@mehmoodqureshi/chrome-mcp 0.9.3 → 0.9.4

package/README.md

@@ -383,6 +383,33 @@ Renders through Chrome's own print pipeline and saves to the task's `results/`
 dir, returning the path and size. The bytes themselves are never returned — a
 PDF is megabytes of base64 no model can read.
 
+### Paying less per turn — `--tools`
+
+Every MCP server you connect costs context before you ask it anything: the host
+sends the whole tool catalog to the model on **every** turn. chrome-mcp's 39
+tools are 27 KB of JSON Schema, about 6.9k tokens, on each one.
+
+Most runs need a handful of them. `--tools` advertises only those:
+
+```
+npx -y @mehmoodqureshi/chrome-mcp \
+  --allow-domain app.example.com --enable-mutations \
+  --tools tabs_list,tab_new,navigate,snapshot,click,type,get_text
+```
+
+That surface is **6.0 KB, ~1.5k tokens** — an 82% cut against the full catalog,
+for a run that was never going to print a PDF or upload a file.
+
+- Comma-separated and repeatable: `--tools navigate,get_text --tools click`.
+- A tool left out is hidden from `tools/list` **and refused if called** — a
+  `batch` op naming it fails the same way an unknown tool does. Hiding a tool is
+  a real restriction, not a display filter. It is not a substitute for the
+  policy gate, though: `--tools eval` still does nothing without
+  `--unsafe-enable-eval`.
+- An unknown name fails at startup and prints the catalog, so a typo can never
+  quietly drop `click` from the surface.
+- `chrome-mcp --help` prints the full catalog of 39 names to pick from.
+
 ## Status
 
 v0.5.0 — **safe multi-tab concurrency.** Adds the `batch` fan-out tool, makes

package/dist/src/cli.js

@@ -21,6 +21,7 @@ const datadir_1 = require("./bridge/datadir");
 const workspace_1 = require("./bridge/workspace");
 const auth_1 = require("./bridge/auth");
 const server_2 = require("./mcp/server");
+const tools_1 = require("./mcp/tools");
 const extension_install_1 = require("./extension-install");
 /** Hard deadline for clean shutdown before we force-exit (a stuck socket must not hang us). */
 const SHUTDOWN_DEADLINE_MS = 3000;
@@ -158,6 +159,21 @@ function runTasksCommand(argv) {
     process.stdout.write(TASKS_HELP);
     return true;
 }
+/** The tool names, wrapped into indented lines for `--help`. */
+function toolList() {
+    const lines = [];
+    let line = ' ';
+    for (const name of tools_1.TOOL_NAMES) {
+        if (line.length + name.length + 2 > 78) {
+            lines.push(line);
+            line = ' ';
+        }
+        line += ` ${name}`;
+    }
+    if (line.trim())
+        lines.push(line);
+    return lines.join('\n');
+}
 async function main() {
     if (runTasksCommand(process.argv.slice(2)))
         return;
@@ -168,6 +184,8 @@ async function main() {
     (0, server_2.setLogLevel)(cfg.logLevel);
     if (cfg.showHelp) {
         process.stdout.write(config_1.HELP_TEXT);
+        // The catalog is what `--tools` takes, so `--help` has to name it.
+        process.stdout.write(`\nTools (${tools_1.TOOL_NAMES.length}) — any of these for --tools:\n${toolList()}\n`);
         return;
     }
     if (cfg.showVersion) {
@@ -178,6 +196,9 @@ async function main() {
         process.stdout.write(`${installExtension()}\n`);
         return;
     }
+    // Before the bridge binds a port or writes a handshake: a typo'd `--tools`
+    // name should fail as a plain startup error, not leave a half-started server.
+    (0, tools_1.setToolAllowlist)(cfg.tools);
     const dataDir = (0, datadir_1.ensureDataDir)(cfg.dataDir);
     const token = (0, auth_1.resolveToken)(dataDir, { persist: cfg.persistToken });
     const { allowDomains, allowEval, allowDownloads, allowUploads, allowAllTabs, enableMutations } = cfg.policy;
@@ -285,9 +306,9 @@ async function main() {
     await (0, server_2.startMcpServer)(version());
 }
 main().catch((err) => {
-    // Port-busy and similar startup failures carry a plain-English message already;
-    // show that to the user without a noisy stack trace.
-    const friendly = err instanceof Error && /Couldn't start:/.test(err.message);
+    // Port-busy and bad-flag failures carry a plain-English message already
+    // (a flag error starts with the flag); show it without a noisy stack trace.
+    const friendly = err instanceof Error && /^(Couldn't start:|--|unknown argument:)/.test(err.message);
     (0, server_2.logErr)(friendly ? err.message : `fatal: ${err instanceof Error ? (err.stack ?? err.message) : String(err)}`);
     process.exit(1);
 });

