safari-mcp 2.5.2 → 2.6.0

package/README.md

@@ -1,19 +1,31 @@
 <div align="center">
 
+<picture>
+  <source media="(prefers-color-scheme: dark)" srcset="assets/banner.svg">
+  <source media="(prefers-color-scheme: light)" srcset="assets/banner.svg">
+  <img src="assets/banner.svg" alt="Safari MCP — Native browser automation for AI agents" width="100%">
+</picture>
+
+<br/>
+
 # 🦁 Safari MCP
 
 **The only MCP server for Safari — native browser automation for AI agents.**
 
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
 [![GitHub release](https://img.shields.io/github/v/release/achiya-automation/safari-mcp)](https://github.com/achiya-automation/safari-mcp/releases)
+[![npm version](https://img.shields.io/npm/v/safari-mcp)](https://www.npmjs.com/package/safari-mcp)
+[![npm downloads](https://img.shields.io/npm/dm/safari-mcp)](https://www.npmjs.com/package/safari-mcp)
+[![CI](https://github.com/achiya-automation/safari-mcp/actions/workflows/ci.yml/badge.svg)](https://github.com/achiya-automation/safari-mcp/actions/workflows/ci.yml)
 [![Node.js](https://img.shields.io/badge/Node.js-18%2B-green)](https://nodejs.org/)
 [![macOS](https://img.shields.io/badge/macOS-only-blue)](https://www.apple.com/macos/)
 [![MCP](https://img.shields.io/badge/MCP-compatible-purple)](https://modelcontextprotocol.io)
-[![CI](https://github.com/achiya-automation/safari-mcp/actions/workflows/ci.yml/badge.svg)](https://github.com/achiya-automation/safari-mcp/actions/workflows/ci.yml)
-[![npm downloads](https://img.shields.io/npm/dm/safari-mcp)](https://www.npmjs.com/package/safari-mcp)
 [![GitHub stars](https://img.shields.io/github/stars/achiya-automation/safari-mcp?style=social)](https://github.com/achiya-automation/safari-mcp/stargazers)
 [![achiya-automation/safari-mcp MCP server](https://glama.ai/mcp/servers/achiya-automation/safari-mcp/badges/score.svg)](https://glama.ai/mcp/servers/achiya-automation/safari-mcp)
 
+<a href="vscode:mcp/install?%7B%22safari-mcp%22%3A%7B%22command%22%3A%22npx%22%2C%22args%22%3A%5B%22safari-mcp%22%5D%7D%7D"><img src="https://img.shields.io/badge/VS_Code-Install_MCP_Server-0078d4?logo=visual-studio-code&logoColor=white" alt="Install in VS Code"></a>
+<a href="https://insiders.vscode.dev/redirect?url=vscode-insiders:mcp/install?%7B%22safari-mcp%22%3A%7B%22command%22%3A%22npx%22%2C%22args%22%3A%5B%22safari-mcp%22%5D%7D%7D"><img src="https://img.shields.io/badge/VS_Code_Insiders-Install_MCP_Server-24bfa5?logo=visual-studio-code&logoColor=white" alt="Install in VS Code Insiders"></a>
+
 **80 tools** · **Zero dependencies** · **~5ms per command** · **60% less CPU than Chrome**
 
 [Quick Start](#quick-start) · [All 80 Tools](#tools-80) · [Examples](examples/) · [Why Safari MCP?](#safari-mcp-vs-alternatives) · [Architecture](#architecture) · [Changelog](CHANGELOG.md)

package/extension/background.js

@@ -198,6 +198,17 @@ async function handleCommand(type, payload) {
     throw new Error("Tab belongs to a different profile — refusing to operate on personal tabs");
   }
 
