@raultov/browser-control-mcp 0.3.1-beta.3 → 0.3.4-beta.4

package/CHANGELOG.md

@@ -10,6 +10,75 @@ from a copy of its code: entries describe the differences from that release.
 
 ## [Unreleased]
 
+## [0.3.4-beta.4] - 2026-10-27
+
+Public **BETA**. The same server as 0.3.3-beta.4, which was published on
+crates.io but without binaries, npm package or Homebrew formula: its
+release notes made GitHub skip the builds. See 0.3.3-beta.4 below for the
+changes.
+
+### Fixed
+
+- The release notes no longer quote a URL with credentials, which GitHub
+  treats as a secret; `make check` now refuses one in this file.
+
+## [0.3.3-beta.4] - 2026-10-27
+
+Public **BETA**. Tools that reported success for something that did not
+happen now say what happened, and proxy credentials are handled more
+safely. Some replies change: an unknown tool argument is an error,
+`navigate`/`reload` add `status`, a download URL fails, and
+`restart_browser`/`stop_browser` on an attached Chrome refuse or only
+disconnect.
+
+### Fixed
+
+- `open_instance` without `headless` follows the server's `--headless` flag.
+  It always opened a window, even on a server started with `--headless`
+  (where there may be no display, as in the Docker image).
+- Credentials written in a proxy URL (a user and password before the host,
+  from `--proxy-server`, `open_instance`'s `proxy` or `restart_browser`)
+  no longer reach the browser: Chrome got them on its command line, readable
+  by any local user with `ps` (and ignored them), and Firefox refused to
+  launch. `enable_proxy_auth` now falls back to the credentials of
+  `--proxy-server`.
+- `enable_proxy_auth` with wrong credentials no longer loops: a request the
+  proxy challenges again after two answers is cancelled. Firefox re-raised
+  the same request forever (about 50 challenges a second, each carrying the
+  password); Chrome retried tens of times. On Firefox, calling the tool
+  again also removes the previous intercept (each call added one more).
+- On Chrome, an instance attached to a browser that was already running on
+  its port (not launched by the server) no longer reports a restart or stop
+  that did not happen. `restart_browser` (and a `copy_cookies` relaunch)
+  fails saying the server cannot relaunch it, and nothing is changed;
+  `stop_browser` disconnects and says the browser keeps running. Both said
+  "successfully" while the same process kept running without the presets.
+- `navigate` and `reload` report the document's HTTP status (`"status":
+  404`), and an error status (400 and up) adds a note. A 404 used to look
+  like any success, and an error with an empty body failed on Chrome
+  (`ERR_HTTP_RESPONSE_CODE_FAILURE`) but succeeded on Firefox: it is now a
+  success with its status on both.
+- `navigate` to a URL the browser downloads fails with `Navigation failed:
+  the URL is a download...` on both browsers. Firefox answered "Navigated
+  to" the previous page; Chrome failed with `net::ERR_ABORTED`.
+- A tool call with an argument the tool does not have now fails before
+  anything runs, naming the argument it was probably meant to be (`tabId`
+  answers "did you mean `tab_id`?"). Unknown arguments were ignored, so a
+  `tabId` typo ran on the active tab.
+
+## [0.3.2-beta.3] - 2026-10-25
+
+Public **BETA**. Replies up to 256 MB no longer drop the browser connection
+(new `cdp-lite` and `bidi-lite` releases).
+
+### Fixed
+
+- Replies up to 256 MB no longer drop the connection: built with `cdp-lite`
+  0.3.1 and `bidi-lite` 0.1.4, which accept WebSocket messages up to 256 MiB
+  (the WebSocket library's default closed the connection on a frame over
+  16 MiB, e.g. an `evaluate_js` string of 20 MB). The lost-connection error
+  now names the 256 MB limit.
+
 ## [0.3.1-beta.3] - 2026-10-25
 
 Public **BETA**. Size limits: large pages, results, scripts, logs and

package/README.md

@@ -11,7 +11,7 @@ It is the successor of
 from a copy of its code) and complements Playwright MCP or
 chrome-devtools-mcp with runtime JavaScript debugging on both browsers.
 
