mcp-browser-extension 0.9.26 → 0.9.28

package/README.md

@@ -82,8 +82,8 @@ or load from the folder the server unpacks.
 ### Up and running in one paste
 
 Hand this to your AI agent (Claude Code, Cursor, Windsurf, anything MCP) and it
-installs the server, wires it into the client, and walks you through the two
-steps that must happen inside Chrome:
+installs the server, wires it into the client, and walks you through installing
+the extension, verifying your email, and pairing Chrome:
 
 ```text
 Set up MCP Browser Extension on this machine by fetching and following
@@ -140,6 +140,15 @@ By default everything is **deny-all** (no domains, no eval, no mutations). Grant
 exactly what you need with `--allow-domain <glob>` (repeatable), `--enable-mutations`,
 `--enable-downloads`, `--enable-uploads`, `--unsafe-enable-eval`, or `--unsafe-all-domains`.
 
+Email verification is on by default. For a trusted, local unattended setup, you
+can opt out with `--no-email-verification` (or set
+`MCP_BROWSER_EXTENSION_EMAIL_VERIFICATION=0`). This skips the email prompt and
+the Firebase access service, so no email or device grant is sent there. The
+local MCP client can then use the browser within the configured domain and
+capability policy without an account check. Treat every process that can launch
+or reach this local server as trusted. This option is rejected with `--tunnel`
+and does not turn off telemetry or the npm update check.
+
 > `--enable-uploads` permits `upload_file` (setting local file(s) on a page's file
 > `<input>`). It is **off by default** because sending local files to a page is an
 > exfiltration risk; it is also gated by the destination-domain allowlist. Pair it
@@ -162,7 +171,19 @@ explicitly (and is never written to disk).
 One click, no Developer mode, and **Chrome keeps it updated for you**. This is
 the way to install it.
 
-**3. Click Connect.** A fresh install opens the extension's Settings with a
+**3. Verify your email.** In your MCP client, ask the agent to call
+`chrome_status`. On this first browser tool call, the client shows an email
+prompt. Enter an address you can access, then open the sign-in link sent to
+that address. The waiting tool reports **Email verified** and continues.
+
+If the tool returns `ACCESS_PENDING`, ask the agent to call `chrome_status`
+again to keep waiting on the same link. You do not need another email or a
+verification code. The MCP client must support interactive input prompts
+(MCP elicitation). If no prompt appears, enable interactive prompts in your
+client and retry; installing the extension alone does not activate access.
+
+**4. Click Connect if Chrome is not already paired.** A fresh install opens the
+extension's Settings with a
 **Connect** button (it is in the toolbar popup too). Click it, allow the one
 permission Chrome asks for, and you are paired: the server registers a small
 helper with Chrome every time it starts, and the button asks it for the port and

package/SETUP.md

@@ -59,6 +59,12 @@ if they want the agent to click, type, and navigate (almost always yes). Add
 `--persist-token` so the pairing survives restarts. Leave every other gate off
 unless they ask.
 
+Email verification stays enabled by default. Only if the human asks for a
+trusted local or unattended setup, add `--no-email-verification`. It skips the
+email prompt and Firebase access check, while the domain allowlist and other
+capability gates still apply. Do not combine it with `--tunnel` or use it when
+untrusted clients can reach the local server.
+
 **Claude Code** (registers for every project on this machine):
 
 ```
@@ -129,6 +135,10 @@ the result includes **Email verified** and the requested browser action continue
 The user does not need to send another chat message. Progress updates and status
 notifications are also sent to clients that display them.
 
