mcp-browser-extension 0.9.30 → 0.9.31

package/README.md

@@ -174,13 +174,24 @@ the way to install it.
 **3. Verify your email.** In your MCP client, ask the agent to call
 `chrome_status`. On this first browser tool call, the client shows an email
 prompt. Enter an address you can access, then open the sign-in link sent to
-that address. The waiting tool reports **Email verified** and continues.
+that address and click **Verify this device**. The waiting tool reports
+**Email verified** and continues.
 
 If the tool returns `ACCESS_PENDING`, ask the agent to call `chrome_status`
 again to keep waiting on the same link. You do not need another email or a
-verification code. The MCP client must support interactive input prompts
-(MCP elicitation). If no prompt appears, enable interactive prompts in your
-client and retry; installing the extension alone does not activate access.
+verification code.
+
+If your client suppresses the prompt (for example, in YOLO/bypass mode), does
+not support MCP elicitation, or the dialog is dismissed, the server automatically
+opens a temporary local verification form in your browser. The tool also returns
+`ACCESS_INPUT_REQUIRED` with the link, so you can open it yourself if necessary
+on the computer running the MCP server. Enter your email in the browser form,
+and open the sign-in link from your inbox. Click **Verify this device**, then
+call `chrome_status` to continue.
+The local form expires after 10 minutes; call the tool again for a fresh one.
+Opening the form does not send an email, and access remains blocked until the
+email link and device grant are verified. Installing the extension alone does
+not activate access.
 
 **4. Click Connect if Chrome is not already paired.** A fresh install opens the
 extension's Settings with a
@@ -675,6 +686,10 @@ what the flags say.
 it says nothing about what is on them. A logged-in page routinely renders a
 session token into a script tag or an API key onto a settings screen.
 
+- **Cookie values are hidden by default.** `get_cookies` returns each cookie's
+  name, domain, path and flags with the value replaced by `[hidden]`. A session
+  cookie can grant access to an account without its password.
+  Pass `--enable-cookie-values` if a task really needs them.
 - **Password field values are always suppressed** — in `get_html`, and in
   `snapshot`, where the field still appears (so you can type into it) flagged
   `secret: true` with no value. No flag, no opt-in: nobody wants those characters.

package/SETUP.md

@@ -128,13 +128,24 @@ the Web Store build passes review separately and can trail it by a version.
 
 The first browser tool call opens an email prompt in the MCP client. Ask the
 human to enter an email address. The website sends a Firebase sign-in link;
-the human opens it in their browser and returns to the MCP client. Do not ask
+the human opens it in their browser, clicks **Verify this device**, and returns
+to the MCP client. Do not ask
 them to copy or paste a verification code. The server detects the verified
 link automatically and reports the result to the waiting tool call. On success,
 the result includes **Email verified** and the requested browser action continues.
 The user does not need to send another chat message. Progress updates and status
 notifications are also sent to clients that display them.
 
+If the client suppresses or cannot display the prompt, or it is dismissed,
+the server automatically opens a temporary local browser form and returns
+`ACCESS_INPUT_REQUIRED` with its link. Show the link as a backup if the form
+did not appear on the computer running the server.
+The human enters their email, opens the sign-in link from their inbox, and clicks
+**Verify this device**. Do not fill
+the form or open their email for them. The form expires after 10 minutes.
+After they submit it, call `chrome_status` to wait for verification.
+YOLO/bypass permission mode does not skip email verification.
+
 If the human explicitly configured `--no-email-verification`, there is no email
 step; continue to pairing. This option is intended only for trusted local
 clients and cannot be combined with a public tunnel.
@@ -146,9 +157,7 @@ remain blocked until access is confirmed. Cancellation stops the waiting action,
 while background verification can still activate the local installation.
 
 Click **Connect** in the extension if the result says Chrome is not already
-paired. This requires the MCP client to
-support elicitation; clients that cannot show the prompt cannot activate
-through this flow.
+paired.
 
 The server also writes a `pairing.json` file for Load unpacked installs, which
 may connect automatically. For the Chrome Web Store copy, or whenever Chrome

package/dist/shared/screenshot.d.ts

@@ -14,8 +14,10 @@ export interface PageDims {
     /** Full content box (document) width/height. */
     fullW: number;
     fullH: number;
-    /** window.devicePixelRatio (default 1). Output pixels = CSS px * dpr * clip.scale. */
+    /** window.devicePixelRatio, including page zoom (default 1). */
     dpr?: number;
+    /** Chrome tab zoom: CSS pixels to device-independent pixels (default 1). */
+    zoom?: number;
     /** Current scroll offset of the top document (default 0,0); a viewport clip starts here. */
     scrollX?: number;
     scrollY?: number;
@@ -35,7 +37,7 @@ export interface ElementRect {
     w: number;
     h: number;
 }
-/** A CDP `Page.captureScreenshot` clip (CSS px; `scale` multiplies output). */
+/** A CDP `Page.captureScreenshot` clip (device-independent px, not CSS px). */
 export interface CaptureClip {
     x: number;
     y: number;