-> **Status: BETA (0.3.1-beta.3).** This version contains known bugs and differences
+> **Status: BETA (0.3.4-beta.4).** This version contains known bugs and differences
 > between Chrome and Firefox (see [Limitations and TODO](#limitations-and-todo))
 > and parts that have not been verified (see [Untested](#untested)). Tool
 > replies may change in incompatible ways before 1.0. Please report problems
@@ -40,8 +40,8 @@ see the note.
 | `open_instance` | ✓ | partial | `features`, `copy_cookies` and `source_profile` are Chrome only |
 | `close_instance` | ✓ | ✓ | |
 | `list_instances` | ✓ | ✓ | each instance reports its `browser` and `capabilities` |
-| `restart_browser` | ✓ | ✓ | was `restart_chrome` |
-| `stop_browser` | ✓ | ✓ | was `stop_chrome`; on an attached Firefox it ends the session, the browser keeps running |
+| `restart_browser` | ✓ | ✓ | was `restart_chrome`; refused on a Chrome already running on the port (attached, not launched by the server) |
+| `stop_browser` | ✓ | ✓ | was `stop_chrome`; on an attached Chrome or Firefox it only disconnects (Firefox: ends the session), the browser keeps running and the reply says so |
 | `open_tab` | ✓ | ✓ | |
 | `close_tab` | ✓ | ✓ | |
 | `list_tabs` | ✓ | ✓ | |
@@ -67,7 +67,7 @@ see the note.
 | `evaluate_on_call_frame` | ✓ | ✓ | |
 | `search_scripts` | ✓ | ✓ | a long line's preview is 100 characters on each side of the match |
 | `pause_on_load` | ✓ | ✗ | TODO on Firefox, see [Limitations and TODO](#limitations-and-todo) |
-| `enable_proxy_auth` | ✓ | partial | needs `--proxy-server`; untested on Firefox against a real proxy |
+| `enable_proxy_auth` | ✓ | partial | needs `--proxy-server`; a request the proxy rejects twice is cancelled; untested on Firefox against a real proxy |
 | `send_cdp_command` | ✓ | ✗ | raw Chrome DevTools Protocol |
 | `send_bidi_command` | ✗ | ✓ | raw WebDriver BiDi; refuses `session.new`, `session.end`, `browser.close` |
 | `send_rdp_request` | ✗ | ✓ | raw Firefox RDP request to an actor (`thread`, `console`, `root` shortcuts) |
@@ -273,13 +273,19 @@ claude mcp add browser-control-mcp -- npx -y @raultov/browser-control-mcp
   lazily, on the first tool that needs them, with an ephemeral profile.
 - **Tabs.** `open_tab`, `list_tabs`, `switch_tab`, `close_tab`. Every tool
   takes `instance_id` and `tab_id`; without them it targets the default
-  instance and its active tab.
+  instance and its active tab. An argument a tool does not have fails the
+  call before anything runs (a `tabId` typo answers "did you mean
+  `tab_id`?"), so a typo never falls back to the active tab.
 - **Same replies on both browsers.** `navigate` and `reload` answer once the
   page fired `load` (at most 30 s, else with a note): a first line
   (`Navigated to <final URL>.` / `Page reloaded.`), then
   `{"url": "<final URL, after redirects>", "tab_id": "tab-N", "browser": {...}}`,
   where `browser` holds the protocol's ids (CDP `frameId`/`loaderId`, BiDi
-  `navigation`). `open_tab` answers `{tab_id, target_id, url, label}` with the
+  `navigation`), plus `"status"`, the document's HTTP status, for http(s)
+  pages (an error status, 400 and up, also adds a note; an error page with
+  an empty body is reported the same way on both browsers). A URL the
+  browser downloads fails with `Navigation failed: the URL is a
+  download...`. `open_tab` answers `{tab_id, target_id, url, label}` with the
   final URL. A network error (unknown host, refused connection...) fails with
   `Navigation failed: <browser's code> (<url>)`, e.g.
   `net::ERR_NAME_NOT_RESOLVED` on Chrome and `NS_ERROR_UNKNOWN_HOST` on
@@ -316,7 +322,7 @@ claude mcp add browser-control-mcp -- npx -y @raultov/browser-control-mcp
 | --- | --- | --- | --- |
 | `--browser <chrome\|firefox>` | `chrome` | browser of the default instance | browser of the default instance |
 | `--local` | off | navigation limited to local addresses | same |
-| `--headless` | off | headless Chrome | headless Firefox |
+| `--headless` | off | headless Chrome (also the default of `open_instance`'s `headless`) | headless Firefox (same) |
 | `--window-size <W>x<H>` | `1920x1080` | window of launched Chrome (`--window-size`) | window of launched Firefox (`--width`/`--height`) |
 | `--host <HOST>` | `127.0.0.1` | debugging host | debugging host |
 | `--port <PORT>` | `9222` | debugging port of the default instance | ignored (use `--firefox-port`) |
@@ -333,6 +339,11 @@ claude mcp add browser-control-mcp -- npx -y @raultov/browser-control-mcp
 | `--firefox-rdp-port <PORT>` | none | — | debugger port of the attached Firefox (needs `--firefox-port`) |
 | `--no-firefox-debugger` | off | — | launch Firefox without its debugger port (no debugger tools) |
 
