MCP server · Audited from source

Chrome Browser MCP server

by hangwin/mcp-chromeMIT licenceAudited 20 Sep 2026 · source 54eb663ae58f

npm @chrome-mcp/wasm-simd 0.1.0ssestdiostreamable-http★ 12,438

✕BLOCKGrade F · 43/100 · 20 Sep 2026 · 54eb663

Safer alternatives View source on GitHub ↗

Is it safe? No — BLOCK, grade F (43/100). It exposes 7 tools: 7 read, 0 write and 0 destructive. The audit recorded 36 findings (0 critical, 8 high, 4 medium, 21 low). Maintainer's description: Chrome MCP Server is a Chrome extension-based Model Context Protocol (MCP) server that exposes your Chrome browser functionality to AI assistants like Claude, enabling complex browser automation, content analysis, and semantic search.

Ask an AI about this pageGChatGPT CClaude PPerplexity GeGemini XGrok

CoCopilot AIGoogle AI Mode

Cite

Cite this page

ModelsAtlas. “Chrome Browser MCP server (hangwin/mcp-chrome)”. Retrieved 20 Sep 2026. https://modelsatlas.com/mcp/hangwin/chrome-browser

Why this is BLOCK. The audit found 0 critical and 8 high findings; the most severe is Inventory / provenance at app/chrome-extension/entrypoints/web-editor-v2/core/payload-builder.ts. Each finding is listed below with its file and line.

Why this page is still public. People search for this server by name. Hiding it would leave them with the README's word alone; here they see what the code does. We list it so you can decide, and we do not show connect commands for BLOCK servers.

Trust audit

Audit 0.4.1 · full source read 20 Sep 2026

Trust score43/100✕BLOCK F

0 critical8 high4 medium21 low3 info

36 findings, listed below with the file and line each was found on. Grade A needs a sandboxed behavioural run too; this audit read the source only.

What the source does

FilesystemDeclared10 observations
NetworkDeclared10 observations
ShellDeclared10 observations
DependenciesNot pinnedSome ranges float
SecretsNone foundNo keys in source

Findings (36)

Sorted by severity · the 25 most severe of 36 are listed

HIGHInventory / provenanceinv.suspicious_name · app/chrome-extension/entrypoints/web-editor-v2/core/payload-builder.ts

F-13 Inventory / provenanceCWE-1104Layer L0

payload-builder.ts

Why: member named after an attack tool
Fix: remove or justify

HIGHCode injectioncode.eval_exec · app/chrome-extension/entrypoints/background/record-replay/actions/handlers/extract.ts:93

F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1

const fn = new Function(code);

Why: evaluates text as code
Fix: remove; use a parser or a dispatch table

HIGHCode injectioncode.eval_exec · app/chrome-extension/entrypoints/background/record-replay/actions/handlers/script.ts:118

F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1

const fn = new Function(...argNames, wrappedCode);

Why: evaluates text as code
Fix: remove; use a parser or a dispatch table

HIGHCode injectioncode.eval_exec · app/chrome-extension/entrypoints/background/record-replay/nodes/conditional.ts:18

F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1

const fn = new Function(

Why: evaluates text as code
Fix: remove; use a parser or a dispatch table

HIGHCode injectioncode.eval_exec · app/chrome-extension/entrypoints/background/record-replay/nodes/conditional.ts:40

F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1

const fn = new Function(

Why: evaluates text as code
Fix: remove; use a parser or a dispatch table

HIGHCode injectioncode.eval_exec · app/chrome-extension/entrypoints/background/tools/browser/inject-script.ts:201

F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1

func: (code) => new Function(code)(),

Why: evaluates text as code
Fix: remove; use a parser or a dispatch table

HIGHNetwork egressnet.tls_off · app/chrome-extension/inject-scripts/element-marker.js:1696

F-04 Network egressCWE-200 · CWE-319Layer L1

{ color = CONFIG.COLORS.HOVER, dashed = true, offsetX = 0, offsetY = 0, isVerify = false } = {},