package/dist/shared/screenshot.js

@@ -27,15 +27,20 @@ exports.MAX_CAPTURE_PX = 16384;
  * viewport capture. Heights are clamped to MAX_CAPTURE_PX with `truncated` set.
  */
 function planScreenshot(dims, opts = {}) {
-    // CDP's clip.scale multiplies on top of the device scale factor, so dividing
-    // by the DPR yields exactly `opts.scale` output pixels per CSS pixel.
+    // Page.Viewport uses device-independent pixels, so convert the CSS geometry
+    // by the tab zoom. DPR already includes that zoom: dividing the output scale
+    // by DPR then yields exactly `opts.scale` output pixels per CSS pixel.
     const dpr = dims.dpr && dims.dpr > 0 ? dims.dpr : 1;
+    const zoom = dims.zoom && dims.zoom > 0 ? dims.zoom : 1;
     const scale = (opts.scale && opts.scale > 0 ? opts.scale : exports.DEFAULT_SCREENSHOT_SCALE) / dpr;
+    const clip = (x, y, width, height) => ({
+        x: x * zoom, y: y * zoom, width: width * zoom, height: height * zoom, scale,
+    });
     if (opts.element) {
         const realH = Math.max(1, Math.round(opts.element.h));
         const clipH = Math.min(opts.element.h, exports.MAX_CAPTURE_PX);
         return {
-            clip: { x: opts.element.x, y: opts.element.y, width: opts.element.w, height: clipH, scale },
+            clip: clip(opts.element.x, opts.element.y, opts.element.w, clipH),
             captureBeyondViewport: true,
             width: Math.max(1, Math.round(opts.element.w)),
             height: Math.min(realH, exports.MAX_CAPTURE_PX),
@@ -46,7 +51,7 @@ function planScreenshot(dims, opts = {}) {
     if (opts.fullPage) {
         const clipH = Math.min(dims.fullH, exports.MAX_CAPTURE_PX);
         return {
-            clip: { x: 0, y: 0, width: dims.fullW, height: clipH, scale },
+            clip: clip(0, 0, dims.fullW, clipH),
             captureBeyondViewport: true,
             width: dims.fullW,
             height: clipH,
@@ -54,11 +59,11 @@ function planScreenshot(dims, opts = {}) {
             fullHeight: dims.fullH,
         };
     }
-    // Plain viewport: capture what's visible. A clip is only needed to apply a
-    // scale; at scale 1 on a 1x display the bare capture is identical and cheaper.
+    // Plain viewport: a clip is needed to apply an output scale or page zoom.
+    // The caller can also force a fresh paint with a viewport clip at 100%.
     return {
-        ...(scale !== 1
-            ? { clip: { x: dims.scrollX ?? 0, y: dims.scrollY ?? 0, width: dims.w, height: dims.h, scale } }
+        ...(scale !== 1 || zoom !== 1
+            ? { clip: clip(dims.scrollX ?? 0, dims.scrollY ?? 0, dims.w, dims.h) }
             : {}),
         captureBeyondViewport: false,
         width: dims.w,

package/dist/src/access-browser.d.ts

@@ -0,0 +1,15 @@
+export interface BrowserEmailPrompt {
+    url: string;
+    close(): void;
+}
+export interface EmailSubmission {
+    ok: boolean;
+    message: string;
+}
+/** Best effort: the tool also returns the link for remote/headless computers. */
+export declare function openBrowserEmailPrompt(url: string): void;
+/** Only the person submitting this form can start an email. GET never sends one. */
+export declare function createBrowserEmailPrompt(submit: (email: string) => Promise<EmailSubmission>, options?: {
+    onClose?: () => void;
+    ttlMs?: number;
+}): Promise<BrowserEmailPrompt>;