+If the human explicitly configured `--no-email-verification`, there is no email
+step; continue to pairing. This option is intended only for trusted local
+clients and cannot be combined with a public tunnel.
+
 Each verification wait lasts up to 45 seconds. If the result says
 `ACCESS_PENDING`, call `chrome_status` again to continue waiting on the same
 link. Expired or denied verification returns a clear failure; browser actions

package/dist/src/access.d.ts

@@ -18,4 +18,6 @@ declare function result(message: string): {
 };
 /** Returns null when authorized, otherwise a user-facing tool error. */
 export declare function requireAccess(server: Server, dataDir: string, request?: AccessRequest): Promise<ReturnType<typeof result> | null>;
+/** Explicit local-only opt-out; the CLI rejects it when a public tunnel is enabled. */
+export declare const bypassEmailVerification: typeof requireAccess;
 export {};

package/dist/src/access.js

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.bypassEmailVerification = void 0;
 exports.setAccessPollIntervalForTesting = setAccessPollIntervalForTesting;
 exports.requireAccess = requireAccess;
 /** Email-link access gate for the MCP tool surface. */
@@ -209,6 +210,9 @@ async function requireAccess(server, dataDir, request = {}) {
         completionToReport.delete(dataDir);
     return outcome ? result(outcome.message) : null;
 }
+/** Explicit local-only opt-out; the CLI rejects it when a public tunnel is enabled. */
+const bypassEmailVerification = async () => null;
+exports.bypassEmailVerification = bypassEmailVerification;
 async function check(server, dataDir, request) {
     const state = loadOrCreate(dataDir);
     try {

package/dist/src/cli.js

@@ -14,6 +14,7 @@ const compat_1 = require("./compat");
 const node_fs_1 = require("node:fs");
 const node_path_1 = require("node:path");
 const config_1 = require("./config");
+const access_1 = require("./access");
 const tasks_1 = require("./bridge/tasks");
 const manager_1 = require("./executor/manager");
 const select_1 = require("./executor/select");
@@ -225,6 +226,7 @@ async function main() {
     // silent from the first line rather than from wherever the first log happened
     // to sit after startup.
     (0, server_2.setLogLevel)(cfg.logLevel);
+    const accessGuard = cfg.noEmailVerification ? access_1.bypassEmailVerification : access_1.requireAccess;
     if (cfg.showHelp) {
         process.stdout.write(config_1.HELP_TEXT);
         // The catalog is what `--tools` takes, so `--help` has to name it.
@@ -250,6 +252,9 @@ async function main() {
     });
     if (handedOff !== null)
         process.exit(handedOff);
+    if (cfg.noEmailVerification) {
+        (0, server_2.logErr)('SECURITY: hosted email verification is disabled; only trusted local MCP clients should connect. The browser-domain allowlist and other safety gates remain active.');
+    }
     // Before the bridge binds a port or writes a handshake: a typo'd `--tools`
     // name should fail as a plain startup error, not leave a half-started server.
     (0, tools_1.setToolAllowlist)(cfg.tools);
@@ -449,7 +454,7 @@ async function main() {
     });
     // The resolved policy shapes the advertised catalog: a capability that is off
     // means its tools are never described to the model.
-    await (0, server_2.startMcpServer)(version(), cfg.policy);
+    await (0, server_2.startMcpServer)(version(), cfg.policy, accessGuard);
 }
 /**
  * `--http` / `--tunnel`: a standalone server for clients on other machines.
@@ -459,7 +464,14 @@ async function serveRemote(cfg, dataDir, stopBridge) {
     const key = (0, key_1.resolveRemoteKey)(dataDir, { rotate: cfg.rotateRemoteKey });
     if (cfg.rotateRemoteKey)
         (0, server_2.logErr)('remote key rotated: every earlier connector URL stops working.');
-    const http = await (0, http_1.startHttpMcp)({ port: cfg.httpPort, key, version: version(), policy: cfg.policy, log: (m) => (0, server_2.logErr)(m) });
+    const http = await (0, http_1.startHttpMcp)({
+        port: cfg.httpPort,
+        key,
+        version: version(),
+        policy: cfg.policy,
+        log: (m) => (0, server_2.logErr)(m),
+        accessGuard: cfg.noEmailVerification ? access_1.bypassEmailVerification : undefined,
+    });
     let tunnel = null;
     let shuttingDown = false;
     const shutdown = () => {

