 @@ export const AntigravityDriver: ProviderDriver<AntigravityConfig> = {
       // exiting, the bot would stay busy forever (agy's own --print-timeout 10m
       // is the only other net). Assigned just below; settle() always clears it.
       let watchdog: ReturnType<typeof setTimeout> | undefined;
+      // Assigned once the child exists. A child can emit `result` and then
+      // hang, so settling must still arrange for process and MCP cleanup.
+      let armPostSettleCleanup = () => {};
       const settle = (
         ok: boolean,
         stopReason: string | null,
@@ -232,6 +414,7 @@ export const AntigravityDriver: ProviderDriver<AntigravityConfig> = {
         settled = true;
         clearTimeout(watchdog);
         active.delete(threadId);
+        armPostSettleCleanup();
         emit({ ...base(threadId, turnId), type: "turn.completed", ok, stopReason, cost, ...(usage ? { usage } : {}) });
       };
 
@@ -245,6 +428,35 @@ export const AntigravityDriver: ProviderDriver<AntigravityConfig> = {
           message: `prompt too large for Antigravity's argv-only print mode (${Buffer.byteLength(prompt)} bytes)`,
         });
         settle(false, "prompt_too_large");
+        pending.delete(threadId);
+        return { turnId };
+      }
+
+      // agy's config is global, so every turn — including one without a
+      // computer — owns the mount for its complete child lifetime. This keeps
+      // overlapping turns from inheriting, replacing, or removing each
+      // other's tools and credentials.
+      const releaseMcpLease = await acquireAntigravityComputerMcpLease();
+      if (disposed) {
+        releaseMcpLease();
+        pending.delete(threadId);
+        settle(false, "disposed");
+        return { turnId };
+      }
+      let restoreMcp = () => {};
+      try {
+        restoreMcp = ensureAntigravityComputerMcp(antigravityComputerMcpServer(turn.integrations), env);
+      } catch (error) {
+        releaseMcpLease();
+        pending.delete(threadId);
+        emit({
+          ...base(threadId, turnId),
+          type: "runtime.error",
+          message: `could not update Antigravity's MCP config (${join(".gemini", "config", "mcp_config.json")}): ${
+            error instanceof Error ? error.message : String(error)
+          }`,
+        });
+        settle(false, "mcp_config_error");
         return { turnId };
       }
 
@@ -261,17 +473,84 @@ export const AntigravityDriver: ProviderDriver<AntigravityConfig> = {
       if (turn.model) args.push("--model", injectedApiModel(turn.model) ?? turn.model);
       if (resumeCursor) args.push("--conversation", resumeCursor);
 
-      const env = antigravityEnvironment();
-
       // spawnCli resolves npm .cmd shims / shebang scripts on Windows and
       // owns the process-group vs windowsHide difference (see procs.ts)
-      const child = spawnCli(config.cli, args, {
-        cwd,
-        env,
-        stdio: ["ignore", "pipe", "pipe"], // prompt is on argv; stdin is unused
-      });
+      let child: ReturnType<typeof spawnCli>;
+      try {
+        child = spawnCli(config.cli, args, {
+          cwd,
+          env,
+          stdio: ["ignore", "pipe", "pipe"], // prompt is on argv; stdin is unused
+        });
+      } catch (error) {
+        try {
+          restoreMcp();
+        } finally {
+          releaseMcpLease();
+        }
+        pending.delete(threadId);
+        emit({
+          ...base(threadId, turnId),
+          type: "runtime.error",
+          ...describeSpawnFailure(error instanceof Error ? error : new Error(String(error)), config.cli),
+        });
+        settle(false, "spawn_error");
+        return { turnId };
+      }
       children.add(child);
 
