browser-compat-mcp-serverBLOCK
Browser compatibility and Baseline status for any web feature — offline, from MDN's browser-compat-data, web-features, and caniuse. STDIO or Streamable HTTP.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
@cyanheads/browser-compat-mcp-server Browser compatibility and Baseline status for any web feature — offline, from MDN's browser-compat-data, web-features, and caniuse. STDIO or Streamable HTTP. 5 Tools
[](https://www.npmjs.com/package/@cyanheads/browser-compat-mcp-server) [](./LICENSE) [](https://modelcontextprotocol.io/) [](https://bun.sh/)
[](https://github.com/cyanheads/browser-compat-mcp-server/releases/latest/download/browser-compat-mcp-server.mcpb) [](https://cursor.com/en/install-mcp?name=browser-compat-mcp-server&config=eyJjb21tYW5kIjoibnB4IiwiYXJncyI6WyIteSIsIkBjeWFuaGVhZHMvYnJvd3Nlci1jb21wYXQtbWNwLXNlcnZlciJdfQ==) [](https://vscode.dev/redirect?url=vscode:mcp/install?%7B%22name%22%3A%22browser-compat-mcp-server%22%2C%22command%22%3A%22npx%22%2C%22args%22%3A%5B%22-y%22%2C%22%40cyanheads%2Fbrowser-compat-mcp-server%22%5D%7D)
[](https://www.npmjs.com/package/@cyanheads/mcp-ts-core)
Public Hosted Server: https://browser-compat.caseyjhand.com/mcp
932c4552cab9OBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add browser-compat-mcp-server -- npx -y @cyanheads/[email protected] run start:stdio
claude mcp add browser-compat-mcp-server -- npx -y @cyanheads/[email protected] run start:http
Trust audit
BLOCKgrade F · trust 45/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | FAIL |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (2 observation(s))
- Network
- declared (1 observation(s))
- Shell
- declared (8 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (18)
**Seed orientation context when the next moves are predictable.** Piggybacking a compact snapshot alongside the primary result — recent activity, tracked state, a few reference items — does two things
- **Mirror a bulk upstream instead of paginating it live.** When the server wraps a large or slow API whose corpus is queried far more than it changes, sync it once into a persistent local index and q
Exercise tools, resources, and prompts against a live HTTP server via MCP JSON-RPC over curl. Starts the server, surfaces the catalog, runs real and adversarial inputs, measures every call (bytes, tok
const tsc = await exec([join(ROOT_DIR, 'node_modules', '.bin', 'tsc'), '-p', project], 'tsc');
const alias = await exec(
exec(cmd: string[], options: { cwd: string }): Promise<ShellResult> {'**/.netrc',
| **Server credential** | The server's own upstream key is missing, or the upstream rejects it (401/403) | `ConfigurationError` — translated in the service, since the automatic status mapping yields `
Prereq: a GitHub PAT with `read:org` + `read:user` scopes stored in Keychain under the service name `mcp-publisher-github-pat`:
2. **No `git stash`, no `git reset --hard`, no `git restore .`, no `git clean -f`, no `git checkout -- .`.** These bypass safety and risk silent data loss. Read-only git (`status`, `diff`, `log`, `sho
Browser compatibility and Baseline status for any web feature — offline, from MDN's browser-compat-data, web-features, and caniuse.
.mcpbignore
const srcRoot = fileURLToPath(new URL('../../src/mcp-server', import.meta.url));new URL('../../src/mcp-server/tools/definitions', import.meta.url),@cyanheads/mcp-ts-core, @mdn/browser-compat-data, browserslist, caniuse-lite, pino-pretty, web-features, zod, @socketsecurity/bun-security-scanner
- [ ] `.codex-plugin/mcp.json` updated — server name key is the unscoped repo name; every user-supplied variable (API key, contact email, instance URL) is listed in `env_vars` so Codex forwards it fro
- [ ] `.codex-plugin/mcp.json` updated — server name key is the unscoped repo name; every user-supplied variable (API key, contact email, instance URL) is listed in `env_vars` so Codex forwards it fro
Gates applied: critical_finding, instruction_override, no_behavioural_pass, undeclared_transfer.
932c4552cab9full audit observations/trust-audit/mcp-server/cyanheads__browser-compat-mcp-server.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | 932c4552cab9 | BLOCK | F | 45 | first audit |
Questions
What is the browser-compat-mcp-server MCP server?
Browser compatibility and Baseline status for any web feature — offline, from MDN's browser-compat-data, web-features, and caniuse. STDIO or Streamable HTTP.
Is browser-compat-mcp-server safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (45/100) and found 11 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does browser-compat-mcp-server need?
No credential environment variables were found in its source, so it appears to need none.
How does browser-compat-mcp-server run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as @cyanheads/browser-compat-mcp-server at 0.2.0.
How current is this page?
The grade is for one exact copy of the source (932c4552cab9), read on 2026-10-12. The repository is watched and re-audited when it changes.