mcp-browser-use: why it is not safe to use

What we found

Our review did not find hidden prompts, hardcoded secrets, obfuscated code, or undisclosed data sinks in the inspected repo. Network use appeared consistent with user directed browser automation and the configured LLM provider.

The warning is based on three specific areas. First, the server exposes long running browser actions and includes deletion of learned skills through its tool or API surface without a built in confirmation step. That means an agent instruction could trigger an irreversible action unless the host adds its own checks. Second, it can be configured to use a persistent Chrome profile or attach to an existing local Chrome session over CDP. In practice, this can expose cookies, active logins, and other private browsing context beyond a fresh, isolated account. Third, installation pulls `fastmcp` directly from GitHub rather than PyPI, which is a named external code source at install time.

What to do instead

Prefer an isolated browser profile or a fresh session for each task. Avoid connecting to your everyday Chrome session. Add human confirmation or policy gates for destructive actions such as deleting skills. If you need stricter supply chain controls, pin and review the GitHub dependency or choose a package with only registry based dependencies.