package/dist/src/config.d.ts

@@ -38,6 +38,8 @@ export interface CliConfig {
     persistToken: boolean;
     /** `--no-telemetry`: send no anonymous usage statistics (see src/telemetry.ts). */
     noTelemetry: boolean;
+    /** `--no-email-verification`: bypass the hosted access gate for trusted local use. */
+    noEmailVerification: boolean;
     /** `--no-site-grants`: the allowlist is exactly what the flags say; the
      *  extension's Options page cannot add sites at runtime. */
     noSiteGrants: boolean;

package/dist/src/config.js

@@ -82,6 +82,7 @@ function parseArgs(argv) {
     let printPairing = false;
     let persistToken = false;
     let noTelemetry = false;
+    let noEmailVerification = ['0', 'false', 'off'].includes(((0, compat_1.runtimeEnv)('EMAIL_VERIFICATION') ?? '').toLowerCase());
     let noSiteGrants = false;
     let noAutoUpdate = false;
     let noNativeHost = false;
@@ -192,6 +193,9 @@ function parseArgs(argv) {
             case '--no-telemetry':
                 noTelemetry = true;
                 break;
+            case '--no-email-verification':
+                noEmailVerification = true;
+                break;
             case '--no-site-grants':
                 noSiteGrants = true;
                 break;
@@ -234,6 +238,11 @@ function parseArgs(argv) {
     cdpFallback = false;
     cdpEndpoint = undefined;
     prefer = 'extension';
+    // The local verification bypass is intended for trusted processes on this
+    // machine. Do not expose it through a public Cloudflare tunnel.
+    if (noEmailVerification && tunnel) {
+        throw new Error('--no-email-verification cannot be used with --tunnel');
+    }
     // File first, then flags win.
     const policy = (0, policy_1.resolvePolicy)({ ...policyFile, ...policyFlags });
     // Uploads must be confined to a directory — refuse to start with uploads enabled
@@ -271,6 +280,7 @@ function parseArgs(argv) {
         printPairing,
         persistToken,
         noTelemetry,
+        noEmailVerification,
         noSiteGrants,
         noAutoUpdate,
         noNativeHost,
@@ -375,6 +385,11 @@ Connection:
                          MCP_BROWSER_EXTENSION_TELEMETRY=0 or DO_NOT_TRACK=1. Only counts are
                          ever sent (version, OS, tool calls, error codes) — never
                          URLs, page content or arguments.
+  --no-email-verification  Skip the hosted email/device access gate for trusted local use.
+                         Email and device data are not sent to the access service.
+                         Same as MCP_BROWSER_EXTENSION_EMAIL_VERIFICATION=0.
+                         Cannot be combined with --tunnel; the domain allowlist,
+                         deny-all defaults, and other safety gates still apply.
 
 Backend:
   This build is EXTENSION-ONLY — it drives ONLY your real Chrome via the paired

package/dist/src/executor/types.d.ts

@@ -310,6 +310,7 @@ export interface Executor {
         outer?: boolean;
     } & FrameOpts): Promise<{
         html: string;
+        frameId?: number;
     }>;
     /** Accessibility snapshot: interactive/landmark elements with stable refs the model can target. */
     snapshot(opts?: {

package/dist/src/mcp/helpers.d.ts

@@ -5,7 +5,7 @@
  * when the backend can (else sequences fill+click).
  * (Only `download_file` is privileged and lives on the executor.)
  */
-import type { Executor, FrameOpts } from '../executor/types';
+import { type Executor, type FrameOpts } from '../executor/types';
 export interface LinkOut {
     href: string;
     text: string;

