Skip to main content

​
Installation options

Chrome Web Store version 0.1.1 was submitted on September 8, 2026 and is pending Google’s review. Item ID: mccidpahaojindbbpndolampefbojlek. Automatic public publication is enabled after approval; store approval is not yet granted. Download the 0.1.1 extension ZIP and SHA-256 checksum. Confirm the origin and SHA-256, then extract into a permanent directory. For a local build:
Load the extracted directory containing manifest.json (or dist/extension for source builds) via Chrome’s chrome://extensions → Developer mode → Load unpacked. The ZIP itself is not a load-unpacked directory. Updates to an unpacked build require replacing its files and using Reload on the extension card.

​
Connect to your upstream

For community, configure your self-hosted server’s canonical URL. For managed, explicitly enter https://browser-mcp.click and choose Sign in with GitHub. Installed/submitted 0.1.1 embeds the retired URL: pause, change the upstream in Settings, grant the new host permission, and start a new approval. Do not use its old Managed preset. Old transports fail closed; stored credentials are not migrated automatically. See the migration instructions and legacy risks. Production upstreams should be HTTPS; localhost HTTP is for development. Pairing opens a regular tab for authentication and explicit device approval. Verify the hostname and device name before approving. The extension retains a random verifier; the server receives its SHA-256 challenge. Polling can redeem the credential only with that verifier, only after approval, and only once. Requests expire after ten minutes. The connection token is separate from an MCP bearer token. Never paste an MCP token into the extension. If using a manually provided connection credential, only use the br_ value associated with this browser, not credentials for a different server or browser entry.

​
Permissions and debugger indicator

The extension needs broad browser permissions, including debugger, tab access, local storage, alarms for reconnect, and optional host access to the selected upstream. This can permit reading and changing content on sites you visit, including signed-in sessions. Chrome’s debugger banner is expected during active control; do not hide or work around it.
The debugger permission enables Chrome DevTools Protocol input, screenshots, and JavaScript execution. It is not merely a permission to take screenshots. Tab access reveals titles and URLs; storage persists the connection settings and credential in your local Chrome profile. Optional host access is requested only for the selected upstream; debugger permission supplies page control. The installed extension/manifest.json is the exact permission list; review it for the build you install. Commands only target HTTP(S) pages. Browser internal pages (chrome://), extension pages, file://, DevTools, and the upstream control-plane origin are excluded. These restrictions are not an allowlist for safe websites: other HTTP(S) pages can still contain sensitive accounts and hostile instructions. Debugger attachment is for active commands, not idle monitoring. Commands on the same tab are serialized. Do not run DevTools/debugger automation from another tool on the same tab concurrently; attachments can conflict.

​
Disconnect and revoke

  • Disconnect in the extension stops the browser connection. It is your immediate pause control.
  • Revoke an MCP token in the dashboard removes that client’s authorization without requiring you to share a new connection token.
  • Rotate the browser connection token invalidates the old extension credential and disconnects it. Re-pair or configure the new credential as appropriate.
  • Removing a browser entry ends access to that registration. Remove the extension or its local data if retiring the Chrome profile.
Disconnecting does not automatically expire an MCP token. Revoke unused tokens even when the browser is offline.

​
Common issues

Use a separate Chrome profile when limiting exposure. Browser-scoped tokens are not tab-scoped; ordinary browser profiles are the practical separation boundary in this version.

​
Support and privacy

For the ricsam-published extension and managed preview, contact support@browser-mcp.click. Include your extension version and a description of the issue, not credentials or private page content. Read the privacy policy for data handling and deletion requests. For a self-hosted upstream, contact its operator.