@automatebrowser/mcp 0.3.0 → 1.0.0

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "automate-browser",
   "displayName": "AutomateBrowser",
-  "version": "0.3.0",
+  "version": "1.0.0",
   "description": "Drive your real, logged-in browser from your editor — 46 tools, plus the automate-browser skill covering tab ownership, page interaction, extraction, sessions, capture and troubleshooting.",
   "author": {
     "name": "AutomateBrowser"

package/CHANGELOG.md

@@ -4,25 +4,31 @@ Notable changes to `@automatebrowser/mcp`. Format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); versions follow
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-**Nothing has been published to npm under this name yet.** `0.3.0` is cut and verified and is the
-version the first publish will carry; `0.2.0` was cut the same way on 2026-08-26 and held. Every
-version before those belongs to `@browsermcp/mcp`, the project this one was extracted from. That
-lineage is kept below rather than hidden, because an installed copy that predates the rebrand is
-still out there and its users need somewhere to see what changed. Until that publish happens,
-`[0.3.0]` is what you get by building from source.
+**`1.0.0` is the first release on npm under this name**, published 2026-09-19. `0.2.0` and `0.3.0`
+were cut the same way — 2026-08-26 and 2026-09-17 — and held; `0.3.0` was published on the day of
+the `1.0.0` release and withdrawn the same hour, so `1.0.0` is the only version the registry serves.
+Its tag stays in the repository because the cut was real. Every version before those belongs to
+`@browsermcp/mcp`, the project this one was extracted from. That lineage is kept below rather than
+hidden, because an installed copy that predates the rebrand is still out there and its users need
+somewhere to see what changed.
 
 Dates are the date of the work, not of a release.
 
 ## [Unreleased]
 
-Nothing yet. `0.3.0` was cut on 2026-09-17, and work after it lands here.
+Nothing yet. `1.0.0` was published on 2026-09-19, and work after it lands here.
 
-## [0.3.0] — 2026-09-17
+## [1.0.0] — 2026-09-19
 
-Cut and verified, **not yet published** — the version the first publish will carry. This is the bulk
-of the current product, substantially more than `[0.2.0]` contains, so it is this section and not
-that one that describes what a user actually receives. `[0.2.0]` stays rather than being absorbed,
-because it names a real cut that the link block below points at.
+The first release published to npm. This is the bulk of the current product, substantially more than
+`[0.2.0]` contains, so it is this section and not that one that describes what a user actually
+receives. `[0.2.0]` stays rather than being absorbed, because it names a real cut that the link block
+below points at.
+
+**Numbered `1.0.0`, not `0.3.0`.** The same content went up as `0.3.0` first and was withdrawn within
+the hour. `0.x` was chosen in September on the grounds that stages were still being added; that
+reasoning expired once the product was complete, gated and documented, and a first public release is
+a statement about the interface being committed to rather than about how much work remains.
 
 ### Added
 
@@ -162,6 +168,6 @@ The last release of `@browsermcp/mcp`, the upstream project this was extracted f
 under that name. `0.1.0` through `0.1.2` precede it; this repository begins at the point the server
 was extracted from that monorepo on 2025-03-27, and no history before that is reproduced here.
 
-[Unreleased]: https://github.com/farazpawle/automatebrowser/compare/v0.3.0...HEAD
-[0.3.0]: https://github.com/farazpawle/automatebrowser/compare/cf28a4b...v0.3.0
+[Unreleased]: https://github.com/farazpawle/automatebrowser/compare/v1.0.0...HEAD
+[1.0.0]: https://github.com/farazpawle/automatebrowser/compare/cf28a4b...v1.0.0
 [0.2.0]: https://github.com/farazpawle/automatebrowser/commit/cf28a4b

package/README.md

@@ -390,111 +390,111 @@ one client run **one at a time, in the order they were issued**, so a click can
 navigation that was meant to precede it. Different clients are not serialized against each other — that
 is what the per-tab claim is for.
 
