
Auto Browser MCP Server by LvcidPsyche: Setup for Claude Code, Codex and Cursor
Lets your assistant drive a real browser on your machine and hand control back to you when needed.
Auto Browser gives Claude Code, Codex, Cursor, VS Code and other assistants a real web browser they can control, with a place for you to step in. It runs as a Docker app on your computer, and your assistant connects to it. Sessions can keep saved logins, and sensitive actions can wait for your approval. Check the safety section before you point it at accounts you care about.
Good for
- Developers who want an assistant to test and debug internal dashboards
- Operators who need to log in once and reuse the session
- People who want a human to step in when a site gets tricky
Works in
12 should work
Tap an app to see how to set it up and any known problems.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Supports local MCP servers.
Client does not support this transport.
Client does not support this transport.
Install Auto Browser MCP
Claude Code
- 1
Copy this prompt.
Add the Auto Browser MCP server to Claude Code. Run this command: git clone https://github.com/LvcidPsyche/auto-browser.git cd auto-browser docker compose up --build Then check that it loaded and tell me if I need to sign in or restart.
- 2
Paste it into Claude Code. It shows the change and asks before running it.
Requires Docker, git.
Start the controller first, then use the HTTP connection. The bridge config after it is an alternative that goes through uvx. If the controller has a bearer token, send it as an Authorization header.
From the project README. Source.
Tools
Opens a new browser window the assistant can control
Starts a fresh browser session, and can go straight to a start page. It can also load a saved login or a memory profile so the session starts signed in.
Try: “Open a browser on our staging dashboard.”
Write ·
browser.create_sessionLists your open and past browser sessions
Shows each session with its name, status, current page and the link for taking over by hand.
Try: “Which browser sessions do I have open?”
Read ·
browser.list_sessionsShows full details for one browser session
Returns the record for one session, including its status, current page and tabs while it is live.
Try: “Show me what session abc is doing right now.”
Read ·
browser.get_sessionCopies a session with its login into a new one
Takes a snapshot of a session's cookies, stored data and page, then opens a new independent session from it.
Try: “Make a copy of this logged-in session so I can try a second flow.”
Write ·
browser.fork_sessionReads the current page: buttons, links, text and a screenshot
Returns a view of the open page with the clickable elements, open tabs, console messages and a summary. Presets let you ask for text only to keep it light.
Try: “What is on the page right now?”
Read ·
browser.observeTakes a picture of what the browser shows
Captures the visible part of the page as an image, without the full observation data.
Try: “Take a screenshot of the checkout page.”
Read ·
browser.screenshotReads the page source or just its visible text
Returns the whole document, or only the visible text if you ask for that, so the assistant can read content outside the viewport.
Try: “Get the text of this article.”
Read ·
browser.get_htmlFinds things on the page by CSS selector or by text
Searches the page for matching elements and returns them, either by selector or by a text or pattern match across the page.
Try: “Find every link on this page that mentions pricing.”
Read ·
browser.find_elementsClicks, types, scrolls or goes to a page
Performs one browser action such as navigate, click, hover, type, press a key, choose an option or scroll. Actions are checked against the rules and logged, and some need an approval first.
Try: “Log in with the saved profile and click Export.”
Write ·
browser.execute_actionAsks you to take over the browser by hand
Flags the session so a person can step in through the live desktop view, for example to solve a login step.
Try: “I am stuck at the sign-in step, ask me to take over.”
Write ·
browser.request_human_takeoverCloses a browser session and saves its records
Ends the session and finalises its trace and files.
Try: “Close the browser session when you are done.”
Write ·
browser.close_sessionLists the tabs open in a session
Returns each open tab in the session by index.
Try: “What tabs are open?”
Read ·
browser.list_tabsSwitches to another tab
Brings one tab to the front so later reads and actions apply to it.
Try: “Switch to the second tab.”
Write ·
browser.activate_tabCloses one tab
Closes the tab at the given index when more than one tab is open.
Try: “Close the pricing tab.”
Write ·
browser.close_tabLists files the browser downloaded
Shows the files captured from downloads in one session.
Try: “What files did that export download?”
Files ·
browser.list_downloadsReads a downloaded file as text
Opens a downloaded CSV, JSON, text or HTML file and returns its contents. Without an id it reads the latest download.
Try: “Read the CSV that just downloaded.”
Files ·
browser.read_downloadLists saved logins you can reuse
Shows the named login profiles that a new session can start from.
Try: “Which saved logins do I have?”
Read ·
browser.list_auth_profilesSaves the current login for reuse
Stores the session's cookies and storage under a name so later sessions open already signed in.
Try: “Save this session as my admin profile.”
Write ·
browser.save_auth_profileWaits until something appears or disappears on the page
Pauses until a CSS selector is visible, hidden, attached or detached, then returns.
Try: “Wait until the results table has loaded.”
Read ·
browser.wait_for_selectorRuns a JavaScript snippet on the current page
Runs one JavaScript expression in the page and returns the result. Each call needs an operator's approval for that exact expression before it runs.
Try: “Run a script to count the rows in the table.”
Runs code ·
browser.eval_jsFinds a button or field by describing it
Uses Claude Vision on a screenshot to locate an element from a plain description and returns its coordinates for a click.
Try: “Find the blue Submit button.”
Network ·
browser.find_by_vision
Read from the source code
Permissions
medium risk · 5 things to watch · 13 advisories
Medium risk
The assistant can click, type, download files and reuse saved logins in a real browser, so it can act as you on sites you are signed in to. Keep the allowed-sites list short, keep the API token set, and only save logins for accounts you are happy to expose.
