mcp-browser-extension 0.9.27 → 0.9.28

package/README.md

@@ -82,8 +82,8 @@ or load from the folder the server unpacks.
 ### Up and running in one paste
 
 Hand this to your AI agent (Claude Code, Cursor, Windsurf, anything MCP) and it
-installs the server, wires it into the client, and walks you through the two
-steps that must happen inside Chrome:
+installs the server, wires it into the client, and walks you through installing
+the extension, verifying your email, and pairing Chrome:
 
 ```text
 Set up MCP Browser Extension on this machine by fetching and following
@@ -140,6 +140,15 @@ By default everything is **deny-all** (no domains, no eval, no mutations). Grant
 exactly what you need with `--allow-domain <glob>` (repeatable), `--enable-mutations`,
 `--enable-downloads`, `--enable-uploads`, `--unsafe-enable-eval`, or `--unsafe-all-domains`.
 
+Email verification is on by default. For a trusted, local unattended setup, you
+can opt out with `--no-email-verification` (or set
+`MCP_BROWSER_EXTENSION_EMAIL_VERIFICATION=0`). This skips the email prompt and
+the Firebase access service, so no email or device grant is sent there. The
+local MCP client can then use the browser within the configured domain and
+capability policy without an account check. Treat every process that can launch
+or reach this local server as trusted. This option is rejected with `--tunnel`
+and does not turn off telemetry or the npm update check.
+
 > `--enable-uploads` permits `upload_file` (setting local file(s) on a page's file
 > `<input>`). It is **off by default** because sending local files to a page is an
 > exfiltration risk; it is also gated by the destination-domain allowlist. Pair it
@@ -162,7 +171,19 @@ explicitly (and is never written to disk).
 One click, no Developer mode, and **Chrome keeps it updated for you**. This is
 the way to install it.
 
-**3. Click Connect.** A fresh install opens the extension's Settings with a
+**3. Verify your email.** In your MCP client, ask the agent to call
+`chrome_status`. On this first browser tool call, the client shows an email
+prompt. Enter an address you can access, then open the sign-in link sent to
+that address. The waiting tool reports **Email verified** and continues.
+
+If the tool returns `ACCESS_PENDING`, ask the agent to call `chrome_status`
+again to keep waiting on the same link. You do not need another email or a
+verification code. The MCP client must support interactive input prompts
+(MCP elicitation). If no prompt appears, enable interactive prompts in your
+client and retry; installing the extension alone does not activate access.
+
+**4. Click Connect if Chrome is not already paired.** A fresh install opens the
+extension's Settings with a
 **Connect** button (it is in the toolbar popup too). Click it, allow the one
 permission Chrome asks for, and you are paired: the server registers a small
 helper with Chrome every time it starts, and the button asks it for the port and

package/SETUP.md

@@ -59,6 +59,12 @@ if they want the agent to click, type, and navigate (almost always yes). Add
 `--persist-token` so the pairing survives restarts. Leave every other gate off
 unless they ask.
 
+Email verification stays enabled by default. Only if the human asks for a
+trusted local or unattended setup, add `--no-email-verification`. It skips the
+email prompt and Firebase access check, while the domain allowlist and other
+capability gates still apply. Do not combine it with `--tunnel` or use it when
+untrusted clients can reach the local server.
+
 **Claude Code** (registers for every project on this machine):
 
 ```
@@ -129,6 +135,10 @@ the result includes **Email verified** and the requested browser action continue
 The user does not need to send another chat message. Progress updates and status
 notifications are also sent to clients that display them.
 
+If the human explicitly configured `--no-email-verification`, there is no email
+step; continue to pairing. This option is intended only for trusted local
+clients and cannot be combined with a public tunnel.
+
 Each verification wait lasts up to 45 seconds. If the result says
 `ACCESS_PENDING`, call `chrome_status` again to continue waiting on the same
 link. Expired or denied verification returns a clear failure; browser actions

package/dist/src/access.d.ts

@@ -18,4 +18,6 @@ declare function result(message: string): {
 };
 /** Returns null when authorized, otherwise a user-facing tool error. */
 export declare function requireAccess(server: Server, dataDir: string, request?: AccessRequest): Promise<ReturnType<typeof result> | null>;
+/** Explicit local-only opt-out; the CLI rejects it when a public tunnel is enabled. */
+export declare const bypassEmailVerification: typeof requireAccess;
 export {};

