Loading npm security reports…
MCP server that gives AI agents full browser control — navigate, click, type, scroll, screenshot, inspect DOM, and read console logs in both headless Puppeteer and real Chrome browser.
LPM flags this version as an AI-agent control-surface risk. Installation silently adds this package as an MCP server to existing AI-client configuration files. Those clients will subsequently launch the package server.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgThe package runs a postinstall hook automatically.
package.jsonView on unpkg · L18Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgSource creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
scripts/setup.jsView on unpkg · L19This report applies to browser-control-mcp-server@1.5.0.
See version security history for other recorded verdicts.
Evidence last updated: .
Package defines install-time lifecycle scripts.
package.jsonView on unpkgThe package runs a postinstall hook automatically.
package.jsonView on unpkg · L18Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgSource creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
scripts/setup.jsView on unpkg · L19