package/dist/src/config.d.ts

@@ -34,6 +34,12 @@ export interface CliConfig {
     showExtensionPath: boolean;
     /** `--persist-token`: reuse a stable on-disk token so the extension never re-pairs. */
     persistToken: boolean;
+    /**
+     * `--tools`: advertise only these tools. `undefined` = the whole catalog.
+     * Names are validated against the catalog by `setToolAllowlist` at startup —
+     * config.ts deliberately does not import the tool surface.
+     */
+    tools?: string[];
     showHelp: boolean;
     showVersion: boolean;
     logLevel: LogLevel;

package/dist/src/config.js

@@ -82,6 +82,10 @@ function parseArgs(argv) {
     let showVersion = false;
     let showExtensionPath = false;
     let logLevel = 'info';
+    // Insertion-ordered so `--tools` keeps the order the operator wrote, and a
+    // name repeated across two flags is listed once.
+    const tools = new Set();
+    let toolsFlagSeen = false;
     // Policy assembled from flags, layered over an optional file.
     let policyFile;
     const policyFlags = {};
@@ -174,6 +178,11 @@ function parseArgs(argv) {
             case '--persist-token':
                 persistToken = true;
                 break;
+            case '--tools':
+                toolsFlagSeen = true;
+                for (const name of splitList(requireValue(argv[++i], '--tools')))
+                    tools.add(name);
+                break;
             case '--log-level':
                 logLevel = requireLogLevel(argv[++i]);
                 break;
@@ -196,6 +205,12 @@ function parseArgs(argv) {
     if (policy.allowUploads && !policy.uploadsDir) {
         throw new Error('--enable-uploads requires --uploads-dir <path> (uploads must be confined to a directory)');
     }
+    // `--tools ""` (or `--tools ,,`) means the operator asked for a restriction and
+    // got none — an empty surface is never what they wanted, and silently serving
+    // all 39 tools is the opposite of what they asked for.
+    if (toolsFlagSeen && tools.size === 0) {
+        throw new Error('--tools requires at least one tool name (comma-separated, e.g. --tools navigate,get_text)');
+    }
     // Fail at startup, not on the first read, if a redaction pattern is malformed:
     // a pattern the user believes is scrubbing secrets but that never compiled is
     // the worst of both worlds.
@@ -223,6 +238,7 @@ function parseArgs(argv) {
         showVersion,
         showExtensionPath,
         logLevel,
+        tools: tools.size > 0 ? [...tools] : undefined,
     };
 }
 // ---------------------------------------------------------------------------
@@ -248,6 +264,13 @@ function requireInt(value, flag) {
         throw new Error(`${flag} must be a non-negative integer`);
     return n;
 }
+/** Split a repeatable comma/space-separated list flag, dropping empty entries. */
+function splitList(value) {
+    return value
+        .split(/[,\s]+/)
+        .map((part) => part.trim())
+        .filter((part) => part.length > 0);
+}
 function requirePreference(value) {
     if (value === 'extension' || value === 'cdp')
         return value;
@@ -318,6 +341,15 @@ Security (default: deny-all safe mode):
                          high-confidence sign-in wall (expired session), so an
                          eval harness never scores it as some other failure.
 
+Tool surface:
+  --tools <list>         Advertise ONLY these tools (comma-separated, repeatable).
+                         Everything else is hidden from tools/list and refused if
+                         called — including from inside a batch op. The catalog is
+                         re-sent to the model on every turn, so trimming it to the
+                         tools a run actually needs is the cheapest context saving
+                         there is. Unknown names fail at startup.
+                         e.g. --tools tabs_list,navigate,get_text,click,type
+
 Misc:
   --log-level <lvl>      silent | info | debug (default info)
   -h, --help             Show this help

