browser-use-mcp-server — Watchlist

MCP100 Assessment

Watchlist / Tracking

Why we’re tracking it

Follow browser engine, navigation scope, and disclosure guidance as the project changes

Reviewed Oct 5, 2026 · Documentation review; complete setup workflow not independently tested

Best fit

Browser automation with browser-use and optional VNC/async tasks

What we know

Community MCP server controlling browsers through browser-use with stdio/SSE modes.

Maintenance / activity evidence

Observed Jul 10, 2025 (UTC)Merge pull request 50 from co-browser/tumberger-patch-1

Tracking evidence observed Oct 5, 2026. These dated signals do not establish current maintenance. Reviewed enrichment confidence: high.

Activity source · commits ↗Activity source · releases ↗

Verification gaps / watch-outs

Installation and comprehensive security have not been independently audited.
Browser session authority. Writes: Navigation; Form interaction; Browser actions.
MCP endpoint auth unresolved.
Sensitive access: Cookies, Authenticated pages, Browser state

Browser automation plus model access can expose authenticated sessions and perform external actions.

Security source · repository notice ↗

Full authority, access and evidence limits are available in Review context and Access & risk.

Popularity

848 repository stars

Stars observed Oct 6, 2026.

No canonical package metric applied.

All limitations / Review context

What browser actions and authorization boundaries are documented at the next review?

The bounded official-source review found no disclosed material public-tracking blocker for the documented browser-use MCP; browser action scope remains an uncertainty and was not treated as a safety certification.

Browser automation plus model access can expose authenticated sessions and perform external actions.
Browser session authority.
MCP endpoint auth unresolved.
Page/session data and prompts may be sent to configured model provider.
Reviewed write actions: Navigation; Form interaction; Browser actions
Sensitive access: Cookies, Authenticated pages, Browser state
Installation, client compatibility and comprehensive security have not been independently audited. Authentication and access depend on the configured services.
Browser actions can have consequential effects; no independent runtime or permission audit was performed and no project-specific SECURITY.md policy was available at the fetched path.
A project-specific SECURITY.md policy was not available at the fetched official path; the review remains limited to published repository notices.
No installation, runtime, client matrix, or complete tool-contract audit was performed in this review.
The fetched official SECURITY.md path returned HTTP 404; it was not treated as positive evidence.
Endpoint authentication
Canonical package identity
Browser automation can affect authenticated sessions.
Exact auth/permission scope is not fully documented.

Original activity observations

2025-07-10T09:57:18Z: Merge pull request 50 from co-browser/tumberger-patch-1

Technical identity

github.com/kontext-security/browser-use-mcp-server

Exact implementation source: https://github.com/kontext-security/browser-use-mcp-server ↗
Reviewed resource type: MCP Server
Repository identity: kontext-security/browser-use-mcp-server

Evidence & Sources

Evidence basis: Recorded source evidence
Setup runtime verification: Not independently runtime-tested by MCP100 for this setup workflow.

Reviewed Oct 5, 2026 · Latest source observation Oct 6, 2026

GitHub repository ↗
kontext-security/browser-use-mcp-server
Recorded repository material and project history.

Setup · Watchlist

Install & Agents

claude-desktop

Publisher instructions with a documented client setup path.

Source evidence observed Oct 14, 2026.

Additional setup details required — see the specific gaps below.

Install / connect
Publisher instructions
Local browser automation server built from source with uv/Playwright; can expose SSE or stdio.
package install · Publisher instructions · Review before use
```
uv sync
uv pip install playwright
uv run playwright install --with-deps --no-shell chromium
```
Configure / authenticate
Publisher instructions
Browser-use MCP requires Playwright Chromium and optionally OPENAI_API_KEY. Publisher documents uv build/install and both stdio and SSE; avoid assuming uvx package without checked distribution.
Check connection
Suggested check
Inspect MCP listing with a sandbox profile; do not run destructive browser automation.
Remove / uninstall / revoke
MCP100 setup guide
Unregister MCP host entry browser-server, stop any mcp-proxy and browser service; command applies only when installed via uv tool wheel.
Distinguish client registration removal from software uninstall, persistent data deletion and provider OAuth/API-key revocation.
uv tool uninstall browser-use-mcp-server

Official Documentation & Sources

What it does

Community MCP server controlling browsers through browser-use with stdio/SSE modes.

Capability: Browser Automation
Resource type: MCP Server
Best fit: Browser automation with browser-use and optional VNC/async tasks

Representative uses

Open/interact with websites
Run async browser tasks
Use VNC streaming

Limitations

Browser automation can affect authenticated sessions.
Exact auth/permission scope is not fully documented.

Reviewed access

Access & risk

Review the exact access boundary before connecting this MCP to accounts, credentials, or sensitive data.

Authentication: MCP endpoint auth unresolved.
Permissions: Browser session authority.
Data handling: Page/session data and prompts may be sent to configured model provider.
Cost: usage_based
Risk and cautions: Browser automation plus model access can expose authenticated sessions and perform external actions.

Access scope and cautions

Write actions: Navigation Form interaction Browser actions
Sensitive access: Cookies Authenticated pages Browser state
Risk level: high

FAQ

Based on reviewed evidence as of 2026-10-06. Watchlist tracking is not a recommendation or a security certification.

Which tasks are documented for this implementation?

The reviewed tasks include: Open/interact with websites; Run async browser tasks; Use VNC streaming.

What setup and authentication are documented?

Recorded installation/entrypoint step: uv sync; uv pip install playwright; uv run playwright install --with-deps --no-shell chromium. Recorded transport: stdio, sse. Recorded environment-variable notes: OPENAI_API_KEY; CHROME_PATH; PATIENT. No configuration values are supplied here. Prerequisites: Python/uv; Chromium. These are the documented setup details, not a claim that installation or client compatibility was independently tested. Authentication: Model/provider credentials as configured; MCP auth not established.

Can it modify data or perform write operations?

Documented write actions include: Navigation; Form interaction; Browser actions. Recorded permission boundary: Browser session authority.

What data-handling boundary should I consider?

Page/session data and prompts may be sent to configured model provider. Recorded sensitive-access context: Cookies; Authenticated pages; Browser state.

What limitations and risks should I check before use?

Browser automation plus model access can expose authenticated sessions and perform external actions. Browser automation can affect authenticated sessions. Exact auth/permission scope is not fully documented. Browser actions can have consequential effects; no independent runtime or permission audit was performed and no project-specific SECURITY.md policy was available at the fetched path. A project-specific SECURITY.md policy was not available at the fetched official path; the review remains limited to published repository notices.

What cost model is recorded?

The reviewed cost model is usage based. This classification does not establish current prices, quotas or the cost of every downstream operation. Check the applicable service terms before authorizing paid actions.

Is this an official MCP?

Kontext Security is listed as Community implementation in MCP100’s current evidence.