package/dist/src/access-browser.js

@@ -0,0 +1,159 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.openBrowserEmailPrompt = openBrowserEmailPrompt;
+exports.createBrowserEmailPrompt = createBrowserEmailPrompt;
+/** A temporary loopback email form for clients that cannot display elicitation. */
+const node_crypto_1 = require("node:crypto");
+const node_http_1 = require("node:http");
+const node_child_process_1 = require("node:child_process");
+/** Best effort: the tool also returns the link for remote/headless computers. */
+function openBrowserEmailPrompt(url) {
+    // Only launch a form we host, never a URL received from an MCP request.
+    if (!/^http:\/\/127\.0\.0\.1:\d+\/verify\/[a-f0-9]{64}$/.test(url))
+        return;
+    const command = process.platform === 'darwin' ? 'open'
+        : process.platform === 'win32' ? 'rundll32.exe' : 'xdg-open';
+    const args = process.platform === 'win32' ? ['url.dll,FileProtocolHandler', url] : [url];
+    try {
+        const child = (0, node_child_process_1.spawn)(command, args, { detached: true, stdio: 'ignore', windowsHide: true });
+        child.on('error', () => { });
+        child.unref();
+    }
+    catch { /* Keep the form available even if the operating system cannot open it. */ }
+}
+const escapeHtml = (s) => s.replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]));
+function page(path, csrf, message, sent) {
+    return `<!doctype html><html lang="en"><meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1">
+<title>Verify your email | MCP Browser Extension</title>
+<style>
+  :root{color-scheme:light dark;font-family:system-ui,sans-serif}
+  body{max-width:440px;margin:12vh auto;padding:24px;line-height:1.5}
+  h1{font-size:28px;line-height:1.2} label{display:block;font-weight:600}
+  input,button{box-sizing:border-box;width:100%;font:inherit;padding:12px;margin-top:8px;border:1px solid #888;border-radius:6px}
+  button{margin-top:18px;background:#175cd3;color:white;border-color:#175cd3;cursor:pointer}
+  p{margin:20px 0} .brand{font-size:14px} small{display:block;margin-top:18px}
+</style>
+<body><p class="brand">MCP Browser Extension</p><h1>${sent ? 'Check your inbox' : 'Verify your email'}</h1>
+<p role="status">${escapeHtml(message)}</p>
+${sent ? '<p>After opening the sign-in link, return to your assistant to continue.</p>' : `
+<form method="post" action="${path}">
+  <input type="hidden" name="csrf" value="${csrf}">
+  <label for="email">Email address</label>
+  <input id="email" name="email" type="email" autocomplete="email" maxlength="254" required autofocus>
+  <button type="submit">Send verification link</button>
+</form><small>Your email is sent to mcp-browser-extension.com to verify and manage access.</small>`}
+</body></html>`;
+}
+/** Only the person submitting this form can start an email. GET never sends one. */
+async function createBrowserEmailPrompt(submit, options = {}) {
+    const path = `/verify/${(0, node_crypto_1.randomBytes)(32).toString('hex')}`;
+    const csrf = (0, node_crypto_1.randomBytes)(32).toString('hex');
+    let origin = '';
+    let sent = false;
+    let busy = false;
+    let closed = false;
+    let expiry;
+    const sentMessage = 'A sign-in link has been sent. Open it from your email and click Verify this device to finish verification.';
+    const respond = (res, status, message) => {
+        res.writeHead(status, {
+            'content-type': 'text/html; charset=utf-8',
+            'cache-control': 'no-store',
+            // Keep Origin on same-origin form POSTs; no-referrer makes Chromium send
+            // Origin: null. Cross-origin destinations still receive no referrer.
+            'referrer-policy': 'same-origin',
+            'x-content-type-options': 'nosniff',
+            'x-frame-options': 'DENY',
+            'content-security-policy': "default-src 'none'; style-src 'unsafe-inline'; form-action 'self'; base-uri 'none'; frame-ancestors 'none'",
+        });
+        res.end(page(path, csrf, message, sent));
+    };
+    const server = (0, node_http_1.createServer)((req, res) => {
+        void (async () => {
+            // Exact Host + Origin checks also prevent DNS rebinding and cross-site
+            // submissions. The random path is independent of every device credential.
+            if (req.headers.host !== origin.slice('http://'.length) || req.url !== path) {
+                res.writeHead(404).end();
+                return;
+            }
+            if (req.method === 'GET') {
+                respond(res, 200, sent ? sentMessage : 'Enter your email below. We will send you a one-time sign-in link.');
+                return;
+            }
+            if (req.method !== 'POST') {
+                res.writeHead(405, { allow: 'GET, POST' }).end();
+                return;
+            }
+            if (req.headers.origin !== origin) {
+                res.writeHead(403).end();
+                return;
+            }
+            if (req.headers['content-type']?.split(';')[0] !== 'application/x-www-form-urlencoded') {
+                res.writeHead(415).end();
+                return;
+            }
+            let body = '';
+            let bytes = 0;
+            for await (const chunk of req) {
+                bytes += Buffer.byteLength(chunk);
+                if (bytes > 2048) {
+                    res.writeHead(413).end();
+                    return;
+                }
+                body += chunk.toString();
+            }
+            const fields = new URLSearchParams(body);
+            if (fields.get('csrf') !== csrf) {
+                res.writeHead(403).end();
+                return;
+            }
+            if (sent) {
+                respond(res, 200, sentMessage);
+                return;
+            }
+            if (busy) {
+                respond(res, 409, 'Your request is already being sent. Please wait.');
+                return;
+            }
+            busy = true;
+            try {
+                const outcome = await submit(fields.get('email') ?? '');
+                sent = outcome.ok;
+                respond(res, outcome.ok ? 200 : 400, outcome.ok ? sentMessage : outcome.message);
+            }
+            finally {
+                busy = false;
+            }
+        })().catch(() => { if (!res.headersSent)
+            respond(res, 503, 'The verification service could not be reached. Please try again.'); });
+    });
+    server.requestTimeout = 10_000;
+    server.headersTimeout = 10_000;
+    const close = () => {
+        if (closed)
+            return;
+        closed = true;
+        clearTimeout(expiry);
+        server.close();
+        server.closeAllConnections();
+        options.onClose?.();
+    };
+    await new Promise((resolve, reject) => {
+        server.once('error', reject);
+        server.listen(0, '127.0.0.1', () => {
+            server.removeListener('error', reject);
+            resolve();
+        });
+    });
+    const address = server.address();
+    if (!address || typeof address === 'string') {
+        close();
+        throw new Error('No loopback address');
+    }
+    origin = `http://127.0.0.1:${address.port}`;
+    expiry = setTimeout(close, options.ttlMs ?? 10 * 60_000);
+    expiry.unref();
+    server.unref();
+    return { url: origin + path, close };
+}
+//# sourceMappingURL=access-browser.js.map

package/dist/src/access.d.ts

@@ -9,6 +9,8 @@ export type AccessRequest = {
 };
 /** @internal Test seam for the verification watcher. */
 export declare function setAccessPollIntervalForTesting(ms: number, waitMs?: number): void;
+/** Close a pending form when verification finishes or its owner shuts down. */
+export declare function closeAccessBrowserPrompt(dataDir: string): void;
 declare function result(message: string): {
     content: {
         type: "text";

