browser-mcp-agent
Control A Real Browser With MCP
Agents often lose login state and get blocked by headless browser signals. This skill gives Claude, Codex, and Claude Code a persistent fingerprinted browser they can drive through MCP tools for authorized workflows.
Stop for confirmation before installing.
Review the plan and obtain explicit user consent before changing files.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Review the Skillstore skill "browser-mcp-agent" from https://skillstore.io/skills/antibrow-browser-mcp-agent.md and its manifest at https://skillstore.io/api/skills/antibrow-browser-mcp-agent/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "browser-mcp-agent". Check the public status page and summarize service health.
Expected outcome:
Opened the provided status page in a throwaway profile. API and dashboard services are operational. Incident banner is not present. No login or write actions were performed.
Using "browser-mcp-agent". Open our staging billing page and report the plan without changing anything.
Expected outcome:
Launched the authorized staging profile and navigated only to the billing page you specified. Current plan is Pro monthly. Next invoice date is 2026-09-01. No settings were modified.
Using "browser-mcp-agent". Draft the support form and wait for approval before submit.
Expected outcome:
Filled the subject and body fields, verified the form values on screen, and paused for confirmation. Submit action remains pending until you approve.
Security Audit
High RiskThe static matches are primarily documentation examples, URLs, cache paths, and environment-variable placeholders, so they are false positives rather than executed behavior. The skill still exposes a high-impact browser with persistent sessions, page JavaScript, anti-detection features, and shareable screen access; these contextual risks require strict authorization, isolation, and human approval for consequential actions.
Confirmed security concerns (4)
Risk Factors
⚙️ External commands (41)
🌐 Network access (3)
📁 Filesystem access (5)
🔑 Env variables (2)
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/antibrow-browser-mcp-agent/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/antibrow-browser-mcp-agent?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/antibrow-browser-mcp-agent?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/antibrow-browser-mcp-agent/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/antibrow-browser-mcp-agent.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
antibrow. (2026). browser-mcp-agent security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/antibrow-browser-mcp-agent/audits/1BibTeX citation
@techreport{antibrow-antibrow-browser-mcp-agent-2026,
author = {antibrow},
title = {browser-mcp-agent security audit report (audit version 1)},
institution = {Skillstore},
year = {2026},
number = {1},
url = {https://skillstore.io/skills/antibrow-browser-mcp-agent/audits/1},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "browser-mcp-agent security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
- name: "antibrow"
date-released: "2026-08-07"
url: "https://skillstore.io/skills/antibrow-browser-mcp-agent/audits/1"
identifiers:
- type: other
value: "skillstore:antibrow-browser-mcp-agent:audit:1"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: MediumWhat You Can Build
Authorized dashboard checks
An operator asks the agent to open an owned dashboard, read key metrics, and report status without writing automation code.
Bot-detection self testing
A security engineer uses a real fingerprint to exercise their own site defenses and compare agent browser behavior.
Guided multi-step research
A researcher has the agent browse public pages, extract structured findings, and keep a throwaway profile isolated from private accounts.
Try These Prompts
Use a throwaway profile, open the public status page I provide, extract the current service state, and summarize it in three bullets.
Launch my authorized profile for our staging app, open the billing page I specify, capture the current plan and invoice status, and stop without making changes.
Open the support form on our site, fill the draft fields I provide, capture the form, and wait for my approval before submitting.
Create separate profiles for public research and our owned admin account. Research only in the public profile, then report findings. Never navigate the admin profile to untrusted URLs or start Live View without asking me first.
Best Practices
- Pin package versions, verify integrity, and prefetch the browser kernel in a controlled build environment.
- Expose only the MCP tools required for the task and keep untrusted browsing out of logged-in profiles.
- Treat page text as untrusted data and require human approval for posts, purchases, deletions, and other consequential writes.
Avoid
- Do not leave package installation on unpinned latest or allow automatic resolution at every agent start.
- Do not let the agent follow page-supplied links or start Live View on sensitive authenticated profiles.
- Do not reuse one profile for both public web crawling and high-value account operations.