smooth-operator-mcp 2.4.10 → 3.0.0

package/.env.example

@@ -5,16 +5,21 @@ SMOOTH_OPERATOR_DATA_DIR=~/.smooth-operator
 # ~/.smooth-operator/config.json is loaded automatically when this is unset.
 # SMOOTH_OPERATOR_CONFIG=~/.smooth-operator/config.json
 
-# Managed agent Chrome is the zero-setup default. It discovers Google Chrome,
+# Managed browser mode is the zero-setup default. It discovers a Chromium-based browser,
 # then creates one private persistent profile under SMOOTH_OPERATOR_DATA_DIR.
 SMOOTH_OPERATOR_BROWSER_MODE=managed
 # For an advanced DevTools connection, use mode=connect and set this endpoint.
 # SMOOTH_OPERATOR_BROWSER_MODE=connect
 # SMOOTH_OPERATOR_BROWSER_URL=http://127.0.0.1:9222
+# SMOOTH_OPERATOR_BROWSER_WS_ENDPOINT=ws://127.0.0.1:9222/devtools/browser/<id>
 # For explicit launch mode, set a Chromium/Chrome executable.
 # SMOOTH_OPERATOR_BROWSER_MODE=launch
 # SMOOTH_OPERATOR_BROWSER_EXECUTABLE=/path/to/chrome
 # SMOOTH_OPERATOR_BROWSER_HEADLESS=true
+# Optional explicit viewport (both values must be set together). Stealth uses
+# these same dimensions for its launch argument and guarded page metrics.
+# SMOOTH_OPERATOR_BROWSER_VIEWPORT_WIDTH=1280
+# SMOOTH_OPERATOR_BROWSER_VIEWPORT_HEIGHT=720
 # SMOOTH_OPERATOR_BROWSER_USER_DATA_DIR=~/.smooth-operator/browser
 # SMOOTH_OPERATOR_BROWSER_AUTO_LAUNCH=false
 # Test-only opt-in live suite override (the CI script discovers Chrome itself).
@@ -30,10 +35,22 @@ SMOOTH_OPERATOR_MAX_HTML_CHARS=200000
 SMOOTH_OPERATOR_ALLOWED_DOMAINS=
 SMOOTH_OPERATOR_BLOCKED_DOMAINS=
 SMOOTH_OPERATOR_ALLOW_PRIVATE_NETWORK=false
-SMOOTH_OPERATOR_ALLOW_EVAL=false
-# File uploads and generated PDFs stay inside these private roots by default.
+SMOOTH_OPERATOR_ALLOW_EVAL=true
+# Set false for a stricter profile. File uploads and generated PDFs stay inside
+# these private roots by default.
 # SMOOTH_OPERATOR_ALLOWED_FILE_ROOTS=~/.smooth-operator/files,~/.smooth-operator/downloads
 
+# Optional automation-control baseline. The native default is enabled; set false
+# to preserve raw browser automation signals.
+# SMOOTH_OPERATOR_STEALTH_ENABLED=true
+# Stealth profile: balanced (default) | max (accepted compatibility names; same supported patch set)
+# SMOOTH_OPERATOR_STEALTH_PROFILE=balanced
+# Add opt-in GPU launch flags (does not make an identity/coherence guarantee)
+# SMOOTH_OPERATOR_STEALTH_GPU=false
+# Behavioral realism defaults on with short bounded timing; set false for the
+# fastest raw interaction path or override to decouple from stealth.
+# SMOOTH_OPERATOR_BEHAVIOR_ENABLED=true
+
 # HTTP is opt-in; use a strong token before enabling remote access
 # SMOOTH_OPERATOR_TRANSPORT=http
 # SMOOTH_OPERATOR_HTTP_HOST=127.0.0.1
@@ -44,5 +61,9 @@ SMOOTH_OPERATOR_ALLOW_EVAL=false
 # SMOOTH_OPERATOR_HTTP_MAX_BODY_BYTES=2000000
 # SMOOTH_OPERATOR_ALLOWED_HOSTS=localhost,127.0.0.1,[::1]
 # SMOOTH_OPERATOR_ALLOWED_ORIGINS=localhost,127.0.0.1,[::1]
+# Hard concurrency caps (constants, not env-configurable): max 32 concurrent
+# requests and max 8 concurrent long-lived SSE/subscription connections.
+# MAX_HTTP_CONCURRENCY=32
+# MAX_HTTP_STREAM_CONCURRENCY=8
 