What it can do
- Read your data
- Create and change things
- Delete things
- Read-only mode
Watch out for
It acts as you on signed-in sites
browser.execute_action can click, type and submit in any session with a saved login. Use throwaway or low-privilege accounts, and keep ALLOWED_HOSTS short. github.com
Saved logins sit on disk
browser.save_auth_profile writes cookies and storage to the controller data folder. Treat that folder like a password store. github.com
No password on the controller by default
API_BEARER_TOKEN is empty in the sample settings. Ports are published on 127.0.0.1 only, but set a token before sharing the machine or opening ports. github.com
The full tool set includes delete tools
MCP_TOOL_PROFILE=full also serves tools that delete memory profiles, proxy personas and cron jobs. The default curated profile does not include them. github.com
JavaScript needs your approval each time
browser.eval_js returns an approval request and waits. Setting AUTONOMOUS_APPROVALS=true lets the agent approve its own requests, so leave it false. github.com
Security advisories
13 known advisories, all fixed in a newer version.
- Unauthenticated browser control plane + "safe" CDP passthrough exposing Runtime.evaluate → account takeover of stored logged-in sessionscritical · Fixed in 1.7.0 · GHSA-xmh3-cw7j-9gp5
- A web page could reach the browser desktop through VNC on port 5900, bypassing noVNC's Origin checkhigh · Fixed in 1.11.2 · GHSA-3pv7-p7w6-q93q
- Named API credentials: one operator could read another's session artifacts and use or redirect their proxy personashigh · Fixed in 1.10.2 · GHSA-m596-6q9j-x6mc
- A page could stop a session's witness receipts; each later action ran, then reported an errormedium · Fixed in 1.11.2 · GHSA-xq9j-p4rw-q2cq
- Content of a page outside ALLOWED_HOSTS reached the agent through popups, logs, downloads, cookies and the pages it chosemedium · Fixed in 1.11.2 · GHSA-j5hf-3vw7-g4cp
Show all 13Show fewer
- Governed approvals could be forged for a tool call, reused after their action started, or skipped by cron toolsmedium · Fixed in 1.11.2 · GHSA-9wxr-2vcc-9x6c
- A page could choose which element an element_id acted onmedium · Fixed in 1.11.1 · GHSA-wrg7-3hw9-f5wj
- Mesh: any API credential could register a peer and call tools without a tokenmedium · Fixed in 1.10.2 · GHSA-hj9r-c8jj-mf9v
- PII scrubbing missed encoded bodies, JSON escapes and URL queries; traces and session forks kept secrets on diskmedium · Fixed in 1.10.2 · GHSA-3pwm-j9pq-4r6q
- Hardening fixes in the controller (1.9.0): click and type targeting, TOTP autofill, session ownership, .env settings, witness verifiermedium · Fixed in 1.9.0 · GHSA-37hm-f6gf-q7vx
- Several hardening fixes in the controller and browser-node (1.8.1)medium · Fixed in 1.8.1 · GHSA-mhmf-ww6p-3jhp
- Safety controls reported success while not functioning: screenshot PII redaction never redacted, and REQUIRE_AUTH_STATE_ENCRYPTION accepted plaintext auth statemedium · Fixed in 1.5.3 · GHSA-32ph-8hp6-7qgj
- Approval double-execution race (check-then-act outside the store lock)low · Fixed in 1.8.1 · GHSA-q7xx-f6pw-w7mv
13 other advisories are about the wider auto-browser project, not this MCP server. See them on GitHub
Technical details
| Turning on read-only | No read-only switch. MCP_TOOL_PROFILE=lean serves only the 7 browse tools, which still include browser.execute_action (click and type). |
|---|---|
| Talks to | Any site on the allowed-hosts list (it defaults to example.com, localhost, 127.0.0.1 and ::1). Anthropic, only for the find-by-vision tool |
| Sign-in and keys | Saved logins are stored as browser state files in the data folder of the Docker app. The bearer token, if you set one, goes in the controller's .env. |
Questions
Is Auto Browser official for Claude or Playwright?
No. LvcidPsyche, an independent developer, makes it. It uses Playwright underneath but is not from Anthropic or Microsoft.
What do I need running first?
Docker. You start the controller with Docker Compose from the cloned repository, and your assistant connects to it. The install box lists the steps.
What does the PyPI package do?
It is only a small bridge for apps that cannot connect over a web address, such as Claude Desktop. The browser itself runs in the Docker app.
How many tools does it have?
The default profile serves 21 tools. The lean profile serves 7, and the full profile serves all 75. Set MCP_TOOL_PROFILE on the controller to switch.
Does it need an API key?
Not to start. A bearer token is optional and protects the controller. The vision tool uses Claude Vision and needs an Anthropic key on the controller.
Can it solve CAPTCHAs or bypass logins?
No. The project lists CAPTCHA solving and unauthorized scraping as non-goals, and offers a human takeover view for steps you do by hand.
Has it had security problems?
Yes. The repo lists 13 published advisories, including a critical one fixed in 1.7.0 and high ones fixed in 1.10.2 and 1.11.2. The current release, 1.12.1, is newer than every fix, so none applies to it.
Is it free?
Yes. It is open source under the MIT license and runs locally.
Information
updated Nov 2, 2026
- Publisher
- Community
- Package
auto-browser-mcp- Registry
- PyPI
- Transport
- stdio, Streamable HTTP
- Auth
- None
- Version
- 1.12.1
- License
- MIT
- Last commit
- Oct 30, 2026
- Open issues
- 1
Sources
Docs, issue trackers and discussions this page is built from. Issues, quotes and findings above link to their own source.
Show all 7Hide
- github.com · github.com
- github.com · github.com
- github.com · github.com
- github.com · github.com
- github.com · github.com
- github.com · github.com
- github.com · github.com