registry / xspace-browser-mcp-bridge / 5.0.1

xspace-browser-mcp-bridge@5.0.1

MCP bridge that connects AI agents (Cursor, Claude Code, VS Code Copilot, etc.) to the xspace-browser browser extension. Auto-spawns a shared daemon to support multiple simultaneous clients.

AI Security Review

scanned 10h ago · by lpm-firewall-ai

Explicit CLI execution starts an authenticated local browser-extension relay. It forwards user-requested MCP browser operations, including powerful browser capabilities, but inspection found no package-initiated external exfiltration or AI-agent configuration mutation.

Static reason

No blocking static signals were detected.

Trigger

User runs one of the package bin commands.

Impact

Can control and inspect the connected browser through advertised MCP tools when explicitly invoked.

Mechanism

Local authenticated WebSocket bridge between MCP clients and the xspace-browser extension.

Rationale

The package implements its stated, explicitly invoked local MCP browser bridge and protects local client paths with a generated token. Its powerful browser tools are package-aligned; no concrete malicious chain, install-time mutation, or external exfiltration was found in the inspected source.

Evidence

package.jsondist/bridge.jsdist/daemon.jsdist/cli.jsdist/chunk-BY3CP7LE.js~/.xspace-browser/bridge-token~/.xspace-browser-daemon.pid

Network endpoints4

ws://localhost:9223/extensionws://localhost:9223/bridgews://localhost:9223/cli127.0.0.1:9223/health

xspace-browser-mcp-bridge@5.0.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code