-<!-- AUTO-GENERATED:tools START — do not edit by hand; run `npm run docs:generate` -->
-
-**Tool profiles** — `full` (46) · `core` (19) · `slim` (7). Set `AUTOMATE_BROWSER_TOOLS` to a profile name or a comma-separated category list to serve fewer schemas; `browser_status`, `browser_list_clients` and `browser_select_client` are always served.
-
-### Navigation & history
-| Tool | Description |
-|------|-------------|
-| `browser_navigate` | Navigate to a URL in YOUR OWN tab, opened in the background if you have none |
-| `browser_go_back` | Go back to the previous page |
-| `browser_go_forward` | Go forward to the next page |
-
-### Snapshot & interaction
-| Tool | Description |
-|------|-------------|
-| `browser_snapshot` | Capture accessibility snapshot of the current page |
-| `browser_click` | Click an element by ref, or a viewport point by x/y |
-| `browser_hover` | Hover over element on page |
-| `browser_type` | Type text into editable element |
-| `browser_select_option` | Select an option in a dropdown |
-| `browser_drag` | Perform drag and drop between two elements |
-
-### Input & timing
-| Tool | Description |
-|------|-------------|
-| `browser_press_key` | Press a key or modifier combo (e.g. Enter, Tab, "Control+A", "Shift+Tab") on the focused element |
-| `browser_wait` | Wait for a specified time in seconds |
-| `browser_wait_for` | Wait for a page condition to become true (element appears/disappears, text appears, URL changes) |
-
-### Reading content
-| Tool | Description |
-|------|-------------|
-| `browser_read_page` | Read the page's main content as clean text or Markdown (strips nav/scripts/styles) |
-| `browser_get_html` | Get the raw outerHTML of the page (or of a specific element by `ref`) |
-| `browser_find` | Find elements by text, role, and/or CSS selector and return fresh refs WITHOUT a full snapshot |
-
-### Page-declared tools
-Actions the PAGE publishes about itself, which an agent can call directly instead of finding and clicking controls for. Forward-looking: the standard is a draft and almost no live site declares anything yet, so `list` normally comes back empty with the reason.
-
-| Tool | Description |
-|------|-------------|
-| `browser_page_tools` | List and call actions a page declares about itself (WebMCP) |
-
-### Forms & scrolling
-| Tool | Description |
-|------|-------------|
-| `browser_fill_form` | Fill multiple form fields (inputs, textareas, selects, checkboxes, radios, contenteditable) in ONE call |
-| `browser_clear` | Clear the value of an input, textarea, or contenteditable element by `ref` |
-| `browser_scroll` | Scroll the page or an element |
-
-### State: cookies, storage, network, downloads, dialogs
-| Tool | Description |
-|------|-------------|
-| `browser_get_cookies` | List cookies for the URL of the tab you are driving (optionally filter by `name`) |
-| `browser_set_cookie` | Set (create/overwrite) a cookie on the URL of the tab you are driving |
-| `browser_storage` | Read or write the page's localStorage/sessionStorage |
-| `browser_network_requests` | List network requests the tab you are driving made on the CURRENT page (method, URL, status, type, timing) — pass includePreserved for the pages before it |
-| `browser_handle_dialog` | Control JS dialogs (alert/confirm/prompt) |
-| `browser_downloads` | Recent downloads: final path on disk, URL, mime, size, state |
-| `browser_proxy` | Route the browser through a proxy |
-
-### Performance
-`browser_perf_trace` measures THIS machine on THIS run and needs `browser_advanced_mode` — except `action: "memory"`, which samples the JS heap with no debugger and no banner. `browser_perf_field_data` needs no browser at all - it reads Google's Chrome UX Report for what real visitors experienced, and sends the URL you ask about to that public API.
-
-| Tool | Description |
-|------|-------------|
-| `browser_perf_field_data` | Real-user Core Web Vitals (p75 LCP/INP/CLS/FCP/TTFB) for a URL, from Google's Chrome UX Report |
-
-### Capture & evaluation
-| Tool | Description |
-|------|-------------|
-| `browser_screenshot` | Capture the visible viewport of the tab you are driving — including a background tab, which is rendered via the debugger (brief banner) rather than refused |
-| `browser_get_console_logs` | Console logs, uncaught errors with stacks, and service-worker lifecycle (register/state/messages) |
