PlugWiki
Auto Browser logo

Auto Browser MCP Server by LvcidPsyche: Setup for Claude Code, Codex and Cursor

CommunityLocal
GetPyPIauto-browser-mcplvcidpsyche/auto-browser

Lets your assistant drive a real browser on your machine and hand control back to you when needed.

Auto Browser gives Claude Code, Codex, Cursor, VS Code and other assistants a real web browser they can control, with a place for you to step in. It runs as a Docker app on your computer, and your assistant connects to it. Sessions can keep saved logins, and sensitive actions can wait for your approval. Check the safety section before you point it at accounts you care about.

Good for

  • Developers who want an assistant to test and debug internal dashboards
  • Operators who need to log in once and reuse the session
  • People who want a human to step in when a site gets tricky

Works in

12 should work

Tap an app to see how to set it up and any known problems.

Install Auto Browser MCP

Claude Code

  1. 1

    Copy this prompt.

    Add the Auto Browser MCP server to Claude Code. Run this command:
    
    git clone https://github.com/LvcidPsyche/auto-browser.git
    cd auto-browser
    docker compose up --build
    
    Then check that it loaded and tell me if I need to sign in or restart.
  2. 2

    Paste it into Claude Code. It shows the change and asks before running it.

Requires Docker, git.

Start the controller first, then use the HTTP connection. The bridge config after it is an alternative that goes through uvx. If the controller has a bearer token, send it as an Authorization header.

From the project README. Source.

Tools

  • Opens a new browser window the assistant can control

    Starts a fresh browser session, and can go straight to a start page. It can also load a saved login or a memory profile so the session starts signed in.

    Try: “Open a browser on our staging dashboard.”

    Write · browser.create_session

  • Lists your open and past browser sessions

    Shows each session with its name, status, current page and the link for taking over by hand.

    Try: “Which browser sessions do I have open?”

    Read · browser.list_sessions

  • Shows full details for one browser session

    Returns the record for one session, including its status, current page and tabs while it is live.

    Try: “Show me what session abc is doing right now.”

    Read · browser.get_session

  • Copies a session with its login into a new one

    Takes a snapshot of a session's cookies, stored data and page, then opens a new independent session from it.

    Try: “Make a copy of this logged-in session so I can try a second flow.”

    Write · browser.fork_session

  • Reads the current page: buttons, links, text and a screenshot

    Returns a view of the open page with the clickable elements, open tabs, console messages and a summary. Presets let you ask for text only to keep it light.

    Try: “What is on the page right now?”

    Read · browser.observe

  • Takes a picture of what the browser shows

    Captures the visible part of the page as an image, without the full observation data.

    Try: “Take a screenshot of the checkout page.”

    Read · browser.screenshot

  • Reads the page source or just its visible text

    Returns the whole document, or only the visible text if you ask for that, so the assistant can read content outside the viewport.

    Try: “Get the text of this article.”

    Read · browser.get_html

  • Finds things on the page by CSS selector or by text

    Searches the page for matching elements and returns them, either by selector or by a text or pattern match across the page.

    Try: “Find every link on this page that mentions pricing.”

    Read · browser.find_elements

  • Clicks, types, scrolls or goes to a page

    Performs one browser action such as navigate, click, hover, type, press a key, choose an option or scroll. Actions are checked against the rules and logged, and some need an approval first.

    Try: “Log in with the saved profile and click Export.”

    Write · browser.execute_action

  • Asks you to take over the browser by hand

    Flags the session so a person can step in through the live desktop view, for example to solve a login step.

    Try: “I am stuck at the sign-in step, ask me to take over.”

    Write · browser.request_human_takeover

  • Closes a browser session and saves its records

    Ends the session and finalises its trace and files.

    Try: “Close the browser session when you are done.”

    Write · browser.close_session

  • Lists the tabs open in a session

    Returns each open tab in the session by index.

    Try: “What tabs are open?”