package/dist/src/access.js

@@ -2,12 +2,14 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.bypassEmailVerification = void 0;
 exports.setAccessPollIntervalForTesting = setAccessPollIntervalForTesting;
+exports.closeAccessBrowserPrompt = closeAccessBrowserPrompt;
 exports.requireAccess = requireAccess;
 /** Email-link access gate for the MCP tool surface. */
 const node_crypto_1 = require("node:crypto");
 const node_fs_1 = require("node:fs");
 const node_path_1 = require("node:path");
 const compat_1 = require("./compat");
+const access_browser_1 = require("./access-browser");
 const SITE = ((0, compat_1.runtimeEnv)('ACCESS_API') ?? 'https://mcp-browser-extension.com/api/access').replace(/\/$/, '');
 let accessPollMs = 2_000;
 let accessWaitMs = 45_000;
@@ -18,10 +20,12 @@ const EMAIL_SCHEMA = {
 };
 const validUntil = new Map();
 const currentChecks = new Map();
+const pendingEmailStarts = new Map();
 const pollingChallenges = new Map();
 const completionToReport = new Map();
+const browserPrompts = new Map();
 const VERIFIED = { status: 'verified', message: 'Email verified. MCP Browser Extension access is active.' };
-const PENDING = { status: 'pending', message: '[ACCESS_PENDING] Email verification is still pending. Open the sign-in link sent to your email. Continue waiting by calling chrome_status; no new email or chat reply is needed.' };
+const PENDING = { status: 'pending', message: '[ACCESS_PENDING] Email verification is still pending. Open the sign-in link sent to your email and click Verify this device. Continue waiting by calling chrome_status; no new email or chat reply is needed.' };
 const CANCELLED = { status: 'cancelled', message: 'Email verification wait was cancelled. The browser action was not run.' };
 const UNAVAILABLE = { status: 'unavailable', message: 'Email verification could not be confirmed because the verification service is unavailable. Access remains blocked. Retry chrome_status shortly.' };
 /** @internal Test seam for the verification watcher. */
@@ -29,6 +33,10 @@ function setAccessPollIntervalForTesting(ms, waitMs = 45_000) {
     accessPollMs = Math.max(1, ms);
     accessWaitMs = Math.max(1, waitMs);
 }
+/** Close a pending form when verification finishes or its owner shuts down. */
+function closeAccessBrowserPrompt(dataDir) {
+    browserPrompts.get(dataDir)?.close();
+}
 function statePath(dataDir) { return (0, node_path_1.join)(dataDir, 'access.json'); }
 function loadOrCreate(dataDir) {
     (0, node_fs_1.mkdirSync)(dataDir, { recursive: true, mode: 0o700 });
@@ -68,6 +76,7 @@ function watchForEmailApproval(server, dataDir, challengeId) {
         let delayMs = accessPollMs;
         const finish = (outcome) => {
             pollingChallenges.delete(challengeId);
+            closeAccessBrowserPrompt(dataDir);
             completionToReport.set(dataDir, outcome);
             void notifyAccess(server, outcome);
             resolve(outcome);
@@ -133,10 +142,10 @@ async function waitForEmailApproval(server, dataDir, challengeId, request) {
         }
         catch { /* Progress is optional; the tool result still carries the outcome. */ }
     };
-    await report('Sign-in link sent. Open it in your email; this tool is waiting for verification automatically.');
+    await report('Sign-in link sent. Open it in your email and click Verify this device; this tool is waiting for verification automatically.');
     let timeout;
     let onAbort;
-    const heartbeat = setInterval(() => { void report('Waiting for email verification. Open the sign-in link sent to your email.'); }, 5_000);
+    const heartbeat = setInterval(() => { void report('Waiting for email verification. Open the sign-in link sent to your email and click Verify this device.'); }, 5_000);
     try {
         const outcome = await Promise.race([
             approval.promise,
@@ -176,6 +185,74 @@ async function api(path, body) {
 function result(message) {
     return { content: [{ type: 'text', text: message }], isError: true };
 }
+const inputRequired = (url) => ({
+    status: 'input-required',
+    message: '[ACCESS_INPUT_REQUIRED] Complete email verification in the browser form. It opens automatically when the client does not display its email prompt. ' +
+        `If no form appeared, open this local page on the computer running MCP Browser Extension:\n${url}\n` +
+        'Enter your email there, open the sign-in link from your inbox, and click Verify this device. This page expires in 10 minutes. ' +
+        'Show this link to the user; do not fill the form or open their email for them. After they submit their email, call chrome_status to wait for verification. Access remains blocked until verification succeeds.',
+});
+function startEmail(server, dataDir, state, input) {
+    const existing = pendingEmailStarts.get(dataDir);
+    if (existing)
+        return existing;
+    const sending = sendVerificationEmail(server, dataDir, state, input)
+        .finally(() => { pendingEmailStarts.delete(dataDir); });
+    pendingEmailStarts.set(dataDir, sending);
+    return sending;
+}
+async function sendVerificationEmail(server, dataDir, state, input) {
+    const email = input.trim().toLowerCase();
+    if (email.length > 254 || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) {
+        return { status: 'denied', message: 'Enter a valid email address.' };
+    }
+    state.challengeId = (0, node_crypto_1.randomBytes)(32).toString('hex');
+    let started;
+    try {
+        started = await api('start', { email, challengeId: state.challengeId, deviceId: state.deviceId, deviceSecret: state.deviceSecret });
+    }
+    catch {
+        delete state.challengeId;
+        saveState(dataDir, state);
+        return { status: 'unavailable', message: 'The verification service could not be reached. Please try again.' };
+    }
+    if (!started.ok) {
+        delete state.challengeId;
+        saveState(dataDir, state);
+        const message = typeof started.data.error === 'string' ? started.data.error : 'The verification email could not be sent. Check your connection and try again.';
+        return { status: 'unavailable', message };
+    }
+    // Other tool calls and local processes must not poll a challenge before the
+    // backend creates it; a premature 410 would discard a valid sign-in request.
+    saveState(dataDir, state);
+    await notifyAccess(server, { status: 'pending', message: 'A sign-in link has been sent. Open it from your email; the browser tool is waiting for verification.' });
+    return { challengeId: state.challengeId };
+}
+async function offerBrowserPrompt(server, dataDir, request) {
+    if (request.signal?.aborted)
+        return CANCELLED;
+    const existing = browserPrompts.get(dataDir);
+    if (existing)
+        return inputRequired(existing.url);
+    const prompt = await (0, access_browser_1.createBrowserEmailPrompt)(async (email) => {
+        const state = loadOrCreate(dataDir);
+        if (state.verified || state.challengeId)
+            return { ok: false, message: 'A verification request is already active. Return to your assistant and call chrome_status.' };
+        const outcome = await startEmail(server, dataDir, state, email);
+        if (outcome && 'challengeId' in outcome) {
+            watchForEmailApproval(server, dataDir, outcome.challengeId);
+            return { ok: true, message: '' };
+        }
+        return { ok: false, message: outcome?.message ?? UNAVAILABLE.message };
+    }, { onClose: () => { browserPrompts.delete(dataDir); } });
+    browserPrompts.set(dataDir, prompt);
+    if (request.signal?.aborted) {
+        prompt.close();
+        return CANCELLED;
+    }
+    (0, access_browser_1.openBrowserEmailPrompt)(prompt.url);
+    return inputRequired(prompt.url);
+}
 /** Returns null when authorized, otherwise a user-facing tool error. */
 async function requireAccess(server, dataDir, request = {}) {
     if (request.signal?.aborted)
@@ -214,11 +291,15 @@ async function requireAccess(server, dataDir, request = {}) {
 const bypassEmailVerification = async () => null;
 exports.bypassEmailVerification = bypassEmailVerification;
 async function check(server, dataDir, request) {
+    const sending = pendingEmailStarts.get(dataDir);
+    if (sending)
+        return sending;
     const state = loadOrCreate(dataDir);
     try {
         if (state.verified) {
             const revalidated = await api('validate', { deviceId: state.deviceId, deviceSecret: state.deviceSecret });
             if (revalidated.ok && revalidated.data.authorized === true) {
+                closeAccessBrowserPrompt(dataDir);
                 validUntil.set(dataDir, Date.now() + 60_000);
                 if (completionToReport.delete(dataDir))
                     return VERIFIED;
@@ -235,6 +316,9 @@ async function check(server, dataDir, request) {
             return { status: 'unavailable', message: 'Access could not be checked right now. Retry the browser tool shortly.' };
         }
         if (!state.challengeId) {
+            const existing = browserPrompts.get(dataDir);
+            if (existing)
+                return inputRequired(existing.url);
             let elicitation;
             // The SDK retains the signal listener after an elicitation completes.
             // Detach our forwarding listener so later cancellation cannot cancel a finished prompt.
@@ -253,28 +337,17 @@ async function check(server, dataDir, request) {
             catch {
                 if (request.signal?.aborted)
                     return CANCELLED;
-                return { status: 'unavailable', message: 'Your MCP client did not display the email prompt. This access flow requires an MCP client that supports elicitation. Enable elicitation or connect from a supported client, then retry.' };
+                return await offerBrowserPrompt(server, dataDir, request);
             }
             finally {
                 request.signal?.removeEventListener('abort', cancelPrompt);
             }
             if (request.signal?.aborted)
                 return CANCELLED;
-            if (elicitation.action !== 'accept' || typeof elicitation.content?.email !== 'string')
-                return { status: 'cancelled', message: 'Email verification was not completed. Retry the browser tool to start again.' };
-            const email = elicitation.content.email.trim().toLowerCase();
-            if (email.length > 254 || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email))
-                return { status: 'denied', message: 'That email address is invalid. Retry the browser tool and enter a valid address.' };
-            state.challengeId = (0, node_crypto_1.randomBytes)(32).toString('hex');
-            saveState(dataDir, state);
-            const started = await api('start', { email, challengeId: state.challengeId, deviceId: state.deviceId, deviceSecret: state.deviceSecret });
-            if (!started.ok) {
-                delete state.challengeId;
-                saveState(dataDir, state);
-                const message = typeof started.data.error === 'string' ? started.data.error : 'The verification email could not be sent. Check your connection and retry the browser tool.';
-                return { status: 'unavailable', message };
+            if (elicitation.action !== 'accept' || typeof elicitation.content?.email !== 'string' || !elicitation.content.email.trim()) {
+                return await offerBrowserPrompt(server, dataDir, request);
             }
-            await notifyAccess(server, { status: 'pending', message: 'A sign-in link has been sent. Open it from your email; the browser tool is waiting for verification.' });
+            return await startEmail(server, dataDir, state, elicitation.content.email);
         }
         return { challengeId: state.challengeId };
     }