-| `browser_issues` | Problems the browser detected that produce NO console error: blocked content (CSP), deprecated API use, browser interventions, and failed or 4xx/5xx network requests |
-| `browser_eval` | Evaluate JavaScript in the tab you are driving and return the result |
-
-### Tabs
-| Tool | Description |
-|------|-------------|
-| `browser_list_tabs` | List the connected browser's open tabs |
-| `browser_new_tab` | Open a new tab IN THE BACKGROUND and drive it — no focus stealing |
-| `browser_switch_tab` | STEALS THE USER'S FOCUS: brings a tab to the front and drives it, by `tabId` (preferred) or `index` |
-| `browser_select_tab` | TAKE OVER a tab the user already has open, WITHOUT focusing it — the tool for "pick up the testing I started" |
-| `browser_close_tab` | Close a tab by `tabId` or `index` |
-
-### Multi-IDE / clients
-| Tool | Description |
-|------|-------------|
-| `browser_list_clients` | List every browser connected to the shared AutomateBrowser relay (e.g. Chrome and Edge when both have the extension connected), across all IDEs |
-| `browser_select_client` | Choose which connected browser your subsequent tools act on |
-| `browser_force_claim` | Forcibly take over a browser that another agent is currently driving, and make it active for your tools |
-| `browser_release_client` | Release your claim on the browser you are currently driving so another agent can take it |
-| `browser_status` | Diagnostics for the AutomateBrowser relay |
-
-### Advanced (opt-in CDP)
-Attach the Chrome debugger only when you need full-fidelity input or network bodies. Enable with
-`browser_advanced_mode` first; a debugging banner shows only while it's attached.
-
-| Tool | Description |
-|------|-------------|
-| `browser_advanced_mode` | Enable/disable opt-in debugger (CDP) mode for the tab you are driving |
-| `browser_upload_file` | Set files on a file input (real upload) |
-| `browser_get_network_request` | Get a network request's response BODY, status and headers by URL substring |
-| `browser_perf_trace` | Record a performance trace (requires advanced/debugger mode) |
-| `browser_emulate` | Emulate location, headers, colour scheme, viewport, user agent, network or CPU |
-
+<!-- AUTO-GENERATED:tools START — do not edit by hand; run `npm run docs:generate` -->
+
+**Tool profiles** — `full` (46) · `core` (19) · `slim` (7). Set `AUTOMATE_BROWSER_TOOLS` to a profile name or a comma-separated category list to serve fewer schemas; `browser_status`, `browser_list_clients` and `browser_select_client` are always served.
+
+### Navigation & history
+| Tool | Description |
+|------|-------------|
+| `browser_navigate` | Navigate to a URL in YOUR OWN tab, opened in the background if you have none |
+| `browser_go_back` | Go back to the previous page |
+| `browser_go_forward` | Go forward to the next page |
+
+### Snapshot & interaction
+| Tool | Description |
+|------|-------------|
+| `browser_snapshot` | Capture accessibility snapshot of the current page |
+| `browser_click` | Click an element by ref, or a viewport point by x/y |
+| `browser_hover` | Hover over element on page |
+| `browser_type` | Type text into editable element |
+| `browser_select_option` | Select an option in a dropdown |
+| `browser_drag` | Perform drag and drop between two elements |
+
+### Input & timing
+| Tool | Description |
+|------|-------------|
+| `browser_press_key` | Press a key or modifier combo (e.g. Enter, Tab, "Control+A", "Shift+Tab") on the focused element |
+| `browser_wait` | Wait for a specified time in seconds |
+| `browser_wait_for` | Wait for a page condition to become true (element appears/disappears, text appears, URL changes) |
+
+### Reading content
+| Tool | Description |
+|------|-------------|
+| `browser_read_page` | Read the page's main content as clean text or Markdown (strips nav/scripts/styles) |
+| `browser_get_html` | Get the raw outerHTML of the page (or of a specific element by `ref`) |
+| `browser_find` | Find elements by text, role, and/or CSS selector and return fresh refs WITHOUT a full snapshot |
+
+### Page-declared tools
+Actions the PAGE publishes about itself, which an agent can call directly instead of finding and clicking controls for. Forward-looking: the standard is a draft and almost no live site declares anything yet, so `list` normally comes back empty with the reason.
+
+| Tool | Description |
+|------|-------------|