+      let childClosed = false;
+      let postSettleReaper: ReturnType<typeof setTimeout> | undefined;
+      let terminationEscalation: ReturnType<typeof setTimeout> | undefined;
+      let mcpFinalized = false;
+      const finalizeMcp = () => {
+        if (mcpFinalized) return;
+        mcpFinalized = true;
+        try {
+          restoreMcp();
+        } catch (error) {
+          emit({
+            ...base(threadId, turnId),
+            type: "runtime.error",
+            message: `could not restore Antigravity's MCP config: ${error instanceof Error ? error.message : String(error)}`,
+          });
+        } finally {
+          releaseMcpLease();
+        }
+      };
+      const armTerminationEscalation = () => {
+        if (childClosed || terminationEscalation) return;
+        terminationEscalation = setTimeout(() => {
+          if (childClosed) return;
+          if (process.platform === "win32") {
+            killCliTree(child); // taskkill /T /F is already forceful
+            return;
+          }
+          try {
+            const pid = child.pid;
+            if (pid) process.kill(-pid, "SIGKILL");
+            else child.kill("SIGKILL");
+          } catch {
+            try {
+              child.kill("SIGKILL");
+            } catch {}
+          }
+        }, 3_000);
+        terminationEscalation.unref?.();
+      };
+      const stop = () => {
+        killCliTree(child); // process groups are POSIX-only
+        armTerminationEscalation();
+      };
+      armPostSettleCleanup = () => {
+        if (childClosed || postSettleReaper) return;
+        // A normal agy process exits immediately after `result`. Give it a
+        // short grace, then reap a zombie. Explicit stops use the same bounded
+        // SIGKILL escalation so an uncooperative child cannot retain the lease.
+        postSettleReaper = setTimeout(stop, 2_000);
+        postSettleReaper.unref?.();
+      };
+
       // conversation_id from the init event → the resumeCursor (session.started
       // is what the harness persists as the cursor). Also seeds tool item ids.
       let conversationId: string | null = null;
@@ -373,7 +652,11 @@ export const AntigravityDriver: ProviderDriver<AntigravityConfig> = {
       });
 
       child.on("close", (code) => {
+        childClosed = true;
         children.delete(child); // close is the true process-exit signal
+        clearTimeout(postSettleReaper);
+        clearTimeout(terminationEscalation);
+        finalizeMcp();
         if (!settled) {
           emit({
             ...base(threadId, turnId),
@@ -384,8 +667,8 @@ export const AntigravityDriver: ProviderDriver<AntigravityConfig> = {
         }
       });
 
-      const stop = () => killCliTree(child); // process groups are POSIX-only
       active.set(threadId, { stop, turnId });
+      pending.delete(threadId);
 
       // 11 min — just above agy's own 10m --print-timeout, so agy normally
       // settles first; this is the backstop for a fully wedged child.
@@ -405,7 +688,7 @@ export const AntigravityDriver: ProviderDriver<AntigravityConfig> = {
 
     const snapshot = async (): Promise<ProviderSnapshot> => {
       const version = await new Promise<string | null>((resolve) => {
-        execCli(config.cli, ["--version"], { timeout: 8000, env: antigravityEnvironment() }, (err, stdout) =>
+        execCli(config.cli, ["--version"], { timeout: 8000, env }, (err, stdout) =>
           resolve(err ? null : stdout.trim()),
         );
       });
@@ -428,7 +711,20 @@ export const AntigravityDriver: ProviderDriver<AntigravityConfig> = {
       snapshot,
       adapter: {
         provider: DRIVER_KIND,
-        capabilities: { sessionModelSwitch: "in-session", images: true },
+        capabilities: {
+          sessionModelSwitch: "in-session",
+          images: true,
+          // Cloud box, Local VM, and VPS computers all mount through the
+          // global mcp_config.json above. Only full-auto instances advertise
+          // it: print mode has no interactive approval channel, and outside
+          // --dangerously-skip-permissions agy auto-denies tools that would
+          // prompt (the accept-edits shell behavior in the header comment),
+          // so a non-fullAuto mount could never fire. localComputerMcp stays
+          // unset on purpose — the host desktop requires per-action human
+          // approval (see contracts.ts), which print mode cannot deliver in
+          // any mode; that returns with the native ACP path (agy issue #31).
+          computerMcp: config.fullAuto,
+        },
         sendTurn,
         interruptTurn: async (threadId) => active.get(threadId)?.stop(),
         respondToRequest: async () => "unavailable" as const, // this engine has no asks to answer
@@ -447,11 +743,12 @@ export const AntigravityDriver: ProviderDriver<AntigravityConfig> = {
           execCli(
             config.cli,
             ["-p", prompt, "--output-format", "text", "--model", "gemini-3.6-flash-low"],
-            { timeout: 60_000, env: antigravityEnvironment() },
+            { timeout: 60_000, env },
             (err, stdout) => (err ? reject(err) : resolve(stdout.trim())),
           );
         }),
       dispose: async () => {
+        disposed = true;
         for (const { stop } of active.values()) stop();
         reapChildren(true); // escalate to SIGKILL — disposal must reap every child
         listeners.clear();
diff --git a/server/testing/fake-agy-cli.ts b/server/testing/fake-agy-cli.ts
index c240ab4b6b..1b671ad97e 100755
--- a/server/testing/fake-agy-cli.ts
+++ b/server/testing/fake-agy-cli.ts
@@ -8,9 +8,16 @@
 // status SUCCESS. Deterministic, no network.
 //
 // Keep this file dependency-free — it runs as a bare `node` subprocess.
-import { writeFileSync } from "node:fs";
+import { readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
 