Why: certificate verification is disabled
Fix: leave verification on

HIGHNetwork egressnet.tls_off · app/chrome-extension/inject-scripts/element-marker.js:1737

F-04 Network egressCWE-200 · CWE-319Layer L1

function drawRects(elements, color = CONFIG.COLORS.HOVER, dashed = true, isVerify = false) {

Why: certificate verification is disabled
Fix: leave verification on

MEDIUMInventory / provenanceinv.binary · app/chrome-extension/workers/simd_math_bg.wasm

F-13 Inventory / provenanceCWE-1104Layer L0

simd_math_bg.wasm

Why: a compiled or binary member cannot be reviewed from source
Fix: ship source, or explain the binary in the README

MEDIUMNetwork egressnet.raw_ip · app/chrome-extension/entrypoints/background/quick-panel/agent-handler.ts:242

F-04 Network egressCWE-200 · CWE-319Layer L1

const url = `http://127.0.0.1:${port}/agent/sessions/${encodeURIComponent(sessionId)}`;

Why: No further detail recorded for this rule.
Fix: —

MEDIUMNetwork egressnet.raw_ip · app/chrome-extension/entrypoints/background/quick-panel/agent-handler.ts:324

F-04 Network egressCWE-200 · CWE-319Layer L1

const sseUrl = `http://127.0.0.1:${request.port}/agent/chat/${encodeURIComponent(request.sessionId)}/stream`;

Why: No further detail recorded for this rule.
Fix: —

MEDIUMNetwork egressnet.raw_ip · app/chrome-extension/entrypoints/background/quick-panel/agent-handler.ts:423

F-04 Network egressCWE-200 · CWE-319Layer L1

const url = `http://127.0.0.1:${request.port}/agent/chat/${encodeURIComponent(request.sessionId)}/act`;

Why: No further detail recorded for this rule.
Fix: —

LOWInventory / provenanceinv.hidden_file · .prettierignore

F-13 Inventory / provenanceCWE-1104Layer L0

.prettierignore

Why: hidden member outside the usual dotfiles
Fix: review its purpose

LOWInventory / provenanceinv.hidden_file · .prettierrc.json

F-13 Inventory / provenanceCWE-1104Layer L0

.prettierrc.json

Why: hidden member outside the usual dotfiles
Fix: review its purpose

LOWFilesystem / pathfs.traversal · app/chrome-extension/entrypoints/background/record-replay-v3/engine/kernel/artifacts.ts:6

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

import type { NodeId, RunId } from '../../domain/ids';

Why: No further detail recorded for this rule.
Fix: —

LOWFilesystem / pathfs.traversal · app/chrome-extension/entrypoints/background/record-replay-v3/engine/kernel/artifacts.ts:7

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

import type { RRError } from '../../domain/errors';

Why: No further detail recorded for this rule.
Fix: —

LOWFilesystem / pathfs.traversal · app/chrome-extension/entrypoints/background/record-replay-v3/engine/kernel/artifacts.ts:8

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

import { RR_ERROR_CODES, createRRError } from '../../domain/errors';

Why: No further detail recorded for this rule.
Fix: —

LOWFilesystem / pathfs.traversal · app/chrome-extension/entrypoints/background/record-replay-v3/engine/kernel/breakpoints.ts:6

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

import type { NodeId, RunId } from '../../domain/ids';

Why: No further detail recorded for this rule.
Fix: —

LOWFilesystem / pathfs.traversal · app/chrome-extension/entrypoints/background/record-replay-v3/engine/kernel/breakpoints.ts:7

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

import type { Breakpoint, DebuggerState } from '../../domain/debug';

Why: No further detail recorded for this rule.
Fix: —

LOWNetwork egressnet.raw_ip · README.md:103

F-04 Network egressCWE-200 · CWE-319Layer L1

"url": "http://127.0.0.1:12306/mcp"

Why: No further detail recorded for this rule.
Fix: —

LOWNetwork egressnet.raw_ip · README_zh.md:101

F-04 Network egressCWE-200 · CWE-319Layer L1

"url": "http://127.0.0.1:12306/mcp"