+| `browser_page_tools` | List and call actions a page declares about itself (WebMCP) |
+
+### Forms & scrolling
+| Tool | Description |
+|------|-------------|
+| `browser_fill_form` | Fill multiple form fields (inputs, textareas, selects, checkboxes, radios, contenteditable) in ONE call |
+| `browser_clear` | Clear the value of an input, textarea, or contenteditable element by `ref` |
+| `browser_scroll` | Scroll the page or an element |
+
+### State: cookies, storage, network, downloads, dialogs
+| Tool | Description |
+|------|-------------|
+| `browser_get_cookies` | List cookies for the URL of the tab you are driving (optionally filter by `name`) |
+| `browser_set_cookie` | Set (create/overwrite) a cookie on the URL of the tab you are driving |
+| `browser_storage` | Read or write the page's localStorage/sessionStorage |
+| `browser_network_requests` | List network requests the tab you are driving made on the CURRENT page (method, URL, status, type, timing) — pass includePreserved for the pages before it |
+| `browser_handle_dialog` | Control JS dialogs (alert/confirm/prompt) |
+| `browser_downloads` | Recent downloads: final path on disk, URL, mime, size, state |
+| `browser_proxy` | Route the browser through a proxy |
+
+### Performance
+`browser_perf_trace` measures THIS machine on THIS run and needs `browser_advanced_mode` — except `action: "memory"`, which samples the JS heap with no debugger and no banner. `browser_perf_field_data` needs no browser at all - it reads Google's Chrome UX Report for what real visitors experienced, and sends the URL you ask about to that public API.
+
+| Tool | Description |
+|------|-------------|
+| `browser_perf_field_data` | Real-user Core Web Vitals (p75 LCP/INP/CLS/FCP/TTFB) for a URL, from Google's Chrome UX Report |
+
+### Capture & evaluation
+| Tool | Description |
+|------|-------------|
+| `browser_screenshot` | Capture the visible viewport of the tab you are driving — including a background tab, which is rendered via the debugger (brief banner) rather than refused |
+| `browser_get_console_logs` | Console logs, uncaught errors with stacks, and service-worker lifecycle (register/state/messages) |
+| `browser_issues` | Problems the browser detected that produce NO console error: blocked content (CSP), deprecated API use, browser interventions, and failed or 4xx/5xx network requests |
+| `browser_eval` | Evaluate JavaScript in the tab you are driving and return the result |
+
+### Tabs
+| Tool | Description |
+|------|-------------|
+| `browser_list_tabs` | List the connected browser's open tabs |
+| `browser_new_tab` | Open a new tab IN THE BACKGROUND and drive it — no focus stealing |
+| `browser_switch_tab` | STEALS THE USER'S FOCUS: brings a tab to the front and drives it, by `tabId` (preferred) or `index` |
+| `browser_select_tab` | TAKE OVER a tab the user already has open, WITHOUT focusing it — the tool for "pick up the testing I started" |
+| `browser_close_tab` | Close a tab by `tabId` or `index` |
+
+### Multi-IDE / clients
+| Tool | Description |
+|------|-------------|
+| `browser_list_clients` | List every browser connected to the shared AutomateBrowser relay (e.g. Chrome and Edge when both have the extension connected), across all IDEs |
+| `browser_select_client` | Choose which connected browser your subsequent tools act on |
+| `browser_force_claim` | Forcibly take over a browser that another agent is currently driving, and make it active for your tools |
+| `browser_release_client` | Release your claim on the browser you are currently driving so another agent can take it |
+| `browser_status` | Diagnostics for the AutomateBrowser relay |
+
+### Advanced (opt-in CDP)
+Attach the Chrome debugger only when you need full-fidelity input or network bodies. Enable with
+`browser_advanced_mode` first; a debugging banner shows only while it's attached.
+
+| Tool | Description |
+|------|-------------|
+| `browser_advanced_mode` | Enable/disable opt-in debugger (CDP) mode for the tab you are driving |
+| `browser_upload_file` | Set files on a file input (real upload) |
+| `browser_get_network_request` | Get a network request's response BODY, status and headers by URL substring |
+| `browser_perf_trace` | Record a performance trace (requires advanced/debugger mode) |
+| `browser_emulate` | Emulate location, headers, colour scheme, viewport, user agent, network or CPU |
+
 <!-- AUTO-GENERATED:tools END -->
 
