Atlas / MCP servers / confident-christmasfactor2015 / jev-ultrafast-mcp

jev-ultrafast-mcpCAUTION

mcp/confident-christmasfactor2015/jev-ultrafast-mcp

Delegate browser operations to an ultra-fast MCP server, executing full page tasks in seconds with one tool call.

Verdict
CAUTION
Grade
B
Trust score
84 /100
Exposed tools
—
Transport
stdio
License
MIT
Stars
0
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

[](https://confident-christmasfactor2015.github.io)

Welcome to jev-ultrafast-mcp – a tool that lets you hand an entire browser job to a smart helper and get it done in one single request. Instead of telling the computer click-by-clickhire a pro driver who takes the wheelhandles every stepand comes back with the result.

🤔 What Problem Does This Solve?

Imagine you want a computer to fill out a form or test a webpage. Normallyyou would need to give it dozens of tiny instructions: "click herewait now type thatclick submit check the text..." That process is slow and needs a new instruction for every action.

jev-ultrafast-mcp changes that completely. You describe the whole goal at once (like "go to this siteorder the blue shirt and leave a review") and the software figures out all the little steps by itself. It runs the browser on a server (not your screen) using a special decision-making brain that watches the page and clickscorrectly. The entire task costs just one call (one command) not one call for each click. That is a huge speed boost for anyone doing browser work with AI tools.

🧠 Core Benefits at a Glance

  • ✅ One-call flow – Describe the whole job onceand it executes end-to-end automatically
  • ✅ Ref-based element tables – The system tracks every button and box on the page with stable references (no missed clicks from shifting layouts)
  • ✅ Code-checked assertions – After each actionit verifies the page changed correctly (like a self-checking robot)
  • ✅ Zero-model macro replay – Re-run successful flows instantly without using any AI compute (super cheap)
  • ✅ Runs over Chrome DevTools Protocol – Same professional protocol that powers Chrome's own debugging (reliable and standardized)

🚀 Getting St

Read from source at commit a88da7a4be49OBSERVED · 2026-10-11
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude-code (pypi)
claude mcp add jev-ultrafast-mcp -- uvx jev-ultrafast-mcp==0.1.5
03

Trust audit

CAUTIONgrade B · trust 84/100 Install with care. The audit found things worth knowing before you trust its output.

LayerWhat it checksResult
L0Provenance & inventoryWARN
L1Static analysis of the codeWARN
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (4 observation(s))
Network
declared (6 observation(s))
Shell
none-observed
Dependencies
pinned
Secrets in source
found

Findings (13)

MEDIUMInventory / provenance · inv.binary · CWE-1104
chrome-extension/icons/jev-ultrafast-mcp-3.7.zip
jev-ultrafast-mcp-3.7.zip
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
.env.example:54
# JEVMCP_CDP_URL=http://127.0.0.1:9222
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
tests/test_macro_recording.py:34
PASSWORD = "correct-horse-battery-staple"
LOWNetwork egress · net.beacon_words · CWE-200, CWE-319
tests/test_page_idle.py:175
_sent(session.cdp, "beacon.js")
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
README.zh-CN.md:381
[obs#1] http://127.0.0.1:54409/fixture.html  "Ultrafast Fixture"  scroll=0/860  reachable=16/16
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
README.zh-CN.md:403
[delta#2] http://127.0.0.1:54409/fixture.html  "Ultrafast Fixture"  reachable=16/16
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
README.zh-CN.md:599
| 否 | `JEVMCP_CDP_URL` | — | `mode=attach` 时填 `http://127.0.0.1:9222`;也可以直接给 `ws://` 地址跳过发现步骤 |
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
README.zh-CN.md:673
可以。`JEVMCP_MODE=attach` 加 `JEVMCP_CDP_URL=http://127.0.0.1:9222` 就是驱动你自己的 Chrome。
LOWObfuscation / stealth · obf.decode_call · CWE-506, CWE-94
jev_ultrafast_mcp/browser.py:1134
path.write_bytes(base64.b64decode(result["data"]))
LOWObfuscation / stealth · obf.decode_call · CWE-506, CWE-94
scripts/extension_check.py:330
path.write_bytes(base64.b64decode(data["data"]))
LOWObfuscation / stealth · obf.decode_call · CWE-506, CWE-94
tests/test_extension.py:124
codecs.decode(escape, "unicode_escape")
LOWPrompt injection · prompt.authority_framing · CWE-94, CWE-1427
README.md:121
CDP is the official language that Chrome browsers speak to developers. Instead of using third-party hacks or flaky screen-simulationthis tool speaks directly to Chromium's core. That gives you rock-so
LOWInventory / provenance · mcp.no_tools_extracted · CWE-1104
server.json
Why it matters. the tool list is enumerated at runtime by tools/list, not declared in source
Fix. the page says so rather than showing an empty table

Gates applied: no_behavioural_pass.

Audited 2026-10-11 · audit v0.4.1 · source sha a88da7a4be49full audit observations/trust-audit/mcp-server/confident-christmasfactor2015__jev-ultrafast-mcp.json · Report an issue / request a re-scan
04

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-11a88da7a4be49CAUTIONB84first audit
05

Questions

What is the jev-ultrafast-mcp MCP server?

Delegate browser operations to an ultra-fast MCP server, executing full page tasks in seconds with one tool call.

Is jev-ultrafast-mcp safe to connect to an agent?

With care. The audit graded it B (84/100) and found 13 things worth knowing before you trust this server, listed below with the exact line each was found on.

What credentials does jev-ultrafast-mcp need?

No credential environment variables were found in its source, so it appears to need none.

How does jev-ultrafast-mcp run?

It speaks stdio, so it runs as a local process your client starts. It is published on PyPI as jev-ultrafast-mcp.

How current is this page?

The grade is for one exact copy of the source (a88da7a4be49), read on 2026-10-11. The repository is watched and re-audited when it changes.

Advertisement