> ## Documentation Index
> Fetch the complete documentation index at: https://browser-mcp.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Managed edition

> GitHub-authenticated pairing for users, and deployment requirements for operators.

<Note>
  The canonical managed preview URL is [browser-mcp.click](https://browser-mcp.click), using GitHub sign-in. This preview has no availability commitment or SLA. Chrome Web Store version 0.1.1 has been submitted and is pending Google's review; it will publish automatically if approved. Until then use the verified ZIP installation instructions.
</Note>

## For users

1. Install a verified [extension build](/extension) from your operator.
2. Explicitly set the upstream to `https://browser-mcp.click`, then choose **Sign in with GitHub**. The extension opens a regular browser tab to that origin so your browser's login state remains in your browser.
3. Sign in with GitHub and review the requested device/browser name and origin.
4. Explicitly approve the request. The managed server registers your browser and issues a separate connection credential to the extension.
5. Open the dashboard, create a browser-scoped MCP token, and configure your trusted client using the displayed URL and bearer token.

Approval expires after ten minutes. You can disconnect at any time in the extension. Revoke MCP credentials in the dashboard to prevent future client use; rotate the connection credential if the extension profile is compromised.

GitHub sign-in authenticates the dashboard user. It does **not** restrict browser MCP tools to GitHub or grant a narrow read-only scope: the paired browser can still be controlled broadly. Review [privacy and security](/security).

## Canonical domain migration

The previous managed origin, `https://browser-mcp-fzftomuy8592.r5d.app`, is **retired for all device, API, WebSocket, and MCP requests**. Only safe dashboard GET/HEAD links redirect to `https://browser-mcp.click`. This intentionally breaks automatic reconnect at the old address rather than exposing the new dashboard to old extensions.

1. **Pause** or **Disconnect & forget** in the extension before opening the new dashboard.
2. In extension Settings, explicitly enter `https://browser-mcp.click` as the upstream (do not use 0.1.1's old embedded managed default). Grant Chrome access to this exact origin and confirm consent.
3. Start a **new** sign-in and approval. An old pending device request cannot redeem at the retired address; restarting creates a new browser registration. Alternatively, manually configure the canonical upstream with a connection credential for an existing registration. No stored extension settings or credentials are migrated automatically.
4. Update each MCP client's URL to `https://browser-mcp.click/b/<browser-id>/mcp`. Existing unexpired/unrevoked MCP tokens still work at the new URL for the same registration; they do not work with a new registration created by re-pairing. Revoke/delete unused old tokens and registrations.

Dashboard sessions are host-only: sign in again on the new domain. No cookie or OAuth callback is forwarded from the retired host. Chrome Web Store **0.1.1 remains pending unchanged**; this migration neither cancels nor resubmits it. Source builds use the new default but are not a new published release.

<Warning>
  The submitted 0.1.1 extension blocks **only its selected upstream origin** from browser tools. It cannot learn a second protected origin from the server. Keeping an old-upstream WebSocket alive while serving a signed-in dashboard at the new domain would let tools read/control that dashboard, including same-origin authenticated actions. A server-only transparent alias cannot fix this. That is why legacy transports are rejected, even with an old valid token or Chrome extension Origin. Explicitly selecting the canonical upstream restores its existing single-origin protection. New source builds additionally block both known managed origins and their build-configured default even when another upstream is selected. Arbitrary other aliases are not discovered automatically; never expose a signed-in control plane under unprotected aliases. These guards remain defense-in-depth, not a sandbox for arbitrary JavaScript.
</Warning>

Operators may opt into **redirect-only** compatibility using `LEGACY_PUBLIC_ORIGIN` (Helm `config.legacyPublicOrigin`). It defaults to empty/disabled and accepts one normalized, distinct HTTPS DNS origin, with an optional non-default port. Wildcards, lists, credentials, whitespace, paths, trailing slashes, queries, fragments, and default `:443` spelling are rejected. Unknown hosts still return 403. Allowed old page paths are `/`, `/settings`, `/connect`, `/device` (including trailing slashes); GET/HEAD uses a no-store 308 with path/query preserved and no referrer. `/device` is retained only as a legacy link path; current pairing uses `/connect`. All other old-host requests return 410 `legacy_origin_retired` with manual reconnect instructions; no credentialed CORS or Location is emitted. Health/readiness probes remain host-exempt and return no session data.

Before cutover, deploy a freshly built server containing this boundary, preserve the database and runtime encryption/auth keys, and configure the GitHub callback to `https://browser-mcp.click/api/auth/callback/github`. Restart the single server so existing old-host WebSockets close. `deploy/managed-values.yaml` retains the old ingress for retirement responses and pins the migration-aware deployed server. The hosted cutover was verified on September 8, 2026, including GitHub sign-in, explicit published-0.1.1 pairing, MCP browser tools and token revocation. The separately configured canonical Cloudflare tunnel must deliver the canonical HTTP **Host** to the server. Do not rewrite **legacy** traffic to the canonical Host: that bypasses retirement and reintroduces exposure. `Forwarded` / `X-Forwarded-Host` do not grant trust. Validate canonical sign-in, explicit 0.1.1 re-pairing, MCP token use, old transport rejection, and old-link redirects before announcing completion. Do not enable the canonical dashboard against an old server that still accepts legacy connections.

## For operators

Build a managed artifact deliberately:

```bash theme={null}
docker build --build-arg EDITION=managed -t browser-mcp:local-managed .
```

Use the same runtime settings as community, plus `GITHUB_CLIENT_ID` and `GITHUB_CLIENT_SECRET`. Register a GitHub OAuth application for your actual deployment, with the callback:

```text theme={null}
https://<your-host>/api/auth/callback/github
```

These are runtime secrets. Do not embed the client secret in frontend or extension builds. Community generic OIDC administration is not available in the managed edition.

For Helm, set `edition: managed` and use the matching managed image tag or digest. Store both GitHub values in `secrets.existingSecret`. The chart adds those env references only for managed. The selected artifact, not this Helm value by itself, determines server behavior.

Build a release extension with the real canonical HTTPS upstream:

```bash theme={null}
EXTENSION_MANAGED_URL=https://<your-host> bun scripts/build-extension.ts
```

The default points to the managed preview; release automation refuses to publish without an explicit HTTPS upstream repository variable. Do not distribute a localhost-configured ZIP as a managed production extension.

## Operator responsibilities

Provide users with your privacy policy, retention schedule, contact and incident-reporting route, outage expectations, and deletion procedure. This repository does not provide a legal service agreement or a hosted-service SLA. It also does not remove the operator's access to relayed tool traffic: screenshots, text, and JavaScript results transit the server.

Keep one server replica, complete migrations before server startup, secure PostgreSQL, and test backup restores. [Operational limitations](/operations) apply equally to managed and community.