Local-first is not risk-free.

What the bridge can do

A connected MCP client can inspect page content and interact with pages in the paired Chrome profile. Those pages may already be authenticated. In effect, the connected client has browser automation capability under your active identity.

Default controls

• The bridge only binds to loopback addresses unless an explicit override is set.
• A random 32-character minimum token is required on both the bridge and extension.
• No remote relay, telemetry, or cookie export is built into the project.
• Page JavaScript evaluation is disabled by default.
• Chrome surfaces its debugger notice when trusted DevTools Protocol input is active.

Operational guidance

• Connect only MCP clients and agents you trust.
• Use a dedicated Chrome profile for sensitive work if you need stronger separation.
• Do not put the bridge token in a repository, prompt, issue, screenshot, shell history shared with others, or a client config committed to source control.
• Prefer snapshot and targeted actions. Keep eval disabled unless its additional power is necessary.
• Stop the bridge when it is not in use and remove the extension from profiles that do not need it.

Threat model

The primary threat is an untrusted or prompt-injected agent issuing browser commands. A malicious page can also try to influence an agent through page text. Treat retrieved page content as untrusted input, review actions that change data or send messages, and never allow arbitrary automation solely because text on a page requests it.

Reporting vulnerabilities

Use a private GitHub security advisory. Do not publish exploit details in an issue. See the repository security policy for details.