package/dist/src/config.js

@@ -157,6 +157,9 @@ function parseArgs(argv) {
             case '--enable-observers':
                 policyFlags.allowObservers = true;
                 break;
+            case '--enable-cookie-values':
+                policyFlags.allowCookieValues = true;
+                break;
             case '--redact':
                 policyFlags.redact = true;
                 break;
@@ -419,6 +422,9 @@ Security (default: deny-all safe mode):
                          in-page hook on allowlisted sites that records console
                          output, fetch/XHR traffic, and intercepts alert/confirm/
                          prompt (off by default: it patches page globals).
+  --enable-cookie-values Let get_cookies return cookie values. Off by default:
+                         a session cookie is the login itself, so get_cookies
+                         returns names and flags with every value hidden.
   --redact               Scrub secret-shaped strings (JWTs, cloud keys, bearer
                          tokens, private keys) out of page reads. Password field
                          values are always suppressed, with or without this.

package/dist/src/mcp/server.js

@@ -36,7 +36,7 @@ const SERVER_VERSION = '0.1.0';
  * than retry.
  */
 exports.SERVER_INSTRUCTIONS = "MCP Browser Extension drives the user's real, signed-in Chrome. " +
-    'On the first browser tool call, enter your email in the MCP input prompt and open the sign-in link sent to you. The tool waits for verification, reports the result, and continues automatically on success. If it returns ACCESS_PENDING, call chrome_status again to keep waiting; do not ask for a chat reply or another email. Only ask the user to click Connect if the result says Chrome is not paired. ' +
+    'On the first browser tool call, enter your email in the MCP input prompt and open the sign-in link sent to you, then click Verify this device on the website. If it returns ACCESS_INPUT_REQUIRED, the local verification form opens automatically in the browser; also show its URL as a backup so the user can enter their email. Do not fill it or read their email for them. The tool waits for verification, reports the result, and continues automatically on success. If it returns ACCESS_PENDING, call chrome_status again to keep waiting; do not ask for a chat reply or another email. Only ask the user to click Connect if the result says Chrome is not paired. ' +
     'Start with chrome_status. If it reports no paired browser (or any tool fails with NO_BACKEND), do not retry: ' +
     'give the user the steps in its `setup` field, which name what went wrong and how to fix it. ' +
     'If a tool fails with POLICY_DENIED because a site is not allowed, ask the user to allow it from the extension\'s ' +

