Skip to main content
Updated October 2, 2026.

​
Scope and contact

Browser MCP connects an explicitly paired dedicated Chrome profile to trusted MCP clients. The managed preview’s canonical origin is https://browser-mcp.click. Contact privacy@browser-mcp.click for account/data deletion, support@browser-mcp.click for support, and security@browser-mcp.click for private security reports. Do not send tokens, passwords or private page captures. Self-hosted operators control their own database, proxy, retention and backups and must supply their own privacy policy. MCP clients and model providers are separate recipients with their own policies.

​
Data handled

  • Account/authentication: login identity, account/session records, credential hashes, encrypted configuration and proof-bound device requests. Managed uses GitHub; community uses local bootstrap/configured OIDC.
  • Local runtime: an owned Chrome profile retains its task-specific sign-ins, native installation settings and protected connection credentials. It does not import everyday browser profiles. Local account or OS compromise can expose this data.
  • Metadata: browser registrations, connection/version/capability status, session/tab ownership and metadata-only audit events. Authorized tools can return URLs, titles and page content.
  • Content: requested text, screenshots, diagnostics, JavaScript results and input pass through the control plane to the MCP client. Signed-in websites may contain sensitive personal, financial, health or authentication information.
  • Files: exact completed Chrome downloads and explicitly staged uploads use private runtime storage and bounded streaming channels. The runtime must not scan personal Downloads or expose arbitrary filesystem paths. Retention/quotas and capability lifecycle are described in data/secrets.
  • Secrets: dedicated capture keeps values in a short-lived runtime vault and returns metadata only. Explicit exports use sensitive short-lived HTTPS capabilities. Values must not be persisted in PostgreSQL, general resources, receipts or logs. This does not redact ordinary arbitrary JavaScript, screenshots or secrets displayed as normal text.
  • Live view: opt-in unmasked pixels transit the server to authorized viewers. The relay does not record them; viewers can capture them independently.
  • Forwarding: explicitly authorized TCP bytes transit the relay. Loopback is accessible to other local processes. See forwarding limits.

​
Recipients, retention and limits

TLS protects network transport but does not hide plaintext relayed traffic from the server operator. Browser MCP does not claim operator-blind encryption or universal model isolation. Capability-bearing tool results themselves are sensitive. The unreleased direct-download workflow intentionally includes short-lived HTTPS GET bearer URLs in ordinary model-visible tool text and structured output, so they can appear in conversation history and shell-command logs. Any holder can redeem a still-valid unused link. This does not expose browser cookies or broad MCP/runtime tokens. Ordinary idempotency receipts can retain requested page-derived results and short-lived download URLs to recover the same outcome without replaying actions or issuing fresh links. Account and configuration records, metadata, receipts and backups have different retention schedules; operators must document deployed settings rather than promise a universal deletion deadline. Files live in runtime-owned staging, and captured secrets in bounded memory with explicit lifecycle expiry. JavaScript memory does not provide guaranteed secure erasure. Proxy logs, crash dumps and client/provider retention require independent safeguards.

​
Your controls

Pair only requests you started. Use a dedicated profile with only task-needed accounts, short-lived MCP credentials and explicit authorization for consequential actions. Pause/stop locally; remote agents cannot resume a local pause. Revoke tokens or delete browser registrations in the dashboard. Registration deletion does not erase your local profile or a third party’s retained copies. Ask the operator about account deletion and backup retention. See security before connecting. These docs do not promise regulatory compliance, a security audit or service availability.