BrowserTools MCP: Setup, the 1.x Flaw and Safety Grade (Nov 2026)

Browser Tools MCP (also written BrowserTools MCP, AgentDeskAI/browser-tools-mcp) lets Cursor, Claude Code and other MCP clients read the console, network requests, screenshots and Lighthouse audits of the Chrome tab you already have open. By default it watches your browser and doesn't drive it. It is not browser-use. TrustedMCP grades it C.

If you set it up in 2025, check your version first. Every 1.x release has a critical flaw: a website, or anyone on your Wi-Fi, could read what it captured, and on a Mac run commands on your computer. It will never be patched. Version 2.x fixes it, and the upgrade is five steps.

What it is	An MCP server plus a Chrome DevTools extension, by AgentDesk
Install	npx -y @agentdeskai/browser-tools-mcp@latest, then load the extension
Latest on npm	2.0.4, released 27 Oct 2026
License and cost	MIT, free, no account
Grade	C, see the listing

What AgentDesk's Browser Tools MCP does

You open Chrome DevTools (F12) on a page. The extension captures what that tab does, and the MCP server hands it to your AI client as tools. Because it uses your everyday Chrome, you stay logged in to the app you're debugging. Your agent reads what you see.

The tools in the npm release (2.0.4):

Tool	What it gives the agent
getConsoleLogs, getConsoleErrors	Console output and uncaught errors, with keyword filters
getNetworkLogs, getNetworkErrors	Requests with status, timing and bodies; or only failed and 4xx/5xx ones
takeScreenshot	A screenshot of the tab, returned as an image
getSelectedElement	The element you selected in the Elements panel
getPageInfo, listBrowserTabs, getConnectionStatus	Which page and tabs it can see, and whether the extension is connected
getBrowserStorage	localStorage, sessionStorage and cookies (values held back unless you ask)
refreshBrowser, wipeLogs	Reload the tab, or clear what was captured before a clean retry
runAccessibilityAudit, runPerformanceAudit, runSEOAudit, runBestPracticesAudit	Lighthouse audits, run in a separate headless browser

It also ships three prompts: debuggerMode, auditMode and nextjsSeoAudit.

The README on GitHub lists more tools: navigateBrowser, listTabs, readTab, navigateTab, softClick and softType. The project's changelog puts those in 2.0.5 and an "Unreleased" section, and npm's latest was still 2.0.4 when we checked on 11 Nov 2026. So @latest may not have them yet. Even when it does, the ones that click, type or navigate stay off unless you start the server with --allow-input.

BrowserTools MCP vs browser-use and other browser servers

The names are close, but these are different tools for different jobs. BrowserTools is for debugging the app in front of you. The others start or control a browser for the agent.

	BrowserTools MCP	browser-use MCP	Playwright MCP	Chrome DevTools MCP
Main job	Read logs, network and audits from your open tab	Hand a whole web task to an agent	Drive a browser step by step, for tests	Debug and drive Chrome with DevTools
Which browser	Your everyday Chrome, through an extension	Its own Chromium or Chrome profile	Chromium by default	Its own Chrome, or yours with --autoConnect
Clicks and types	Off unless --allow-input	Yes	Yes	Yes
Code the model can run	None unless --allow-eval	JavaScript through the agent tool; Python with --cli-mcp	browser_run_code_unsafe, on by default	JavaScript, off with --no-javascript-evaluation
Authentication	One token per run, on its local connector	None	None	None
Grade	C	C	C	C

All four grade C, for different reasons. The other three lose points mainly because they have no authentication and the model can run code by default. BrowserTools loses points across the board: a single maintainer, a slow security fix, and one all-access token.

Our short version:

• "Why is this page throwing errors?" BrowserTools, or Chrome DevTools MCP.
• Testing your own app, step by step? Playwright MCP.
• "Go and do this task for me"? browser-use.

Compare every graded server in browser automation.

How to set up Browser Tools MCP 2.x in Cursor and Claude Code

You need Node 22.19 or newer. Check with node --version. If you use nvm or asdf, make sure your editor picks up the same version.

1. Add the server to your client. This JSON comes from the README and works in Cursor, Claude Desktop, Windsurf and other JSON-config clients:

{
  "mcpServers": {
    "browser-tools": {
      "command": "npx",
      "args": ["-y", "@agentdeskai/browser-tools-mcp@latest"]
    }
  }
}

On Windows, if your client can't find npx, the README says to use "command": "cmd" with "args": ["/c", "npx", "-y", "@agentdeskai/browser-tools-mcp@latest"].

In Claude Code, the README only gives the JSON. This is the standard Claude Code way to add the same command:

claude mcp add browser-tools -- npx -y @agentdeskai/browser-tools-mcp@latest

Our Claude Code MCP setup guide explains scopes and .mcp.json.