package/dist/src/mcp/tools.js

@@ -124,7 +124,7 @@ exports.TOOL_DEFINITIONS = [
     { name: 'get_html', description: 'Get HTML of the page or an element. Output is capped (see maxBytes) and cut at a tag boundary; narrow it with `selector` rather than raising the cap when you can. Password field values are always blanked.', inputSchema: { ...TARGET_PROPS, ...FRAME_PROPS, outer: zod_1.z.boolean().optional(), tabId: tabIdField, maxBytes: maxBytesField } },
     { name: 'snapshot', description: 'Accessibility snapshot: interactive elements with refs to target by `ref` (more reliable than guessing CSS selectors). Pass diff:true to get only what changed since the last snapshot of this tab - far cheaper in a click/read loop. Password fields appear as secret:true with no value.', inputSchema: { interactiveOnly: zod_1.z.boolean().optional(), max: zod_1.z.number().optional(), diff: zod_1.z.boolean().describe('Return added/removed/changed elements since the previous snapshot of this tab instead of the whole tree').optional(), failOnAuthWall: authWallField, ...FRAME_PROPS, tabId: tabIdField } },
     { name: 'page_watch', description: 'Save a local page checkpoint and compare it later. Actions: create (name), compare (watchId), list, delete. Stores accessibility labels and state, never form values. Site allowlist still applies.', inputSchema: { action: zod_1.z.enum(['create', 'compare', 'list', 'delete']), name: zod_1.z.string().optional(), watchId: zod_1.z.string().optional(), tabId: tabIdField } },
-    { name: 'get_cookies', description: "Read cookies visible to the tab's URL (or a given url).", inputSchema: { url: zod_1.z.string().optional(), tabId: tabIdField } },
+    { name: 'get_cookies', description: "Cookies for the tab's URL (or url); values need --enable-cookie-values.", inputSchema: { url: zod_1.z.string().optional(), tabId: tabIdField } },
     { name: 'storage', description: 'Read/write localStorage (or sessionStorage). op: get|set|remove|clear.', inputSchema: { op: zod_1.z.enum(['get', 'set', 'remove', 'clear']), key: zod_1.z.string().optional(), value: zod_1.z.string().optional(), session: zod_1.z.boolean().optional(), tabId: tabIdField } },
     { name: 'eval', description: 'Evaluate JavaScript in the page (disabled in safe-mode).', inputSchema: { expression: zod_1.z.string(), awaitPromise: zod_1.z.boolean().optional(), ...FRAME_PROPS, tabId: tabIdField } },
     { name: 'wait_for', description: 'Wait for a selector or text to appear/disappear.', inputSchema: { selector: zod_1.z.string().optional(), textContains: zod_1.z.string().optional(), gone: zod_1.z.boolean().optional(), timeoutMs: zod_1.z.number().optional(), ...FRAME_PROPS, tabId: tabIdField, failOnAuthWall: authWallField } },
@@ -400,6 +400,8 @@ function enabledToolNames() {
 const GATE_CONTEXT = 'cannot resolve the target tab URL for the policy gate';
 /** How long the gate waits for a just-opened background tab to report its URL. */
 const OPENING_TAB_WAIT_MS = 5_000;
+/** What `get_cookies` returns in place of a value unless --enable-cookie-values is set. */
+const COOKIE_VALUE_HIDDEN = '[hidden]';
 /**
  * Resolve the URL the policy should be evaluated against: the URL of the tab
  * this very call will act on — the explicit `tabId` when the caller gave one,
@@ -965,7 +967,16 @@ exports.TOOL_HANDLERS = {
         const url = (0, validators_1.optionalString)(a, 'url');
         if (url !== undefined)
             await gate(ctx, 'get_text', { url });
-        return (0, envelopes_1.jsonResult)(await ctx.ex.getCookies({ tabId: tabId(a), url }));
+        const result = await ctx.ex.getCookies({ tabId: tabId(a), url });
+        if (ctx.policy.allowCookieValues)
+            return (0, envelopes_1.jsonResult)(result);
+        // A session cookie is the login itself: whoever holds its value can use the
+        // account from anywhere. The browser stays signed in without the agent ever
+        // seeing it, so hide every value unless the operator opted in.
+        return (0, envelopes_1.jsonResult)({
+            cookies: result.cookies.map((c) => ({ ...c, value: COOKIE_VALUE_HIDDEN })),
+            valuesHidden: 'Cookie values are hidden. Ask the user to restart the server with --enable-cookie-values if they need them.',
+        });
     },
     storage: async (a, ctx) => {
         const op = (0, validators_1.requireString)(a, 'op');

package/dist/src/security/policy.d.ts

@@ -36,6 +36,10 @@ export interface Policy extends WirePolicy {
      *  `AUTH_REQUIRED` when the page it lands on is a high-confidence sign-in
      *  wall, so an expired session is never scored as some other failure. */
     failOnAuthWall?: boolean;
+    /** `--enable-cookie-values`: `get_cookies` returns each cookie's value. Off by
+     *  default, because a session cookie is the login itself: whoever holds it can
+     *  use the account from anywhere, with no password and no browser. */
+    allowCookieValues?: boolean;
 }
 /** The SAFE default: deny everything until the user opts in. */
 export declare const DEFAULT_POLICY: Readonly<Policy>;

package/dist/src/security/policy.js

@@ -45,6 +45,7 @@ exports.DEFAULT_POLICY = Object.freeze({
     redact: false,
     redactPatterns: [],
     failOnAuthWall: false,
+    allowCookieValues: false,
 });
 /** Merge a partial (from a policy file and/or CLI flags) over the safe default. */
 function resolvePolicy(partial) {
@@ -60,6 +61,7 @@ function resolvePolicy(partial) {
         redact: partial?.redact ?? exports.DEFAULT_POLICY.redact,
         redactPatterns: partial?.redactPatterns ?? [...(exports.DEFAULT_POLICY.redactPatterns ?? [])],
         failOnAuthWall: partial?.failOnAuthWall ?? exports.DEFAULT_POLICY.failOnAuthWall,
+        allowCookieValues: partial?.allowCookieValues ?? exports.DEFAULT_POLICY.allowCookieValues,
     };
 }
 /**

