Headless automation fails on the sites that check whether a real person is driving; this sidesteps that by driving the Chrome you are already signed into, so cookies, sessions and 2FA are simply there. The move that follows is the interesting one — hit a login wall, read the verification code out of your own mail tab, carry on — and the same property is the risk, since it acts as you on your own accounts. Hence the tool whose entire job is to stop and hand the sensitive step back to you.
Two halves that need each other: a Chrome extension that drives your real browser, and a local MCP server your agent talks to. Because it is your actual Chrome, the pages it reaches are the ones you are already signed in to.
- Navigation that reuses the current tab by default, with tabs listed, switched, opened and closed, and the newest tab found after a link or an OAuth popup opens one
- Page content as text or HTML, screenshots of the visible area, and the recent console messages
- Clicks, fills, key presses with modifiers, hovering, scrolling and waiting — using text-based selectors as well as CSS, through real mouse events that work on Angular and React apps and CSP-strict sites
- The awkward widgets handled as single calls: custom dropdowns, autocomplete comboboxes including multi-select, and date inputs across native, masked and calendar-picker forms
- Popups, modals, banners and "are you sure?" overlays dismissed in one call
- File uploads set programmatically through the Chrome Debugger API, including drag-and-drop zones that hide a file input
- JavaScript executed on the page, or inside a specific iframe once you have listed the frames
- A wait for a network request matching a URL pattern, so the page gets read after the data lands rather than before
- HTTP requests made from the extension background, where CORS does not apply
- Cookies and localStorage read and written for a domain
- JavaScript dialogs — alert, confirm, prompt — handled by calling before the action that triggers them
- An overlay that asks you directly for credentials, a 2FA code, a CAPTCHA or OAuth consent, with input fields, so the sensitive step comes back to you
- CAPTCHA detection for reCAPTCHA v2 and v3, hCaptcha, Cloudflare Turnstile and FunCaptcha, with an auto-click attempt first
Both halves — neither does anything alone. The Chrome extension installs from the Chrome Web Store in one click, or unpacked from the repository. The server registers with your client: claude mcp add --scope user browser-mcp -- npx @agent360/browser-mcp@latest for Claude Code, and the equivalent config entry for Cursor, VS Code, Codex or Windsurf. Restarting the client is what starts the server, and the extension icon turns green when the two find each other. Everything runs locally and nothing leaves the machine — the flip side being that it acts inside your signed-in browser, with your sessions, which is what makes approving the sensitive steps worth doing.
One command — claude mcp add --scope user browser-mcp -- npx @agent360/browser-mcp@latest