package/dist/src/access.js

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.bypassEmailVerification = void 0;
 exports.setAccessPollIntervalForTesting = setAccessPollIntervalForTesting;
 exports.requireAccess = requireAccess;
 /** Email-link access gate for the MCP tool surface. */
@@ -209,6 +210,9 @@ async function requireAccess(server, dataDir, request = {}) {
         completionToReport.delete(dataDir);
     return outcome ? result(outcome.message) : null;
 }
+/** Explicit local-only opt-out; the CLI rejects it when a public tunnel is enabled. */
+const bypassEmailVerification = async () => null;
+exports.bypassEmailVerification = bypassEmailVerification;
 async function check(server, dataDir, request) {
     const state = loadOrCreate(dataDir);
     try {

package/dist/src/cli.js

@@ -14,6 +14,7 @@ const compat_1 = require("./compat");
 const node_fs_1 = require("node:fs");
 const node_path_1 = require("node:path");
 const config_1 = require("./config");
+const access_1 = require("./access");
 const tasks_1 = require("./bridge/tasks");
 const manager_1 = require("./executor/manager");
 const select_1 = require("./executor/select");
@@ -225,6 +226,7 @@ async function main() {
     // silent from the first line rather than from wherever the first log happened
     // to sit after startup.
     (0, server_2.setLogLevel)(cfg.logLevel);
+    const accessGuard = cfg.noEmailVerification ? access_1.bypassEmailVerification : access_1.requireAccess;
     if (cfg.showHelp) {
         process.stdout.write(config_1.HELP_TEXT);
         // The catalog is what `--tools` takes, so `--help` has to name it.
@@ -250,6 +252,9 @@ async function main() {
     });
     if (handedOff !== null)
         process.exit(handedOff);
+    if (cfg.noEmailVerification) {
+        (0, server_2.logErr)('SECURITY: hosted email verification is disabled; only trusted local MCP clients should connect. The browser-domain allowlist and other safety gates remain active.');
+    }
     // Before the bridge binds a port or writes a handshake: a typo'd `--tools`
     // name should fail as a plain startup error, not leave a half-started server.
     (0, tools_1.setToolAllowlist)(cfg.tools);
@@ -449,7 +454,7 @@ async function main() {
     });
     // The resolved policy shapes the advertised catalog: a capability that is off
     // means its tools are never described to the model.
-    await (0, server_2.startMcpServer)(version(), cfg.policy);
+    await (0, server_2.startMcpServer)(version(), cfg.policy, accessGuard);
 }
 /**
  * `--http` / `--tunnel`: a standalone server for clients on other machines.
@@ -459,7 +464,14 @@ async function serveRemote(cfg, dataDir, stopBridge) {
     const key = (0, key_1.resolveRemoteKey)(dataDir, { rotate: cfg.rotateRemoteKey });
     if (cfg.rotateRemoteKey)
         (0, server_2.logErr)('remote key rotated: every earlier connector URL stops working.');
-    const http = await (0, http_1.startHttpMcp)({ port: cfg.httpPort, key, version: version(), policy: cfg.policy, log: (m) => (0, server_2.logErr)(m) });
+    const http = await (0, http_1.startHttpMcp)({
+        port: cfg.httpPort,
+        key,
+        version: version(),
+        policy: cfg.policy,
+        log: (m) => (0, server_2.logErr)(m),
+        accessGuard: cfg.noEmailVerification ? access_1.bypassEmailVerification : undefined,
+    });
     let tunnel = null;
     let shuttingDown = false;
     const shutdown = () => {

package/dist/src/config.d.ts

@@ -38,6 +38,8 @@ export interface CliConfig {
     persistToken: boolean;
     /** `--no-telemetry`: send no anonymous usage statistics (see src/telemetry.ts). */
     noTelemetry: boolean;
+    /** `--no-email-verification`: bypass the hosted access gate for trusted local use. */
+    noEmailVerification: boolean;
     /** `--no-site-grants`: the allowlist is exactly what the flags say; the
      *  extension's Options page cannot add sites at runtime. */
     noSiteGrants: boolean;