Why: No further detail recorded for this rule.
Fix: —

LOWObfuscation / stealthobf.decode_call · app/chrome-extension/entrypoints/background/tools/browser/gif-recorder.ts:1127

F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1

const byteChars = atob(base64Data);

Why: No further detail recorded for this rule.
Fix: —

LOWObfuscation / stealthobf.decode_call · app/chrome-extension/inject-scripts/network-helper.js:44

F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1

const decodedString = atob(base64);

Why: No further detail recorded for this rule.
Fix: —

LOWSupply chainsupply.unpinned · app/chrome-extension/package.json

F-08 Supply chainCWE-829 · CWE-1357Layer L1

@modelcontextprotocol/sdk, @vue-flow/background, @vue-flow/controls, @vue-flow/core, @vue-flow/minimap, @xenova/transformers, date-fns, elkjs

Why: 25 dependency range(s) float
Fix: pin exact versions or ship a lockfile

LOWSupply chainsupply.unpinned · app/native-server/package.json

F-08 Supply chainCWE-829 · CWE-1357Layer L1

@anthropic-ai/claude-agent-sdk, @fastify/cors, @modelcontextprotocol/sdk, better-sqlite3, chalk, chrome-devtools-frontend, commander, drizzle-orm

Why: 29 dependency range(s) float
Fix: pin exact versions or ship a lockfile

Tools it exposes

7 declared in source · 0 destructive

7 read0 write0 destructive

Tool	What it does	Risk
`Auto`	Cursor auto-selects the best model	read
`GPT-4.1`	OpenAI model via Cursor	read
`GPT-5.1`	OpenAI high-quality reasoning model	read
`GPT-5.2`	OpenAI flagship reasoning model with extended effort support	read
`Test`	A test flow	read
`__MSG_extensionName__`	__MSG_extensionDescription__	read
`url`	Target URL	read

Safer alternatives

We could not match this server to a job, so we cannot suggest a like-for-like alternative. Read-only servers are the least-privilege place to start.

Audit history

2026-09-20
✕BLOCK F 43 / 100
Source changed, verdict held · 54eb663ae58f

README badge

Badges show the current verdict, BLOCK included

A badge cannot be hidden by the maintainer while the verdict is BLOCK. Fix the findings, push, and the re-audit updates it.

Questions about Chrome Browser MCP server

What is the Chrome Browser MCP server?

Chrome MCP Server is a Chrome extension-based Model Context Protocol (MCP) server that exposes your Chrome browser functionality to AI assistants like Claude, enabling complex browser automation, content analysis, and semantic search.

What tools does Chrome Browser expose?

7 in total: 7 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is Chrome Browser safe to connect to an agent?

No — not without reading the findings first. The audit graded it F (43/100) and found 8 critical or high issues in the source. Each one is listed on this page with the file and line it is on.

What credentials does Chrome Browser need?

It reads ANTHROPIC_AUTH_TOKEN and CHROME_EXTENSION_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does Chrome Browser run?

It speaks sse, stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as @chrome-mcp/wasm-simd at 0.1.0.

How current is this page?

The grade is for one exact copy of the source (54eb663ae58f), read on 2026-09-20. The repository is watched and re-audited when it changes.

I already installed Chrome Browser. What should I do?

Remove it from your client's MCP configuration, then rotate any API keys and tokens that were in your environment while it ran.

Can the verdict change?

Yes. The repository is watched and re-audited when its source changes. If the findings are removed the verdict updates, and the history on this page shows it.

Sources

hangwin/mcp-chrome on GitHub — the source we read, its licence, stars and activityObserved · 20 Sep 2026
ModelsAtlas trust audit — BLOCK verdict for commit 54eb663ae58fObserved · 20 Sep 2026

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.

What is the Chrome Browser MCP server?
GChatGPT CClaude PPerplexity
What tools does Chrome Browser expose?
GChatGPT CClaude PPerplexity
Is Chrome Browser safe to connect to an agent?
GChatGPT CClaude PPerplexity