registry / AI-agent control-surface risk / browser-control-mcp-server

browser-control-mcp-server

MCP server that gives AI agents full browser control — navigate, click, type, scroll, screenshot, inspect DOM, and read console logs in both headless Puppeteer and real Chrome browser.

This report shows the evidence for browser-control-mcp-server@1.5.0, the only known version.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

The automatic postinstall chain persistently alters multiple third-party AI-client configurations to launch this package. This meets the policy for unconsented broad AI-agent control-surface mutation despite no observed network exfiltration.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm installation runs the postinstall lifecycle hook.

Impact

Unconsented persistence in foreign AI-agent control surfaces and automatic future execution of the package server.

Mechanism

Postinstall discovery and rewriting of broad third-party AI-client configurations.

Policy narrative

On npm installation, package.json starts scripts/postinstall.js, which calls setupClients. The setup code searches existing configurations for Claude Desktop, Claude Code, Cursor, VS Code variants, Cline, Cody, Zed, Continue, OpenCode, and Roo Code. It rewrites found files to add a browser-control MCP command pointing into this package, deliberately overwriting an existing entry. This is automatic mutation of broad, foreign AI-agent control surfaces without an explicit user setup action.

AI rationale

Evidence

package.jsonscripts/postinstall.jsscripts/setup.js~/.claude.json~/.cursor/mcp.jsonVS Code User/mcp.jsonZed settings.json

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 99.0% confidence with low false-positive risk.

Evidence for policy risk

The package runs a postinstall hook automatically.
The postinstall hook invokes client setup.
Setup discovers and rewrites existing configuration files for many unrelated AI clients.
It inserts a command that launches this package's server and overwrites any existing entry.

Evidence against

The inspected installer code makes no outbound network request or credential upload.
The shell commands only locate installed browser or client executables.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 53 file(s), 231 KB of source, external domains: 127.0.0.1, example.com, shop.example.com, www.google.com

Source & flagged code

4 flagged

package.jsonView file

Lines 1-45json

2 "name": "browser-control-mcp-server",

3 "version": "1.5.0",

4 "description": "MCP server that gives AI agents full browser control — navigate, click, type, scroll, screenshot, inspect DOM, and read console logs in both headless Puppeteer and real Chrome browser.",

5 "type": "module",

6 "main": "dist/index.js",

7 "bin": {

8 "browser-control-mcp-server": "dist/index.js"

9 },

10 "files": [

11 "dist",

12 "scripts",

13 "config.json",

14 "LICENSE",

15 "README.md",

16 "CHANGELOG.md"

17 ],

18 "scripts": {

19 "build": "tsc",

20 "dev": "tsx src/index.ts",

21 "test": "node --experimental-vm-modules node_modules/.bin/jest && node scripts/setup.test.js",

22 "test:watch": "node --experimental-vm-modules node_modules/.bin/jest --watch",

23 "test:setup": "node scripts/setup.test.js",

24 "lint": "eslint src --ext .ts",

25 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L25

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L25

26 "prepublishOnly": "npm run build"

27 },

High

Suspicious Lifecycle Evidence

The package runs a postinstall hook automatically.

package.jsonView on unpkg · L18

28 "keywords": [

29 "mcp",

30 "browser",

31 "automation",

32 "puppeteer",

33 "chrome",

34 "cdp",

35 "chrome-devtools-protocol",

36 "screenshot",

37 "headless",

38 "browser-control",

39 "model-context-protocol",

40 "claude",

41 "ai-agent",

42 "web-automation",

43 "dom-inspection",

44 "testing"

45 ],

scripts/setup.jsView file

Lines 1-39javascript

1#!/usr/bin/env node

3/**

4 * Auto-setup: detects installed AI clients and injects the browser-control

5 * MCP server entry into each one's config file.

6 * Called from postinstall.js after Chrome detection.

7 *

8 * DYNAMIC DETECTION STRATEGY:

9 * For each client we check ALL known config paths (across OS versions, install

10 * methods, and version changes). Every path that exists gets updated — so if a

11 * user has multiple installs (stable + insiders, brew + direct, etc.) all are

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

18"scripts": { "build": "tsc", "dev": "tsx src/index.ts", "test": "node --experimental-vm-modules node_modules/.bin/jest && node scripts/setup.test.js", "test:watch": "node --experimental-vm-modules node_modules/.bin/jest --watch", "test:setup": "node scripts/setup.test.js", "lint": "eslint src --ext .ts", "postinstall": "node scripts/postinstall.js", "prepublishOnly": "npm run build" }

High

Suspicious Lifecycle Evidence

The package runs a postinstall hook automatically.

package.jsonView on unpkg · L18

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

Findings

1 Critical2 High4 Medium5 Low

CriticalAi Agent Control Hijackscripts/setup.js

HighInstall Time Lifecycle Scriptspackage.json

HighSuspicious Lifecycle Evidencepackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to browser-control-mcp-server@1.5.0.

The versions list below shows the verdict for each recorded version.

Avoid installing browser-control-mcp-server@1.5.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-12 13:24:30.712Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

1 known version

1.5.0latestshownMaliciousSoft block: AI-agent control surfaceBlockPublishedSep 10, 2026, 10:48 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other AI-agent control-surface risk packages

Runtime surface

Behavioral surface

Source & flagged code

Related packages

Other AI-agent control-surface risk packages