 ## Terminal CLI
@@ -535,45 +535,45 @@ pays none.
 
 All settings are environment variables on the **server** side (set them in the MCP client's `env`):
 
-<!-- AUTO-GENERATED:config START — do not edit by hand; run `npm run docs:generate` -->
-
-| Variable | Purpose | Default |
-|----------|---------|---------|
-| `AUTOMATE_BROWSER_CLIENT_NAME` | Human name for this IDE in the relay roster | `mcp-<pid>` (CLI: `cli`) |
-| `AUTOMATE_BROWSER_TOKEN` | Optional auth token (set the same value in the extension popup) | unset |
-| `AUTOMATE_BROWSER_TOOLS` | Tool profile (`full`, `core`, `slim`) or a comma-separated category list | `full` |
-| `AUTOMATE_BROWSER_CONNECT_WAIT_MS` | How long a tool waits for a browser to appear | `30000` |
-| `AUTOMATE_BROWSER_LEASE_TTL_MS` | Soft-claim lease duration | `60000` |
-| `AUTOMATE_BROWSER_INSTANCE_ID` | Identity used to replace this agent's own previous roster entry when it restarts | derived from parent process + folder |
-| `AUTOMATE_BROWSER_CONTROLLER_STALE_MS` | Drop an agent that has sent nothing for this long | `45000` |
-| `AUTOMATE_BROWSER_WS_PORT_RANGE` | Port scan range (e.g. `9109-9116` to isolate) | `9009-9013` |
-| `AUTOMATE_BROWSER_RELAY_IDLE_MS` | Idle time before the relay exits | `300000` |
-| `AUTOMATE_BROWSER_RELAY_HOST` | Bind the relay past loopback so a browser on **another machine** can connect. Refuses to start without `AUTOMATE_BROWSER_TOKEN` | `127.0.0.1` |
-| `AUTOMATE_BROWSER_RELAY_FOREGROUND` | `1` also tees the relay's log to stderr instead of the file only | unset |
-| `AUTOMATE_BROWSER_SNAPSHOT_EACH_ACTION` | Bundle a snapshot after every interaction | unset |
-| `AUTOMATE_BROWSER_DELTA_FOOTER` | `off` disables the console-error footer below | on |
-| `AUTOMATE_BROWSER_DELTA_FOOTER_MS` | Hard ceiling on the footer's console probe | `2000` |
-| `AUTOMATE_BROWSER_NAV_CONFIRM_MS` | How long a navigation that reported no movement is re-checked before it is called a failure | `2000` |
-| `AUTOMATE_BROWSER_SCREENSHOT_MAX_WIDTH` | Widest an **inline** screenshot may come back. A `filePath` capture is never downscaled; `0` = off | `1536` |
-| `AUTOMATE_BROWSER_SCREENSHOT_MAX_HEIGHT` | Tallest an **inline** screenshot may come back, aspect ratio preserved; `0` = off | `4096` |
-| `AUTOMATE_BROWSER_ACTIONABILITY` | `off` disables the pre-action checks and post-action settle below | on |
-| `AUTOMATE_BROWSER_WS_MAX_PAYLOAD_BYTES` | Max WebSocket frame size. A whole Chrome trace is never under 1 MiB, and an oversized frame closes the socket rather than truncating | `67108864` (64 MiB) |
-| `AUTOMATE_BROWSER_WS_RATE_MAX` | Frames one socket may send per window before it is closed | `120` |
-| `AUTOMATE_BROWSER_WS_RATE_WINDOW_MS` | The window that ceiling is counted over | `1000` |
-| `AUTOMATE_BROWSER_EXTENSION_ORIGINS` | Comma-separated browser-extension origins allowed to open a socket | the AutomateBrowser extension |