2. Load the Chrome extension. It isn't installed from a store. Download or clone the repository, open chrome://extensions, turn on Developer mode, choose Load unpacked and select the chrome-extension folder.

3. Open DevTools on your page. Capture starts when DevTools (F12) is open on a tab. The BrowserTools panel inside DevTools is only for settings and status. Then ask your agent something like "check the console for errors".

4. If nothing comes through, run:

npx @agentdeskai/browser-tools-mcp --doctor

It reports which piece is missing.

There is no second server to start in 2.x. The MCP server runs the connector itself. You only need npx @agentdeskai/browser-tools-server if several MCP clients should share one browser session.

Still on BrowserTools 1.x? Upgrade now

You are probably on 1.x if any of these is true:

• Your MCP config says @agentdeskai/browser-tools-mcp@1.2.0. The old README told you to pin that version, so it never updated itself.
• You start browser-tools-server in a second terminal.
• Your extension came from the old chrome-extension-v1-1-0.zip download.
• Your agent shows tools called runDebuggerMode, runAuditMode or runNextJSAudit. 2.0 removed them.

What's wrong with 1.x. The project's advisory, GHSA-xvrv-w8pg-f25f, is rated critical. The 1.x server listened on every network interface, asked for no password and didn't check where a connection came from. So any web page you visited, or any device on the same network, could read your captured logs (including Authorization and Cookie headers), take screenshots of your logged-in pages and write files on your disk. On a Mac with screenshot auto-paste turned on, a bug in the screenshot code also let them run commands as you. The 1.x extension also searched your local network for a server and connected to whichever answered first, so someone on shared Wi-Fi could receive your data.

The project says 1.x "will not receive fixes".

How to upgrade (from the project's MIGRATION.md):

1. Install Node 22.19 or newer.
2. In your MCP config, change @1.2.0 (or any 1.x version) to @latest, as in the JSON above.
3. Stop the separate browser-tools-server and delete that step from your scripts.
4. Remove the old extension at chrome://extensions, then load the new chrome-extension folder. Old and new aren't compatible.
5. Restart your client and run --doctor.

The new extension asks for fewer permissions. Cookie access is now an optional permission you grant from the panel.

Is BrowserTools MCP safe?

Version 2.x, with its defaults, is a reasonable local debugging tool. Version 1.x isn't safe at all. Here is what 2.x changed, from its README:

• Local only. The connector listens on 127.0.0.1 and refuses other addresses.
• A token. The local API and the extension's connection need a token that is new on every run. Only a browser extension can collect it.
• Credentials are scrubbed. Authorization and Cookie headers, JWTs, cloud keys and similar tokens in captured data become [REDACTED]. Headers are off by default.
• Actions are off. Clicking, typing and navigating need --allow-input. Running scripts needs --allow-eval. Both are start-up flags with no environment-variable form, and both are off by default.
• The warning banner stays. Chrome's "started debugging this browser" bar is never hidden.

The risk that remains is what the agent reads. Console messages, network bodies and page text are written by websites. If you open DevTools on a page with hostile text, that text goes to your model. That's prompt injection. With actions turned on, it could also steer clicks in a browser that is logged in to your accounts.

The second advisory shows the pattern. GHSA-fm7v-38h4-4q7w (high) let a model that had read injected text point a Lighthouse audit at your local network or a cloud metadata address and get a screenshot back. It affected 2.0.0 to 2.0.2 and was fixed in 2.0.3 on 26 Oct 2026, the day it was published. Audits now refuse those addresses and only reach local pages that you have open in a connected tab.

Six settings that make it safer

1. Use a separate Chrome profile for development. Extensions are installed per profile, so load BrowserTools in a profile without your email, bank or admin logins.
2. Open DevTools only on tabs you want read. Capture starts when DevTools opens.
3. Leave --allow-input and --allow-eval off. Most debugging only needs reading.
4. Expose only the tools you use with --only, for example "args": ["-y", "@agentdeskai/browser-tools-mcp@latest", "--only", "getConsoleErrors,getNetworkErrors"].
5. Pin the extension with --extension-id <id>, so no other extension can pair.
6. Never use --no-redact, and grant the cookie permission only when you need it.

A container sandbox doesn't fit this tool, because it has to reach your real Chrome. The separate profile is the practical boundary. For servers that can run in one, see how to sandbox MCP servers.