 const argv = process.argv.slice(2);
+if (process.env.FAKE_AGY_IGNORE_SIGTERM === "1") {
+  process.on("SIGTERM", () => {});
+}
+if (process.env.FAKE_AGY_READY_FILE) {
+  writeFileSync(process.env.FAKE_AGY_READY_FILE, "ready");
+}
 if (process.env.FAKE_AGY_DUMP) {
   writeFileSync(process.env.FAKE_AGY_DUMP, JSON.stringify({ argv, env: process.env }, null, 2));
 }
@@ -19,6 +26,19 @@ if (argv.includes("--version")) {
   process.exit(0);
 }
 
+const delayMs = Number(process.env.FAKE_AGY_DELAY_MS ?? 0);
+if (Number.isFinite(delayMs) && delayMs > 0) {
+  await new Promise((resolve) => setTimeout(resolve, delayMs));
+}
+if (process.env.FAKE_AGY_MCP_DUMP) {
+  const home = process.env.HOME || process.env.USERPROFILE || "";
+  let config = "null";
+  try {
+    config = readFileSync(join(home, ".gemini", "config", "mcp_config.json"), "utf8");
+  } catch {}
+  writeFileSync(process.env.FAKE_AGY_MCP_DUMP, config);
+}
+
 const out = (obj: unknown) => process.stdout.write(JSON.stringify(obj) + "\n");
 const CONV = "conv-fake-123";
 
@@ -33,4 +53,8 @@ out({ event: "step_update", conversation_id: CONV, step_update: { conversation_i
 out({ event: "step_update", conversation_id: CONV, step_update: { conversation_id: CONV, step_index: 0, state: "DONE", step_type: "tool", tool_name: "write_to_file", tool_info: { name: "write_to_file", parameters: {} } } });
 out({ event: "step_update", conversation_id: CONV, step_update: { conversation_id: CONV, step_index: 1, state: "DONE", step_type: "agent_response", usage: { input_tokens: 100, output_tokens: 20, thinking_tokens: 0, cache_read_tokens: 5, total_tokens: 125 } } });
 out({ event: "result", conversation_id: CONV, result: { conversation_id: CONV, status: "SUCCESS", response: "done from fake agy", duration_seconds: 1, num_turns: 1, usage: { input_tokens: 100, output_tokens: 20, thinking_tokens: 0, cache_read_tokens: 5, total_tokens: 125 } } });
+const postResultDelayMs = Number(process.env.FAKE_AGY_POST_RESULT_DELAY_MS ?? 0);
+if (Number.isFinite(postResultDelayMs) && postResultDelayMs > 0) {
+  await new Promise((resolve) => setTimeout(resolve, postResultDelayMs));
+}
 process.exit(0);