package/dist/src/mcp/helpers.js

@@ -10,6 +10,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.extractLinks = extractLinks;
 exports.readAsMarkdown = readAsMarkdown;
 exports.fillForm = fillForm;
+const htmlparser2_1 = require("htmlparser2");
+const types_1 = require("../executor/types");
 const markdown_extract_1 = require("./markdown-extract");
 /**
  * Collect anchors from the page (or a subtree). Implemented as a single page
@@ -25,31 +27,99 @@ async function extractLinks(ex, args) {
     const root = ${root} ? document.querySelector(${root}) : document;
     if (!root) return [];
     const here = location.origin;
-    return [...root.querySelectorAll('a[href]')].map(a => ({
-      href: a.href, text: (a.textContent || '').trim().slice(0, 200),
-    })).filter(l => l.href && (${args.sameOriginOnly ? 'l.href.startsWith(here)' : 'true'}));
+    return [...root.querySelectorAll('a[href]')].filter(a => {
+      const raw = (a.getAttribute('href') || '').trim();
+      if (!raw || raw.startsWith('#')) return false;
+      try {
+        const url = new URL(a.href);
+        return !['javascript:', 'data:', 'blob:'].includes(url.protocol) &&
+          (${args.sameOriginOnly ? 'url.origin === here' : 'true'});
+      } catch { return false; }
+    }).map(a => ({ href: a.href, text: (a.textContent || '').trim().slice(0, 200) }));
   })()`;
     const frames = { frameId: args.frameId, allFrames: args.allFrames };
     let links;
-    const res = await ex.eval(expr, { tabId: args.tabId, ...frames });
-    if (res.ok && Array.isArray(res.value)) {
-        links = res.value;
+    try {
+        const res = await ex.eval(expr, { tabId: args.tabId, ...frames });
+        if (res.ok && Array.isArray(res.value))
+            links = res.value;
     }
-    else {
+    catch (err) {
+        if (!(err instanceof types_1.ExecutorError) || err.code !== 'POLICY_DENIED')
+            throw err;
+    }
+    if (!links) {
         // Fallback: parse hrefs out of the HTML (e.g. when eval is policy-denied).
-        const { html } = await ex.getHtml(args.selector ? { selector: args.selector } : undefined, {
+        const result = await ex.getHtml(args.selector ? { selector: args.selector } : undefined, {
             tabId: args.tabId,
             ...frames,
         });
-        links = [];
-        const re = /<a[^>]*href=["']([^"']+)["'][^>]*>([\s\S]*?)<\/a>/gi;
-        let m;
-        while ((m = re.exec(html)) !== null) {
-            links.push({ href: m[1], text: m[2].replace(/<[^>]+>/g, '').trim().slice(0, 200) });
+        const tabs = await ex.tabsList();
+        const tab = args.tabId ? tabs.find(t => t.tabId === args.tabId) : tabs.find(t => t.active);
+        let pageUrl = tab?.url;
+        const frameId = result.frameId ?? args.frameId;
+        if (frameId !== undefined && frameId !== 0) {
+            pageUrl = (await ex.framesList?.({ tabId: args.tabId }))?.find(f => f.frameId === frameId)?.url;
         }
+        if (!pageUrl)
+            throw new types_1.ExecutorError('TARGET_GONE', 'could not resolve the page URL for link extraction');
+        links = linksFromHtml(result.html, pageUrl, args.sameOriginOnly);
     }
     return { links: refineLinks(links, args) };
 }
+/** Parse serialized HTML without executing page code; the parser decodes entities. */
+function linksFromHtml(html, pageUrl, sameOriginOnly = false) {
+    const raw = [];
+    let current;
+    let baseHref;
+    let skippedDepth = 0;
+    new htmlparser2_1.Parser({
+        onopentag(name, attrs) {
+            if (skippedDepth || ['script', 'style', 'template'].includes(name)) {
+                skippedDepth++;
+                return;
+            }
+            if (name === 'base' && baseHref === undefined && attrs.href !== undefined)
+                baseHref = attrs.href;
+            if (name === 'a' && attrs.href !== undefined) {
+                current = { href: attrs.href.trim(), text: '' };
+                raw.push(current);
+            }
+        },
+        ontext(text) { if (current && !skippedDepth)
+            current.text += text; },
+        onclosetag(name) {
+            if (skippedDepth) {
+                skippedDepth--;
+                return;
+            }
+            if (name === 'a')
+                current = undefined;
+        },
+    }, { decodeEntities: true }).end(html);
+    const here = new URL(pageUrl);
+    let base = here.href;
+    try {
+        if (baseHref !== undefined)
+            base = new URL(baseHref, here).href;
+    }
+    catch { /* ignore invalid base */ }
+    return raw.flatMap(link => {
+        if (!link.href || link.href.startsWith('#'))
+            return [];
+        try {
+            const url = new URL(link.href, base);
+            if (['javascript:', 'data:', 'blob:'].includes(url.protocol))
+                return [];
+            if (sameOriginOnly && url.origin !== here.origin)
+                return [];
+            return [{ href: /^[a-z][a-z\d+.-]*:/i.test(link.href) ? link.href : url.href, text: link.text.trim().slice(0, 200) }];
+        }
+        catch {
+            return [];
+        }
+    });
+}
 /**
  * Collapse links that share an href (keeping the first, but preferring a
  * non-empty label) when `dedupe` is set, then cap to `limit`. Order is