package/dist/src/mcp/tools.d.ts

@@ -22,6 +22,27 @@ export interface ToolDefinition {
     inputSchema: z.ZodRawShape;
 }
 export declare const TOOL_DEFINITIONS: ToolDefinition[];
+/** Every advertised tool name, in catalog order. */
+export declare const TOOL_NAMES: readonly string[];
+/**
+ * Restrict the tool surface to `names` (`--tools`). The catalog is the single
+ * largest fixed cost of having this server connected: every tool's JSON Schema
+ * is re-sent to the model on EVERY turn. A run that only reads pages has no use
+ * for uploads, PDFs or task management, and should not pay for their schemas.
+ *
+ * Excluded tools are neither advertised in `tools/list` nor callable — a
+ * `batch` op naming one is refused exactly like an unknown tool, so hiding a
+ * tool is a real restriction and not just a display filter.
+ *
+ * Passing `null`/`undefined`/`[]` restores the full catalog. Unknown names
+ * throw rather than being ignored: a typo that silently drops `click` from the
+ * surface is far more expensive to debug than a startup error.
+ */
+export declare function setToolAllowlist(names: readonly string[] | null | undefined): void;
+/** Is `name` on the surface? True for every catalog tool when no allowlist is set. */
+export declare function isToolEnabled(name: string): boolean;
+/** The names actually advertised, in catalog order. */
+export declare function enabledToolNames(): readonly string[];
 interface ToolCtx {
     ex: Executor;
     policy: Policy;