+  // ========== TAB OWNERSHIP GUARD ==========
+  // Block write operations on tabs not opened by this session.
+  // new_tab is always allowed (it creates owned tabs). Read-only ops are allowed on any tab.
+  if (type !== "new_tab" && !_readOnlyCommands.has(type) && !_isTabOwnedBySession(sessionId, tabId)) {
+    const anyOwned = _sessionOwnedTabs.has(sessionId) && _sessionOwnedTabs.get(sessionId).size > 0;
+    if (anyOwned) {
+      throw new Error(`⚠️ Tab safety: refusing "${type}" on tab ${tabId} (${targetTab.url || 'unknown'}) — not opened by this MCP session. Use safari_new_tab first.`);
+    }
+    // If no tabs owned yet, allow operation (backward compatibility for sessions that don't use new_tab)
+  }
+
   switch (type) {
     // --- Navigation ---
     case "navigate": {
@@ -1018,6 +1029,8 @@ async function handleCommand(type, payload) {
       // Use the requested URL (not updated.url) when page hasn't loaded yet (still about:blank)
       const trackUrl = (updated.url && updated.url !== "about:blank") ? updated.url : (payload.url || updated.url);
       _setSessionTab(sessionId, updated.id, trackUrl);
+      // Register tab as owned by this session
+      _addOwnedTab(sessionId, updated.id);
       return { title: updated.title, url: updated.url, tabIndex: updated.index + 1 };
     }
 
@@ -1026,8 +1039,12 @@ async function handleCommand(type, payload) {
         const query = _profileWindowId ? { windowId: _profileWindowId } : { currentWindow: true };
         const tabs = await browser.tabs.query(query);
         const target = tabs[payload.index - 1];
-        if (target) await browser.tabs.remove(target.id);
+        if (target) {
+          _removeOwnedTab(sessionId, target.id);
+          await browser.tabs.remove(target.id);
+        }
       } else {
+        _removeOwnedTab(sessionId, tabId);
         await browser.tabs.remove(tabId);
       }
       return "Tab closed";
@@ -1616,6 +1633,42 @@ const _DEFAULT_SESSION = "__default__"; // Fallback for commands without session
 const SESSION_MAX_AGE_MS = 5 * 60 * 1000; // 5 min — prune stale sessions
 const MAX_SESSIONS = 50; // Hard cap on session cache size
 
+// ========== TAB OWNERSHIP: track tabs opened by each MCP session ==========
+// Prevents operating on user's tabs — only tabs created via new_tab are "owned".
+const _sessionOwnedTabs = new Map(); // sessionId → Set<tabId>
+
+function _addOwnedTab(sessionId, tabId) {
+  const sid = sessionId || _DEFAULT_SESSION;
+  if (!_sessionOwnedTabs.has(sid)) _sessionOwnedTabs.set(sid, new Set());
+  _sessionOwnedTabs.get(sid).add(tabId);
+}
+
+function _removeOwnedTab(sessionId, tabId) {
+  const sid = sessionId || _DEFAULT_SESSION;
+  const set = _sessionOwnedTabs.get(sid);
+  if (set) set.delete(tabId);
+}
+
+function _isTabOwnedBySession(sessionId, tabId) {
+  const sid = sessionId || _DEFAULT_SESSION;
+  const set = _sessionOwnedTabs.get(sid);
+  return set ? set.has(tabId) : false;
+}
+
+// Read-only commands that don't modify the page — allowed on any tab
+const _readOnlyCommands = new Set([
+  "list_tabs", "read_page", "get_source", "snapshot", "accessibility_snapshot",
+  "get_element", "query_all", "screenshot", "screenshot_element",
+  "console_messages", "network_requests", "list_console_messages",
+  "list_network_requests", "get_console_message", "get_network_request",
+  "start_console", "start_network_capture", "network", "network_details",
+  "console_filter", "performance_metrics", "css_coverage", "get_computed_style",
+  "extract_images", "extract_links", "extract_meta", "extract_tables",
+  "get_cookies", "local_storage", "session_storage",
+  "get_indexed_db", "list_indexed_dbs", "detect_forms",
+  "save_pdf", "analyze_page",
+]);
+
 function _getSessionCache(sessionId) {
   const sid = sessionId || _DEFAULT_SESSION;
   if (!_sessionTabCache.has(sid)) {

package/index.js

@@ -59,11 +59,45 @@ const WEBKIT_MEMORY_LIMIT_MB = parseInt(process.env.MCP_WEBKIT_LIMIT_MB || "3000
 // Track tabs opened by THIS session (index → {url, openedAt})
 const _openedTabs = new Map();
 
