From your question it seems that you want to control someone's account to perform operations (e.g. send tokens, ETH..).
About "controlling" MetaMask. It is not possible. As Pranay said, MetaMask is a signer and it is not supposed to be interacted to, if not from the user.
What you can do instead is:
- Have the user give you their private key. I am saying this only for academic reasons, but with the user private key you can do everything! Of course it's very difficult that a user will trust you so much to give you the private key, so I would say to DO NOT CONSIDER THIS OPTION.
Pros: god mode on user's wallet
Cons: Too risky, no one will give you their private key
- Have a smart contract do these operations for the user. The user would have to approve the ERC20 tokens they want to move and then the contract would "get" them from the user's wallet and move them somewhere else. The transaction that moves the funds can be called by the same user or by anyone else.
Pros: easy to do
Cons: cannot move ETH, only ERC20
- Have the user send their funds to a wallet you control. Same as option 1, you'd have total control over that wallet and the user would send you only the amount of funds they are willing to entrust you with.
Pros: god mode on your own wallet
Cons: User has to send you the funds (or have a contract doing so). I have never seen this happening but, who knows.