-| `AUTOMATE_BROWSER_LOG_LEVEL` | `debug`, `info`, `warn` or `error`. Diagnostics go to stderr, never stdout | `info` |
-| `AUTOMATE_BROWSER_WORKSPACE` | Extra folders the file-path sandbox accepts, `;`-separated on Windows and `:`-separated elsewhere. Adds to the roots your client sends; never replaces them | unset (client roots, or the working directory when it sends none) |
-| `AUTOMATE_BROWSER_ALLOW_UNRESTRICTED_PATHS` | `1` disables the file-path sandbox below | unset |
-| `AUTOMATE_BROWSER_ALLOW_ORIGINS` | Comma-separated origin patterns; when set, **only** these may be driven | unset (unrestricted) |
-| `AUTOMATE_BROWSER_DENY_ORIGINS` | Origins that may never be driven, also blocked at the network layer | unset |
-| `AUTOMATE_BROWSER_SENSITIVE_ORIGINS` | Origins that stay readable but can never be acted on | unset |
-| `AUTOMATE_BROWSER_READ_ONLY` | `1` refuses every page-changing tool, everywhere | unset |
-| `AUTOMATE_BROWSER_NO_EVAL` | `1` refuses every tool that runs JavaScript you wrote — `browser_eval` and `browser_navigate`'s `initScript` | unset |
-| `AUTOMATE_BROWSER_AUDIT` | `off` stops the action audit log below | on |
-| `AUTOMATE_BROWSER_AUDIT_FILE` | Where the audit trail is written | `~/.automate-browser/automate-browser-audit.log` |
-| `AUTOMATE_BROWSER_NO_UPDATE_CHECK` | Any value stops the daily check for a newer release below | unset (check runs) |
-| `AUTOMATE_BROWSER_CRUX_KEY` | Google Chrome UX Report API key; `browser_perf_field_data` is inert without it | unset |
-
+<!-- AUTO-GENERATED:config START — do not edit by hand; run `npm run docs:generate` -->
+
+| Variable | Purpose | Default |
+|----------|---------|---------|
+| `AUTOMATE_BROWSER_CLIENT_NAME` | Human name for this IDE in the relay roster | `mcp-<pid>` (CLI: `cli`) |
+| `AUTOMATE_BROWSER_TOKEN` | Optional auth token (set the same value in the extension popup) | unset |
+| `AUTOMATE_BROWSER_TOOLS` | Tool profile (`full`, `core`, `slim`) or a comma-separated category list | `full` |
+| `AUTOMATE_BROWSER_CONNECT_WAIT_MS` | How long a tool waits for a browser to appear | `30000` |
+| `AUTOMATE_BROWSER_LEASE_TTL_MS` | Soft-claim lease duration | `60000` |
+| `AUTOMATE_BROWSER_INSTANCE_ID` | Identity used to replace this agent's own previous roster entry when it restarts | derived from parent process + folder |
+| `AUTOMATE_BROWSER_CONTROLLER_STALE_MS` | Drop an agent that has sent nothing for this long | `45000` |
+| `AUTOMATE_BROWSER_WS_PORT_RANGE` | Port scan range (e.g. `9109-9116` to isolate) | `9009-9013` |
+| `AUTOMATE_BROWSER_RELAY_IDLE_MS` | Idle time before the relay exits | `300000` |
+| `AUTOMATE_BROWSER_RELAY_HOST` | Bind the relay past loopback so a browser on **another machine** can connect. Refuses to start without `AUTOMATE_BROWSER_TOKEN` | `127.0.0.1` |
+| `AUTOMATE_BROWSER_RELAY_FOREGROUND` | `1` also tees the relay's log to stderr instead of the file only | unset |