package/extension-dist/background.js

@@ -922,12 +922,20 @@
   var MAX_CAPTURE_PX = 16384;
   function planScreenshot(dims, opts = {}) {
     const dpr = dims.dpr && dims.dpr > 0 ? dims.dpr : 1;
+    const zoom = dims.zoom && dims.zoom > 0 ? dims.zoom : 1;
     const scale = (opts.scale && opts.scale > 0 ? opts.scale : DEFAULT_SCREENSHOT_SCALE) / dpr;
+    const clip = (x, y, width, height) => ({
+      x: x * zoom,
+      y: y * zoom,
+      width: width * zoom,
+      height: height * zoom,
+      scale
+    });
     if (opts.element) {
       const realH = Math.max(1, Math.round(opts.element.h));
       const clipH = Math.min(opts.element.h, MAX_CAPTURE_PX);
       return {
-        clip: { x: opts.element.x, y: opts.element.y, width: opts.element.w, height: clipH, scale },
+        clip: clip(opts.element.x, opts.element.y, opts.element.w, clipH),
         captureBeyondViewport: true,
         width: Math.max(1, Math.round(opts.element.w)),
         height: Math.min(realH, MAX_CAPTURE_PX),
@@ -938,7 +946,7 @@
     if (opts.fullPage) {
       const clipH = Math.min(dims.fullH, MAX_CAPTURE_PX);
       return {
-        clip: { x: 0, y: 0, width: dims.fullW, height: clipH, scale },
+        clip: clip(0, 0, dims.fullW, clipH),
         captureBeyondViewport: true,
         width: dims.fullW,
         height: clipH,
@@ -947,7 +955,7 @@
       };
     }
     return {
-      ...scale !== 1 ? { clip: { x: dims.scrollX ?? 0, y: dims.scrollY ?? 0, width: dims.w, height: dims.h, scale } } : {},
+      ...scale !== 1 || zoom !== 1 ? { clip: clip(dims.scrollX ?? 0, dims.scrollY ?? 0, dims.w, dims.h) } : {},
       captureBeyondViewport: false,
       width: dims.w,
       height: dims.h,
@@ -1233,8 +1241,9 @@
     const w = cmd.params.waitUntil;
     return w === "domcontentloaded" || w === "networkidle" ? w : "load";
   }
-  function armNavigationWait(tabId, waitUntil, timeoutMs = 3e4) {
+  function armNavigationWait(tabId, waitUntil, timeoutMs = 3e4, expectedUrl) {
     const start = Date.now();
+    const destination = expectedUrl === void 0 ? void 0 : new URL(expectedUrl).href;
     const NETWORK_QUIET_MS = 500;
     let done = () => void 0;
     const finished = new Promise((resolve) => {
@@ -1250,21 +1259,26 @@
     };
     const onBefore = (d) => {
       if (!isTop(d)) return;
+      if (destination && !started && d.url !== destination) return;
       started = true;
       startUrl = d.url;
       committed = false;
     };
     const onCommitted = (d) => {
-      if (isTop(d)) committed = true;
+      if (!isTop(d)) return;
+      const redirected = d.transitionQualifiers.some((q) => q === "server_redirect" || q === "client_redirect");
+      if (destination && (!started || d.url !== startUrl && !redirected)) return;
+      startUrl = d.url;
+      committed = true;
     };
     const onDom = (d) => {
-      if (isTop(d) && committed && waitUntil === "domcontentloaded") done();
+      if (isTop(d) && committed && (!destination || d.url === startUrl) && waitUntil === "domcontentloaded") done();
     };
     const onCompleted = (d) => {
-      if (isTop(d) && committed) reached();
+      if (isTop(d) && committed && (!destination || d.url === startUrl)) reached();
     };
     const onSameDoc = (d) => {
-      if (isTop(d)) done();
+      if (isTop(d) && (!destination || d.url === destination)) done();
     };
     const onError = (d) => {
       if (!isTop(d) || !started) return;
@@ -1458,7 +1472,7 @@
     const found = await execOp(tabId, { op: "measure", selector: selector ?? null }, frameIds);
     const top = selector && frameIds && frameIds.length > 0 ? await execOp(tabId, { op: "measure", selector: null }) : found;
     return {
-      dims: top.dims,
+      dims: { ...top.dims, zoom: await chrome.tabs.getZoom(tabId) },
       element: found.element ?? null,
       missing: found.missing === true
     };
@@ -1504,6 +1518,43 @@
       fullHeight: plan.fullHeight
     };
   }
+  var SETTLE_MS = 5e3;
+  var SETTLE_QUIET_MS = 400;
+  async function waitForSettled(tabId, quietMs = 0) {
+    const deadline = Date.now() + SETTLE_MS;
+    let last = "";
+    let since = Date.now();
+    while (Date.now() < deadline) {
+      const t = await chrome.tabs.get(tabId).catch(() => null);
+      if (!t) return;
+      const state = `${t.status}|${t.url}`;
+      if (state !== last) {
+        last = state;
+        since = Date.now();
+      }
+      if (t.status === "complete" && Date.now() - since >= quietMs) return;
+      await delay(100);
+    }
+  }
+  async function pageMoved(tabId, url) {
+    const t = await chrome.tabs.get(tabId).catch(() => null);
+    return !!t && (t.status === "loading" || t.url !== url);
+  }
+  async function scaleShot(dataUrl, width, height, enc) {
+    const raw = dataUrl.split(",")[1] ?? "";
+    if (!(width > 0 && height > 0)) return raw;
+    const bitmap = await createImageBitmap(await (await fetch(dataUrl)).blob());
+    if (Math.abs(bitmap.width - width) <= 1) return raw;
+    const canvas = new OffscreenCanvas(width, height);
+    canvas.getContext("2d")?.drawImage(bitmap, 0, 0, width, height);
+    const blob = await canvas.convertToBlob(
+      enc.format === "jpeg" ? { type: "image/jpeg", quality: enc.quality / 100 } : { type: "image/png" }
