selenium-flowBLOCK
A selenium mcp and http workflow client.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
One browser, many calls. Drive a real Chrome or Firefox on Selenium Grid from an agent over MCP — or from anything else over plain HTTP. Same actions, same server, one browser that stays exactly where you left it. 🧭
[](https://github.com/kubed-io/selenium-flow/actions/workflows/test.yml) [](https://github.com/kubed-io/selenium-flow/actions/workflows/quality.yml) [](https://github.com/kubed-io/selenium-flow/actions/workflows/image.yml) [](https://github.com/kubed-io/selenium-flow/wiki) [](LICENSE) [](https://hub.docker.com/r/kubed/selenium-flow) [](https://gofastmcp.com/)
The whole idea, in one breath
Open a browser once. It stays alive — same page, same cookies, same scroll position — while an agent works a task one call at a time, or an n8n workflow steps node to node. Nothing relaunches, nothing logs in twice.
agent ──── MCP /mcp ─────▶ ┌───────────────┐ ┌───────────────┐ │ selenium-flow │ ─────▶ │ Selenium Grid │ ──▶ 🌐 workflow ──── HTTP /browser ──▶ └───────────────┘ └───────────────┘ holds no browser the browser lives here
This server holds no browser. The browser lives on the Grid, and with WORKSPACE_STORE=redis the recor
768dcd40b726OBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add selenium-flow-ui -- npx -y selenium-flow-ui
{
"mcpServers": {
"selenium-flow-ui": {
"command": "npx",
"args": [
"-y",
"selenium-flow-ui"
]
}
}
}Exposed tools (15)
15 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
admin | read | The token. |
auth | read | The bearer token every request needs. |
db | read | Redis database number. |
dirs | read | Directories of secrets. First match wins. |
grafana | read | LDAP sign-in for Grafana |
login | read | Sign in |
password | read | Redis password. |
port | read | Port to listen on. |
public_base_url | read | Where browsers reach this server, for links. |
redis | read | The workspace store’s connection. |
secrets | read | Where secrets are read from. |
selenium-admin | read | Admin token for this server |
server | read | Where it listens, and where it lives. |
the-internet | read | Public demo login |
token | read | Bearer token for every request. Unset is open. |
Trust audit
BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (1 observation(s))
- Network
- declared (1 observation(s))
- Shell
- declared (1 observation(s))
- Dependencies
- pinned
- Secrets in source
- found
Findings (24)
return len(text.encode()) + ENTRY_BYTES, yaml.load(text, Loader=_LOADER)
token = "Tk-bound-secret-token-0123456789" # 32: fits the text
.gitmodules
.hadolint.yaml
"const counts = [eval(local), eval(session)];\n"
"console.log(JSON.stringify({counts, local: eval(read), session: sessionStorage.getItem('t')}));\n",("../../etc/passwd", "passwd"),assert "%2F" in links.file_path("abc", "../../etc/passwd")response = client.get("/flows", headers=named("../../etc"))"sneaky/../../etc",
for attempt in ("../escape", "..", "a/../../b"):self.url = f"http://127.0.0.1:{self.server.server_address[1]}"local = f"http://127.0.0.1:{port}"self.issuer = f"http://127.0.0.1:{port}/realms/example"base = f"http://127.0.0.1:{port}""GRID_URL": "http://127.0.0.1:9",
sys.settrace(lambda *a: None)
sys.settrace(before)
return len(base64.b64decode(value, validate=False))
shot["raw"] = base64.b64decode(image)
data = base64.b64decode(at.driver.print_page(options))
raw = base64.b64decode(b64[:64])
archive = base64.b64decode(response.json()["value"]["contents"])
| [`save_site_data`](https://github.com/kubed-io/selenium-flow/wiki/save_site_data) | `POST /browser/save-site-data` | Keep cookies and storage to restore 🍪 |
Gates applied: no_behavioural_pass.
768dcd40b726full audit observations/trust-audit/mcp-server/kubed-io__selenium-flow.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | 768dcd40b726 | BLOCK | D | 69 | first audit |
Questions
What is the selenium-flow MCP server?
A selenium mcp and http workflow client.
What tools does selenium-flow expose?
15 in total: 15 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is selenium-flow safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (69/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.
What credentials does selenium-flow need?
No credential environment variables were found in its source, so it appears to need none.
How does selenium-flow run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as selenium-flow-ui.
How current is this page?
The grade is for one exact copy of the source (768dcd40b726), read on 2026-10-12. The repository is watched and re-audited when it changes.