BrowserTools MCP advisories

Advisory	Severity	Affected	What it allowed	Fixed
GHSA-xvrv-w8pg-f25f	Critical	All 1.x	Any website or nearby device could read captured data and write files; on a Mac with auto-paste, run commands	2.0.0, 10 Aug 2026. Described in a public issue (#224) on 14 Mar 2026, 149 days earlier
GHSA-fm7v-38h4-4q7w	High	2.0.0 to 2.0.2	An audit URL could reach your local network or cloud metadata and return a screenshot	2.0.3, 26 Oct 2026, same day

OSV had no entries for either npm package when we checked.

Fixing common BrowserTools MCP problems

• The agent says nothing was captured. DevTools must be open on the tab. Requests that finished before you opened DevTools aren't recorded, so reload the page.
• npx not found on Windows. Use the cmd /c form shown above.
• A Node version error. You need 22.19 or newer, and your editor must use that version, not an older one from nvm.
• The "started debugging this browser" bar. That's intentional. To capture the console without it, switch the panel's capture mode to Wrap page console.
• An audit of a localhost page is refused. Local pages are audited only while open in a connected tab, or when you list them with --audit-allow-origin.
• A huge screenshot. Images over 3 MB are re-encoded or shrunk. If one still won't fit, the tool returns a file path instead.
• Firefox. The project says Firefox is not verified. Treat it as unsupported.

If your team needs an agent that reads your own app's logs or browser data with stricter rules than start-up flags, we build custom MCP servers.

Why BrowserTools MCP grades C

We graded version 2.x. The 1.x flaw still counts in the advisory check, because it was fixed 149 days after it went public.

Check	Points	Why
Authentication	18 of 30	The local connector needs a per-run token, but it's one token that unlocks everything. There are no scopes; flags decide what the agent may do.
Maintenance	18 of 25	Release 2.0.4 on 27 Oct 2026 and 50 commits in 90 days, but almost all from one developer. Before 2.0 there was no release for 17 months.
Known CVEs	15 of 25	Both advisories are fixed. The critical one was public for 149 days before the fix.
Transport	14 of 20	stdio, plus a local connector on 127.0.0.1 without TLS. No shell commands built from model input; audits start a browser with fixed settings.

Read the full assessment on the BrowserTools MCP listing, or how we grade in how TrustedMCP scores servers. The grade is an assessment from public signals, not an audit.

Frequently asked questions

Is browser-tools MCP the same as browser-use MCP?

No. BrowserTools MCP, by AgentDesk, reads console logs, network traffic and audits from the Chrome tab you already have open. browser-use MCP gives an agent its own browser to click through web tasks. They are separate projects with separate risks. Our browser-use guide covers that one.

Is BrowserTools MCP safe to use?

Version 2.x, with its defaults, is fine for local debugging in a separate Chrome profile. It listens only on your machine, needs a token and scrubs credentials. Version 1.x is not safe: it has a critical flaw that will never be fixed. Upgrade any config that pins @1.2.0.

Is BrowserTools MCP still maintained?

Yes, as of November 2026. Version 2.0.4 came out on 27 Oct 2026. Almost all recent work is by one developer, and there was a 17-month gap with no release before 2.0, so check the releases page before you rely on it.

What is AgentDesk's Browser Tools MCP?

It is an MCP server plus a Chrome DevTools extension from AgentDesk (AgentDeskAI/browser-tools-mcp). It lets Cursor, Claude Code and other MCP clients read the console, network requests, screenshots and Lighthouse audits of the Chrome tab you already have open. It is open source under the MIT license.

How do I install browser tools MCP in Cursor?

Add the JSON block from the setup section to your Cursor MCP config, with npx -y @agentdeskai/browser-tools-mcp@latest as the command. Then load the chrome-extension folder at chrome://extensions and open DevTools on your page. You need Node 22.19 or newer.

Do I still need to run browser-tools-server?

No. In 2.x the MCP server runs the connector itself. Start npx @agentdeskai/browser-tools-server only if several MCP clients should share one browser session.

Does BrowserTools MCP work with Claude Code?

Yes. Add it with claude mcp add browser-tools -- npx -y @agentdeskai/browser-tools-mcp@latest, load the Chrome extension, and open DevTools on your page. The README lists Claude Code among the supported clients.

Does BrowserTools MCP work in Firefox, Edge or Brave?

The README only documents the extension for Chrome, and says Firefox is not verified. Lighthouse audits can run in any Chromium-based browser that's installed, such as Edge or Brave.

Is BrowserTools MCP free?

Yes. It's open source under the MIT license, with no account or API key.

BrowserTools MCP or Chrome DevTools MCP?

Both help an agent debug a page. BrowserTools reads the tab you already have open, through an extension, and can't click or run scripts unless you turn that on. Chrome DevTools MCP is Google's server: it usually starts its own Chrome, can drive the page, and runs JavaScript by default. See our Chrome DevTools MCP guide.