+    );
+    const bytes = new Uint8Array(await blob.arrayBuffer());
+    let bin = "";
+    for (let i = 0; i < bytes.length; i += 32768) bin += String.fromCharCode(...bytes.subarray(i, i + 32768));
+    return btoa(bin);
+  }
   async function screenshotViaVisibleTab(tabId, fullPage, enc) {
     let t = await chrome.tabs.get(tabId);
     let restore;
@@ -1532,8 +1583,11 @@
     );
     const viewportH = dims?.h ?? 0;
     const fullH = dims?.full ?? viewportH;
+    const scale = enc.scale ?? DEFAULT_SCREENSHOT_SCALE;
+    const out = Math.round((dims?.w ?? 0) * scale);
+    const outH = Math.round(viewportH * scale);
     return {
-      dataBase64: dataUrl.split(",")[1] ?? "",
+      dataBase64: await scaleShot(dataUrl, out, outH, enc).catch(() => dataUrl.split(",")[1] ?? ""),
       mimeType: enc.format === "jpeg" ? "image/jpeg" : "image/png",
       width: dims?.w ?? 0,
       height: viewportH,
@@ -1722,7 +1776,7 @@
             return { id: created.id, reused: false, needsNav: url !== void 0 };
           });
           if (claim.needsNav) {
-            const nav = armNavigationWait(claim.id, "load", 25e3);
+            const nav = armNavigationWait(claim.id, "load", 25e3, url);
             await chrome.tabs.update(claim.id, { url }).catch((err) => {
               nav.cancel();
               throw err;
@@ -1745,7 +1799,7 @@
         case "navigate": {
           const id = await targetTab2(cmd);
           const url = String(cmd.params.url);
-          const nav = armNavigationWait(id, waitUntilOf(cmd));
+          const nav = armNavigationWait(id, waitUntilOf(cmd), 3e4, url);
           await chrome.tabs.update(id, { url }).catch((err) => {
             nav.cancel();
             throw err;
@@ -2062,9 +2116,24 @@
           if (selector && !await waitForSelector(id, selector, frameIds, READ_WAIT_MS)) {
             throw notFound(selector, await execOp(id, { op: "waitSelector", selector, timeoutMs: 0 }, frameIds));
           }
-          try {
+          await waitForSettled(id);
+          const shoot = async () => {
+            const at = (await chrome.tabs.get(id)).url;
+            if (at) this.assertAllowed(at, "screenshot");
+            const shot = await screenshotViaDebugger(id, fullPage, enc, selector, frameIds).catch(async (err) => {
+              if (!await pageMoved(id, at)) throw err;
+              return null;
+            });
+            if (shot && !await pageMoved(id, at)) return shot;
+            await waitForSettled(id, SETTLE_QUIET_MS);
+            const now = (await chrome.tabs.get(id)).url;
+            if (now) this.assertAllowed(now, "screenshot");
             return await screenshotViaDebugger(id, fullPage, enc, selector, frameIds);
+          };
+          try {
+            return await shoot();
           } catch (err) {
+            if (err instanceof CmdError && err.code === "POLICY_DENIED") throw err;
             if (err instanceof CmdError && (err.code === "SELECTOR_NOT_FOUND" || err.code === "TIMEOUT")) throw err;
             return await screenshotViaVisibleTab(id, fullPage, enc);
           }
@@ -2536,7 +2605,7 @@
           delete marked[tabId];
         } else {
           await unpaint(tabId, marked[tabId]);
-          marked[tabId] = await paint(tabId);
+          marked[tabId] = this.capturing.has(tabId) ? "" : await paint(tabId);
         }
         await saveMarked(marked);
       });
@@ -2554,11 +2623,10 @@
       if (tabId === null) return fn();
       const css = await this.locked(async () => {
         const c = (await loadMarked())[tabId] ?? "";
-        if (c) this.capturing.set(tabId, (this.capturing.get(tabId) ?? 0) + 1);
+        this.capturing.set(tabId, (this.capturing.get(tabId) ?? 0) + 1);
         await unpaint(tabId, c);
         return c;
       });
-      if (!css) return fn();
       try {
         return await fn();
       } finally {
@@ -2566,7 +2634,7 @@
           const left = (this.capturing.get(tabId) ?? 1) - 1;
           if (left > 0) return void this.capturing.set(tabId, left);
           this.capturing.delete(tabId);
-          if ((await loadMarked())[tabId] !== css) return;
+          if (!css || (await loadMarked())[tabId] !== css) return;
           await bounded(chrome.scripting.insertCSS({ target: { tabId }, css, origin: "USER" }), void 0);
         });
       }

package/extension-dist/manifest.json

@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "MCP Browser Extension – AI agent in your logged-in Chrome",
-  "version": "0.9.30",
+  "version": "0.9.31",
   "description": "Lets your AI agent use the Chrome you are signed into, through a local MCP server. Deny-all by default.",
   "homepage_url": "https://mcp-browser-extension.com",
   "minimum_chrome_version": "116",

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "mcp-browser-extension",
   "mcpName": "io.github.Mehmoodqureshi/mcp-browser-extension",
-  "version": "0.9.30",
+  "version": "0.9.31",
   "description": "Drive your real Chrome browser over MCP — real logins, real cookies. A stdio MCP server (CLI) plus an MV3 extension, driving Chrome via chrome.scripting/chrome.tabs. Multi-tab batch automation, accessibility snapshots, deny-all security by default.",
   "author": "Mehmood Ur Rehman Qureshi",
   "license": "MIT",