+Credentials written in a proxy URL (`http://user:pass@host:port`) never reach
+the browser's command line; `enable_proxy_auth` uses those of `--proxy-server`
+when neither its arguments nor `--proxy-username`/`--proxy-password` give
+them.
+
 `--proxy` and `--webmcp` are aliases. To attach to your own Firefox, start it
 with `--remote-debugging-port <port>` (and `--start-debugger-server ws:<rdp>`
 plus `devtools.debugger.remote-enabled` and `devtools.chrome.enabled` for the
@@ -423,7 +434,7 @@ incompatible:
 
 | Tool | 0.1.x | 0.2.0 |
 | --- | --- | --- |
-| `navigate`, `reload` | Chrome: raw `Page.navigate` reply (`frameId`, `loaderId`, `errorText`) without waiting, `{}` on reload; Firefox: `{navigation, url}` | `{url, tab_id, browser, notes?}` after `load`; `url` is the final URL; protocol ids under `browser` |
+| `navigate`, `reload` | Chrome: raw `Page.navigate` reply (`frameId`, `loaderId`, `errorText`) without waiting, `{}` on reload; Firefox: `{navigation, url}` | `{url, tab_id, browser, status?, notes?}` after `load`; `url` is the final URL; protocol ids under `browser`; `status` is the document's HTTP status |
 | `navigate`, `open_tab` to an unreachable host | Chrome: success (`errorText` inside, or a `chrome-error://` tab) | error `Navigation failed: <code> (<url>)`; `open_tab` names the tab, which stays open |
 | `evaluate_js` | Chrome: `{"result": {type, value, ...}}`; Firefox: the bare value | `{value, type, subtype?, description?}` |
 | `set_breakpoint` | Chrome: CDP id (`1:3:0:http://…`) and `locations`; Firefox: `{breakpointId, url, lineNumber, columnNumber}` | `{breakpoint_id: "bp-N", url, line_number, column_number, resolved}` |
@@ -500,7 +511,7 @@ incompatible:
 
 ```sh
 make check        # fmt, clippy -D warnings, tests, docs, duplication, packaging, version
-make e2e          # E2E smoke against real, visible Chrome and Firefox (Linux, macOS)
+make e2e          # E2E smoke against real Chrome and Firefox, headless (E2E_VISIBLE=1 shows them; Linux, macOS)
 make check-all    # both
 ```
 

package/npm-shrinkwrap.json

@@ -19,7 +19,7 @@
       "hasInstallScript": true,
       "license": "MIT",
       "name": "@raultov/browser-control-mcp",
-      "version": "0.3.1-beta.3"
+      "version": "0.3.4-beta.4"
     },
     "node_modules/detect-libc": {
       "engines": {
@@ -48,5 +48,5 @@
     }
   },
   "requires": true,
-  "version": "0.3.1-beta.3"
+  "version": "0.3.4-beta.4"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "artifactDownloadUrls": [
-    "https://github.com/raultov/browser-control-mcp/releases/download/v0.3.1-beta.3"
+    "https://github.com/raultov/browser-control-mcp/releases/download/v0.3.4-beta.4"
   ],
   "author": "raultov <raultov@protonmail.com>",
   "bin": {
@@ -92,7 +92,7 @@
       "zipExt": ".tar.xz"
     }
   },
-  "version": "0.3.1-beta.3",
+  "version": "0.3.4-beta.4",
   "volta": {
     "node": "18.14.1",
     "npm": "9.5.0"