package/dist/src/mcp/server.d.ts

@@ -27,7 +27,7 @@ export declare const SERVER_INSTRUCTIONS: string;
  */
 export declare function createServer(version?: string, policy?: Policy, accessGuard?: typeof requireAccess): McpServer;
 /** Start over stdio. Idempotent. */
-export declare function startMcpServer(version?: string, policy?: Policy): Promise<void>;
+export declare function startMcpServer(version?: string, policy?: Policy, accessGuard?: typeof requireAccess): Promise<void>;
 /** Stop and release the transport. Idempotent, best-effort. */
 export declare function stopMcpServer(): Promise<void>;
 /** The MCP client this session serves, as it named itself at initialize (for analytics). */

package/dist/src/mcp/server.js

@@ -43,6 +43,10 @@ exports.SERVER_INSTRUCTIONS = "MCP Browser Extension drives the user's real, sig
     'toolbar icon (its popup has an Allow button). It applies at once, with no restart. You cannot approve a site yourself. ' +
     "Work in your own tab: tab_new opens one in the background, and calls without a tabId go to it, never to the tab the user is on. " +
     "To act on the user's current page, pass its tabId from tabs_list.";
+const LOCAL_BYPASS_INSTRUCTIONS = 'Email verification is disabled by the local operator for this server. Only trusted local MCP clients should connect; the browser-domain allowlist and other capability safety gates remain active. ' +
+    'Start with chrome_status. If it reports no paired browser (or any tool fails with NO_BACKEND), give the user the steps in its `setup` field. ' +
+    'If a tool fails with POLICY_DENIED because a site is not allowed, ask the user to allow it from the extension\'s toolbar icon. ' +
+    "Work in your own tab: tab_new opens one in the background. To act on the user's current page, pass its tabId from tabs_list.";
 /** Default version reported when no explicit version is passed in (legacy callers/tests). */
 const DEFAULT_VERSION = SERVER_VERSION;
 let server = null;
@@ -56,7 +60,10 @@ let transport = null;
  * full catalog is advertised, which is what the tests want.
  */
 function createServer(version = DEFAULT_VERSION, policy, accessGuard = access_1.requireAccess) {
-    const srv = new mcp_js_1.McpServer({ name: SERVER_NAME, version }, { capabilities: { tools: {}, logging: {} }, instructions: exports.SERVER_INSTRUCTIONS });
+    const srv = new mcp_js_1.McpServer({ name: SERVER_NAME, version }, {
+        capabilities: { tools: {}, logging: {} },
+        instructions: accessGuard === access_1.bypassEmailVerification ? LOCAL_BYPASS_INSTRUCTIONS : exports.SERVER_INSTRUCTIONS,
+    });
     const advertised = (0, tools_1.registerTools)(srv, policy, accessGuard);
     watchInitialize(srv, advertised);
     // `McpServer` wraps the low-level `Server`, which owns the `onerror` hook.
@@ -88,12 +95,12 @@ function watchInitialize(srv, advertised) {
     };
 }
 /** Start over stdio. Idempotent. */
-async function startMcpServer(version = DEFAULT_VERSION, policy) {
+async function startMcpServer(version = DEFAULT_VERSION, policy, accessGuard = access_1.requireAccess) {
     if (server) {
         (0, log_1.logErr)('startMcpServer called but already running; ignoring.');
         return;
     }
-    const srv = createServer(version, policy);
+    const srv = createServer(version, policy, accessGuard);
     const tx = new stdio_js_1.StdioServerTransport();
     try {
         await srv.connect(tx);

