Is Browser MCP - Automate your browser using VS Code, Cursor, Claude, and more safe?
We analyzed Browser MCP - Automate your browser using VS Code, Cursor, Claude, and more version 1.3.4's actual code and gave it a 55/100 trust score. This…
Bottom line
This is a purpose-aligned but highly privileged automation extension with a serious unauthenticated local control channel.
What it can access
It can inspect screenshots and page content and control any connected website, using broad all-site and debugger access for its automation purpose.[Q1][Q2][Q3]
Security weaknesses
The local control channel lacks its own authentication, so another local process could control the selected tab while it remains connected.[Q16][Q19]
Signs of misuse
No clear vendor misuse is shown, but the extension sends account analytics and persistent identifiers while local automation can expose sensitive page content.[Q6][Q13][Q14]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests debugger, scripting, tabs, webNavigation, storage and all-site access. These unusually powerful permissions match its advertised browser-automation purpose, but compromise would have high impact.
Declares debugger, scripting, storage, tabs, webNavigation and <all_urls> access. — manifest.json:12-24
Which websites can it run on, and can it read or change what appears on those pages?
For the connected tab it can obtain an accessibility snapshot, URL, title and screenshot, then navigate, click, drag, hover, type, select options and press keys. That is the product's stated function.
Registers browser_navigate, snapshot, screenshot, click, drag, hover, type, select-option, key, history and console-log tools. — background.js:587
Runs the packaged content helper on all sites for element lookup and interaction. — manifest.json:47-55
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
Accessibility snapshots and screenshots can expose sensitive content displayed in the connected tab. The tool can also type supplied secrets into fields.
browser_snapshot returns a page accessibility representation and browser_screenshot returns the visible page image to the local MCP socket. — background.js:587
browser_type resolves an element and sends supplied text through Chrome input commands. — background.js:573,587
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
No evidence of this behavior was found in the reviewed package.
The complete MCP tool union has no cookie, network-storage, history, bookmark or download tool. — background.js:587
Requests no cookies, history, bookmarks or downloads permission. — manifest.json:12-24
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It captures screenshots of the connected tab. It does not access arbitrary local files, location, camera, microphone, clipboard or native applications in the registered product tools.
browser_screenshot uses captureVisibleTab or Page.captureScreenshot, resizes the image and returns it. — background.js:587
Declares no file-system, geolocation, camera, microphone, clipboard or nativeMessaging permission. — manifest.json:12-24
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
Page snapshots, screenshots, URLs, titles and console logs are returned through ws://localhost:9009 to the local MCP process that requested them. PostHog and Amplitude receive account identity and event names such as the tool used, but no page content is attached to those observed telemetry events.
Creates a localhost WebSocket, registers page-data and automation handlers, and sends each response back on that socket. — background.js:587
Analytics identifies the logged-in user and records install/open/tool events; the MCP tool event contains the tool name. — background.js:26,587
Does it download or run code, settings, or instructions supplied by a remote server?
The localhost MCP server supplies structured browser commands and text to type. These instructions actively control the connected tab, but the finite packaged command dispatcher does not download JavaScript or evaluate arbitrary server-supplied code.
Parses named WebSocket messages against a fixed schema and dispatches them through a fixed Lq command table. — background.js:587
The registered commands omit arbitrary evaluate-script or execute-JavaScript functionality. — background.js:587
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
The user must click Connect for a specific tab, and can disconnect it. Connection first navigates that tab to Browser MCP's blank page.
Shows Connect/Connect from this tab and Disconnect controls backed by local:selectedTabId. — chunks/popup-xxiXE7fj.js:663
The connect flow stores the selected tab and navigates it to the packaged production blank route before automation. — chunks/popup-xxiXE7fj.js:663
Processes socket commands directly while selectedTabId remains set. — background.js:587
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Declares no search, homepage, proxy, privacy or browser-settings permission. — manifest.json:12-24
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
The package contains about 2.2 MB of compiled/minified JavaScript, including automation, UI, telemetry, Sentry and third-party libraries. Core permissions, commands and destinations remain readable, but the size limits exhaustive manual branch review.
