cdpilot 0.1.0 → 0.1.2

package/README.md

@@ -1,8 +1,8 @@
-# browserctl
+# cdpilot
 
 > Zero-dependency browser automation from your terminal. One command, full control.
 
-[![npm version](https://img.shields.io/npm/v/browserctl.svg)](https://www.npmjs.com/package/browserctl)
+[![npm version](https://img.shields.io/npm/v/cdpilot.svg)](https://www.npmjs.com/package/cdpilot)
 [![License: MIT](https://img.shields.io/badge/License-MIT-green.svg)](LICENSE)
 
 <!-- Demo GIF will be added after first release -->
@@ -10,27 +10,27 @@
 ## Quick Start
 
 ```bash
-npx browserctl launch    # Start browser with CDP
-npx browserctl go https://example.com
-npx browserctl shot      # Take screenshot
+npx cdpilot launch    # Start browser with CDP
+npx cdpilot go https://example.com
+npx cdpilot shot      # Take screenshot
 ```
 
 No config files. No boilerplate. Just `npx` and go.
 
-## Why browserctl?
+## Why cdpilot?
 
 AI agents and developers need browser control that **just works**:
 
-- **Zero config** — `npx browserctl launch` starts an isolated browser session
+- **Zero config** — `npx cdpilot launch` starts an isolated browser session
 - **Zero dependency** — No Puppeteer, no Playwright, no Selenium. Pure CDP over HTTP
 - **40+ commands** — Navigate, click, type, screenshot, network, console, accessibility, and more
 - **AI-agent friendly** — Designed for Claude, GPT, Gemini, and any LLM tool-use workflow
-- **Isolated sessions** — Your personal browser stays untouched. browserctl runs in its own profile
+- **Isolated sessions** — Your personal browser stays untouched. cdpilot runs in its own profile
 - **Privacy-first** — Everything runs locally. No data leaves your machine
 
 ### Why Brave?
 
-browserctl uses [Brave Browser](https://brave.com) as its engine. Here's why:
+cdpilot uses [Brave Browser](https://brave.com) as its engine. Here's why:
 
 | Feature | Brave | Chrome | Why it matters |
 |---------|-------|--------|---------------|
@@ -43,16 +43,16 @@ browserctl uses [Brave Browser](https://brave.com) as its engine. Here's why:
 
 **TL;DR:** Brave = Chrome's power + built-in privacy + less bloat. Perfect for automation.
 
-> browserctl also works with Chrome and Chromium as fallback. Brave is recommended, not required.
+> cdpilot also works with Chrome and Chromium as fallback. Brave is recommended, not required.
 
 ## Installation
 
 ```bash
 # Use directly (no install needed)
-npx browserctl <command>
+npx cdpilot <command>
 
 # Or install globally
-npm i -g browserctl
+npm i -g cdpilot
 ```
 
 **Requirements:** Node.js 18+ and one of: Brave Browser, Google Chrome, or Chromium.
@@ -60,9 +60,9 @@ npm i -g browserctl
 ### First-time setup
 
 ```bash
-npx browserctl setup     # Auto-detect browser, create isolated profile
-npx browserctl launch    # Start browser with CDP enabled
-npx browserctl status    # Check connection
+npx cdpilot setup     # Auto-detect browser, create isolated profile
+npx cdpilot launch    # Start browser with CDP enabled
+npx cdpilot status    # Check connection
 ```
 
 ## Commands
@@ -70,126 +70,126 @@ npx browserctl status    # Check connection
 ### Navigation & Content
 
 ```bash
-browserctl go <url>              # Navigate to URL
-browserctl content               # Get page text content
-browserctl html                  # Get page HTML
-browserctl shot [file]           # Take screenshot (PNG)
-browserctl pdf [file]            # Save page as PDF
+cdpilot go <url>              # Navigate to URL
+cdpilot content               # Get page text content
+cdpilot html                  # Get page HTML
+cdpilot shot [file]           # Take screenshot (PNG)
+cdpilot pdf [file]            # Save page as PDF
 ```
 
 ### Interaction
 
 ```bash
-browserctl click <selector>      # Click element
-browserctl type <selector> <text># Type into input
-browserctl fill <selector> <val> # Set input value (React-compatible)
-browserctl submit <form>         # Submit form
-browserctl hover <selector>      # Hover element
-browserctl keys <combo>          # Keyboard shortcut (ctrl+a, enter, etc.)
-browserctl scroll-to <selector>  # Scroll element into view
-browserctl drag <from> <to>      # Drag and drop
+cdpilot click <selector>      # Click element
+cdpilot type <selector> <text># Type into input
+cdpilot fill <selector> <val> # Set input value (React-compatible)
+cdpilot submit <form>         # Submit form
+cdpilot hover <selector>      # Hover element
+cdpilot keys <combo>          # Keyboard shortcut (ctrl+a, enter, etc.)
+cdpilot scroll-to <selector>  # Scroll element into view
+cdpilot drag <from> <to>      # Drag and drop
 ```
 
