jellyBLOCK
mcp/fabioflorey/jelly
Browser instrumentation for agents.
Verdict
BLOCK
Grade
F
Trust score
57 /100
Exposed tools
28 16r · 11w · 1d
Transport
—
License
NOASSERTION
Stars
3
01
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Browser instrumentation for agents
✨ Quickstart • ⭐ Architecture • ⚡ MCP • 💡 Documentation • 🍯 Tool Index
[](https://github.com/FabioFlorey/jelly/stargazers) [](https://github.com/FabioFlorey/jelly/forks) [](https://github.com/FabioFlorey/jelly/actions/workflows/ci.yml?query=branch%3Amain+event%3Apush) [](./rust-toolchain.toml) [](./LICENSE)
Table of Contents
- 1. What Jelly does
- 2. Use cases
- 3. Quickstart
- 4. Connect your agent
- 5. MCP tools
- 6. MCP usage example
- 7. Work around the click!
- 8. Documentation and support
- 9. Project information
1. What Jelly does
Jelly is a Rust Model Context Protocol (MCP) server that lets authenticated agents inspect and control a real Chromium browser, verify page state, and retain browser artifacts.
Jelly starts or attaches to Chromium and exposes browser capabilities through a local Streamable HTTP MCP endpoint, normally http://127.0.0.1:8787/mcp. A configured HTTPS tunnel or reverse proxy can expose that endpoint to a remote client.
-
Read from source at commit
b6add1ec9067OBSERVED · 2026-10-1202
Exposed tools (28)
16 read · 11 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
artifacts | read | Capture browser artifacts and inspect or control first-class download lifecycle state. |
bad-named-shape | read | Test-only invalid positional grammar. |
browser-lifecycle | write | Start and stop the persistent Chromium browser service and run scoped browser tasks. |
browser-task | write | Open a headed browser, run one agent tool, and close the browser unless persistence is requested. |
call-routine | write | Save, discover, inspect, run or resume reusable named JSON graphs with descriptions, variables, conditions, loops and chained routines. Saving never executes; use browser-call for a simple ordered batch. |
close-browser | write | Gracefully stop the persistent jelly Chromium browser service and clean its state files. |
download | read | Inspect and control first-class browser download lifecycle state, including progress, cancellation, suggested filenames, destination selection, and collision policy. |
downloads | read | List files downloaded into jelly browser download locations. This legacy filesystem view is retained for compatibility; use download for lifecycle state. |
files | write | Move local files into browser-controlled file inputs. |
hitl | read | Pause workflows for human intervention. Telegram is the current HITL transport. |
input | read | Interact with page controls through clicks, typing, keys, selection, checks, dialogs, and drag-and-drop. |
inspect | read | Observe page content, elements, controls, links, images, layout, and accessibility state. |
inspect-network | write | Start, stop, or query persistent browser network capture with optional filters. |
navigation | write | Navigate documents, wait for browser conditions, and move through page history. |
network | read | Capture and inspect browser network traffic. |
open-browser | write | Start the persistent Chromium browser service, optionally opening a URL. Headed mode is the default. |
profile-import | write | Copy a closed Chromium user-data directory into Jelly-managed runtime state for session reuse. This does not guarantee anti-bot or CAPTCHA behavior. |
record-browser | write | Start or stop a browser-content MP4. Use steps for captioned action-by-action evidence; continuous streams renderer frames. Use screenshot for one still image. |
routines | write | Discover, save, run and resume named JSON graph workflows with variables, branches, loops and calls to other routines. |
screenshot | read | Capture a single browser-rendered viewport or targeted element. For a multi-action video use record-browser, not repeated screenshots. |
script | read | Evaluate or inject JavaScript as an explicit browser-page escape hatch. |
storage | read | Inspect and mutate browser cookies plus active-origin localStorage and sessionStorage without page JavaScript. |
tabs | read | List, open, switch, and close browser tabs while preserving the active session. |
unknown-agent-system-tool | read | Test-only system tool with no agent schema mapping. |
verify | read | Establish explicit browser-state predicates and wait for bounded conditions before dependent actions run. |
verify-artifact | read | Verify a captured artifact still exists, is nonempty, and has valid format-specific integrity metadata. |
visual | destructive | Add or remove non-interactive visual annotations from browser-rendered content. |
wait-download | read | Wait for a completed download newer than a supplied timestamp baseline and register it as an artifact. |
03
Trust audit
BLOCKgrade F · trust 57/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (6 observation(s))
