AgentDeskAI/browser-tools-mcp v2.0.0

v2.0.0 — the security rewrite

on GitHub

Upgrade regardless of what else you want from 2.0 — 1.2.x contains a critical remote code execution vulnerability. See GHSA-xvrv-w8pg-f25f (CVSS 9.8).

2.0 is a rewrite. One process instead of three, no unauthenticated local server, credentials scrubbed before they leave the browser, and 400 tests where there were none.

Start here

• MIGRATION.md — what changes for you
• CHANGELOG.md — the full list
• browsertools.agentdesk.ai — installation and reference

{
  "mcpServers": {
    "browser-tools": {
      "command": "npx",
      "args": ["-y", "@agentdeskai/browser-tools-mcp@latest"]
    }
  }
}

There is no second server to start. Reinstall the extension — 1.x and 2.0 are not compatible. Node 22.19+.

Security

The RCE is fixed by design change, not patch: loopback-only binding, a per-run bearer token, browser-extension origins only on the WebSocket, Host validation, and no captured value reaching a shell. The extension's private-network scan is gone. Credentials are redacted in the browser before anything is transmitted. All 24 vulnerable 1.x releases are deprecated on npm.

Highlights

• Single process. The MCP server embeds the connector.
• Screenshots reach the model as images, within a byte budget that degrades PNG → JPEG → downscale rather than blowing past what a context can take.
• Multi-tab. Per-tab attribution and retention; every result reports its tabId and url.
• Resources. Full console/network history, HAR 1.2 export, screenshots and unabridged Lighthouse reports at browser-tools:// URIs, linked rather than inlined.
• 16 tools with output schemas and annotations, plus keyword filters and paging. Guidance moved to MCP prompts.
• --doctor diagnoses a broken setup; --verbose shows capture as it happens.
• Audits work without Google Chrome — any Chromium-based browser.

Thanks

This release reimplements ideas from contributors whose PRs could not merge against rewritten code. Credit to @mirageN1349, @pntgoswami18, @ymrdf (stdio purity), @lukasvdberk (screenshots as images), @bryankthompson (tool annotations), @yj1438 (keyword filters), @isaiahbjork (refreshBrowser), @zzh948498 (stringSizeLimit), @thepushkarp (browser storage), @bmacer (tool selection), @TargiX (undocked DevTools), @rogeriochaves (cross-browser design), @Jinsoo1004, @wer416182-afk, @xianzuyang9-blip.

And to @notwo1f, @wing3e, @VitorLourenco and @AgentSeal, who reported the security issues and waited a long time for an answer.

Known limits

Network capture starts when DevTools opens — reload for a full page load. Firefox is built for but unverified; screenshots will not work there. Audits launch a separate browser and take up to a minute.