package/dist/src/config.js

@@ -82,6 +82,7 @@ function parseArgs(argv) {
     let printPairing = false;
     let persistToken = false;
     let noTelemetry = false;
+    let noEmailVerification = ['0', 'false', 'off'].includes(((0, compat_1.runtimeEnv)('EMAIL_VERIFICATION') ?? '').toLowerCase());
     let noSiteGrants = false;
     let noAutoUpdate = false;
     let noNativeHost = false;
@@ -192,6 +193,9 @@ function parseArgs(argv) {
             case '--no-telemetry':
                 noTelemetry = true;
                 break;
+            case '--no-email-verification':
+                noEmailVerification = true;
+                break;
             case '--no-site-grants':
                 noSiteGrants = true;
                 break;
@@ -234,6 +238,11 @@ function parseArgs(argv) {
     cdpFallback = false;
     cdpEndpoint = undefined;
     prefer = 'extension';
+    // The local verification bypass is intended for trusted processes on this
+    // machine. Do not expose it through a public Cloudflare tunnel.
+    if (noEmailVerification && tunnel) {
+        throw new Error('--no-email-verification cannot be used with --tunnel');
+    }
     // File first, then flags win.
     const policy = (0, policy_1.resolvePolicy)({ ...policyFile, ...policyFlags });
     // Uploads must be confined to a directory — refuse to start with uploads enabled
@@ -271,6 +280,7 @@ function parseArgs(argv) {
         printPairing,
         persistToken,
         noTelemetry,
+        noEmailVerification,
         noSiteGrants,
         noAutoUpdate,
         noNativeHost,
@@ -375,6 +385,11 @@ Connection:
                          MCP_BROWSER_EXTENSION_TELEMETRY=0 or DO_NOT_TRACK=1. Only counts are
                          ever sent (version, OS, tool calls, error codes) — never
                          URLs, page content or arguments.
+  --no-email-verification  Skip the hosted email/device access gate for trusted local use.
+                         Email and device data are not sent to the access service.
+                         Same as MCP_BROWSER_EXTENSION_EMAIL_VERIFICATION=0.
+                         Cannot be combined with --tunnel; the domain allowlist,
+                         deny-all defaults, and other safety gates still apply.
 
 Backend:
   This build is EXTENSION-ONLY — it drives ONLY your real Chrome via the paired

package/dist/src/mcp/server.d.ts

@@ -27,7 +27,7 @@ export declare const SERVER_INSTRUCTIONS: string;
  */
 export declare function createServer(version?: string, policy?: Policy, accessGuard?: typeof requireAccess): McpServer;
 /** Start over stdio. Idempotent. */
-export declare function startMcpServer(version?: string, policy?: Policy): Promise<void>;
+export declare function startMcpServer(version?: string, policy?: Policy, accessGuard?: typeof requireAccess): Promise<void>;
 /** Stop and release the transport. Idempotent, best-effort. */
 export declare function stopMcpServer(): Promise<void>;
 /** The MCP client this session serves, as it named itself at initialize (for analytics). */

package/dist/src/mcp/server.js

@@ -43,6 +43,10 @@ exports.SERVER_INSTRUCTIONS = "MCP Browser Extension drives the user's real, sig
     'toolbar icon (its popup has an Allow button). It applies at once, with no restart. You cannot approve a site yourself. ' +
     "Work in your own tab: tab_new opens one in the background, and calls without a tabId go to it, never to the tab the user is on. " +
     "To act on the user's current page, pass its tabId from tabs_list.";
+const LOCAL_BYPASS_INSTRUCTIONS = 'Email verification is disabled by the local operator for this server. Only trusted local MCP clients should connect; the browser-domain allowlist and other capability safety gates remain active. ' +
+    'Start with chrome_status. If it reports no paired browser (or any tool fails with NO_BACKEND), give the user the steps in its `setup` field. ' +
+    'If a tool fails with POLICY_DENIED because a site is not allowed, ask the user to allow it from the extension\'s toolbar icon. ' +
+    "Work in your own tab: tab_new opens one in the background. To act on the user's current page, pass its tabId from tabs_list.";
 /** Default version reported when no explicit version is passed in (legacy callers/tests). */
 const DEFAULT_VERSION = SERVER_VERSION;
 let server = null;
@@ -56,7 +60,10 @@ let transport = null;
  * full catalog is advertised, which is what the tests want.
  */
 function createServer(version = DEFAULT_VERSION, policy, accessGuard = access_1.requireAccess) {
-    const srv = new mcp_js_1.McpServer({ name: SERVER_NAME, version }, { capabilities: { tools: {}, logging: {} }, instructions: exports.SERVER_INSTRUCTIONS });
+    const srv = new mcp_js_1.McpServer({ name: SERVER_NAME, version }, {
+        capabilities: { tools: {}, logging: {} },
+        instructions: accessGuard === access_1.bypassEmailVerification ? LOCAL_BYPASS_INSTRUCTIONS : exports.SERVER_INSTRUCTIONS,
+    });
     const advertised = (0, tools_1.registerTools)(srv, policy, accessGuard);
     watchInitialize(srv, advertised);
     // `McpServer` wraps the low-level `Server`, which owns the `onerror` hook.
@@ -88,12 +95,12 @@ function watchInitialize(srv, advertised) {
     };
 }
 /** Start over stdio. Idempotent. */
-async function startMcpServer(version = DEFAULT_VERSION, policy) {
+async function startMcpServer(version = DEFAULT_VERSION, policy, accessGuard = access_1.requireAccess) {
     if (server) {
         (0, log_1.logErr)('startMcpServer called but already running; ignoring.');
         return;
     }
-    const srv = createServer(version, policy);
+    const srv = createServer(version, policy, accessGuard);
     const tx = new stdio_js_1.StdioServerTransport();
     try {
         await srv.connect(tx);