package/dist/src/mcp/tools.js

@@ -857,7 +857,7 @@ exports.TOOL_HANDLERS = {
         const res = await ctx.ex.getText((0, validators_1.optionalTarget)(a), { tabId: tabId(a), ...frameOpts(a) });
         // Save the FULL read before capping — the artifact on disk stays lossless;
         // only what crosses into the caller's context is bounded.
-        (0, workspace_1.saveResult)('get_text', 'json', JSON.stringify(res, null, 2));
+        const savedTo = (0, workspace_1.saveResult)('get_text', 'json', JSON.stringify(res, null, 2));
         const clean = (0, redact_1.redactText)(res.text, redaction(ctx.policy));
         (0, audit_1.noteRedactions)(clean.redactions);
         const capped = (0, limits_1.capText)(clean.value, maxBytes(a));
@@ -865,6 +865,7 @@ exports.TOOL_HANDLERS = {
         return (0, envelopes_1.jsonResult)({
             ...res,
             text: capped.text,
+            ...(savedTo ? { savedTo } : {}),
             ...(0, limits_1.truncationMeta)(capped),
             ...(clean.redactions ? { redactions: clean.redactions } : {}),
         });
@@ -993,7 +994,7 @@ exports.TOOL_HANDLERS = {
             tabId: tabId(a),
             ...frameOpts(a),
         });
-        (0, workspace_1.saveResult)('read_as_markdown', 'md', md);
+        const savedTo = (0, workspace_1.saveResult)('read_as_markdown', 'md', md);
         const clean = (0, redact_1.redactText)(md, redaction(ctx.policy));
         (0, audit_1.noteRedactions)(clean.redactions);
         const capped = (0, limits_1.capText)(clean.value, maxBytes(a));
@@ -1001,7 +1002,7 @@ exports.TOOL_HANDLERS = {
         // Markdown is returned as plain text, so the truncation notice has to ride in
         // the body rather than as sibling JSON fields.
         return (0, envelopes_1.textResult)(capped.truncated
-            ? `${capped.text}\n\n[truncated: ${capped.returnedBytes} of ${capped.totalBytes} bytes — raise maxBytes or narrow with selector; the full document was saved to the task's results/ dir]`
+            ? `${capped.text}\n\n[truncated: ${capped.returnedBytes} of ${capped.totalBytes} bytes — raise maxBytes or narrow with selector${savedTo ? `; full document saved to ${savedTo}` : '; full document could not be saved'}]`
             : capped.text);
     },
     fill_form: async (a, ctx) => {

package/extension-dist/background.js

@@ -49,6 +49,7 @@
     constructor(deps) {
       this.deps = deps;
     }
+    deps;
     ws = null;
     state = "idle";
     isConnected() {
@@ -1070,6 +1071,7 @@
       super(message);
       this.code = code;
     }
+    code;
   };
   var DOWNLOAD_TIMEOUT_MS = 12e4;
   function waitForDownloadComplete(id) {
@@ -1480,6 +1482,7 @@
     constructor(getPolicy = () => null) {
       this.getPolicy = getPolicy;
     }
+    getPolicy;
     /**
      * Resolve `frameId` / `allFrames` params into the frame ids an injection may
      * touch, dropping any whose own URL the policy does not allow for this method.
@@ -2121,6 +2124,7 @@
         if (!HANDLED.has(m)) throw new Error(`router drift: no handler for wire method "${m}"`);
       }
     }
+    deps;
     async dispatch(cmd) {
       try {
         const policy = this.deps.getPolicy();
@@ -2318,6 +2322,7 @@
     constructor(getPolicy) {
       this.getPolicy = getPolicy;
     }
+    getPolicy;
     /** One lock for all border state: parallel batch ops touching the same tab
      *  must not both inject (removeCSS takes out one copy, not both). */
     lock = new KeyedMutex();

