github JavaScript analyzed d9ec4c6

MRsuperkosmos/yx-bridge

github

Browser extension + local MCP server: 250+ tools so an AI agent can read and control your open tabs (Yandex Browser / Chromium). Password, pause switch, browsing stats. | Расширение + локальный MCP-сервер: 250+ инструментов, чтобы ИИ-агент читал и управлял вашими вкладками (Яндекс Браузер / Chromium). Пароль, пауза, статистика.

maintainer
MRsuperkosmos
licence
Apache-2.0
first seen
2026-09-12
last seen
2026-09-13
releases · 30d
1
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 60 tools
transport stdio counts 60 tools · 0 res · 0 prompts permission surface via README inference

tools

  • browser_accessibility_tree

    The page's AX tree (roles, names, values) — a compact semantic map

  • browser_activate_tab

    Make a tab active; focusWindow=false keeps your window in front

  • browser_active_tab

    Current tab

  • browser_article

    Main article text without menus and footers

  • browser_back

    Go back

  • browser_choose

    Pick a radio/checkbox answer by its visible label text

  • browser_clear_data

    Clear cache, cookies, localStorage etc., optionally only for given sites

  • browser_click

    Click the Nth element matching a selector

  • browser_close_tab

    Close a tab

  • browser_console_logs

    console.log/warn/error and uncaught exceptions

  • browser_element_screenshot

    Screenshot of one element

  • browser_eval

    Run JS in the page context (sees page globals and frameworks, bypasses CSP). Use return …, await allowed

  • browser_extract

    Structured scraping: {name: selector or {selector, attr, all, html}}

  • browser_fetch

    HTTP request from the page context (site cookies + origin): status, headers, body. Probe APIs, replay requests

  • browser_fill_form

    Fill many fields at once: inputs, selects, checkboxes, contenteditable; submit

  • browser_find_tabs

    Find tabs by url/title regex

  • browser_find_text

    Substring search with count and context snippets

  • browser_forms

    Forms and fields (passwords masked)

  • browser_get_html

    HTML of the document or of an element by CSS selector

  • browser_get_page

    url, title and the visible text; original=true re-fetches untranslated HTML

  • browser_highlight

    Outline elements to check a selector

  • browser_hover

    Hover to reveal menus and tooltips

  • browser_iframes

    List iframes: src, origin, same-origin flag, sandbox

  • browser_inject_css

    Inject a stylesheet

  • browser_links

    All unique links with text

  • browser_list_tabs

    All tabs: id, window, url, title, active

  • browser_math_extract

    Extract formulas: MathML, LaTeX/TeX (MathJax/KaTeX), inline $…$ / \(…\)

  • browser_meta

    Metadata: canonical, favicon, OpenGraph, all meta, JSON-LD, headings

  • browser_navigate

    Go to a URL and wait for load

  • browser_notify

    Desktop notification from the browser

  • browser_open_tab

    Open a new tab (in the work window if set)

  • browser_outline

    Fast summary aid: title, heading tree, ARIA landmarks, element counts

  • browser_page_code

    The page's code: rendered HTML, inline scripts/styles, external script/style URLs

  • browser_pdf

    Save the page as PDF

  • browser_press_key

    Key press on an element without the debugger

  • browser_query

    querySelectorAll: tag, id, class, text, href/src/value, rect, visibility, attributes

  • browser_quiz_extract

    Scan a test/quiz page for questions and answer inputs (radio/checkbox groups with option labels, text answers, selects)

  • browser_reload

    Reload (optionally bypassing cache)

  • browser_remove

    Remove elements (banners, popups)

  • browser_screenshot

    Screenshot of the tab; fullPage=true for the whole page; saves a file and shows the image

  • browser_scroll

    Scroll the window or to an element

  • browser_scroll_bottom

    Scroll an infinite feed to the end

  • browser_search

    Search with the default search engine

  • browser_security_scan

    Passive overview: CSP, HSTS/X-Frame-Options/etc, inline vs external scripts and origins, forms (CSRF token, https action), mixed content

  • browser_select

    Choose a <select> option by value or text

  • browser_set_attr

    Set or remove an attribute

  • browser_set_html

    Replace element HTML (inner/outer), append/prepend, or set text

  • browser_set_style

    Inline styles

  • browser_speak

    Read text aloud with the built-in TTS

  • browser_status

    Is the extension connected, its version, tabs with the debugger attached

  • browser_storage

    Page localStorage / sessionStorage: get, set, remove, clear, keys

  • browser_storage_dump

    Dump localStorage, sessionStorage, JS cookies and all URL cookies (with flags). Sensitive

  • browser_tab_duplicate

    Duplicate a tab

  • browser_tab_update

    Pin, mute, change url, activate

  • browser_tables

    HTML tables as row arrays, headers from <thead>

  • browser_type

    Type into input/textarea/contenteditable; clear, submit

  • browser_wait_for

    Wait until a selector and/or text appears

  • browser_windows

    All windows with their tabs

  • browser_work_window

    Assign the agent a "work window" so it does not disturb yours: least_tabs picks another window with the fewest tabs, new creates one, a number = windowId, clear resets. While set, new tabs open there

  • browser_zoom

    Tab zoom

skills & danger signals github-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit d9ec4c6 · analyzer v33 · 6d ago

danger signals1

code evidence vv1.0.0 · github-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 25

filesystem 6

  • fs MRsuperkosmos-yx-bridge-d9ec4c6/server/src/cli.js :8 import fs from "node:fs";
  • fs MRsuperkosmos-yx-bridge-d9ec4c6/server/src/profile.js :8 import fs from "node:fs";
  • fs MRsuperkosmos-yx-bridge-d9ec4c6/server/src/server.js :10 import fs from "node:fs";
  • fs (weak) MRsuperkosmos-yx-bridge-d9ec4c6/server/test-extras.mjs :7 import fs from "node:fs";
  • fs (weak) MRsuperkosmos-yx-bridge-d9ec4c6/server/test-media.mjs :7 import fs from "node:fs";
  • fs (weak) MRsuperkosmos-yx-bridge-d9ec4c6/server/test-translate.mjs :6 import fs from "node:fs";

shell / exec 6

  • shell MRsuperkosmos-yx-bridge-d9ec4c6/extension/background.js :1488 return exec(tabId, original ? pageGetOriginal : pageGetInfo, [maxChars]);
  • shell MRsuperkosmos-yx-bridge-d9ec4c6/server/src/profile.js :11 import { execFile, spawn } from "node:child_process";
  • shell MRsuperkosmos-yx-bridge-d9ec4c6/server/src/selftest.js :6 import { spawn } from "node:child_process";
  • shell MRsuperkosmos-yx-bridge-d9ec4c6/server/src/ui.js :9 import { execFile } from "node:child_process";
  • shell (weak) MRsuperkosmos-yx-bridge-d9ec4c6/server/test-all.mjs :3 import { spawn } from "node:child_process";
  • shell (weak) MRsuperkosmos-yx-bridge-d9ec4c6/server/test-session.mjs :6 import { spawn } from "node:child_process";

network 1

  • net MRsuperkosmos-yx-bridge-d9ec4c6/extension/background.js :34 const res = await fetch(chrome.runtime.getURL(`icon${S}.png`));

secrets 1

  • secrets MRsuperkosmos-yx-bridge-d9ec4c6/server/src/server.js :32 if (process.env.YX_BRIDGE_TOKEN) return String(process.env.YX_BRIDGE_TOKEN).trim();

declared dependencies 2

  • @modelcontextprotocol/sdk@^1.0.4
  • ws@^8.18.0