 ### Debugging
 
 ```bash
-browserctl console [url]         # Capture console logs
-browserctl network [url]         # Monitor network requests
-browserctl debug [url]           # Full diagnostic (console+network+perf+shot)
-browserctl perf                  # Performance metrics
-browserctl eval <js>             # Execute JavaScript
+cdpilot console [url]         # Capture console logs
+cdpilot network [url]         # Monitor network requests
+cdpilot debug [url]           # Full diagnostic (console+network+perf+shot)
+cdpilot perf                  # Performance metrics
+cdpilot eval <js>             # Execute JavaScript
 ```
 
 ### Tab Management
 
 ```bash
-browserctl tabs                  # List open tabs
-browserctl new-tab [url]         # Open new tab
-browserctl switch-tab <id>       # Switch to tab
-browserctl close-tab [id]        # Close tab
-browserctl close                 # Close active tab
+cdpilot tabs                  # List open tabs
+cdpilot new-tab [url]         # Open new tab
+cdpilot switch-tab <id>       # Switch to tab
+cdpilot close-tab [id]        # Close tab
+cdpilot close                 # Close active tab
 ```
 
 ### Network Control
 
 ```bash
-browserctl throttle slow3g       # Simulate slow 3G
-browserctl throttle fast3g       # Simulate fast 3G
-browserctl throttle offline      # Go offline
-browserctl throttle off          # Back to normal
-browserctl proxy <url>           # Set proxy
-browserctl proxy off             # Remove proxy
+cdpilot throttle slow3g       # Simulate slow 3G
+cdpilot throttle fast3g       # Simulate fast 3G
+cdpilot throttle offline      # Go offline
+cdpilot throttle off          # Back to normal
+cdpilot proxy <url>           # Set proxy
+cdpilot proxy off             # Remove proxy
 ```
 
 ### Request Interception
 
 ```bash
-browserctl intercept block <pattern>                    # Block requests
-browserctl intercept mock <pattern> <json-file>         # Mock responses
-browserctl intercept headers <pattern> <header:value>   # Add headers
-browserctl intercept list                               # List active rules
-browserctl intercept clear                              # Clear all rules
+cdpilot intercept block <pattern>                    # Block requests
+cdpilot intercept mock <pattern> <json-file>         # Mock responses
+cdpilot intercept headers <pattern> <header:value>   # Add headers
+cdpilot intercept list                               # List active rules
+cdpilot intercept clear                              # Clear all rules
 ```
 
 ### Device Emulation
 
 ```bash
-browserctl emulate iphone        # iPhone emulation
-browserctl emulate ipad          # iPad emulation
-browserctl emulate android       # Android emulation
-browserctl emulate reset         # Back to desktop
+cdpilot emulate iphone        # iPhone emulation
+cdpilot emulate ipad          # iPad emulation
+cdpilot emulate android       # Android emulation
+cdpilot emulate reset         # Back to desktop
 ```
 
 ### Geolocation
 
 ```bash
-browserctl geo istanbul          # Set location to Istanbul
-browserctl geo london            # Set location to London
-browserctl geo 41.01 28.97       # Custom coordinates
-browserctl geo off               # Remove override
+cdpilot geo istanbul          # Set location to Istanbul
+cdpilot geo london            # Set location to London
+cdpilot geo 41.01 28.97       # Custom coordinates
+cdpilot geo off               # Remove override
 ```
 
 ### Accessibility
 
 ```bash
-browserctl a11y                  # Full accessibility tree
-browserctl a11y summary          # Quick summary
-browserctl a11y find <role>      # Find elements by ARIA role
+cdpilot a11y                  # Full accessibility tree
+cdpilot a11y summary          # Quick summary
+cdpilot a11y find <role>      # Find elements by ARIA role
 ```
 
 ### Session Management
 
 ```bash
-browserctl session               # Current session info
-browserctl sessions              # List all sessions
-browserctl session-close [id]    # Close session
+cdpilot session               # Current session info
+cdpilot sessions              # List all sessions
+cdpilot session-close [id]    # Close session
 ```
 
 ### Advanced
 
 ```bash
-browserctl cookies [domain]      # List cookies
-browserctl storage               # localStorage contents
-browserctl upload <sel> <file>   # Upload file to input
-browserctl multi-eval <js>       # Execute JS in all tabs
-browserctl headless [on|off]     # Toggle headless mode
-browserctl frame list            # List iframes
-browserctl dialog auto-accept    # Auto-accept dialogs
-browserctl permission grant geo  # Grant geolocation
+cdpilot cookies [domain]      # List cookies
+cdpilot storage               # localStorage contents
+cdpilot upload <sel> <file>   # Upload file to input
+cdpilot multi-eval <js>       # Execute JS in all tabs
+cdpilot headless [on|off]     # Toggle headless mode
+cdpilot frame list            # List iframes
+cdpilot dialog auto-accept    # Auto-accept dialogs
+cdpilot permission grant geo  # Grant geolocation
 ```
 
 ## Use with AI Agents
 
-browserctl is designed to be called by AI agents as a tool:
+cdpilot is designed to be called by AI agents as a tool:
 
 ### Claude Code (MCP)
 
 ```json
 {
   "mcpServers": {
-    "browserctl": {
+    "cdpilot": {
       "command": "npx",
-      "args": ["browserctl", "mcp"]
+      "args": ["cdpilot", "mcp"]
     }
   }
 }
@@ -211,7 +211,7 @@ browserctl is designed to be called by AI agents as a tool:
 
 ```python
 import subprocess
-result = subprocess.run(["npx", "browserctl", "go", url], capture_output=True, text=True)
+result = subprocess.run(["npx", "cdpilot", "go", url], capture_output=True, text=True)
 print(result.stdout)
 ```
 
@@ -221,14 +221,14 @@ print(result.stdout)
 |----------|---------|-------------|
 | `CDP_PORT` | `9222` | CDP debugging port |
 | `CHROME_BIN` | Auto-detect | Browser binary path |
-| `BROWSERCTL_PROFILE` | `~/.browserctl/profile` | Isolated browser profile |
+| `CDPILOT_PROFILE` | `~/.cdpilot/profile` | Isolated browser profile |
 | `BROWSER_SESSION` | Auto | Session identifier |
 
 ## How It Works
 
 ```
 ┌─────────────┐     HTTP/WebSocket      ┌──────────────┐
-│  browserctl │ ◄──────────────────────► │ Brave/Chrome │
+│  cdpilot │ ◄──────────────────────► │ Brave/Chrome │
 │   (CLI)     │    Chrome DevTools       │  (CDP mode)  │
 └─────────────┘     Protocol             └──────────────┘
        │                                        │
@@ -242,7 +242,7 @@ print(result.stdout)
 
 ## Comparison
 
-| Feature | browserctl | Puppeteer | Playwright | Selenium |
+| Feature | cdpilot | Puppeteer | Playwright | Selenium |
 |---------|-----------|-----------|------------|----------|
 | Install size | **~50KB** | 400MB+ | 200MB+ | 100MB+ |
 | Dependencies | **0** | 50+ | 30+ | Java + drivers |
@@ -254,18 +254,28 @@ print(result.stdout)
 
 ## Monetization / Pro (Coming Soon)
 
-browserctl CLI is and will always be **free and open source** (MIT).
+cdpilot CLI is and will always be **free and open source** (MIT).
 
 Future paid offerings:
-- **browserctl cloud** — Remote browser instances, no local browser needed
+- **cdpilot cloud** — Remote browser instances, no local browser needed
 - **Team dashboard** — Shared sessions, audit logs, usage analytics
 - **Priority support** — Direct help for enterprise integrations
 
+## Security
+
+- **Isolated browser profile** — cdpilot runs in `~/.cdpilot/profile`, separate from your daily browser. Your cookies, passwords, and history are never exposed.
+- **No arbitrary file access** — MCP screenshot filenames are sanitized and restricted to the screenshots directory. Path traversal is blocked.
+- **Safe CSS selectors** — All selectors passed to `querySelector` are JSON-escaped to prevent injection.
+- **No network exposure** — CDP listens on `127.0.0.1` only. Remote connections are not possible by default.
+- **No dependencies** — Zero npm/Python runtime dependencies means zero supply-chain attack surface.
+
+Found a vulnerability? Please email the maintainer directly instead of opening a public issue.
+
 ## Contributing
 
 ```bash
-git clone https://github.com/user/browserctl.git
-cd browserctl
+git clone https://github.com/mehmetnadir/cdpilot.git
+cd cdpilot
 npm install
 npm test
 ```
@@ -279,5 +289,5 @@ MIT — do whatever you want.
 ---
 
 <p align="center">
-  Built with the <a href="https://github.com/nicedoc/browserctl">browserctl</a> mindset: one tool, one job, done right.
+  Built with the <a href="https://github.com/mehmetnadir/cdpilot">cdpilot</a> mindset: one tool, one job, done right.
 </p>

package/bin/{browserctl.js → cdpilot.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 
 /**
- * browserctl — Zero-dependency browser automation CLI
- * Entry point: detects Python, finds browser, delegates to browserctl.py
+ * cdpilot — Zero-dependency browser automation CLI
+ * Entry point: detects Python, finds browser, delegates to cdpilot.py
  */
 
 const { execSync, spawn } = require('child_process');
@@ -10,7 +10,7 @@ const path = require('path');
 const fs = require('fs');
 const os = require('os');
 
-const SCRIPT = path.join(__dirname, '..', 'src', 'browserctl.py');
+const SCRIPT = path.join(__dirname, '..', 'src', 'cdpilot.py');
 const VERSION = require('../package.json').version;
 
 // ── Browser Detection ──
@@ -85,11 +85,11 @@ function findPython() {
 
 function runSetup() {
   const browser = findBrowser();
-  const profileDir = process.env.BROWSERCTL_PROFILE
-    || path.join(os.homedir(), '.browserctl', 'profile');
+  const profileDir = process.env.CDPILOT_PROFILE
+    || path.join(os.homedir(), '.cdpilot', 'profile');
   const port = process.env.CDP_PORT || '9222';
 
-  console.log('\n  browserctl setup\n');
+  console.log('\n  cdpilot setup\n');
   console.log(`  Browser:  ${browser || '❌ Not found'}`);
   console.log(`  Profile:  ${profileDir}`);
   console.log(`  CDP Port: ${port}`);
@@ -116,14 +116,14 @@ function runSetup() {
     console.log(`\n  ✓ Profile exists: ${profileDir}`);
   }
 
-  console.log('  ✓ Setup complete! Run: browserctl launch\n');
+  console.log('  ✓ Setup complete! Run: cdpilot launch\n');
 }
 
 // ── Status Command ──
 
 function runStatus() {
   const port = process.env.CDP_PORT || '9222';
-  console.log(`\n  browserctl status (port ${port})\n`);
+  console.log(`\n  cdpilot status (port ${port})\n`);
 
   try {
     const http = require('http');
@@ -144,12 +144,12 @@ function runStatus() {
     });
     req.on('error', () => {
       console.log('  ❌ No browser connected on this port.');
-      console.log('  Run: browserctl launch\n');
+      console.log('  Run: cdpilot launch\n');
     });
     req.on('timeout', () => {
       req.destroy();
       console.log('  ❌ Connection timeout.');
-      console.log('  Run: browserctl launch\n');
+      console.log('  Run: cdpilot launch\n');
     });
   } catch {
     console.log('  ❌ Could not check status.\n');
@@ -159,17 +159,17 @@ function runStatus() {
 // ── Version ──
 
 function showVersion() {
-  console.log(`browserctl v${VERSION}`);
+  console.log(`cdpilot v${VERSION}`);
 }
 
 // ── Help ──
 
 function showHelp() {
   console.log(`
-  browserctl v${VERSION} — Zero-dependency browser automation
+  cdpilot v${VERSION} — Zero-dependency browser automation
 
   USAGE
-    browserctl <command> [args]
+    cdpilot <command> [args]
 
   SETUP
     setup              Auto-detect browser, create isolated profile
@@ -203,7 +203,10 @@ function showHelp() {
     new-tab [url]      Open new tab
     close-tab [id]     Close tab
 
-  More: https://github.com/user/browserctl#commands
+  AI AGENT
+    mcp                Start MCP server (stdin/stdout JSON-RPC)
+
+  More: https://github.com/mehmetnadir/cdpilot#commands
 `);
 }
 
@@ -239,14 +242,14 @@ if (cmd === 'status') {
   }
 
   const browser = findBrowser();
-  const profileDir = process.env.BROWSERCTL_PROFILE
-    || path.join(os.homedir(), '.browserctl', 'profile');
+  const profileDir = process.env.CDPILOT_PROFILE
+    || path.join(os.homedir(), '.cdpilot', 'profile');
   const port = process.env.CDP_PORT || '9222';
 
   const env = {
     ...process.env,
     CDP_PORT: port,
-    BROWSERCTL_PROFILE: profileDir,
+    CDPILOT_PROFILE: profileDir,
   };
 
   if (browser && !process.env.CHROME_BIN) {

package/package.json

@@ -1,43 +1,32 @@
 {
   "name": "cdpilot",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Zero-dependency browser automation from your terminal. One command, full control.",
   "bin": {
-    "bctl": "./bin/browserctl.js",
-    "browserctl": "./bin/browserctl.js"
+    "cdpilot": "./bin/cdpilot.js",
+    "bctl": "./bin/cdpilot.js"
   },
   "scripts": {
     "test": "node test/test.js",
-    "start": "node bin/browserctl.js"
+    "start": "node bin/cdpilot.js"
   },
   "keywords": [
-    "browser",
-    "automation",
-    "cdp",
-    "chrome-devtools-protocol",
-    "cli",
-    "devtools",
-    "headless",
-    "screenshot",
-    "testing",
-    "web-scraping",
-    "ai-agent",
-    "mcp",
-    "claude",
-    "brave"
+    "browser", "automation", "cdp", "chrome-devtools-protocol", "cli",
+    "devtools", "headless", "screenshot", "testing", "web-scraping",
+    "ai-agent", "mcp", "claude", "brave"
   ],
-  "author": "",
+  "author": "Mehmet Nadir",
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "https://github.com/user/browserctl"
+    "url": "https://github.com/mehmetnadir/cdpilot"
   },
   "engines": {
     "node": ">=18.0.0"
   },
   "files": [
     "bin/",
-    "src/",
+    "src/cdpilot.py",
     "README.md",
     "LICENSE"
   ]

package/src/{browserctl.py → cdpilot.py}

@@ -1,20 +1,20 @@
 #!/usr/bin/env python3
 """
-browserctl — Zero-dependency browser automation from your terminal.
+cdpilot — Zero-dependency browser automation from your terminal.
 
 Controls any Chromium-based browser (Brave, Chrome, Chromium) via the
 Chrome DevTools Protocol (CDP). No Puppeteer, no Playwright, no Selenium.
 
 Usage:
-  browserctl <command> [arguments]
+  cdpilot <command> [arguments]
 
 Environment:
   CDP_PORT             CDP debugging port (default: 9222)
   CHROME_BIN           Browser binary path (auto-detected if not set)
-  BROWSERCTL_PROFILE   Isolated browser profile directory
+  CDPILOT_PROFILE      Isolated browser profile directory
 """
 
-__version__ = "0.1.0"
+__version__ = "0.1.2"
 
 import asyncio
 import json
@@ -27,13 +27,13 @@ import subprocess
 import shutil
 
 # ─── Session Configuration ───
-# browserctl runs in its own Chrome instance on the configured CDP port.
+# cdpilot runs in its own Chrome instance on the configured CDP port.
 # The user's existing Chrome/browser session is not affected.
 
 CDP_PORT = int(os.environ.get("CDP_PORT", "9222"))
 CDP_BASE = f"http://127.0.0.1:{CDP_PORT}"
 CHROME_BIN = os.environ.get("CHROME_BIN")
-PROFILE_DIR = os.environ.get("BROWSERCTL_PROFILE", os.path.expanduser("~/.browserctl/profile"))
+PROFILE_DIR = os.environ.get("CDPILOT_PROFILE", os.path.expanduser("~/.cdpilot/profile"))
 SCREENSHOT_DIR = "/tmp"
 
 DEV_EXTENSIONS_FILE = os.path.join(PROFILE_DIR, 'dev-extensions.json')
@@ -52,7 +52,7 @@ def _get_session_id():
     if sid:
         return sid
     # Default session — all commands share the same window
-    return "browserctl-default"
+    return "cdpilot-default"
 
 def _load_sessions():
     """Read the session registry."""
@@ -93,11 +93,11 @@ _current_session_id = None  # lazy init
 
 GLOW_CSS = """
 (function() {
-  if (document.getElementById('browserctl-glow')) return 'already active';
+  if (document.getElementById('cdpilot-glow')) return 'already active';
   const style = document.createElement('style');
-  style.id = 'browserctl-glow';
+  style.id = 'cdpilot-glow';
   style.textContent = `
-    @keyframes browserctl-pulse {
+    @keyframes cdpilot-pulse {
       0%, 100% { box-shadow: inset 0 0 20px 4px rgba(34, 197, 94, 0.25), inset 0 0 60px 8px rgba(34, 197, 94, 0.08); }
       50% { box-shadow: inset 0 0 30px 6px rgba(34, 197, 94, 0.35), inset 0 0 80px 12px rgba(34, 197, 94, 0.12); }
     }
@@ -107,7 +107,7 @@ GLOW_CSS = """
       top: 0; left: 0; right: 0; bottom: 0;
       pointer-events: none;
       z-index: 2147483647;
-      animation: browserctl-pulse 2s ease-in-out infinite;
+      animation: cdpilot-pulse 2s ease-in-out infinite;
       border: 2px solid rgba(34, 197, 94, 0.3);
       border-radius: 0;
       box-shadow: 0 2px 8px rgba(0,0,0,0.3);
@@ -120,7 +120,7 @@ GLOW_CSS = """
 
 GLOW_OFF_CSS = """
 (function() {
-  const el = document.getElementById('browserctl-glow');
+  const el = document.getElementById('cdpilot-glow');
   if (el) { el.remove(); return 'glow off'; }
   return 'already off';
 })()
@@ -130,9 +130,9 @@ GLOW_OFF_CSS = """
 
 INPUT_BLOCKER_ON = """
 (function() {
-  if (document.getElementById('browserctl-input-blocker')) return 'blocker already active';
+  if (document.getElementById('cdpilot-input-blocker')) return 'blocker already active';
   const overlay = document.createElement('div');
-  overlay.id = 'browserctl-input-blocker';
+  overlay.id = 'cdpilot-input-blocker';
   overlay.style.cssText = `
     position: fixed; top: 0; left: 0; right: 0; bottom: 0;
     z-index: 2147483646; cursor: not-allowed;
@@ -145,21 +145,21 @@ INPUT_BLOCKER_ON = """
   overlay.addEventListener('contextmenu', e => { e.stopPropagation(); e.preventDefault(); }, true);
   overlay.addEventListener('wheel', e => { e.stopPropagation(); e.preventDefault(); }, {capture: true, passive: false});
   document.addEventListener('keydown', function _cb(e) {
-    if (!document.getElementById('browserctl-input-blocker')) {
+    if (!document.getElementById('cdpilot-input-blocker')) {
       document.removeEventListener('keydown', _cb, true);
       return;
     }
     e.stopPropagation(); e.preventDefault();
   }, true);
   document.addEventListener('keyup', function _cb(e) {
-    if (!document.getElementById('browserctl-input-blocker')) {
+    if (!document.getElementById('cdpilot-input-blocker')) {
       document.removeEventListener('keyup', _cb, true);
       return;
     }
     e.stopPropagation(); e.preventDefault();
   }, true);
   document.addEventListener('keypress', function _cb(e) {
-    if (!document.getElementById('browserctl-input-blocker')) {
+    if (!document.getElementById('cdpilot-input-blocker')) {
       document.removeEventListener('keypress', _cb, true);
       return;
     }
@@ -172,7 +172,7 @@ INPUT_BLOCKER_ON = """
 
 INPUT_BLOCKER_OFF = """
 (function() {
-  const el = document.getElementById('browserctl-input-blocker');
+  const el = document.getElementById('cdpilot-input-blocker');
   if (el) { el.remove(); return 'input blocker off'; }
   return 'blocker already off';
 })()
@@ -182,11 +182,11 @@ INPUT_BLOCKER_OFF = """
 
 _glow_script_id = None  # addScriptToEvaluateOnNewDocument identifier
 
-GLOW_ACTIVATE_JS = "document.documentElement.dataset.browserctlActive = 'true';"
+GLOW_ACTIVATE_JS = "document.documentElement.dataset.cdpilotActive = 'true';"
 GLOW_DEACTIVATE_JS = """
-document.documentElement.removeAttribute('data-browserctl-active');
-var _go = document.getElementById('browserctl-glow-overlay');
-var _gs = document.getElementById('browserctl-glow-style');
+document.documentElement.removeAttribute('data-cdpilot-active');
+var _go = document.getElementById('cdpilot-glow-overlay');
+var _gs = document.getElementById('cdpilot-glow-style');
 if (_go) _go.remove();
 if (_gs) _gs.remove();
 """
@@ -495,7 +495,7 @@ async def navigate_collect(ws_url, url, network=False, console=False, glow=True)
                 if loaded:
                     break
 
-        # Inject visual indicator (sets data-browserctl-active attribute)
+        # Inject visual indicator (sets data-cdpilot-active attribute)
         if glow:
             await ws.send(json.dumps({
                 "id": 200, "method": "Runtime.evaluate",
@@ -903,9 +903,10 @@ async def cmd_eval(js_code):
 
 async def cmd_click(selector):
     ws, _ = get_page_ws()
+    safe_sel = json.dumps(selector)
     js = f"""(function() {{
-        const el = document.querySelector('{selector}');
-        if (!el) return 'Not found: {selector}';
+        const el = document.querySelector({safe_sel});
+        if (!el) return 'Not found: ' + {safe_sel};
         el.scrollIntoView({{behavior:'smooth', block:'center'}});
         el.click();
         return 'Clicked: ' + el.tagName + ' ' + (el.textContent || '').substring(0, 60).trim();
@@ -917,10 +918,11 @@ async def cmd_click(selector):
 async def cmd_fill(selector, value):
     """Fill an input field (React/Vue compatible)."""
     ws, _ = get_page_ws()
+    safe_sel = json.dumps(selector)
     safe_value = json.dumps(value)
     js = f"""(function() {{
-        const el = document.querySelector('{selector}');
-        if (!el) return 'Not found: {selector}';
+        const el = document.querySelector({safe_sel});
+        if (!el) return 'Not found: ' + {safe_sel};
         el.focus();
         const nativeSet = Object.getOwnPropertyDescriptor(
             window.HTMLInputElement.prototype, 'value'
@@ -936,9 +938,10 @@ async def cmd_fill(selector, value):
 
 async def cmd_submit(selector="form"):
     ws, _ = get_page_ws()
+    safe_sel = json.dumps(selector)
     js = f"""(function() {{
-        const form = document.querySelector('{selector}');
-        if (!form) return 'Form not found: {selector}';
+        const form = document.querySelector({safe_sel});
+        if (!form) return 'Form not found: ' + {safe_sel};
         const btn = form.querySelector('button[type=submit], input[type=submit], button:last-of-type');
         if (btn) {{ btn.click(); return 'Submit clicked: ' + btn.textContent.trim(); }}
         form.submit();
@@ -950,15 +953,16 @@ async def cmd_submit(selector="form"):
 
 async def cmd_wait(selector, timeout=5):
     ws, _ = get_page_ws()
+    safe_sel = json.dumps(selector)
     js = f"""new Promise((resolve) => {{
-        const el = document.querySelector('{selector}');
+        const el = document.querySelector({safe_sel});
         if (el) return resolve('Found: ' + el.tagName + ' ' + (el.textContent||'').substring(0,60).trim());
         const obs = new MutationObserver(() => {{
-            const el = document.querySelector('{selector}');
+            const el = document.querySelector({safe_sel});
             if (el) {{ obs.disconnect(); resolve('Found: ' + el.tagName + ' ' + (el.textContent||'').substring(0,60).trim()); }}
         }});
         obs.observe(document.body, {{childList:true, subtree:true}});
-        setTimeout(() => {{ obs.disconnect(); resolve('Timeout: {selector} not found ({timeout}s)'); }}, {int(timeout)*1000});
+        setTimeout(() => {{ obs.disconnect(); resolve('Timeout: ' + {safe_sel} + ' not found ({timeout}s)'); }}, {int(timeout)*1000});
     }})"""
     r = await cdp_send(ws, [(1, "Runtime.evaluate", {"expression": js, "returnByValue": True, "awaitPromise": True})])
     print(r.get(1, {}).get("result", {}).get("value", "?"))
@@ -1614,7 +1618,7 @@ def cmd_headless(state=None):
 
 
 def cmd_stop():
-    """Stop the browser instance managed by browserctl."""
+    """Stop the browser instance managed by cdpilot."""
     import signal
     try:
         result = subprocess.run(
@@ -1632,8 +1636,8 @@ def cmd_stop():
 
 
 def cmd_version():
-    """Show browserctl version."""
-    print(f"browserctl v{__version__}")
+    """Show cdpilot version."""
+    print(f"cdpilot v{__version__}")
 
 
 # ─── New CDP Commands ───
@@ -2205,6 +2209,149 @@ async def cmd_permission(subcmd, perm=None):
             sys.exit(1)
 
 
+# ─── MCP Server ───
+
+class MCPServer:
+    """Minimal MCP (Model Context Protocol) server over stdin/stdout.
+    Implements JSON-RPC 2.0 for tool discovery and execution.
+    Usage: cdpilot mcp
+    """
+
+    def __init__(self):
+        self.tools = self._register_tools()
+
+    def _register_tools(self):
+        return [
+            {"name": "browser_navigate", "description": "Navigate to a URL",
+             "inputSchema": {"type": "object", "properties": {"url": {"type": "string", "description": "URL to navigate to"}}, "required": ["url"]}},
+            {"name": "browser_screenshot", "description": "Take a screenshot of the current page",
+             "inputSchema": {"type": "object", "properties": {"filename": {"type": "string", "description": "Output filename", "default": "screenshot.png"}}}},
+            {"name": "browser_click", "description": "Click an element by CSS selector",
+             "inputSchema": {"type": "object", "properties": {"selector": {"type": "string", "description": "CSS selector"}}, "required": ["selector"]}},
+            {"name": "browser_type", "description": "Type text into an input element",
+             "inputSchema": {"type": "object", "properties": {"selector": {"type": "string", "description": "CSS selector"}, "text": {"type": "string", "description": "Text to type"}}, "required": ["selector", "text"]}},
+            {"name": "browser_content", "description": "Get text content of the current page",
+             "inputSchema": {"type": "object", "properties": {}}},
+            {"name": "browser_html", "description": "Get HTML source of the current page",
+             "inputSchema": {"type": "object", "properties": {}}},
+            {"name": "browser_eval", "description": "Execute JavaScript in the browser",
+             "inputSchema": {"type": "object", "properties": {"expression": {"type": "string", "description": "JavaScript expression"}}, "required": ["expression"]}},
+            {"name": "browser_tabs", "description": "List all open browser tabs",
+             "inputSchema": {"type": "object", "properties": {}}},
+            {"name": "browser_console", "description": "Get console logs from the browser",
+             "inputSchema": {"type": "object", "properties": {"url": {"type": "string", "description": "URL to navigate and capture logs"}}}},
+            {"name": "browser_network", "description": "Monitor network requests",
+             "inputSchema": {"type": "object", "properties": {"url": {"type": "string", "description": "URL to navigate and monitor"}}}},
+            {"name": "browser_a11y", "description": "Get accessibility tree of the current page",
+             "inputSchema": {"type": "object", "properties": {"mode": {"type": "string", "enum": ["full", "summary"], "default": "full"}}}},
+            {"name": "browser_fill", "description": "Set input value (React-compatible)",
+             "inputSchema": {"type": "object", "properties": {"selector": {"type": "string", "description": "CSS selector"}, "value": {"type": "string", "description": "Value to set"}}, "required": ["selector", "value"]}},
+            {"name": "browser_launch", "description": "Launch browser with CDP enabled",
+             "inputSchema": {"type": "object", "properties": {}}},
+            {"name": "browser_close", "description": "Close the active tab",
+             "inputSchema": {"type": "object", "properties": {}}},
+        ]
+
+    def _handle_request(self, request):
+        method = request.get("method", "")
+        req_id = request.get("id")
+        params = request.get("params", {})
+
+        if method == "initialize":
+            return {"jsonrpc": "2.0", "id": req_id, "result": {
+                "protocolVersion": "2024-11-05",
+                "capabilities": {"tools": {}},
+                "serverInfo": {"name": "cdpilot", "version": __version__}
+            }}
+        elif method == "notifications/initialized":
+            return None
+        elif method == "tools/list":
+            return {"jsonrpc": "2.0", "id": req_id, "result": {"tools": self.tools}}
+        elif method == "tools/call":
+            return self._execute_tool(req_id, params.get("name", ""), params.get("arguments", {}))
+        elif method == "ping":
+            return {"jsonrpc": "2.0", "id": req_id, "result": {}}
+        else:
+            return {"jsonrpc": "2.0", "id": req_id, "error": {"code": -32601, "message": f"Method not found: {method}"}}
+
+    @staticmethod
+    def _safe_filename(name):
+        import re
+        base = os.path.basename(name)
+        base = re.sub(r'[^\w.\-]', '_', base)
+        if not base.lower().endswith('.png'):
+            base += '.png'
+        return os.path.join(SCREENSHOT_DIR, base)
+
+    def _execute_tool(self, req_id, tool_name, args):
+        import io, subprocess
+        tool_map = {
+            "browser_navigate": lambda a: ["go", a.get("url", "")],
+            "browser_screenshot": lambda a: ["shot"] + ([self._safe_filename(a["filename"])] if a.get("filename") else []),
+            "browser_click": lambda a: ["click", a.get("selector", "")],
+            "browser_type": lambda a: ["type", a.get("selector", ""), a.get("text", "")],
+            "browser_content": lambda a: ["content"],
+            "browser_html": lambda a: ["html"],
+            "browser_eval": lambda a: ["eval", a.get("expression", "")],
+            "browser_tabs": lambda a: ["tabs"],
+            "browser_console": lambda a: ["console"] + ([a["url"]] if a.get("url") else []),
+            "browser_network": lambda a: ["network"] + ([a["url"]] if a.get("url") else []),
+            "browser_a11y": lambda a: ["a11y"] + ([a["mode"]] if a.get("mode") and a["mode"] != "full" else []),
+            "browser_fill": lambda a: ["fill", a.get("selector", ""), a.get("value", "")],
+            "browser_launch": lambda a: ["launch"],
+            "browser_close": lambda a: ["close"],
+        }
+        if tool_name not in tool_map:
+            return {"jsonrpc": "2.0", "id": req_id, "error": {"code": -32602, "message": f"Unknown tool: {tool_name}"}}
+
+        cli_args = [a for a in tool_map[tool_name](args) if a]
+        try:
+            result = subprocess.run(
+                [sys.executable, __file__] + cli_args,
+                capture_output=True, text=True, timeout=30
+            )
+            output = result.stdout.strip()
+            errors = result.stderr.strip()
+            content = []
+            if output:
+                content.append({"type": "text", "text": output})
+            if errors:
+                content.append({"type": "text", "text": f"stderr: {errors}"})
+            if not content:
+                content.append({"type": "text", "text": "Command executed successfully"})
+            return {"jsonrpc": "2.0", "id": req_id, "result": {"content": content, "isError": result.returncode != 0}}
+        except subprocess.TimeoutExpired:
+            return {"jsonrpc": "2.0", "id": req_id, "result": {"content": [{"type": "text", "text": "Error: Command timed out (30s)"}], "isError": True}}
+        except Exception as e:
+            return {"jsonrpc": "2.0", "id": req_id, "result": {"content": [{"type": "text", "text": f"Error: {str(e)}"}], "isError": True}}
+
+    def run(self):
+        import json as json_mod
+        sys.stderr.write(f"cdpilot MCP server v{__version__} ready\n")
+        sys.stderr.flush()
+        while True:
+            try:
+                line = sys.stdin.readline()
+                if not line:
+                    break
+                line = line.strip()
+                if not line:
+                    continue
+                request = json_mod.loads(line)
+                response = self._handle_request(request)
+                if response is not None:
+                    sys.stdout.write(json_mod.dumps(response) + "\n")
+                    sys.stdout.flush()
+            except json_mod.JSONDecodeError as e:
+                sys.stdout.write(json_mod.dumps({"jsonrpc": "2.0", "id": None, "error": {"code": -32700, "message": f"Parse error: {str(e)}"}}) + "\n")
+                sys.stdout.flush()
+            except KeyboardInterrupt:
+                break
+            except Exception as e:
+                sys.stderr.write(f"MCP error: {str(e)}\n")
+                sys.stderr.flush()
+
+
 # ─── CLI ───
 
 if __name__ == "__main__":
@@ -2228,6 +2375,11 @@ if __name__ == "__main__":
         'session-close': lambda: cmd_session_close(args[0] if args else None),
     }
 
+    if cmd == "mcp":
+        server = MCPServer()
+        server.run()
+        sys.exit(0)
+
     if cmd == "ext-install":
         if not args:
             print("Usage: ext-install <crx-file-or-directory>")