github JavaScript re-analysis due

Agent360dk/browser-mcp

github

Drive your real, logged-in Chrome from any AI agent (Claude Code, Cursor, VS Code) — works where headless dies. Reads emailed login codes from your Gmail, solves CAPTCHAs, 34 tools. MIT, local-only.

maintainer
Agent360dk
license
MIT
first seen
2026-06-03
last seen
2026-09-01
releases · 30d
2
short id

Drift inferred · capture-to-capture

tool count over time

08-12 20:32 now
33t
41t
capabilities 41 tools
transport stdio · http verified reported listed in the official MCP registry counts 41 tools · 0 res · 0 prompts permission surface via README inference

tools

  • browser_ask_user

    Show overlay dialog for 2FA, CAPTCHA, credentials, or any user input

  • browser_click

    Click via CSS or text selector (text=Submit, button:text(Next))

  • browser_click_xy

    Escape hatch: click at raw viewport coordinates (CSS pixels) with trusted mouse events

  • browser_clipboard_stats

    Inspect the clipboard's shape (length, trimmed length) without exposing content

  • browser_close_tab

    Close tab (session-owned only)

  • browser_console_logs

    Capture console.log/warn/error messages from page

  • browser_copy_to_clipboard

    Copy an element's value/text to the clipboard without returning the content

  • browser_dismiss_overlays

    Bulk-dismiss popups/modals/tooltips/banners via aria-label/text/×-char heuristics. non_critical mode preserves dialogs with form data

  • browser_double_click

    True double-click (two trusted press/release pairs)

  • browser_drop_file

    Upload via drop-zones: finds hidden <input type="file"> in target subtree/parent (up to 2 levels). Use when browser_upload_file fails because the zone has no visible input

  • browser_execute_script

    Run JavaScript in page context

  • browser_extract_list

    Read every row of a long/virtualised list by scrolling its container until no new rows appear

  • browser_extract_token

    Navigate to provider dashboard + extract API token

  • browser_fetch

    HTTP request from extension (bypasses CORS)

  • browser_fill

    Fill input fields (works on CSP-strict sites)

  • browser_get_cookies

    Get cookies for domain

  • browser_get_local_storage

    Read localStorage

  • browser_get_new_tab

    Get most recently opened tab (OAuth popups)

  • browser_get_page_content

    Get page text or HTML

  • browser_handle_dialog

    Accept/dismiss native alert/confirm/prompt dialogs

  • browser_hover

    Hover for tooltips/dropdowns

  • browser_list_frames

    List iframes on page

  • browser_list_tabs

    List session's tabs only

  • browser_navigate

    Navigate to URL (reuses tab, or new_tab=true)

  • browser_paste_from_clipboard

    Paste the system clipboard into a form field without exposing the content

  • browser_press_key

    Keyboard events (Enter, Tab, Escape, modifiers)

  • browser_reattach_debugger

    Recovery: force-detach and re-attach the Chrome debugger on the current tab

  • browser_right_click

    Right-click to open page-level context menus

  • browser_screenshot

    Screenshot via Chrome Debugger (works even when tab isn't focused)

  • browser_scroll

    Scroll to element or by pixels

  • browser_select_frame

    Execute JS in specific iframe

  • browser_select_option

    Native <select> + custom dropdowns (Angular Material, React Select)

  • browser_set_combobox

    Autocomplete/combobox: type query → wait for filtered listbox → click option (multi-value chip support). Use when browser_select_option fails on lazy-rendered options

  • browser_set_cookies

    Set cookies for a domain

  • browser_set_date

    Robust date inputs: tries native value-set → masked typing → calendar-picker navigation (MUI/AntD/react-datepicker/Lexical). Use when browser_fill fails on date fields

  • browser_set_local_storage

    Write localStorage values

  • browser_solve_captcha

    Detect and solve CAPTCHAs. Auto-detects reCAPTCHA v2/v3, hCaptcha, Turnstile, FunCaptcha. Actions: detect, click_checkbox (auto-click, often passes when signed into Google), click_grid (AI vision guid

  • browser_switch_tab

    Switch to tab by ID

  • browser_upload_file

    Upload files to <input type="file"> via Chrome Debugger API (no dialog)

  • browser_wait

    Wait for element to appear

  • browser_wait_for_network

    Wait for specific API call to complete

skills & danger signals github-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 1b66b52 · analyzer v33 · 6d ago

danger signals14

code evidence vv1.28.0 · github-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 53

