Privacy Policy

Last updated: October 7, 2026

Browser MCP is an open source Chrome extension + MCP server by Agent360. We take your privacy seriously.

Data Collection

Browser MCP does not send any personal data to Agent360 by itself, and uploads nothing to anyone else on its own. Two things can still carry data out: your AI client, which receives the tool results, and the addresses your agent asks the browser to visit or browser_fetch to request (see below). Specifically:

• No browsing history is collected or sent anywhere
• No cookies or login credentials are read by our servers
• No analytics, tracking, or telemetry is included
• Nothing is sent to Agent360 - there is no server of ours to receive it
• The extension keeps a short log on your own machine of which tools ran (time, tool name and session), shown in its popup. From version 1.29.1 it does not keep what the agent typed, cookie values or page addresses, and clears those from older entries when it updates. You can empty the log from the popup
• Browser MCP tells your agent to call browser_provide_feedback on its own whenever Browser MCP itself gets in its way (a tool fails, times out or does something other than it promised, the extension will not connect, or a capability is missing). Each time, the server tries to add one line to ~/.browser-mcp/feedback.jsonl on your own machine (a line is not written again for a report of the same kind and tool as an earlier line written in the same server run, and a description that is the same after the clean-up below, lower-casing it, replacing numbers and long hexadecimal strings, and keeping the first 160 characters; such a report is still returned and still gets the issue link): the time, the kind of report, which tool, the agent's own description of what went wrong, what it tried and what worked in the end (this can include error text from the page; first, email addresses and numbers of six or more characters are replaced with [email] and [number], runs of spaces and tabs become one space, and each of the three is cut to 600 characters), the page address if the agent gave one, cut down to origin and path (no query string, fragment or login part; an address that is not a web address, such as a data: link, can keep its content), a short diagnosis of the connection, version numbers, the number of connected extensions and a fingerprint used to skip repeats. The server does not upload any of this itself, and it never clears the file: delete it to clear it. The report is also returned to your AI client like any other tool result: the address exactly as the agent gave it, environment details (version numbers, connected extensions with their IDs and code fingerprints, port, Node version and operating system), its repeat-skipping fingerprint and, when the line was written, where (a path that may include your user name), otherwise the reason it was not. The tool also gives your agent a pre-filled GitHub issue link containing the agent's description, what it tried and what worked (cleaned up the same way), the tool, the shortened address and the environment details, but not the time or the repeat-skipping fingerprint. Opening that link shows its content to GitHub, and nothing is posted until you submit it, so review the report before you open or share the link. A version check against npm runs only if you set BROWSER_MCP_CHECK_NPM=1

How Browser MCP Works

Browser MCP runs on your own machine:

• The Chrome extension communicates with a local MCP server via WebSocket (localhost only)
• The MCP server communicates with Claude Code (or other MCP clients) via stdio
• Browser MCP itself contacts no server of ours or any third party on its own, unless you turn on its optional npm version check (BROWSER_MCP_CHECK_NPM=1). What does leave your machine: the pages your agent reads go to your AI client and, if that client uses a cloud model, may be passed on to its model provider; the browser visits the sites your agent opens, and browser_fetch requests the addresses your agent asks for; and npx @agent360/browser-mcp@latest may look the package up on npm when the server starts

The localhost WebSocket bridge is not password-protected - it trusts connections from your own machine. That means the extension is only as private as your computer: any software already running on it could, in principle, connect to the same local port. Browser MCP never exposes this bridge beyond localhost, and the bridge itself sends nothing off your machine. If you share your computer with untrusted software, disable or remove the extension when you are not using it.

Permissions

Browser MCP requests the following Chrome permissions. Each is required for browser automation functionality:

• tabs, tabGroups, activeTab - See and switch between the session's own tabs, and group them by colour. The agent acts only on tabs the session opened, never on a tab you opened yourself
• cookies - Read and write cookies for browser_get_cookies / browser_set_cookies, and only for the http(s) sites the session has open
• scripting - Execute JavaScript in page context for content reading and interaction
• debugger - Chrome DevTools Protocol for reliable mouse and keyboard events, screenshots, running scripts on CSP-strict sites, and reading network responses for browser_wait_for_network
• webNavigation - List a page's frames, so a tool can reach into an iframe
• storage, alarms, offscreen - Local extension state, two timers (one keeps the bridge alive, one releases a port when a session's last tab closes), and the offscreen document that hosts the WebSocket bridge
• notifications - Alert you when a human-in-the-loop action is needed
• <all_urls> (host permission) - Browser automation requires access to whatever website you navigate to

Open Source

Browser MCP is fully open source under the MIT License. You can inspect all code at github.com/Agent360dk/browser-mcp.

Contact

Questions? Email hello@agent360.dk or open an issue on GitHub.

← Back to browsermcp.dev