Browser MCP: why it is not safe to use
Browser MCP can control an already logged-in browser session and may trigger sensitive actions or access account data without an in-skill confirmation step.
What we found
Our review did not find hidden instructions, hardcoded secrets, obfuscated code, or undisclosed remote endpoints in the inspected repository. The project describes browser activity as staying on device, and the inspected code appears to use a local WebSocket connection to the browser extension.
The main concern is how much access the skill inherits from the user’s existing browser session. It is designed to use the current browser profile and logged-in tabs, which means it can reach account data already available in that browser. We also found action controls such as click, type, navigation, keypress, and selection, but no built-in confirmation gate was visible before potentially irreversible actions on websites. In addition, the server code includes a call to `killProcessOnPort(port)` before starting its local WebSocket server, which could terminate another local process already using that port.
What to do instead
Use this skill only in a separate browser profile with minimal saved sessions and limited account access. Prefer test accounts for sensitive sites, review requested actions carefully, and avoid using it where unintended clicks, form submissions, or account changes would carry risk.
Source: https://github.com/BrowserMCP/mcp
We report what our security review found at the time we checked, with the goal of keeping people safe. Projects change; if a maintainer has since fixed this, we are glad to recheck it. Email hello@agentpod.com.