The first browser MCP built for security testing.

Other browser MCPs let your AI fill forms and take screenshots.
This one lets it find vulnerabilities.

What It Does • How It's Different • Quick Start • Examples • Tools • Architecture

--- ## What It Does **hackbrowser-mcp** gives your AI agent a real Firefox browser and 39 security testing tools via the [Model Context Protocol](https://modelcontextprotocol.io). The agent can launch the browser, browse a target, capture all traffic, and test for vulnerabilities — all through natural language. ``` You: "Log in as admin and as a regular user. Find endpoints the user shouldn't access." Agent: → launches Firefox → creates two isolated containers (admin + user) → logs in both accounts → browses the app, captures traffic → compares responses across roles → "User can access GET /api/admin/users — should return 403, returns 200" ``` The AI handles the entire workflow: launching the browser, managing sessions, discovering endpoints, testing parameters, and generating a security report. You describe what to test. It does the rest. --- ## How It's Different There are dozens of browser MCPs. They all do the same thing: let an LLM navigate pages, click buttons, and extract text. They're built for **automation** — filling forms, scraping data, running UI tests. **None of them can test for vulnerabilities.** That's the gap hackbrowser-mcp fills.

	Other Browser MCPs	hackbrowser-mcp
Purpose	Web automation, scraping, form filling	Security testing, vulnerability assessment
Sessions	Single session	2-4 isolated containers with separate cookies, storage, and auth
Traffic	Read-only network tab (if any)	Full HAR capture + replay with modifications
Security tools	None	14 tools: injection testing, CSRF, IDOR, access matrix, report generation
Injection testing	Not possible	7 types, 60+ payloads, technique-labeled results
Access control	Not possible	Cross-role comparison, endpoint access matrix, IDOR detection
Browser	Chromium (CDP)	Firefox (WebDriver BiDi) — different engine catches different bugs
Anti-detection	Varies	Stealth mode built-in (fingerprint, UA, WebGL spoofing)

Specific comparisons with popular projects

| Project | Stars | What it does | What it can't do | |---|---|---|---| | [playwright-mcp](https://github.com/microsoft/playwright-mcp) | 29k | Navigate, click, type, screenshot via accessibility tree | No multi-session, no traffic capture, no security testing | | [browser-use](https://github.com/browser-use/browser-use) | 81k | AI completes web tasks (shopping, forms, research) | Single agent action, no HAR, no injection testing | | [stagehand](https://github.com/browserbase/stagehand) | 22k | act/extract/observe SDK for browser automation | No security tools, no container isolation | | [chrome-devtools-mcp](https://github.com/nichochar/chrome-devtools-mcp) | 29k | DevTools debugging, performance analysis, network monitoring | Read-only network, no replay, no active testing | | [browser-tools-mcp](https://github.com/AgentDeskAI/browser-tools-mcp) | 7k | Console, network, audit monitoring for coding agents | IDE-focused, no offensive testing capability | | [mcp-playwright](https://github.com/executeautomation/mcp-playwright) | 5k | Multi-browser test automation + scraping | No security awareness, no access control analysis | All of these are excellent tools for their intended purpose. hackbrowser-mcp doesn't replace them — it serves a completely different use case.

--- ## Core Capabilities ### Multi-Container Isolation Run 2-4 browser sessions simultaneously, each with **completely isolated** state. This is the foundation for access control testing. ``` ┌────────────────────────────────────────────────────────┐ │ Firefox Instance │ ├───────────────┬───────────────┬────────────────────────-┤ │ Container 1 │ Container 2 │ Container 3 │ │ role: admin │ role: user │ role: guest │ │ │ │ │ │ cookies: A │ cookies: B │ cookies: none │ │ storage: A │ storage: B │ storage: none │ │ session: ✓ │ session: ✓ │ session: ✗ │ └───────────────┴───────────────┴─────────────────────────┘ compare_access → "GET /api/admin/users returns 200 for user (expected 403)" access_matrix → role × endpoint grid showing every authorization gap ``` ### Traffic Intelligence Every HTTP request and response is captured, stored, and queryable. Replay any request with modifications. ``` Browser → Network Interceptor → In-Memory Store (10K max, FIFO) │ ┌─────────┴──────────┐ │ │ Auto-save (60s) Replay / modify │ │ ▼ ▼ HAR file (disk) replay_request │ (change method, Resume on restart headers, body) ``` ### Active Security Testing Discover injection points from captured traffic, then test them with 60+ payloads across 7 vulnerability types. | Type | Payloads | Techniques | |------|----------|------------| | **SQLi** | 9 | Error-based, union, time-based blind (MSSQL/MySQL/Postgres), boolean-blind | | **XSS** | 8 | Reflected script, event handler, SVG, JS context, HTML5 events, iframe | | **SSTI** | 8 | Jinja2, Freemarker, ERB, Angular sandbox, Spring EL, Vue | | **SSRF** | 8 | Localhost variants (IPv4/v6/hex/octal), AWS/GCP/Azure metadata, DNS rebind | | **CMDi** | 8 | Semicolon, pipe, backtick, subshell, newline, quote-break | | **LFI** | 8 | Path traversal, double-dot, /proc/environ, PHP filter, double-encode | | **HTML Injection** | 6 | Tag injection, form injection, style overlay, meta redirect | When built-in payloads get blocked, the AI agent analyzes the WAF response and crafts custom bypass payloads using `replay_request`. --- ## Quick Start ### Install ```bash git clone https://github.com/user/hackbrowser-mcp.git cd hackbrowser-mcp bun install ``` ### Connect to your AI agent

Claude Desktop / Claude Code

Add to your MCP config (`~/.claude/claude_desktop_config.json`): ```json { "mcpServers": { "hackbrowser": { "command": "bun", "args": ["run", "/path/to/hackbrowser-mcp/src/index.ts", "--mcp"] } } } ```

Cursor / Continue / other MCP clients

Same config format. Point the command to your installation path.

Standalone (no AI agent)

```bash bun run src/index.ts --launch # GUI mode bun run src/index.ts --launch --headless # headless bun run src/index.ts --mcp # MCP server (stdio) ```

### Start testing ``` You: "Launch the browser and scan https://target.com for vulnerabilities" ``` That's it. The agent handles the rest. --- ## Workflow Examples ### Full Security Scan ``` You: "Crawl https://app.com, find injection points, test them, generate a report." Agent: browser_launch → navigate → crawl (100 pages) → find_injection_points → test_injection (SQLi, XSS) → test_csrf → test_rate_limit → generate_report → "Found 3 XSS, 1 SQLi, 2 missing CSRF tokens" ``` ### IDOR / Access Control Audit ``` You: "Login as admin and regular user. Find what the user shouldn't access." Agent: container_setup (admin + user) → container_login (both) → navigate admin pages → compare_access → access_matrix → "User can reach GET /api/admin/users (200 instead of 403)" ``` ### WAF Bypass ``` You: "Test the search param for XSS. Bypass any WAF." Agent: test_injection {types: ["xss"]} → all blocked → analyzes response: