chrome-bridge-mcp 1.20.0 → 1.20.1

package/README.md

@@ -156,6 +156,7 @@ Environment variables, each with a matching CLI flag:
 | `CHROME_BRIDGE_TOKEN` | unset | Required on both `ext_init` and `relay_init`. Strongly recommended whenever the bind isn't loopback |
 | `CHROME_BRIDGE_CAPS` / `--caps` | `core` | `core`, `audits`, `visual`, `network`, `storage`, `dom`, `files`, `all`. `install.sh` uses `all` |
 | `CHROME_BRIDGE_NO_JS` / `--no-js` | unset | No arbitrary JavaScript in the page: `execute_js` and `modify_dom` leave the schema, `wait_for(condition=function)` and `javascript:`/`data:` URLs are refused. `get_status` reports `js_evaluation` |
+| `CHROME_BRIDGE_READ_ROOT` / `--read-root` | unset | Where `upload_file` may read from. Unset: any file except keys and credentials (`~/.ssh`, `~/.aws`, `~/.gnupg`, `.env*`, `id_*`, `*.pem`, `*.key`, …), symlinks resolved first. Set: only files under this directory, whatever their name — the way to upload a certificate key on purpose |
 | `CHROME_BRIDGE_OBSERVE` | unset | `off` stops the local error log below. The plugin sets `hook`: its hooks keep the log and the server stays out of it |
 | `CHROME_BRIDGE_WRITE_ROOT` / `--write-root` | unset | Every path the model chooses (`save_to`, `output_path`, exports) must be under this directory, checked before the browser does any work; the server's own state under `~/.config/chrome-bridge` stays writable. The CLI is your shell and is not restricted |
 
@@ -172,6 +173,32 @@ exports and screenshots are **not** redacted and may carry cookies, tokens or
 personal data. Don't point the automation at pages holding secrets you wouldn't
 paste into a chat.
 
+### Threat model
+
+chrome-bridge gives an AI agent your real, logged-in browser. Scanners that
+rate MCP servers by capability flag it, correctly, for code execution
+(`execute_js`), requests that carry your cookies (`http_request`) and reading
+private page data (`get_storage`, `get_tabs`). Those are the product, not bugs.
+What matters is who can reach them and what a hostile page can make the agent
+do with them.
+
+- **Who can connect:** see above — loopback bind, `chrome-extension://` origin
+  check, `CHROME_BRIDGE_TOKEN` on both handshakes.
+- **The real risk is prompt injection.** A page can ask the agent to run
+  JavaScript, send a request with your cookies, submit a form or upload a file.
+  Treat every page you automate as untrusted input, and review what the agent
+  proposes on sites that hold money or credentials.
+- **Reduce the surface:** `--caps core` (the default) exposes the smallest set;
+  `--no-js` removes arbitrary JavaScript; `--write-root` fences every path the
+  model writes; `upload_file` refuses keys and credentials, and `--read-root`
+  fences it to one directory. For sessions that matter, automate in a separate
+  Chrome profile.
+- **`--no-js` is not a sandbox:** `inject_css` stays, and CSS attribute
+  selectors with `url()` can leak attribute values to a remote host.
+- **What leaves your machine** is what the browser sends on the agent's behalf.
+  chrome-bridge itself has no telemetry; the error log below stays local unless
+  you approve an issue.
+
 ### Local error log
 
 When one of its own tools fails, chrome-bridge adds a line to a **local** file,

package/extension/manifest.json

@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "Chrome Bridge for Claude Code",
-  "version": "1.20.0",
+  "version": "1.20.1",
   "description": "Bridge your browser to Claude Code: 59 token-efficient web-dev automation tools over a local WebSocket. ChromeOS included.",
   "homepage_url": "https://github.com/frsorrentino/chrome-bridge",
   "minimum_chrome_version": "135",

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "chrome-bridge-mcp",
   "mcpName": "io.github.frsorrentino/chrome-bridge",
-  "version": "1.20.0",
+  "version": "1.20.1",
   "type": "module",
   "description": "MCP server with 59 tools for browser automation via Chrome extension. Works on ChromeOS/Crostini.",
   "main": "server/index.js",

package/server/index.js

@@ -38,6 +38,7 @@ function parseSecurity() {
   return {
     noJs: process.argv.includes('--no-js') || on(process.env.CHROME_BRIDGE_NO_JS),
     writeRoot: argValue('--write-root') ?? process.env.CHROME_BRIDGE_WRITE_ROOT ?? null,
+    readRoot: argValue('--read-root') ?? process.env.CHROME_BRIDGE_READ_ROOT ?? null,
   };
 }
 

package/server/protocol.js

@@ -92,7 +92,7 @@ export const MessageType = Object.freeze({
 });
 
 // Versione
-export const VERSION               = '1.20.0';
+export const VERSION               = '1.20.1';
 
 // Configurazione
 export const DEFAULT_PORT          = 8765;

package/server/tools.js

@@ -5,7 +5,7 @@
  * e restituisce il risultato al client MCP.
  */
 
-import { appendFile, mkdir, readFile, writeFile } from 'node:fs/promises';
+import { appendFile, mkdir, readFile, realpath, writeFile } from 'node:fs/promises';
 import { homedir } from 'node:os';
 import { basename, dirname, extname, join, resolve, sep } from 'node:path';
 import { parse as parseHtml } from 'node-html-parser';
@@ -40,6 +40,14 @@ const JS_TOOLS = new Set(['execute_js', 'modify_dom']);
 // Sotto CHROME_BRIDGE_WRITE_ROOT lo stato del server resta scrivibile: non è un
 // percorso scelto dal modello.
 const STATE_DIRS = [join(homedir(), '.config', 'chrome-bridge'), SESSIONS_DIR, RECORDINGS_DIR, FIXTURES_DIR];
+// upload_file mette un file del disco in un form della pagina: una pagina ostile
+// con prompt injection può chiedere ~/.ssh/id_ed25519 o un .env. Senza
+// CHROME_BRIDGE_READ_ROOT questi percorsi sono rifiutati; con la radice
+// impostata vale solo la radice, scelta a mano da chi la imposta (il caso
+// legittimo: una chiave SSL da caricare nel pannello dell'hosting).
+const SECRET_DIRS = ['.ssh', '.aws', '.gnupg', '.kube', '.docker', '.azure', join('.config', 'gcloud'), join('.config', 'gh'), join('.config', 'chrome-bridge')]
+  .map((d) => join(homedir(), d));
+const SECRET_FILES = /(^|[\\/])(\.env(\..*)?|\.netrc|\.npmrc|\.pypirc|\.git-credentials|id_(rsa|dsa|ecdsa|ed25519)(_sk)?|[^\\/]*\.(pem|key|p12|pfx|jks|keystore|kdbx))$/i;
 
 // `hint` è il parametro REALE del tool chiamante che riduce i dati. Suggerire
 // max_length quando 56 tool su 59 non lo espongono mandava il modello a
@@ -364,7 +372,7 @@ export const TOOL_ANNOTATIONS = {
  * @param {import('@modelcontextprotocol/sdk/server/index.js').McpServer} server - MCP Server
  * @param {import('./ws-manager.js').WSManager} wsManager - WebSocket manager
  * @param {string} [caps='all'] - 'all', 'core', o lista di gruppi "audits,visual"
- * @param {{noJs?: boolean, writeRoot?: string|null}} [options] - CHROME_BRIDGE_NO_JS / CHROME_BRIDGE_WRITE_ROOT
+ * @param {{noJs?: boolean, writeRoot?: string|null, readRoot?: string|null}} [options] - CHROME_BRIDGE_NO_JS / CHROME_BRIDGE_WRITE_ROOT / CHROME_BRIDGE_READ_ROOT
  */
 /** Procedura leggibile da un'osservazione: un passo per riga, i campi sensibili marcati come passo umano. */
 function observedProcedure(name, d) {
@@ -396,6 +404,20 @@ export function registerTools(server, wsManager, caps = 'all', options = {}) {
     if (inside(WRITE_ROOT) || STATE_DIRS.some((d) => inside(resolve(d)))) return p;
     throw new Error(`Refusing to write ${abs}: outside CHROME_BRIDGE_WRITE_ROOT (${WRITE_ROOT})`);
   };
+  const READ_ROOT = options.readRoot ? resolve(String(options.readRoot)) : null;
+  // realpath: un symlink innocuo verso ~/.ssh non deve passare.
+  const guardRead = async (p) => {
+    const abs = await realpath(resolve(String(p)));
+    const inside = (root) => abs === root || abs.startsWith(root + sep);
+    if (READ_ROOT) {
+      if (inside(READ_ROOT)) return abs;
+      throw new Error(`Refusing to read ${abs}: outside CHROME_BRIDGE_READ_ROOT (${READ_ROOT})`);
+    }
+    if (SECRET_DIRS.some(inside) || SECRET_FILES.test(abs)) {
+      throw new Error(`Refusing to upload ${abs}: looks like a key or credential file. To upload it on purpose, set CHROME_BRIDGE_READ_ROOT to a folder that contains it.`);
+    }
+    return abs;
+  };
   const activeCaps = caps === 'all'
     ? ['core', ...Object.keys(TOOL_CAPS)]
     : ['core', ...String(caps).split(',').map((s) => s.trim()).filter((s) => s && s !== 'core')];
@@ -619,6 +641,7 @@ export function registerTools(server, wsManager, caps = 'all', options = {}) {
             // scoprire che esiste ma è in un gruppo disattivato.
             js_evaluation: !noJs,
             write_root: WRITE_ROOT,
+            read_root: READ_ROOT,
             caps_active: activeCaps,
             caps_available: ['core', ...Object.keys(TOOL_CAPS)],
             session_tab_id: sessionTabId,
@@ -1519,12 +1542,12 @@ export function registerTools(server, wsManager, caps = 'all', options = {}) {
     'Set a file on input[type=file] from the server filesystem via DataTransfer (max 10MB).',
     {
       selector: z.string().describe('The file input to fill; ">>>" pierces shadow DOM'),
-      path: z.string().describe('Absolute path on the server machine'),
+      path: z.string().describe('Absolute path on the server machine; keys and credentials (~/.ssh, .env, *.pem) refused'),
       mime_type: z.string().optional().describe('Default: inferred from extension'),
       tab_id: tabId,
     },
     async ({ selector, path, mime_type, tab_id }) => {
-      const buf = await readFile(path);
+      const buf = await readFile(await guardRead(path));
       if (buf.length > 10 * 1024 * 1024) throw new Error(`File too large: ${buf.length} bytes (max 10MB)`);
       const mime = mime_type || MIME_BY_EXT[extname(path).toLowerCase()] || 'application/octet-stream';
       const data = await send(MessageType.UPLOAD_FILE, {