+| `AUTOMATE_BROWSER_SNAPSHOT_EACH_ACTION` | Bundle a snapshot after every interaction | unset |
+| `AUTOMATE_BROWSER_DELTA_FOOTER` | `off` disables the console-error footer below | on |
+| `AUTOMATE_BROWSER_DELTA_FOOTER_MS` | Hard ceiling on the footer's console probe | `2000` |
+| `AUTOMATE_BROWSER_NAV_CONFIRM_MS` | How long a navigation that reported no movement is re-checked before it is called a failure | `2000` |
+| `AUTOMATE_BROWSER_SCREENSHOT_MAX_WIDTH` | Widest an **inline** screenshot may come back. A `filePath` capture is never downscaled; `0` = off | `1536` |
+| `AUTOMATE_BROWSER_SCREENSHOT_MAX_HEIGHT` | Tallest an **inline** screenshot may come back, aspect ratio preserved; `0` = off | `4096` |
+| `AUTOMATE_BROWSER_ACTIONABILITY` | `off` disables the pre-action checks and post-action settle below | on |
+| `AUTOMATE_BROWSER_WS_MAX_PAYLOAD_BYTES` | Max WebSocket frame size. A whole Chrome trace is never under 1 MiB, and an oversized frame closes the socket rather than truncating | `67108864` (64 MiB) |
+| `AUTOMATE_BROWSER_WS_RATE_MAX` | Frames one socket may send per window before it is closed | `120` |
+| `AUTOMATE_BROWSER_WS_RATE_WINDOW_MS` | The window that ceiling is counted over | `1000` |
+| `AUTOMATE_BROWSER_EXTENSION_ORIGINS` | Comma-separated browser-extension origins allowed to open a socket | the AutomateBrowser extension |
+| `AUTOMATE_BROWSER_LOG_LEVEL` | `debug`, `info`, `warn` or `error`. Diagnostics go to stderr, never stdout | `info` |
+| `AUTOMATE_BROWSER_WORKSPACE` | Extra folders the file-path sandbox accepts, `;`-separated on Windows and `:`-separated elsewhere. Adds to the roots your client sends; never replaces them | unset (client roots, or the working directory when it sends none) |
+| `AUTOMATE_BROWSER_ALLOW_UNRESTRICTED_PATHS` | `1` disables the file-path sandbox below | unset |
+| `AUTOMATE_BROWSER_ALLOW_ORIGINS` | Comma-separated origin patterns; when set, **only** these may be driven | unset (unrestricted) |
+| `AUTOMATE_BROWSER_DENY_ORIGINS` | Origins that may never be driven, also blocked at the network layer | unset |
+| `AUTOMATE_BROWSER_SENSITIVE_ORIGINS` | Origins that stay readable but can never be acted on | unset |
+| `AUTOMATE_BROWSER_READ_ONLY` | `1` refuses every page-changing tool, everywhere | unset |
+| `AUTOMATE_BROWSER_NO_EVAL` | `1` refuses every tool that runs JavaScript you wrote — `browser_eval` and `browser_navigate`'s `initScript` | unset |
+| `AUTOMATE_BROWSER_AUDIT` | `off` stops the action audit log below | on |
+| `AUTOMATE_BROWSER_AUDIT_FILE` | Where the audit trail is written | `~/.automate-browser/automate-browser-audit.log` |
+| `AUTOMATE_BROWSER_NO_UPDATE_CHECK` | Any value stops the daily check for a newer release below | unset (check runs) |
+| `AUTOMATE_BROWSER_CRUX_KEY` | Google Chrome UX Report API key; `browser_perf_field_data` is inert without it | unset |
+
 <!-- AUTO-GENERATED:config END -->
 