package/extension-dist/background.js

@@ -49,6 +49,7 @@
     constructor(deps) {
       this.deps = deps;
     }
+    deps;
     ws = null;
     state = "idle";
     isConnected() {
@@ -1070,6 +1071,7 @@
       super(message);
       this.code = code;
     }
+    code;
   };
   var DOWNLOAD_TIMEOUT_MS = 12e4;
   function waitForDownloadComplete(id) {
@@ -1480,6 +1482,7 @@
     constructor(getPolicy = () => null) {
       this.getPolicy = getPolicy;
     }
+    getPolicy;
     /**
      * Resolve `frameId` / `allFrames` params into the frame ids an injection may
      * touch, dropping any whose own URL the policy does not allow for this method.
@@ -2121,6 +2124,7 @@
         if (!HANDLED.has(m)) throw new Error(`router drift: no handler for wire method "${m}"`);
       }
     }
+    deps;
     async dispatch(cmd) {
       try {
         const policy = this.deps.getPolicy();
@@ -2318,6 +2322,7 @@
     constructor(getPolicy) {
       this.getPolicy = getPolicy;
     }
+    getPolicy;
     /** One lock for all border state: parallel batch ops touching the same tab
      *  must not both inject (removeCSS takes out one copy, not both). */
     lock = new KeyedMutex();

package/extension-dist/popup.html

@@ -63,7 +63,6 @@
 
       main { padding: 4px 12px 12px; display: grid; gap: 10px; }
       .card { background: var(--card); border: 1px solid var(--line); border-radius: 14px; padding: 12px; box-shadow: var(--shadow); }
-      .card.connect { color: #0f172a; background: color-mix(in oklch, oklch(0.58 0.19 255) 7%, white); border-color: color-mix(in oklch, oklch(0.58 0.19 255) 25%, #e6e8ec); }
       h2 { display: flex; align-items: center; justify-content: space-between; margin: 0 0 8px; font-size: 11px; font-weight: 600; letter-spacing: 0.06em; text-transform: uppercase; color: var(--muted); }
       .count { font-size: 11px; letter-spacing: 0; text-transform: none; padding: 1px 7px; border-radius: 999px; background: var(--panel); border: 1px solid var(--line); color: var(--muted); }
 
@@ -118,7 +117,7 @@
       ol { margin: 2px 0 12px; padding-left: 18px; color: var(--muted); }
       ol li { margin: 3px 0; }
       code { font: 11.5px ui-monospace, SFMono-Regular, Menlo, monospace; padding: 1px 5px; border-radius: 5px; background: var(--panel); border: 1px solid var(--line); color: var(--fg); }
-      .connect .note { margin: 0 0 10px; color: inherit; }
+      .connect .note { margin: 0 0 10px; color: var(--fg); }
       #connect { width: 100%; padding: 10px 12px; font-size: 13.5px; font-weight: 600; }
       #connect.secondary { background: var(--panel); color: var(--fg); border-color: var(--line); box-shadow: none; padding: 7px 12px; font-size: 12.5px; font-weight: 500; }
       .connect .error { margin: 8px 0 0; color: var(--warn); }

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "mcp-browser-extension",
   "mcpName": "io.github.Mehmoodqureshi/mcp-browser-extension",
-  "version": "0.9.27",
-  "description": "Drive your real Chrome browser over MCP \u2014 real logins, real cookies. A stdio MCP server (CLI) plus an MV3 extension, driving Chrome via chrome.scripting/chrome.tabs. Multi-tab batch automation, accessibility snapshots, deny-all security by default.",
+  "version": "0.9.28",
+  "description": "Drive your real Chrome browser over MCP — real logins, real cookies. A stdio MCP server (CLI) plus an MV3 extension, driving Chrome via chrome.scripting/chrome.tabs. Multi-tab batch automation, accessibility snapshots, deny-all security by default.",
   "author": "Mehmood Ur Rehman Qureshi",
   "license": "MIT",
   "homepage": "https://mcp-browser-extension.com",
@@ -70,7 +70,7 @@
     "@types/chrome": "^0.0.287",
     "@types/node": "^20.17.10",
     "@types/ws": "^8.5.13",
-    "esbuild": "^0.24.0",
+    "esbuild": "^0.28.2",
     "playwright": "^1.49.1",
     "rimraf": "^5.0.10",
     "typescript": "^5.7.2"