Records an 840,759-byte background bundle, 1,100,278-byte popup chunk and 299,072-byte content script. — inventory.json:1
The automation protocol and tool table remain identifiable despite bundling. — background.js:561-587
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Maps validated command names to fixed functions in the Lq object. — background.js:587
All packaged JavaScript was checked for the requested dynamic-code primitives. — inventory.json:1
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Registers getUrl and getTitle socket handlers for only local:selectedTabId. — background.js:587
Recorded vendor analytics events contain account/install/open/tool usage, not the connected tab URL. — background.js:26,587
Does it create a persistent ID or browser fingerprint to recognize you?
PostHog and Amplitude use persistent analytics identifiers and identify a Browser MCP account by user ID and email after login. Analytics are enabled by default, while a local analyticsEnabled setting can disable event delivery.
Defines local:analyticsEnabled with a true fallback and production PostHog/Amplitude keys. — background.js:4,12,26
Calls PostHog and Amplitude identify with the logged-in user ID and email. — background.js:26
Does it send cookies, session details, authentication data, or page contents elsewhere?
Visible page content, screenshots and console output can go to the local MCP process while a tab is connected. No package path was found sending that material, cookies or login sessions to Browser MCP, PostHog or Amplitude.
Returns snapshots, screenshots and console logs only through the localhost WebSocket response path. — background.js:587
Vendor telemetry logs user identity and the command name, without the command response or page content in the observed call. — background.js:26,587
Does it record typing, form entries, clipboard contents, or screenshots?
It can take screenshots, inspect the accessibility tree, type supplied text and press keys in the connected tab. It does not capture camera or microphone input, and the registered tools do not read the clipboard or continuously log physical keystrokes.
Uses Chrome debugger input events for click, drag, hover, key and text actions and captures screenshots/accessibility snapshots on request. — background.js:573,587
Declares no camera, microphone or clipboard permission. — manifest.json:12-24
Can a website or remote server send commands that make the extension take actions?
Any process serving the expected local WebSocket protocol on port 9009 can issue the fixed browser commands while a tab remains connected. The selected-tab requirement, blank-page start and disconnect control limit exposure; no per-command approval is enforced.
Reconnects to ws://localhost:9009 every second while local:selectedTabId is present and dispatches received named commands. — background.js:587
Only an explicit popup action sets or clears selectedTabId. — chunks/popup-xxiXE7fj.js:663
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
The automation tool table has general user-directed navigation and interaction, not packaged advertising or commerce rewriting. — background.js:587
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
Declares no proxy, webRequest, declarativeNetRequest or downloads permission. — manifest.json:12-24
Observed Chrome DevTools Protocol calls cover Runtime, Input and Page operations, not Network interception. — background.js:561,573,587
Can it communicate with software on the computer or services running on localhost?
Its core control channel is a WebSocket client to ws://localhost:9009. This intentionally delegates the connected tab to a separately installed local MCP service; the extension package does not authenticate that socket itself.
Polls for a selected tab, opens ws://localhost:9009, attaches the debugger and registers command listeners on the socket. — background.js:587
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Parses socket JSON into fixed message types and returns screenshots as image data rather than executable code. — background.js:587
Can ordinary websites access privileged extension features through messaging or exposed files?
Pages under *.browsermcp.io can externally message the extension to log in, log out, emit analytics events, ping it and read its version. They cannot invoke the localhost browser-tool dispatcher.
Restricts externally_connectable to HTTPS subdomains of browsermcp.io. — manifest.json:37-43
External handlers are limited to logIn, logOut, logWebEvent, ping and version. — background.js:26
window.postMessage is used only for WXT content-script invalidation, not privileged browser commands. — content-scripts/content.js:90
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Connect stores the active tab ID and Disconnect clears it. — chunks/popup-xxiXE7fj.js:663
Debugger events and WebSocket commands are scoped to local:selectedTabId. — background.js:561,587
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Background work consists of socket polling, selected-tab automation, screenshots, console collection and telemetry. — background.js:587
Does it change form fields or where a form sends its information?
The local agent can type into editable fields, select options, press Enter and click submit controls in the connected tab. This is explicit browser automation.
browser_type accepts text and an optional submit flag; select-option, press-key and click are also registered commands. — background.js:587
Implements text and key input through Chrome debugger Input commands. — background.js:573