MCP bridge between Claude Code and your real browser via a WebSocket-connected extension
Drift inferred · capture-to-capture
- HIGH code analysis flagged dynamic code execution ×2 in softwaresoftware-dev/claude-browser-bridge
transport stdio · http counts 12 tools · 0 res
· 0 prompts
permission surface via code analysis
tools
-
click
Click an element by CSS selector
-
eval_js
Execute JavaScript in the page context (main world)
-
fill_form
Fill multiple form fields at once
-
get_element_info
Get attributes, text, and bounding box of an element
-
get_page_content
Get page text or full HTML
-
get_tab_info
Get URL, title, and status of a specific tab
-
list_tabs
List all open tabs with IDs, URLs, and titles
-
navigate
Navigate a tab to a URL and wait for load
-
screenshot
Capture the visible tab as a PNG image
-
scroll
Scroll the page or a specific element
-
type
Type text into an input field
-
wait_for
Wait for a CSS selector to appear on the page
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed commit 3c219d9 · analyzer v20 · 10h ago
skills & prompt files 3
danger signals2
- dynamic code executionnew Function()softwaresoftware-dev-claude-browser-bridge-3c219d9/dist/index.mjs:2942
const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); - dynamic code executioneval()softwaresoftware-dev-claude-browser-bridge-3c219d9/extension/background.js:709
return { __bb_ok: true, value: eval(c) };
evidence-backed
findings quoted directly from the published source artifact — not inferred
filesystem 4
- fs softwaresoftware-dev-claude-browser-bridge-3c219d9/dist/daemon.cjs :3657
var import_fs2 = require("fs"); - fs softwaresoftware-dev-claude-browser-bridge-3c219d9/dist/index.mjs :21355
import { mkdirSync } from "fs"; - fs softwaresoftware-dev-claude-browser-bridge-3c219d9/server/daemon.js :14
import { unlinkSync, existsSync, readFileSync } from "fs"; - fs softwaresoftware-dev-claude-browser-bridge-3c219d9/server/ipc.js :9
import { mkdirSync } from "fs";
shell / exec 1
- shell softwaresoftware-dev-claude-browser-bridge-3c219d9/dist/index.mjs :7747
var _emojiRegex = `^(\\p{Extended_Pictographic}|\\p{Emoji_Component})+$`;
network 5
- net softwaresoftware-dev-claude-browser-bridge-3c219d9/dist/daemon.cjs :2227
var https = require("https"); - net softwaresoftware-dev-claude-browser-bridge-3c219d9/dist/index.mjs :21001
import { createConnection } from "net"; - net softwaresoftware-dev-claude-browser-bridge-3c219d9/server/daemon.js :12
import { createServer as createNetServer } from "net"; - net softwaresoftware-dev-claude-browser-bridge-3c219d9/server/index.js :13
import { createConnection } from "net"; - net softwaresoftware-dev-claude-browser-bridge-3c219d9/server/telemetry.js :19
fetch(TELEMETRY_URL, {
declared dependencies 5
- @modelcontextprotocol/sdk@^1.27.1
- ws@^8.18.0
- zod@^3.24.0
- esbuild@^0.28.0
- puppeteer-core@^24.43.1