filesystem 23

  • fs Agent360dk-browser-mcp-1b66b52/mcp-server/bin/cli.js :16 import { existsSync, mkdirSync, cpSync, readFileSync, writeFileSync } from 'fs';
  • fs Agent360dk-browser-mcp-1b66b52/mcp-server/index.js :21 import { readFileSync, writeFileSync, mkdirSync, appendFileSync } from 'fs';
  • fs (weak) Agent360dk-browser-mcp-1b66b52/scripts/feedback-report.mjs :15 import { readFileSync, existsSync } from 'node:fs';
  • fs (weak) Agent360dk-browser-mcp-1b66b52/scripts/oauth-init.mjs :14 import { readFileSync, writeFileSync } from 'node:fs';
  • fs (weak) Agent360dk-browser-mcp-1b66b52/test/adgang.test.mjs :23 import { readFileSync } from 'node:fs';
  • fs (weak) Agent360dk-browser-mcp-1b66b52/test/baggrundsdrift.test.mjs :19 import { readFileSync } from 'node:fs';
  • fs (weak) Agent360dk-browser-mcp-1b66b52/test/beskeder.test.mjs :14 import { readFileSync } from 'node:fs';
  • fs (weak) Agent360dk-browser-mcp-1b66b52/test/bro.test.mjs :14 import { readFileSync } from 'node:fs';
  • fs (weak) Agent360dk-browser-mcp-1b66b52/test/click-honesty.test.mjs :20 import { readFileSync } from 'node:fs';
  • fs (weak) Agent360dk-browser-mcp-1b66b52/test/dialog.test.mjs :14 import { readFileSync } from 'node:fs';
  • fs (weak) Agent360dk-browser-mcp-1b66b52/test/extension-conflict.test.mjs :20 import { readFileSync } from 'node:fs';
  • fs (weak) Agent360dk-browser-mcp-1b66b52/test/fanevalg.test.mjs :13 import { readFileSync } from 'node:fs';
  • fs (weak) Agent360dk-browser-mcp-1b66b52/test/flow/run.mjs :19 import { readFileSync, writeFileSync, mkdtempSync } from 'node:fs';
  • fs (weak) Agent360dk-browser-mcp-1b66b52/test/offscreen-recovery.test.mjs :18 import { readFileSync } from 'node:fs';
  • fs (weak) Agent360dk-browser-mcp-1b66b52/test/overlay-sikkerhed.test.mjs :24 import { readFileSync } from 'node:fs';
  • fs (weak) Agent360dk-browser-mcp-1b66b52/test/provide-feedback.test.mjs :16 import { readFileSync } from 'node:fs';
  • fs (weak) Agent360dk-browser-mcp-1b66b52/test/release-coherence.test.mjs :15 import { readFileSync, readdirSync, statSync } from 'node:fs';
  • fs (weak) Agent360dk-browser-mcp-1b66b52/test/server-instructions.test.mjs :17 import { readFileSync } from 'node:fs';
  • fs (weak) Agent360dk-browser-mcp-1b66b52/test/session-isolation.test.mjs :21 import { readFileSync } from 'node:fs';
  • fs (weak) Agent360dk-browser-mcp-1b66b52/test/sessioner.test.mjs :19 import { readFileSync } from 'node:fs';
  • fs (weak) Agent360dk-browser-mcp-1b66b52/test/tab-cap.test.mjs :15 import { readFileSync } from 'node:fs';
  • fs (weak) Agent360dk-browser-mcp-1b66b52/test/tool-surface.test.mjs :17 import { readFileSync } from 'node:fs';
  • fs (weak) Agent360dk-browser-mcp-1b66b52/test/vagter.test.mjs :10 import { readFileSync } from 'node:fs';

shell / exec 5

  • shell Agent360dk-browser-mcp-1b66b52/mcp-server/bin/cli.js :17 import { execFileSync } from 'child_process';
  • shell Agent360dk-browser-mcp-1b66b52/mcp-server/index.js :17 import { execSync, execFile } from 'child_process';
  • shell (weak) Agent360dk-browser-mcp-1b66b52/scripts/oauth-init.mjs :15 import { exec } from 'node:child_process';
  • shell (weak) Agent360dk-browser-mcp-1b66b52/test/flow/run.mjs :17 import { spawn } from 'node:child_process';
  • shell (weak) Agent360dk-browser-mcp-1b66b52/test/flow/sessions.mjs :21 import { spawn, execSync } from 'node:child_process';

network 8

  • net Agent360dk-browser-mcp-1b66b52/extension/background.js :3135 const resp = await fetch(params.url, options);
  • net Agent360dk-browser-mcp-1b66b52/extension/offscreen.js :64 const svar = await fetch(`http://127.0.0.1:${port}/`, {
  • net Agent360dk-browser-mcp-1b66b52/mcp-server/extension/background.js :3135 const resp = await fetch(params.url, options);
  • net Agent360dk-browser-mcp-1b66b52/mcp-server/extension/offscreen.js :64 const svar = await fetch(`http://127.0.0.1:${port}/`, {
  • net (weak) Agent360dk-browser-mcp-1b66b52/scripts/oauth-init.mjs :13 import { createServer } from 'node:http';
  • net (weak) Agent360dk-browser-mcp-1b66b52/test/flow/run.mjs :18 import { createServer } from 'node:http';
  • net (weak) Agent360dk-browser-mcp-1b66b52/test/flow/samtidighed.mjs :24 import net from 'node:net';
  • net (weak) Agent360dk-browser-mcp-1b66b52/test/flow/sessions.mjs :22 import { createServer } from 'node:http';

declared dependencies 12

  • @remotion/cli@4.0.442
  • react@19.2.3
  • react-dom@19.2.3
  • remotion@4.0.442
  • @remotion/tailwind-v4@4.0.442
  • tailwindcss@4.0.0
  • @remotion/eslint-config-flat@4.0.442
  • @types/react@19.2.7
  • @types/web@0.0.166
  • eslint@9.19.0
  • prettier@3.8.1
  • typescript@5.9.3