package/extension-dist/popup.html

@@ -63,7 +63,6 @@
 
       main { padding: 4px 12px 12px; display: grid; gap: 10px; }
       .card { background: var(--card); border: 1px solid var(--line); border-radius: 14px; padding: 12px; box-shadow: var(--shadow); }
-      .card.connect { color: #0f172a; background: color-mix(in oklch, oklch(0.58 0.19 255) 7%, white); border-color: color-mix(in oklch, oklch(0.58 0.19 255) 25%, #e6e8ec); }
       h2 { display: flex; align-items: center; justify-content: space-between; margin: 0 0 8px; font-size: 11px; font-weight: 600; letter-spacing: 0.06em; text-transform: uppercase; color: var(--muted); }
       .count { font-size: 11px; letter-spacing: 0; text-transform: none; padding: 1px 7px; border-radius: 999px; background: var(--panel); border: 1px solid var(--line); color: var(--muted); }
 
@@ -118,7 +117,7 @@
       ol { margin: 2px 0 12px; padding-left: 18px; color: var(--muted); }
       ol li { margin: 3px 0; }
       code { font: 11.5px ui-monospace, SFMono-Regular, Menlo, monospace; padding: 1px 5px; border-radius: 5px; background: var(--panel); border: 1px solid var(--line); color: var(--fg); }
-      .connect .note { margin: 0 0 10px; color: inherit; }
+      .connect .note { margin: 0 0 10px; color: var(--fg); }
       #connect { width: 100%; padding: 10px 12px; font-size: 13.5px; font-weight: 600; }
       #connect.secondary { background: var(--panel); color: var(--fg); border-color: var(--line); box-shadow: none; padding: 7px 12px; font-size: 12.5px; font-weight: 500; }
       .connect .error { margin: 8px 0 0; color: var(--warn); }

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "mcp-browser-extension",
   "mcpName": "io.github.Mehmoodqureshi/mcp-browser-extension",
-  "version": "0.9.26",
-  "description": "Drive your real Chrome browser over MCP \u2014 real logins, real cookies. A stdio MCP server (CLI) plus an MV3 extension, driving Chrome via chrome.scripting/chrome.tabs. Multi-tab batch automation, accessibility snapshots, deny-all security by default.",
+  "version": "0.9.28",
+  "description": "Drive your real Chrome browser over MCP — real logins, real cookies. A stdio MCP server (CLI) plus an MV3 extension, driving Chrome via chrome.scripting/chrome.tabs. Multi-tab batch automation, accessibility snapshots, deny-all security by default.",
   "author": "Mehmood Ur Rehman Qureshi",
   "license": "MIT",
   "homepage": "https://mcp-browser-extension.com",
@@ -61,7 +61,8 @@
     "prepack": "npm run clean && npm run build && npm run build:ext"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.29.0",
+    "@modelcontextprotocol/sdk": "^1.32.1",
+    "htmlparser2": "^10.1.0",
     "ws": "^8.18.0",
     "zod": "^4.4.3"
   },
@@ -69,7 +70,7 @@
     "@types/chrome": "^0.0.287",
     "@types/node": "^20.17.10",
     "@types/ws": "^8.5.13",
-    "esbuild": "^0.24.0",
+    "esbuild": "^0.28.2",
     "playwright": "^1.49.1",
     "rimraf": "^5.0.10",
     "typescript": "^5.7.2"