BrowserMCP Secure

Security-hardened fork of Smotree/BrowserMCP — full 36-tool suite, fully open source (server + Chrome extension).

See SECURITY.md for patches, threat model, and hardening options.

MCP server that gives AI assistants full control over your browser. Works with Claude Code, Cursor, and any MCP-compatible client.

The key advantage: uses your real browser session with all cookies, auth tokens, and extensions — no headless browser, no 403 errors.

Quick start

git clone https://github.com/manishpandey9/BrowserMCP-secure.git
cd BrowserMCP-secure
npm install
npm run build
npm run install-mcp   # configures Cursor ~/.cursor/mcp.json

1. Chrome: chrome://extensions → Developer mode → Load unpacked → select extension/
2. Cursor: restart → MCP browser-mcp-secure should connect
3. Extension badge ON (green) when server is running

Architecture

AI Client (Cursor)  --stdio-->  MCP Server (Node.js)  --ws://127.0.0.1:12800-->  Chrome Extension

36 Tools

Core

Navigation

Data Extraction

Utilities

Monitoring

Window Management

Advanced Interaction

Downloads

Installation

1. Clone and build

git clone https://github.com/Smotree/BrowserMCP.git
cd BrowserMCP
npm install
npm run build

2. Load Chrome extension

1. Open chrome://extensions/
2. Enable Developer mode (top right)
3. Click Load unpacked
4. Select the extension/ folder

3. Configure your MCP client

Auto-install (recommended)

Run the install script — it auto-detects Claude Code, VS Code, Cursor, and Claude Desktop:

npm run install-mcp        # install to all detected clients
npm run install-mcp -- --uninstall  # remove from all

Manual setup

claude mcp add --transport stdio --scope user browser -- node /path/to/BrowserMCP/server/dist/index.js

{
  "mcpServers": {
    "browser": {
      "type": "stdio",
      "command": "node",
      "args": ["/path/to/BrowserMCP/server/dist/index.js"]
    }
  }
}

{
  "servers": {
    "browser": {
      "command": "node",
      "args": ["/path/to/BrowserMCP/server/dist/index.js"],
      "type": "stdio"
    }
  }
}

{
  "mcpServers": {
    "browser": {
      "command": "node",
      "args": ["/path/to/BrowserMCP/server/dist/index.js"]
    }
  }
}

4. Verify

The extension badge shows ON (green) when connected, OFF (red) when disconnected. The extension auto-reconnects within 1-2 seconds when the server starts.

Testing

A test page and two test scripts are included:

# Serve the test page
npm run test:serve

# Quick test — verifies all tools with DOM state checks
# (close Claude Code first to free port 12800)
npm run test:quick

# Demo test — visual walkthrough of all tools for screen recording
npm run test:demo

Both test scripts auto-kill any process on port 12800 before starting.

Configuration

Multi-instance (HTTP Relay)

When multiple IDE windows are open, each launches its own BrowserMCP server. The first instance owns port 12800 and connects to the Chrome extension directly. Subsequent instances detect the port is busy and automatically switch to HTTP relay mode — they proxy commands through the first instance's /exec endpoint. This is transparent: all tools work the same regardless of which instance you use.

Project Structure

BrowserMCP/
  extension/              Chrome extension (Manifest V3)
    background.js           Service worker — WebSocket client, command handlers
    manifest.json           Extension manifest
    popup.html/js           Connection status popup
    icons/                  Extension icons
  server/                 MCP server (TypeScript)
    src/
      index.ts              Entry point — stdio transport + WS bridge
      mcp-server.ts         Creates MCP server, registers tools
      ws-bridge.ts          WebSocket server with request correlation
      types.ts              Shared types
      tools/                Tool definitions by category
        core.ts             navigate, read_page, list_tabs, etc.
        navigation.ts       scroll, back, forward, keyboard, etc.
        extraction.ts       get_links, extract_table, get_cookies, etc.
        utilities.ts        wait_for, new_tab, reload, find_text, etc.
        interaction.ts      right_click, double_click, drag_drop
        monitoring.ts       console_log, network_log, inject_css, etc.
        window.ts           new_window, resize_window, pin_tab, etc.
        content.ts          highlight, readability, watch_changes, etc.
  test/
    test-page.html          Test page exercising all 36 tools
    quick-test.mjs          Automated test with assertions
    demo-test.mjs           Visual demo for screen recording

How It Works

1. MCP client (Claude Code) spawns node server/dist/index.js as a child process
2. Server communicates with the client via stdin/stdout (MCP protocol)
3. Server starts a WebSocket server on port 12800
4. Chrome extension connects to the WebSocket and waits for commands
5. When a tool is called, server sends a command to the extension via WebSocket
6. Extension executes the command using Chrome APIs and returns the result
7. Server forwards the result back to the MCP client

License

MIT