package/dist/src/mcp/tools.js

@@ -12,7 +12,10 @@
  * `Error` as an `isError` result.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.TOOL_HANDLERS = exports.TOOL_DEFINITIONS = void 0;
+exports.TOOL_HANDLERS = exports.TOOL_NAMES = exports.TOOL_DEFINITIONS = void 0;
+exports.setToolAllowlist = setToolAllowlist;
+exports.isToolEnabled = isToolEnabled;
+exports.enabledToolNames = enabledToolNames;
 exports.resetRateLimiter = resetRateLimiter;
 exports.dispatchToolCall = dispatchToolCall;
 exports.assertNoDrift = assertNoDrift;
@@ -35,45 +38,59 @@ const log_1 = require("./log");
 const tasks_1 = require("../bridge/tasks");
 const workspace_1 = require("../bridge/workspace");
 const validators_1 = require("./validators");
-/** Shared selector|ref target — both optional; a handler that needs one calls `requireTarget`. */
+/**
+ * Element targeting, defined ONCE and spread whole by every tool that acts on
+ * an element. `TARGET_PROPS` is the plain selector|ref pair (for tools whose
+ * handler resolves a node and nothing else); `LOCATOR_PROPS` is the full block
+ * — selector | ref | role+name, in any frame — and is what click/type/hover/
+ * select_option spread as a single object.
+ *
+ * Keeping the block in one place is also what keeps `tools/list` cheap: these
+ * seven fields repeat across a dozen tools, so every byte of prose here is paid
+ * a dozen times on EVERY turn. Detail an agent does not need on every call
+ * belongs in the owning tool's description (`frames_list`, `auth_check`) or the
+ * README, not here.
+ *
+ * A handler that needs a target calls `requireTarget`; ambiguity fails loudly
+ * rather than acting on the wrong element.
+ */
 const TARGET_PROPS = {
-    selector: zod_1.z.string().describe('CSS selector (exactly one of selector|ref)').optional(),
-    ref: zod_1.z.string().describe('Element ref from a prior read (exactly one of selector|ref)').optional(),
+    selector: zod_1.z.string().describe('CSS selector (or pass ref)').optional(),
+    ref: zod_1.z.string().describe('Element ref from a snapshot').optional(),
 };
-const tabIdField = zod_1.z.string().describe('Target tab id (defaults to the active tab)').optional();
-const authWallField = zod_1.z.boolean().describe('Fail with [AUTH_REQUIRED] when the page this call lands on is a high-confidence sign-in wall (session expired). Off by default unless the server runs with --fail-on-auth-wall; snapshot still reports the verdict as `authWall` either way.').optional();
 /**
- * Frame targeting. Omitted = the top frame, which is what every call did before
- * frames were addressable. `allFrames` is the one to reach for when a selector
- * "should" match but does not: the element is almost always inside an iframe
- * (checkout widgets, OAuth consent, embedded editors). Every frame is
- * authorized against its own URL, so a scan never reaches a site the allowlist
- * does not cover.
+ * Frame targeting. Omitted = the top frame. `allFrames` is the one to reach for
+ * when a selector "should" match but does not — the element is almost always
+ * inside an iframe. Every frame is authorized against its own URL, so a scan
+ * never reaches a site the allowlist does not cover.
  */
 const FRAME_PROPS = {
-    frameId: zod_1.z.number().describe('Act inside this frame (ids come from frames_list)').optional(),
-    allFrames: zod_1.z
-        .boolean()
-        .describe('Search every frame of the tab and act on the first that matches - use when a selector should match but does not (the element is in an iframe)')
-        .optional(),
+    frameId: zod_1.z.number().describe('Frame id from frames_list').optional(),
+    allFrames: zod_1.z.boolean().describe('Act on the first match in ANY frame (the element may be in an iframe)').optional(),
 };
 /**
- * Target an element by role + accessible name instead of a CSS selector, so an
- * action needs no snapshot first. Resolution is server-side and fails loudly on
- * ambiguity rather than acting on the wrong element.
+ * The full locator block. role+name targets an element the way a person reads
+ * the page, so an action needs no snapshot first; resolution is server-side.
  */
 const LOCATOR_PROPS = {
-    role: zod_1.z.string().describe('Target by ARIA role (e.g. button, link, textbox) - alternative to selector/ref').optional(),
-    name: zod_1.z.string().describe('Target by accessible name/visible label (pairs with role)').optional(),
-    nth: zod_1.z.number().describe('Pick the nth (0-based) match when a role+name locator is legitimately ambiguous').optional(),
+    ...TARGET_PROPS,
+    // These tools take role+name too, so their `selector` says so; the tools that
+    // only resolve a node keep the plain TARGET_PROPS wording.
+    selector: zod_1.z.string().describe('CSS selector (or ref, or role+name)').optional(),
+    role: zod_1.z.string().describe('ARIA role, e.g. button|link|textbox (pair with name)').optional(),
+    name: zod_1.z.string().describe('Accessible name / visible label (pair with role)').optional(),
+    nth: zod_1.z.number().describe('0-based index when role+name is ambiguous').optional(),
+    ...FRAME_PROPS,
 };
+const tabIdField = zod_1.z.string().describe('Tab id (default: active tab)').optional();