    Read · browser.list_tabs

Read from the source code

Permissions

medium risk · 5 things to watch · 13 advisories

Medium risk

The assistant can click, type, download files and reuse saved logins in a real browser, so it can act as you on sites you are signed in to. Keep the allowed-sites list short, keep the API token set, and only save logins for accounts you are happy to expose.

What it can do

  • Read your data
  • Create and change things
  • Delete things
  • Read-only mode

Watch out for

  • It acts as you on signed-in sites

    browser.execute_action can click, type and submit in any session with a saved login. Use throwaway or low-privilege accounts, and keep ALLOWED_HOSTS short. github.com

  • Saved logins sit on disk

    browser.save_auth_profile writes cookies and storage to the controller data folder. Treat that folder like a password store. github.com

  • No password on the controller by default

    API_BEARER_TOKEN is empty in the sample settings. Ports are published on 127.0.0.1 only, but set a token before sharing the machine or opening ports. github.com

  • The full tool set includes delete tools

    MCP_TOOL_PROFILE=full also serves tools that delete memory profiles, proxy personas and cron jobs. The default curated profile does not include them. github.com

  • JavaScript needs your approval each time

    browser.eval_js returns an approval request and waits. Setting AUTONOMOUS_APPROVALS=true lets the agent approve its own requests, so leave it false. github.com

Security advisories

13 known advisories, all fixed in a newer version.

Show all 13

13 other advisories are about the wider auto-browser project, not this MCP server. See them on GitHub

Technical details
Turning on read-onlyNo read-only switch. MCP_TOOL_PROFILE=lean serves only the 7 browse tools, which still include browser.execute_action (click and type).
Talks toAny site on the allowed-hosts list (it defaults to example.com, localhost, 127.0.0.1 and ::1). Anthropic, only for the find-by-vision tool
Sign-in and keysSaved logins are stored as browser state files in the data folder of the Docker app. The bearer token, if you set one, goes in the controller's .env.

Questions

Is Auto Browser official for Claude or Playwright?

No. LvcidPsyche, an independent developer, makes it. It uses Playwright underneath but is not from Anthropic or Microsoft.

What do I need running first?

Docker. You start the controller with Docker Compose from the cloned repository, and your assistant connects to it. The install box lists the steps.

What does the PyPI package do?

It is only a small bridge for apps that cannot connect over a web address, such as Claude Desktop. The browser itself runs in the Docker app.

How many tools does it have?

The default profile serves 21 tools. The lean profile serves 7, and the full profile serves all 75. Set MCP_TOOL_PROFILE on the controller to switch.

Does it need an API key?

Not to start. A bearer token is optional and protects the controller. The vision tool uses Claude Vision and needs an Anthropic key on the controller.

Can it solve CAPTCHAs or bypass logins?

No. The project lists CAPTCHA solving and unauthorized scraping as non-goals, and offers a human takeover view for steps you do by hand.

Has it had security problems?

Yes. The repo lists 13 published advisories, including a critical one fixed in 1.7.0 and high ones fixed in 1.10.2 and 1.11.2. The current release, 1.12.1, is newer than every fix, so none applies to it.

Is it free?

Yes. It is open source under the MIT license and runs locally.

Information

updated Nov 2, 2026

Publisher
Community
Package
auto-browser-mcp
Registry
PyPI
Transport
stdio, Streamable HTTP
Auth
None
Version
1.12.1
License
MIT
Last commit
Oct 30, 2026
Open issues
1

GitHubPyPIChangelogIssues

Sources

Docs, issue trackers and discussions this page is built from. Issues, quotes and findings above link to their own source.

Show all 7
  1. github.com · github.com
  2. github.com · github.com
  3. github.com · github.com
  4. github.com · github.com
  5. github.com · github.com
  6. github.com · github.com
  7. github.com · github.com

Facts from the official MCP registry, GitHub, npm, PyPI and the Docker catalog. Updated Nov 2, 2026.