Puppeteer Real BrowserBLOCK
Provides AI assistants with powerful, detection-resistant browser automation capabilities built on ZFC Digital's puppeteer-real-browser package.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://www.npmjs.com/package/puppeteer-real-browser-mcp-server) [](./package.json) [](./LICENSE)
Give an MCP-compatible AI assistant a local Chrome browser that it can open, navigate, read, and control.
Under maintenance: This project is still changing. Themainbranch may be newer than the package published on npm. The npm badge above shows the published version used by@latest.
What it does
This package runs as a local Model Context Protocol (MCP) server. Your MCP client starts the server, and the server starts one Chrome process for browser automation.
Main features:
- Opens a visible browser by default, with optional headless mode
- Navigates pages and reads HTML or text
- Finds elements, clicks, types, waits, and scrolls
- Uses
rebrowser-puppeteer-coreand a small set of anti-detection settings - Detects Chrome on Windows, macOS, and Linux
- Supports a custom Chrome path, proxy, and dedicated automation profile
- Tracks the exact Chrome process it starts and closes only that process
- Enforces a content-first workflow before page interaction
No browser automation is invisible. Websites may still detect it or block it.
Safety and current limits
Please read this before using the server:
- Use it only on websites you are allowed to automate.
- Review tool calls before approving logins, forms, purchases, downloads, or
other sensitive actions.
- The browser and file tools run with your normal user permissions.
- The server supports one browser session at a time.
solve_captchais currently a placeholder. It does not use a CAPTCHA-solving
service. Browser startup only makes a best-effort click on detected Turnstile widgets.
- `save_conte
aae8d240077cOBSERVED · 2026-10-09Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add mcp-server-tests -- npx -y [email protected]
{
"mcpServers": {
"mcp-server-tests": {
"command": "npx",
"args": [
"-y",
"[email protected]"
]
}
}
}Exposed tools (11)
10 read · 1 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
browser_close | read | Close the browser instance |
browser_init | read | Initialize a new browser instance with anti-detection features and automatic Chrome path detection |
click | read | Click on an element |
find_selector | read | Find CSS selector for element containing specific text |
get_content | read | **Recommended** method to get page content (HTML or text) - More reliable than screenshots for content analysis and navigation tasks |
navigate | read | Navigate to a URL |
random_scroll | read | Perform random scrolling with natural timing |
save_content_as_markdown | write | Extract page content and save it as a formatted markdown file |
solve_captcha | read | Attempt to solve CAPTCHAs (if supported) |
type | read | Type text into an input field |
wait | read | Wait for various conditions |
Trust audit
BLOCKgrade D · trust 62/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (2 observation(s))
- Shell
- declared (7 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (14)
content = await pageInstance.$eval(selector, (el: any) => el.innerText || el.textContent || '');
content = await pageInstance.$eval(selector, (el: any) => el.outerHTML || '');
content = await pageInstance.$eval(selector, (el: any) => el.innerText || el.textContent || '');
content = await pageInstance.$eval(selector, (el: any) => el.outerHTML || '');
await pageInstance.$eval(usedSelector, (el: any) => el.click());
'beacon',
browserURL: `http://127.0.0.1:${launcher.port}`,filePath: '../../../etc/passwd.md'
} from '../../src/browser-manager.js';
import { handleBrowserInit, handleBrowserClose } from '../../src/handlers/browser-handlers';import { handleNavigate } from '../../src/handlers/navigation-handlers';import { handleGetContent, handleFindSelector } from '../../src/handlers/content-handlers';{ connectOption: { browserURL: 'http://127.0.0.1:9222' } },date-fns, uuid
Gates applied: no_behavioural_pass.
aae8d240077cfull audit observations/trust-audit/mcp-server/withlinda__puppeteer-real-browser.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-09 | aae8d240077c | BLOCK | D | 62 | first audit |
Questions
What is the Puppeteer Real Browser MCP server?
Provides AI assistants with powerful, detection-resistant browser automation capabilities built on ZFC Digital's puppeteer-real-browser package.
What tools does Puppeteer Real Browser expose?
11 in total: 10 read-only, 1 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is Puppeteer Real Browser safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (62/100) and found 5 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does Puppeteer Real Browser need?
No credential environment variables were found in its source, so it appears to need none.
How does Puppeteer Real Browser run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as mcp-server-tests at 1.0.0.
How current is this page?
The grade is for one exact copy of the source (aae8d240077c), read on 2026-10-09. The repository is watched and re-audited when it changes.