+const authWallField = zod_1.z.boolean().describe('Error with [AUTH_REQUIRED] if this lands on a sign-in wall (expired session)').optional();
 const snapshotAfterField = zod_1.z
     .boolean()
-    .describe('Return what CHANGED on the page after this action (added/removed/changed elements vs the last snapshot) instead of making you re-read the page')
+    .describe('Return what CHANGED on the page after this action instead of making you re-read it')
     .optional();
 const maxBytesField = zod_1.z
     .number()
-    .describe(`Cap the returned content at this many UTF-8 bytes (default ${limits_1.DEFAULT_MAX_OUTPUT_BYTES}). A truncated result reports truncated/totalBytes/returnedBytes. The full payload is still written to the task's results/ dir.`)
+    .describe(`Cap returned content at N UTF-8 bytes (default ${limits_1.DEFAULT_MAX_OUTPUT_BYTES}); the full payload still lands in results/`)
     .optional();
 const waitUntilField = zod_1.z.enum(['load', 'domcontentloaded', 'networkidle']).describe('When to consider navigation done').optional();
 exports.TOOL_DEFINITIONS = [
@@ -85,11 +102,11 @@ exports.TOOL_DEFINITIONS = [
     { name: 'back', description: 'Go back in history.', inputSchema: { tabId: tabIdField, failOnAuthWall: authWallField } },
     { name: 'forward', description: 'Go forward in history.', inputSchema: { tabId: tabIdField, failOnAuthWall: authWallField } },
     { name: 'reload', description: 'Reload the active (or given) tab.', inputSchema: { tabId: tabIdField, waitUntil: waitUntilField, failOnAuthWall: authWallField } },
-    { name: 'click', description: 'Click an element. Target by selector, a snapshot ref, or role+name (e.g. role:"button", name:"Sign in") - the locator needs no snapshot first. trusted=true uses real OS-level input.', inputSchema: { ...TARGET_PROPS, ...LOCATOR_PROPS, ...FRAME_PROPS, tabId: tabIdField, button: zod_1.z.enum(['left', 'right', 'middle']).optional(), clickCount: zod_1.z.number().optional(), trusted: zod_1.z.boolean().optional(), snapshotAfter: snapshotAfterField, failOnAuthWall: authWallField } },
-    { name: 'type', description: 'Type text into an element (target by selector, ref, or role+name). trusted=true sends real keystrokes (works on React/Vue controlled inputs).', inputSchema: { ...TARGET_PROPS, ...LOCATOR_PROPS, ...FRAME_PROPS, text: zod_1.z.string(), tabId: tabIdField, clear: zod_1.z.boolean().optional(), pressEnter: zod_1.z.boolean().optional(), keyEvents: zod_1.z.boolean().optional(), trusted: zod_1.z.boolean().optional(), snapshotAfter: snapshotAfterField, failOnAuthWall: authWallField } },
-    { name: 'select_option', description: 'Select option(s) of a <select> by value or visible label.', inputSchema: { ...TARGET_PROPS, ...LOCATOR_PROPS, ...FRAME_PROPS, values: zod_1.z.array(zod_1.z.string()), tabId: tabIdField, snapshotAfter: snapshotAfterField, failOnAuthWall: authWallField } },
+    { name: 'click', description: 'Click an element. Target by selector, a snapshot ref, or role+name (e.g. role:"button", name:"Sign in") - the locator needs no snapshot first. trusted=true uses real OS-level input.', inputSchema: { ...LOCATOR_PROPS, tabId: tabIdField, button: zod_1.z.enum(['left', 'right', 'middle']).optional(), clickCount: zod_1.z.number().optional(), trusted: zod_1.z.boolean().optional(), snapshotAfter: snapshotAfterField, failOnAuthWall: authWallField } },
+    { name: 'type', description: 'Type text into an element (target by selector, ref, or role+name). trusted=true sends real keystrokes (works on React/Vue controlled inputs).', inputSchema: { ...LOCATOR_PROPS, text: zod_1.z.string(), tabId: tabIdField, clear: zod_1.z.boolean().optional(), pressEnter: zod_1.z.boolean().optional(), keyEvents: zod_1.z.boolean().optional(), trusted: zod_1.z.boolean().optional(), snapshotAfter: snapshotAfterField, failOnAuthWall: authWallField } },
+    { name: 'select_option', description: 'Select option(s) of a <select> by value or visible label.', inputSchema: { ...LOCATOR_PROPS, values: zod_1.z.array(zod_1.z.string()), tabId: tabIdField, snapshotAfter: snapshotAfterField, failOnAuthWall: authWallField } },
     { name: 'press', description: 'Press a key (with optional modifiers).', inputSchema: { key: zod_1.z.string(), modifiers: zod_1.z.array(zod_1.z.string()).optional(), tabId: tabIdField, failOnAuthWall: authWallField } },
-    { name: 'hover', description: 'Hover over an element.', inputSchema: { ...TARGET_PROPS, ...LOCATOR_PROPS, ...FRAME_PROPS, tabId: tabIdField, snapshotAfter: snapshotAfterField } },
+    { name: 'hover', description: 'Hover over an element.', inputSchema: { ...LOCATOR_PROPS, tabId: tabIdField, snapshotAfter: snapshotAfterField } },
     { name: 'scroll', description: 'Scroll the page or to an element.', inputSchema: { ...TARGET_PROPS, ...FRAME_PROPS, x: zod_1.z.number().optional(), y: zod_1.z.number().optional(), deltaX: zod_1.z.number().optional(), deltaY: zod_1.z.number().optional(), tabId: tabIdField } },