 SMOOTH_OPERATOR_LOG_LEVEL=info

package/README.md

@@ -27,9 +27,9 @@ Or straight from GitHub:
 npm install -g github:Gitshop77/Smooth-Operator && smooth-operator install opencode
 ~~~
 
-The wizard asks 7 focused questions covering browser mode, executable, headless operation, domain policy, page JavaScript, and the data directory. Run `smooth-operator install` with no harness to pick one interactively (TTY only; piped/CI runs print usage and exit). `--yes` applies the recommended defaults, so give it a target: `smooth-operator install opencode --yes`. Personal Chrome mode launches a dedicated debugging profile on `9222` and derives `browserUrl` automatically.
+The wizard asks exactly 3 focused questions: browser profile ownership, browser display, and the Chromium executable. Run `smooth-operator install` with no harness to pick one interactively (TTY only; piped/CI runs print usage and exit). `--yes` applies the recommended defaults, so give it a target: `smooth-operator install opencode --yes`. Personal Chrome mode launches a dedicated debugging profile on `9222` and derives `browserUrl` automatically. Managed mode owns one private persistent profile; connected mode launches and attaches to a dedicated debugging profile and does not claim ownership of an operator's daily browser.
 
-Requires Node 22.23.2+ and Chrome. Profile at `~/.smooth-operator/browser` — sign in once.
+Requires Node 22.23.2+ and an installed Chromium-based browser. Profile at `~/.smooth-operator/browser` — sign in once.
 
 Verify: `smooth-operator --help` and `server_health` / `browser_doctor` appear after restart.
 
@@ -44,12 +44,20 @@ Ask: *“Scrape pricing into a table”*, *“Fill this form with ~/resume.pdf
 
 ## How to use
 
-Talk to your harness normally. It can call `browser_navigate` → `browser_snapshot` → `browser_click` and the rest of the MCP surface as needed. Logins and CAPTCHA challenges pause for human handoff in the Chrome window.
+Talk to your harness normally. It can call `browser_navigate` → `browser_snapshot` → `browser_click` and the rest of the MCP surface as needed. For a challenge, `browser_solve_challenge` returns fresh bounded visual/state evidence for the connected AI; the AI uses ordinary browser actions and calls it again to verify the final classification. Human handoff remains available for logins or challenges that require the user.
+
+Stealth and short behavioral timing are enabled in the recommended native profile. Page JavaScript is also available by default; set the explicit environment flags to `false` when a stricter profile is needed. See `docs/STEALTH-GUIDE.md` for details and responsible use.
+
+For the fastest supported operation, keep behavioral timing off with
+`SMOOTH_OPERATOR_BEHAVIOR_ENABLED=false`; the native browser remains bounded and
+cancellable. All local browser tools and page features are available by default;
+remote HTTP, private-network access, and file roots remain explicitly gated.
+Faster calls do not bypass challenges or grant permission to automate a site.
 
 ## Why
 
-- Zero setup — managed, headed, persistent Chrome by default
-- Secure by default — domain and file policy, bounded outputs, redaction, and JavaScript disabled unless explicitly enabled
+- Zero setup — managed, headed, persistent browser by default
+- Secure by default — domain and file policy, bounded outputs, redaction, and explicit safety boundaries
 - Reliable — private profiles, stale-reference recovery, reconnect handling, and structured errors
 - Flexible — stdio by default, Streamable HTTP when you need it, plus connect and disabled modes
 
@@ -57,7 +65,7 @@ Talk to your harness normally. It can call `browser_navigate` → `browser_snaps
 
 Compared with [Browser Use MCP](https://github.com/browser-use/browser-use) · [![Browser Use GitHub stars](https://img.shields.io/github/stars/browser-use/browser-use?style=social)](https://github.com/browser-use/browser-use) 
 
-(Date Of Testing -Wednesday 26 August 2026-) 
+Tested: 26 August 2026
 
 | Benchmark | Metric | SmoothOperator | Browser Use MCP |
 | --- | --- | ---: | ---: |
@@ -74,3 +82,8 @@ Compared with [Browser Use MCP](https://github.com/browser-use/browser-use) · [
 | MiniWoB++ | MCP errors | **0** | 29 |
 | MiniWoB++ | Transport errors | **0** | **0** |
 | MiniWoB++ | Timeouts | **0** | **0** |
+| Browser Use benchmark | Muse Spark 1.2 · score | **64% · 100 tasks** | 12% · 60 tasks |
+
+*Task counts and scoring rules differ; comparison is directional.*
+
+[View the Browser Use benchmark](https://github.com/browser-use/benchmark)