koala-studios-newton-browserBLOCK
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Newton Browser is a local MCP browser-control product for agents. Each session launches an isolated Chrome or Edge process and controls it through inherited private CDP pipes. By default browser traffic uses Chromium's normal networking with no Newton proxy, origin allowlist, request interception, or resource filtering.
The default runtime requires no browser extension, relay, daemon, debug TCP port, database, telemetry, hosted service, or model-provider integration.
Status
The default source runtime now uses the replacement shared engine, with isolated workers from a shared Newton login source and an optional thin existing-browser adapter. Native actions, precise editing, contextual controls, records/documents, screenshots, tab ownership and update foundations are implemented. This is an unreleased development checkpoint, not completed real-world acceptance.
The legacy direct runtime is retired (2026-09-25): the session engine is the only action, receipt and ref authority. Build, typecheck, boundary lint and the full suite pass. Feedback/reading refinements, platform and authenticated task QA, and three unchanged packed release gates remain open. See the current progress ledger, remaining roadmap and consolidation record.
Version 0.7.2 is published as a GitHub prerelease tarball verified on macOS Chrome; Windows and Linux receipts for it remain open. No npm or browser-store release exists.
Newton implements only stateless MCP 2026-07-28 over newline-delimited stdio JSON. Clients send protocol version and capabilities in every request. Newton exposes no legacy handshake or framing mode.
Requirements
- Node.js 24 or newer.
- A current local Chrome or Edge installation.
- An MCP client that supports MCP
2026-07-28, local stdio servers, and image content.
Build and connect
pnpm install --frozen-lockfile pnpm build node a
4eff255177a5OBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add driver -- npx -y @newton-browser/[email protected]
{
"mcpServers": {
"driver": {
"command": "npx",
"args": [
"-y",
"@newton-browser/[email protected]"
]
}
}
}Exposed tools (13)
11 read · 2 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
browser.command | read | Get or cancel a command without waiting behind input. |
browser.console | read | Console messages and uncaught errors, oldest first. Recording starts on the first call (with the page |
browser.document.continue | read | Continue one immutable document snapshot with its opaque cursor. Snapshots expire after five minutes or when their document changes. |
browser.document.read | read | Read bounded redacted document text, optionally from one container, and receive an opaque continuation cursor. |
browser.existing.discover | read | Probe the configured existing-browser connection and return bounded live tab inventory with instance identity and ownership. Does not claim tabs. Existing mode requires the operator to request their browser. |
browser.existing.setup | read | Check live existing-browser readiness and tab inventory. Reports not_ready when the adapter cannot respond; does not install the extension or claim tabs. |
browser.network | read | Request metadata (method, URL, type, status, failure; never headers), oldest first, or with requestId one text response body from the page |
browser.page.select | read | Select a known session page and return its current bounded state. |
browser.pages.list | read | List attached session pages with document stamps, observed URL/title, opener and selection. Popups do not change the selected page. |
browser.screenshot | read | Capture a bounded PNG with automatic password and sensitive-autocomplete masking across frames and shadow roots. Optional sensitiveZones add explicit masks. Refuses unverifiable geometry or incomplete discovery. |
browser.session.start | write | Default: isolated headless browser at a complete URL. Only when the operator requests their browser, claim a specific existing tab or create an owned background tab using target kind new_tab and a complete URL. |
browser.session.stop | write | Stop this owned session independently of its action queue. |
browser.sessions.list | read | List this MCP process |
Trust audit
BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | FAIL |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (6 observation(s))
- Network
- declared (13 observation(s))
- Shell
- declared (5 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (19)
| Changed extension code followed by self-reload | Passed with developer mode enabled | The same installed extension reports a new boot epoch and rejects its old claim; no reinstall required |
proxyServer: `http://127.0.0.1:${port}`,const started = json(await engine.start({ url: `http://127.0.0.1:${address.port}/` }));const origin=`http://127.0.0.1:${server.address().port}`;const origin=`http://127.0.0.1:${server.address().port}`;const fixtureUrl = `http://127.0.0.1:${address.port}/fixture.html`;const secret = "opaque-cookie-secret";
await client.call('command',{method:'Input.insertText',params:{text:'private-fixture-value'},token:'private-fixture-token'});import { browserExecutableCandidates, discoverBrowserExecutable, trustedLinuxSystemBrowserTarget } from "../../src/browser-runtime/browser-discovery.ts";const guardian = path.resolve(testDirectory, "../../src/browser-runtime/browser-guardian.ts");
import { CdpPipeTransport, CdpTransportError } from "../../src/browser-runtime/cdp-pipe.ts";import { chromiumLaunchArgs, ChromiumLaunchError, launchChromium } from "../../src/browser-runtime/chromium-process.ts";import { browserMajorVersion, headedUserAgent } from "../../src/browser-runtime/browser-user-agent.ts";for (const address of ['10.0.0.1', '172.16.0.1', '172.31.255.255', '192.168.1.1', '127.0.0.1', '0.0.0.0', '169.254.169.254',
'::ffff:10.0.0.1', '::ffff:169.254.169.254', '::ffff:7f00:1', '64:ff9b::a00:1', '2002:a00:1::', '2001:db8::1', 'ff02::1', 'not-an-ip'])
const names = { 'internal.test': ['10.0.0.5'], 'metadata.test': ['169.254.169.254'], 'mixed.test': ['93.184.216.34', '192.168.0.2'], 'postgres': ['172.18.0.4'] };for (const target of ['internal.test:443', 'metadata.test:80', 'mixed.test:443', 'postgres:5432', '127.0.0.1:22', '[::1]:443', '169.254.169.254:80', 'unknown.test:443'])
@types/node, esbuild, typescript
checkout. `claude mcp list` should report the server connected. Start a new session to load its tools.
Gates applied: instruction_override, no_behavioural_pass.
4eff255177a5full audit observations/trust-audit/mcp-server/koala-studios__newton-browser.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 4eff255177a5 | BLOCK | D | 69 | first audit |
Questions
What tools does koala-studios-newton-browser expose?
13 in total: 11 read-only, 2 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is koala-studios-newton-browser safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (69/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.
What credentials does koala-studios-newton-browser need?
No credential environment variables were found in its source, so it appears to need none.
How current is this page?
The grade is for one exact copy of the source (4eff255177a5), read on 2026-10-11. The repository is watched and re-audited when it changes.