+// ========== TAB OWNERSHIP: prevent operating on user's tabs ==========
+// Tracks URLs of tabs opened by this MCP session.
+// Any tool that modifies a tab (navigate, click, fill, etc.) is blocked
+// unless the current tab was opened via safari_new_tab.
+const _ownedTabURLs = new Set();
+
+function _isURLOwned(url) {
+  if (!url) return false;
+  if (_ownedTabURLs.has(url)) return true;
+  // Match ignoring query params / fragments (URL may change slightly after load)
+  const urlBase = url.split('?')[0].split('#')[0];
+  for (const owned of _ownedTabURLs) {
+    const ownedBase = owned.split('?')[0].split('#')[0];
+    if (urlBase === ownedBase) return true;
+  }
+  return false;
+}
+
+function _addOwnedURL(url) {
+  if (url && url !== 'about:blank' && url !== 'favorites://') _ownedTabURLs.add(url);
+}
+
+function _removeOwnedURL(url) {
+  if (url) _ownedTabURLs.delete(url);
+}
+
+function _updateOwnedURL(oldUrl, newUrl) {
+  _removeOwnedURL(oldUrl);
+  _addOwnedURL(newUrl);
+}
+
 function _trackTab(tabIndex, url) {
   _openedTabs.set(tabIndex, { url: url || "", openedAt: Date.now() });
+  _addOwnedURL(url);
 }
 
 function _untrackTab(tabIndex) {
+  const info = _openedTabs.get(tabIndex);
+  if (info?.url) _removeOwnedURL(info.url);
   _openedTabs.delete(tabIndex);
 }
 
@@ -539,9 +573,43 @@ const _nullMeansFailure = new Set([
   // CSP fallback is handled separately via isCspError check.
 ]);
 
