Browser Bridge lets AI agents drive your real, logged-in Chrome via MCP

AI coding agents are getting more capable by the week, but they've mostly been stuck working in a sandbox. Browser Bridge aims to change that by giving agents like Claude Code and OpenAI's Codex CLI direct control of the very Chrome browser you're already signed into — no headless mode, no fresh profile, no re-authentication dance.

Built as a local MCP server paired with a Manifest V3 Chrome extension, Browser Bridge lets agents read and act inside your live, authenticated sessions. Because it operates in your real profile, the agent inherits your cookies, HttpOnly session tokens, SSO state, and even 2FA status automatically. That means a prompt like "read my feed and summarize it" or "capture the API traffic on this page" works against the actual, logged-in app rather than a stripped-down test environment.

The project ships with 64 tools spanning everyday browsing, DevTools-grade network capture, a web-security testing toolkit, and a playbook system that saves "self-healing" recipes for repetitive tasks. It also includes a session recorder that captures interactions into a self-contained HTML replay — complete with a smooth mouse-trail, click, and keystroke overlay — and can export that replay to a high-resolution MP4.

Getting started

Setup is straightforward, taking roughly 60 seconds. You build both packages, run the server, load the extension, and connect your agent. The extension is loaded unpacked from chrome://extensions, and you paste a bearer token from ~/.browser-bridge/token into its options page. For Codex CLI, you export that token as an environment variable and register the server with a single command.

Verification is a simple health check:

curl -s http://127.0.0.1:8765/health
# → {"ok":true,"extensionConnected":true}

The playbook system

One of the more interesting pieces is the playbook feature. Rather than recording brittle click coordinates, Browser Bridge stores intent plus robust role/accessible-name locators and checkpoints in a local Markdown file. When the agent runs a playbook, it re-perceives each step, verifies its target before acting, and re-derives anything that's drifted — a self-healing approach that's far more resilient than a traditional record-replay macro. Destructive or irreversible steps require explicit confirmation.

Playbooks live in ~/.browser-bridge/playbooks/<slug>.md globally or ./playbooks/<slug>.md for project-local, git-shareable recipes, and every connected agent learns the convention automatically via the MCP instructions field.

Security considerations

Because Browser Bridge operates inside your real browser session, it raises real security questions. The project is MIT-licensed and positions itself as a tool for authorized automation, research, and security testing. It explicitly notes that users are responsible for complying with the terms of service of the sites they automate, and the authors disclaim liability for misuse. It's worth remembering that any tool with this level of access to your authenticated sessions is a significant attack surface — if an agent is compromised, your cookies, SSO, and 2FA state are all exposed.

The recorder also handles sensitive input cautiously: input masking is off by default (meaning cleartext values are captured), and canvas/WebGL and live video pixels aren't included in the DOM-based replay. For those worried about leaking passwords or tokens, there's a maskInputs: true option to redact them.

A maturing ecosystem

Browser Bridge joins a growing wave of projects pushing agents beyond the terminal and into real-world applications. The MCP protocol — which Claude popularized and OpenAI has since adopted — is proving to be the connective tissue for this kind of integration. While the idea of letting an AI drive your live browser is both exciting and slightly terrifying, the practical value for developers is clear: debugging a flaky front-end, testing an API endpoint for BOLA/IDOR vulnerabilities, or automating a repetitive admin task all become one natural-language prompt away, in the exact environment where the problem actually lives.

The project is open source under MIT, with contributions welcome. It bundles rrweb and rrweb-player (both MIT) for its session recording, and the documentation goes deep into the build, development loop, and a security disclosure process for the bridge itself.

Whether Browser Bridge becomes a staple in your agent toolchain or an occasional utility, it's a solid example of how fast the boundary between AI agents and the real web is shrinking — and a reminder that with that power comes genuine responsibility to use it carefully.