> ## Documentation Index
> Fetch the complete documentation index at: https://browser-mcp.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Privacy and security

> Understand what browser access exposes before connecting any AI client.

<Warning>
  An MCP bearer token grants broad control of one connected browser registration, including signed-in pages and arbitrary JavaScript. It is not a read-only credential, site allowlist, or single-tab grant. An AI client can cause real-world effects as you: submitting forms, sending messages, changing settings, and using existing website sessions. Connect only clients and models you trust.
</Warning>

For the ricsam-published extension and managed preview, see the [privacy policy](/privacy), including data recipients, retention, and deletion requests. Self-hosted operators must publish their own policy.

## What can be accessed

The extension uses Chrome's debugger/CDP capabilities, tab access, local storage, and broad HTTP(S) host permissions. These support trusted input, page inspection, screenshots, and runtime evaluation. Chrome may warn that the extension can read or change website data. That warning is material, not boilerplate.

* Tab metadata exposes URLs and titles.
* Snapshots and JavaScript results can contain personal data, internal documents, credentials rendered in pages, and signed-in account content.
* Screenshots can expose anything visible in the capture.
* JavaScript can manipulate the page and make requests with its signed-in authority, subject to browser rules. HttpOnly cookies are not directly readable by page JavaScript, but that does **not** prevent authenticated actions.
* Input can submit forms or send confidential text to websites.

The selected upstream control-plane origin and non-HTTP(S) pages are excluded from tool control. New source builds also exclude both known current/retired managed origins and their build-configured default. The submitted 0.1.1 blocks only its selected upstream; it must explicitly select `https://browser-mcp.click` after the [managed domain migration](/managed#canonical-domain-migration). Old transports are retired, not transparently aliased. These checks reduce specific risks; they are not a complete sandbox or protection against arbitrary hostile websites, redirects, compromised clients, or actions within other sensitive HTTP(S) services.

Use a separate Chrome profile containing only the accounts needed for the task. Incognito by itself is not a permission model; do not enable extension access there without understanding the impact. Keep Chrome's debugger indicator visible. No debugger attachment is needed while idle.

## Where data goes

```text theme={null}
Your Chrome profile ↔ extension ↔ Browser MCP server ↔ MCP client ↔ model/provider
```

Traffic crosses the operator's server. HTTPS/WSS protects transport when correctly configured; this is **not end-to-end encryption that hides browser results from the server operator**. Your MCP client and model provider may retain prompts, tool results, and screenshots according to their policies.

The application stores user/session records, browser metadata, hashed browser/MCP tokens, encrypted OIDC settings and pending device credentials, and audit metadata in PostgreSQL. Audit records contain tool name, status, and time rather than page content or tool arguments. Browser command/result bodies are relayed and are not intended as persisted audit content; reverse proxies, debug logging, crash reports, and third-party telemetry can still capture data if an operator configures them unsafely.

The connection credential is persisted in the extension's local Chrome profile so it can reconnect. Local profile access, malicious extensions, or a compromised operating system can expose it. The operator must define database retention, backup retention, account/browser deletion procedures, and incident contacts. These docs do not promise automatic deletion deadlines or regulatory compliance.

## Authentication boundaries

* The first community account is an administrator; protect bootstrap from public access.
* Community OIDC settings are admin-only, with encrypted client secrets. Managed builds use GitHub sign-in.
* Dashboard cookies are HttpOnly and SameSite Lax; authenticated mutations require the same origin. Extension device/proof routes do not rely on dashboard cookies.
* Each browser/MCP request verifies ownership and credential type. Browser connection tokens and MCP bearer tokens are separate, hashed, one-time-displayed, and revocable.
* WebSocket credentials are sent in the first authentication message within five seconds, never in query strings. Device approval requires a user gesture and proof-bound one-time redemption.

Do not add wildcard credentialed CORS or log tokens to simplify integration. Use explicit HTTPS origins and a trusted reverse proxy.

## Prompt injection and authorization

Web content is not instruction from the user. A page can contain text asking an AI agent to ignore rules, reveal secrets, paste tokens, open attacker URLs, or execute JavaScript. Screenshots and tool output can carry the same attack. Browser MCP supplies browser tools; it cannot make every agent's interpretation of page content safe.

Require explicit approval for sensitive or irreversible actions. Do not paste MCP credentials into websites. Do not run code from page content. Never assume a successful login gives an AI client blanket permission to perform every action available in that account.

## Limits are not isolation

Commands have size/time bounds, and same-tab commands are serialized. These are reliability measures, not security boundaries against a malicious authorized client. One server replica is required for routing correctness, not tenant-isolation certification. This project does not claim a third-party security audit, SOC 2 certification, HIPAA readiness, or a hosted-service SLA.

## Reduce risk

1. Keep Chrome and the extension current; verify release origins and checksums.
2. Use a task-specific profile and the shortest practical MCP token expiry.
3. Issue a separate token per client; revoke unused or exposed tokens.
4. Pause access using Disconnect, and rotate the connection credential after compromise.
5. Encrypt transport, secure the database and keys, and avoid content/credential logging.
6. Test backup recovery and document an incident response route before inviting other users.

For the managed preview or published extension, report vulnerabilities privately to [security@browser-mcp.click](mailto:security@browser-mcp.click). For other upstreams, contact your operator. Do not post live credentials, page screenshots, or customer data in a public issue.