+// Operations that don't need tab ownership (read-only or tab management)
+const _noOwnershipCheck = new Set([
+  // Tab management
+  "new_tab", "list_tabs", "close_tab", "switch_tab",
+  // Read-only — don't modify the page
+  "read_page", "get_source", "snapshot", "accessibility_snapshot",
+  "get_element", "query_all", "screenshot", "screenshot_element",
+  "get_console", "list_console_messages", "start_console",
+  "get_network", "list_network_requests", "start_network_capture",
+  "network", "network_details", "console_filter",
+  "performance_metrics", "css_coverage", "get_computed_style",
+  "extract_images", "extract_links", "extract_meta", "extract_tables",
+  "get_cookies", "local_storage", "session_storage",
+  "get_indexed_db", "list_indexed_dbs", "detect_forms",
+  "save_pdf", "analyze_page",
+]);
+
 // Try extension first, fall back to AppleScript.
 // When SAFARI_PROFILE is set, skip extension entirely — AppleScript doesn't steal focus.
 async function extensionOrFallback(extensionType, extensionPayload, fallbackFn) {
+  // ========== TAB OWNERSHIP GUARD ==========
+  // Block operations on tabs not opened by this MCP session.
+  // Once any tab has been opened via new_tab, ALL subsequent operations
+  // must target an owned tab. This prevents navigating/clicking in user's tabs.
+  if (!_noOwnershipCheck.has(extensionType)) {
+    const currentUrl = safari.getActiveTabURL();
+    if (_ownedTabURLs.size === 0) {
+      // No tabs opened yet — block everything except read-only ops
+      const msg = `⚠️ Tab safety: no tabs opened yet. Call safari_new_tab first before "${extensionType}".`;
+      console.error(`[Safari MCP] ${msg}`);
+      throw new Error(msg);
+    } else if (currentUrl && !_isURLOwned(currentUrl)) {
+      const msg = `⚠️ Tab safety: refusing "${extensionType}" — current tab (${currentUrl}) was not opened by this MCP session. Use safari_new_tab or safari_switch_tab to target your own tab.`;
+      console.error(`[Safari MCP] ${msg}`);
+      throw new Error(msg);
+    }
+  }
   if (_extensionConnected && !_preferAppleScript) {
     try {
       const t0 = Date.now();
@@ -587,10 +655,13 @@ server.tool(
   "Navigate to a URL in Safari. Waits for page to fully load.",
   { url: z.string().describe("URL to navigate to") },
   async ({ url }) => {
+    const oldUrl = safari.getActiveTabURL();
     const result = await extensionOrFallback(
       "navigate", { url },
       () => safari.navigate(url)
     );
+    // Update ownership: old URL → new URL (tab is still ours, just different URL)
+    if (oldUrl) _updateOwnedURL(oldUrl, url);
     return { content: [{ type: "text", text: typeof result === 'string' ? result : JSON.stringify(result) }] };
   }
 );
@@ -681,6 +752,7 @@ server.tool(
     timeout: z.coerce.number().optional().describe("Load timeout in ms (default: 30000)"),
   },
   async ({ url, maxLength, timeout }) => {
+    const oldUrl = safari.getActiveTabURL();
     const result = await extensionOrFallback(
       "navigate_and_read", { url, maxLength, timeout },
       async () => {
@@ -688,6 +760,8 @@ server.tool(
         return safari.readPage({ maxLength });
       }
     );
+    // Update ownership: old URL → new URL
+    if (oldUrl) _updateOwnedURL(oldUrl, url);
     return { content: [{ type: "text", text: typeof result === "string" ? result : JSON.stringify(result) }] };
   }
 );
@@ -1053,6 +1127,8 @@ server.tool(
     }
     if (result?.url) {
       safari.setActiveTabURL(result.url);
+      // Also register actual URL (may differ from requested due to redirects)
+      _addOwnedURL(result.url);
     }
     return { content: [{ type: "text", text: typeof result === 'string' ? result : JSON.stringify(result) }] };
   }
@@ -1075,6 +1151,20 @@ server.tool(
   "Switch to a specific tab by index (use safari_list_tabs to see indices). All subsequent commands (click, fill, evaluate, screenshot, scroll) will target this tab. If commands seem to run on the wrong tab, call switch_tab again to re-anchor.",
   { index: z.coerce.number().describe("Tab index (starting from 1)") },
   async ({ index }) => {
+    // Tab ownership check: verify target tab is one we opened
+    if (_ownedTabURLs.size > 0) {
+      // Get target tab's URL via list_tabs before switching
+      try {
+        const tabs = await safari.listTabs();
+        const parsed = typeof tabs === 'string' ? JSON.parse(tabs) : tabs;
+        const target = parsed.find(t => t.index === index);
+        if (target && target.url && !_isURLOwned(target.url)) {
+          const msg = `⚠️ Tab safety: refusing switch_tab to index ${index} (${target.url}) — not opened by this MCP session. Use safari_new_tab to open your own tab.`;
+          console.error(`[Safari MCP] ${msg}`);
+          return { content: [{ type: "text", text: msg }], isError: true };
+        }
+      } catch {}
+    }
     const result = await extensionOrFallback(
       "switch_tab", { index },
       () => safari.switchTab(index)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "safari-mcp",
-  "version": "2.5.2",
+  "version": "2.6.0",
   "mcpName": "io.github.achiya-automation/safari-mcp",
   "description": "Safari browser automation for AI agents — native macOS, zero Chrome overhead. 80 tools via AppleScript + JavaScript.",
   "type": "module",

package/safari.js

@@ -97,7 +97,7 @@ process.on("uncaughtException", (err) => { console.error("Uncaught:", err); clea
 let _activeTabIndex = null; // null = use front document (default)
 let _activeTabURL = null;   // URL-based tracking (stable even when tabs shift)
 let _lastResolveTime = 0;   // Cache: skip resolve if verified recently
-const RESOLVE_CACHE_MS = 1500; // Re-verify tab every 1.5 seconds (was 5s — too stale)
+const RESOLVE_CACHE_MS = 0; // Always re-verify — cached indices go stale when tabs open/close
 
 // ========== DIAGNOSTIC LOG ==========
 // File-based log for profile/focus issues — survives MCP restart, visible to user