     { name: 'screenshot', description: 'Capture a screenshot (page or element). Default is JPEG (quality 70) at CSS-pixel size, which is several times smaller than PNG and reads fine. Pass format:"png" for lossless, quality 1-100 for JPEG, scale 2 for device pixels on a Retina display or 0.5 to shrink.', inputSchema: { ...TARGET_PROPS, ...FRAME_PROPS, fullPage: zod_1.z.boolean().optional(), format: zod_1.z.enum(['jpeg', 'png']).optional(), quality: zod_1.z.number().optional(), scale: zod_1.z.number().optional(), tabId: tabIdField } },
     { name: 'get_text', description: 'Get visible text of the page or an element.', inputSchema: { ...TARGET_PROPS, ...FRAME_PROPS, tabId: tabIdField, maxBytes: maxBytesField } },
@@ -182,6 +199,48 @@ exports.TOOL_DEFINITIONS = [
         },
     },
 ];
+// ---------------------------------------------------------------------------
+// Tool allowlist (--tools)
+// ---------------------------------------------------------------------------
+/** Every advertised tool name, in catalog order. */
+exports.TOOL_NAMES = exports.TOOL_DEFINITIONS.map((d) => d.name);
+/** `null` = the whole catalog (the default). */
+let toolAllowlist = null;
+/**
+ * Restrict the tool surface to `names` (`--tools`). The catalog is the single
+ * largest fixed cost of having this server connected: every tool's JSON Schema
+ * is re-sent to the model on EVERY turn. A run that only reads pages has no use
+ * for uploads, PDFs or task management, and should not pay for their schemas.
+ *
+ * Excluded tools are neither advertised in `tools/list` nor callable — a
+ * `batch` op naming one is refused exactly like an unknown tool, so hiding a
+ * tool is a real restriction and not just a display filter.
+ *
+ * Passing `null`/`undefined`/`[]` restores the full catalog. Unknown names
+ * throw rather than being ignored: a typo that silently drops `click` from the
+ * surface is far more expensive to debug than a startup error.
+ */
+function setToolAllowlist(names) {
+    if (!names || names.length === 0) {
+        toolAllowlist = null;
+        return;
+    }
+    const known = new Set(exports.TOOL_NAMES);
+    const unknown = names.filter((n) => !known.has(n));
+    if (unknown.length > 0) {
+        throw new Error(`--tools: unknown tool ${unknown.map((n) => JSON.stringify(n)).join(', ')}. ` +
+            `Known tools: ${exports.TOOL_NAMES.join(', ')}`);
+    }
+    toolAllowlist = new Set(names);
+}
+/** Is `name` on the surface? True for every catalog tool when no allowlist is set. */
+function isToolEnabled(name) {
+    return toolAllowlist === null || toolAllowlist.has(name);
+}
+/** The names actually advertised, in catalog order. */
+function enabledToolNames() {
+    return exports.TOOL_NAMES.filter(isToolEnabled);
+}
 const GATE_CONTEXT = 'cannot resolve the target tab URL for the policy gate';
 /**
  * Resolve the URL the policy should be evaluated against: the URL of the tab
@@ -984,6 +1043,10 @@ function isRetryableFault(name, err) {
     return err instanceof types_1.ExecutorError && err.code === 'EXTENSION_DISCONNECTED' && RETRY_SAFE_TOOLS.has(name);
 }
 async function dispatchToolCall(name, rawArgs) {
+    // The allowlist is checked here, not only at registration, so a `batch` op
+    // cannot reach a tool the operator kept off the surface.
+    if (!isToolEnabled(name))
+        return (0, envelopes_1.errorResult)(`tool not enabled on this server (--tools): ${name}`);
     const handler = exports.TOOL_HANDLERS[name];
     if (!handler)
         return (0, envelopes_1.errorResult)(`unknown tool: ${name}`);
@@ -1046,7 +1109,13 @@ function registerTools(server) {
     // just routes back through `dispatchToolCall` — our never-throw firewall that
     // applies the rate limit, executor readiness, policy gate, and history log.
     for (const d of exports.TOOL_DEFINITIONS) {
+        if (!isToolEnabled(d.name))
+            continue;
         server.registerTool(d.name, { description: d.description, inputSchema: d.inputSchema }, async (args) => dispatchToolCall(d.name, args));
     }
+    const advertised = enabledToolNames();
+    if (advertised.length < exports.TOOL_NAMES.length) {
+        (0, log_1.logErr)(`--tools: advertising ${advertised.length} of ${exports.TOOL_NAMES.length} tools (${advertised.join(', ')})`);
+    }
 }
 //# sourceMappingURL=tools.js.map

package/extension-dist/manifest.json

@@ -3,7 +3,7 @@
   "name": "MCP Extension for Chrome",
   "version": "0.9.3",
   "description": "Lets a local chrome-mcp server drive this browser. Pair it with the server's handshake token.",
-  "homepage_url": "https://github.com/Mehmoodqureshi/chrome-mcp",
+  "homepage_url": "https://chrome-mcp-omega.vercel.app",
   "minimum_chrome_version": "116",
   "icons": {
     "16": "icon16.png",

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "@mehmoodqureshi/chrome-mcp",
-  "version": "0.9.3",
+  "version": "0.9.4",
   "description": "Drive your real Chrome browser over MCP — real logins, real cookies. A stdio MCP server (CLI) plus an MV3 extension, driving Chrome via chrome.scripting/chrome.tabs. Multi-tab batch automation, accessibility snapshots, deny-all security by default.",
   "author": "Mehmood Ur Rehman Qureshi",
   "license": "MIT",
-  "homepage": "https://github.com/Mehmoodqureshi/chrome-mcp#readme",
+  "homepage": "https://chrome-mcp-omega.vercel.app",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/Mehmoodqureshi/chrome-mcp.git"