 ### Console-error and issue footers
@@ -1637,7 +1637,7 @@ So, on startup, the server checks whether a newer release exists and prints one
 if there is:
 
 ```
-A newer @automatebrowser/mcp is available: 0.3.0 -> 0.4.0. Update with `npm i -g @automatebrowser/mcp`.
+A newer @automatebrowser/mcp is available: 1.0.0 -> 1.1.0. Update with `npm i -g @automatebrowser/mcp`.
 Set AUTOMATE_BROWSER_NO_UPDATE_CHECK=1 to silence this.
 ```
 

package/dist/{chunk-WAXVZKT5.js → chunk-7POW4XPJ.js}

@@ -11,7 +11,7 @@ import {
   probePort,
   signAuthChallenge,
   snapshotEachAction
-} from "./chunk-R5JREBXQ.js";
+} from "./chunk-NRT623ZU.js";
 
 // src/tools/errors.ts
 var ERROR_CODES = [
@@ -5270,8 +5270,9 @@ async function runTool(context, tool, args, state) {
 // package.json
 var package_default = {
   name: "@automatebrowser/mcp",
-  version: "0.3.0",
+  version: "1.0.0",
   description: "MCP server for browser automation using AutomateBrowser",
+  license: "Apache-2.0",
   author: "AutomateBrowser",
   homepage: "https://farazpawle.github.io/automatebrowser/",
   bugs: "https://github.com/farazpawle/automatebrowser/issues",

package/dist/{chunk-R5JREBXQ.js → chunk-NRT623ZU.js}

@@ -1,10 +1,10 @@
 // src/vendor/config.ts
 var appConfig = {
   name: "@automatebrowser/mcp",
-  version: "0.3.0",
+  version: "1.0.0",
   server: {
     name: "@automatebrowser/mcp",
-    version: "0.3.0"
+    version: "1.0.0"
   }
 };
 function resolveWsPortRange() {
@@ -20,7 +20,7 @@ function resolveWsPortRange() {
 var mcpConfig = {
   server: {
     name: "@automatebrowser/mcp",
-    version: "0.3.0"
+    version: "1.0.0"
   },
   transport: {
     type: "stdio"

package/dist/cli.js

@@ -6,10 +6,10 @@ import {
   package_default,
   renderError,
   selectTools
-} from "./chunk-WAXVZKT5.js";
+} from "./chunk-7POW4XPJ.js";
 import {
   debugLog
-} from "./chunk-R5JREBXQ.js";
+} from "./chunk-NRT623ZU.js";
 
 // src/cli.ts
 import { randomUUID } from "crypto";

package/dist/index.js

@@ -8,13 +8,13 @@ import {
   package_default,
   selectTools,
   setRoots
-} from "./chunk-WAXVZKT5.js";
+} from "./chunk-7POW4XPJ.js";
 import {
   appConfig,
   debugLog,
   log,
   logPath
-} from "./chunk-R5JREBXQ.js";
+} from "./chunk-NRT623ZU.js";
 
 // src/index.ts
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";

package/dist/relay.js

@@ -15,7 +15,7 @@ import {
   parseFrame,
   probePort,
   verifyAuthResponse
-} from "./chunk-R5JREBXQ.js";
+} from "./chunk-NRT623ZU.js";
 
 // src/ws.ts
 import { WebSocketServer } from "ws";

package/package.json

@@ -1,7 +1,8 @@
 {
   "name": "@automatebrowser/mcp",
-  "version": "0.3.0",
-  "description": "MCP server for browser automation using AutomateBrowser",
+  "version": "1.0.0",
+  "description": "MCP server for browser automation using AutomateBrowser",
+  "license": "Apache-2.0",
   "author": "AutomateBrowser",
   "homepage": "https://farazpawle.github.io/automatebrowser/",
   "bugs": "https://github.com/farazpawle/automatebrowser/issues",