- Network
- declared (10 observation(s))
- Shell
- declared (5 observation(s))
- Dependencies
- pinned
- Secrets in source
- found
Findings (25)
HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
src/bin/jelly-fcis-probe.rs:81
fn exec(
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
src/bin/jelly-fcis-probe.rs:453
let (ok, out, err) = exec(&bin.join("jelly-agent-api-probe"), &[mode], &repo, &envs)?;Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
src/bin/jelly-fcis-probe.rs:465
let (_, out, err) = exec(
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
src/bin/jelly-fcis-probe.rs:478
let (ok, out, _) = exec(
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
src/bin/jelly-fcis-probe.rs:493
let (ok, out, _) = exec(
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
MEDIUMInventory / provenance · inv.symlink · CWE-1104
.cargo/config.toml
.cargo/config.toml
Why it matters. link not followed
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
src/bin/jelly-fcis-probe.rs:667
let token = "fcis-test-token-0123456789012345678901234567";
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
src/bin/jelly-fcis-probe.rs:669
let password = "fcis-test-password-012345678901234567890123";
MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59
visual
Why it matters. 1 tool(s) can delete or overwrite
Fix. prefer a read-only mode or scoped tokens; the page states the blast radius
LOWInventory / provenance · inv.binary · CWE-1104
site/assets/fonts/gocake.otf
gocake.otf
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
LOWInventory / provenance · inv.hidden_file · CWE-1104
site/.nojekyll
.nojekyll
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/artifacts.rs:491
assert!(!valid_artifact_id("../../state/secret"));LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/artifacts.rs:492
assert!(!valid_artifact_id("artifact-123-456-7/../../secret"));LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/artifacts.rs:493
assert!(metadata_path("../../state/secret").is_err());LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/mcp/protocol.rs:5
const SERVER_INSTRUCTIONS: &str = include_str!("../../.agent/instructions/mcp.md");LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/mcp/tests.rs:138
"../../tests/fixtures/agent-guidance-cases.json"
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
README.md:33
Jelly starts or attaches to Chromium and exposes browser capabilities through a local **Streamable HTTP** MCP endpoint, normally `http://127.0.0.1:8787/mcp`. A configured HTTPS tunnel or reverse proxy
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
README.md:158
curl --fail --silent --show-error http://127.0.0.1:8787/health
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
README.md:214
curl --fail --silent --show-error http://127.0.0.1:8787/mcp \
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
docs/getting-started/QUICKSTART.md:70
curl --fail --silent --show-error http://127.0.0.1:8787/health
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
docs/getting-started/QUICKSTART.md:71
curl --fail --silent --show-error http://127.0.0.1:8787/ready
LOWPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427
docs/architecture/ARCHITECTURE.md:229
Public `/health` and `/ready` report minimal MCP service state, not browser availability. Detailed `/dashboard`, `/status`, and `/status.json` require operator access through an owner session or admin
Why it matters. an instruction to move sensitive data to an outside destination
Fix. remove; a skill never needs the user's secrets off the machine
INFOInventory / provenance · inv.oversize · CWE-1104
assets/full-logo.png
assets/full-logo.png
Why it matters. 1454251 bytes not read
INFOInventory / provenance · inv.oversize · CWE-1104
assets/jelly-chan.png
assets/jelly-chan.png
Why it matters. 1320831 bytes not read
INFOInventory / provenance · inv.oversize · CWE-1104
assets/og-jelly-chan.png
assets/og-jelly-chan.png
Why it matters. 2305951 bytes not read
Gates applied: no_behavioural_pass.
Audited 2026-10-12 · audit v0.4.1 · source sha
b6add1ec9067full audit observations/trust-audit/mcp-server/fabioflorey__jelly.json · Report an issue / request a re-scan04
Audit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | b6add1ec9067 | BLOCK | F | 57 | first audit |
05
Questions
What is the jelly MCP server?
Browser instrumentation for agents.
What tools does jelly expose?
28 in total: 16 read-only, 11 that write, and 1 that can delete or overwrite (visual). Every one is listed on this page with its risk.
Is jelly safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (57/100) and found 5 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does jelly need?
No credential environment variables were found in its source, so it appears to need none.
How current is this page?
The grade is for one exact copy of the source (b6add1ec9067), read on 2026-10-12. The repository is watched and re-audited when it changes.