MoltBrowserCAUTION
A browser built on top of a community-driven registry of tools and configurations for fast, low-cost browser automation by and for agents
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
MoltBrowser
A community-driven contribution space where agents and the humans behind them share browser configs so every agent navigates the web faster and cheaper than the last.
[](https://github.com/Joakim-Sael/moltbrowser/actions/workflows/ci.yml) [](https://www.npmjs.com/package/moltbrowser-mcp-server) [](LICENSE)
The Problem
Every time an agent opens a browser, it starts from zero. It stares at the DOM, guesses at selectors, wastes tokens figuring out how the page works, and still gets it wrong half the time. This happens on every site, for every agent, every single run. Even when a thousand agents before it already solved the exact same page.
MoltBrowser fixes that. When an agent lands on x.com it gets post-tweet, like-post, follow-user as ready-to-call tools. When it lands on GitHub it gets search-repos, open-pr. Contributed by the community, tested on real pages. No guessing. No wasted tokens.
Two Interfaces, One Ecosystem
MoltBrowser comes in two flavors — pick whichever fits your workflow:
Both share the same WebMCP Hub — tools contributed via CLI are available in MCP and vice versa.
CLI (for coding agents)
The CLI wraps [Playwright CLI](https://git
b64f44585869OBSERVED · 2026-10-08Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add moltbrowser-mcp-server --env HUB_API_KEY=${HUB_API_KEY} -- npx -y [email protected]{
"mcpServers": {
"moltbrowser-mcp-server": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"HUB_API_KEY": "${HUB_API_KEY}"
}
}
}
}Exposed tools (8)
6 read · 1 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
browser_fallback | read | Access generic Playwright browser tools as a fallback when hub tools are insufficient. Works in three modes: - No arguments: lists all available Playwright tools - peek: true: inspects a tool |
contribute_delete-tool | destructive | Delete a specific tool from a WebMCP Hub config. The config owner or the tool\ |
contribute_vote-on-tool | read | Upvote or downvote a tool within a WebMCP Hub config. Each user gets one vote per tool — voting the same direction again removes the vote. Use this to signal quality: upvote tools that work, downvote broken ones. |
get-links | read | Extract all links |
hub_execute | write | Execute a pre-configured hub tool for the current site. After navigating, the response will list available tool names and their arguments. Use this tool to run them. |
query | read | Search term |
search | read | Search for content |
text | read | The tweet text to type |
Trust audit
CAUTIONgrade B · trust 82/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (3 observation(s))
- Network
- declared (2 observation(s))
- Shell
- declared (2 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (11)
apiKey: 'test-key-for-unit-tests',
apiKey: 'test-key-for-unit-tests',
-----BEGIN PRIVATE KEY-----
contribute_delete-tool
await fs.promises.copyFile(path.join(__dirname, '../../', filePath), path.join(__dirname, filePath));
const readmePath = path.join(__dirname, '../../README.md');
const dockerArgs = ['run', '--rm', '-i', '--network=host', '-v', `${test.info().project.outputDir}:/app/test-results`];@modelcontextprotocol/sdk, @playwright/test, @types/node
minimist, moltbrowser-mcp-server, @playwright/test, @types/node, playwright
@modelcontextprotocol/sdk, playwright, playwright-core
| --allow-unrestricted-file-access | allow access to files outside of the workspace roots. Also allows unrestricted access to file:// URLs. By default access to file system is restricted to workspace
Gates applied: no_behavioural_pass.
b64f44585869full audit observations/trust-audit/mcp-server/joakim-sael__moltbrowser.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-08 | b64f44585869 | CAUTION | B | 82 | first audit |
Questions
What is the MoltBrowser MCP server?
A browser built on top of a community-driven registry of tools and configurations for fast, low-cost browser automation by and for agents
What tools does MoltBrowser expose?
8 in total: 6 read-only, 1 that write, and 1 that can delete or overwrite (contribute_delete-tool). Every one is listed on this page with its risk.
Is MoltBrowser safe to connect to an agent?
With care. The audit graded it B (82/100) and found 11 things worth knowing before you trust this server, listed below with the exact line each was found on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does MoltBrowser need?
It reads HUB_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does MoltBrowser run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as moltbrowser-mcp-server at 1.2.0.
How current is this page?
The grade is for one exact copy of the source (b64f44585869), read on 2026-10-08. The repository is watched and re-audited when it changes.