registry / gemini-browser-mcp / 1.1.3

gemini-browser-mcp@1.1.3

MCP server that bridges Claude Code to Google Gemini via a Chrome extension

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessFilesystemShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 10.5 KB of source, external domains: gemini.google.com, github.com

Source & flagged code

3 flagged

server.jsView file

Lines 1-30javascript

1#!/usr/bin/env node

2import { Server } from "@modelcontextprotocol/sdk/server/index.js";

3import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";

4import {

5 CallToolRequestSchema,

6 ListToolsRequestSchema,

7} from "@modelcontextprotocol/sdk/types.js"

Source & flagged code

3 flagged · loading source

server.jsView file

10import path from "path"; L11: import { execSync } from "child_process"; L12:

High

Child Process

Package source references child process execution.

server.jsView on unpkg · L10

cli.jsView file

27L28: const { execSync } = await import('child_process'); L29: ... L31: execSync( L32: 'claude mcp add gemini-browser-mcp -- npx gemini-browser-mcp start', L33: { stdio: 'inherit', timeout: 30000 }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

cli.jsView on unpkg · L27

package.jsonView file

•scripts registry_only=start

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg

Findings

1 Critical3 High1 Medium3 Low

CriticalManifest Confusionpackage.json

HighChild Processserver.js

HighShell

HighRuntime Package Installcli.js

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

cli.jsView file

Lines 7-47javascript

7 import('./server.js').catch((err) => {

8 console.error('Failed to start server:', err);

9 process.exit(1);

10 });

11} else {

12 // ── Setup wizard ──────────────────────────────────────────

13 console.log('');

14 console.log('╔══════════════════════════════════════════════╗');

15 console.log('║ gemini-browser-mcp Setup ║');

16 console.log('╚══════════════════════════════════════════════╝');

17 console.log('');

19 // For now, only Claude Code is supported

20 console.log('Which CLI would you like to configure?');

21 console.log('');

22 console.log(' 1. Claude Code (default)');

23 console.log('');

24 console.log(' GitHub: https://github.com/Walkoud/gemini-browser-mcp');

25 console.log('');

26 console.log('→ Configuring Claude Code...');

28 const { execSync } = await import('child_process');

30 try {

31 execSync(

32 'claude mcp add gemini-browser-mcp -- npx gemini-browser-mcp start',

33 { stdio: 'inherit', timeout: 30000 }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

cli.jsView on unpkg · L27

34 );

36 console.log('');

37 console.log(' ✓ Claude Code configured successfully!');

38 console.log('');

39 console.log(' Next steps:');

40 console.log(' 1. Download the Chrome extension:');

41 console.log(' https://github.com/Walkoud/gemini-browser-mcp');

42 console.log(' 2. Load it in Chrome at chrome://extensions/ (as unpacked)');

43 console.log(' 3. Open https://gemini.google.com and log in');

44 console.log(' 4. Restart Claude Code');

45 console.log('');

46 } catch (err) {

47 console.error('');