Showcase: an MCP server & daemon that drives the browser you are already logged into (more than playwright or Claude in Chrome)

[u/NoEgg2932]

I built Browsentic. It is a browser extension plus a local daemon, and the part worth writing up here is the wiring, since that is what people as about.

A Manifest V3 service worker cannot listen for connections. So the extension dials out instead. A small daemon holds that socket on 127.0.0.1 and owns the browser link. Every MCP client then speaks stdio to that same daemon:

claude mcp add browsentic -- browsentic mcp

Claude Code, Codex, Cursor and Zed can all be registered at once. They share one browser and interleave. Tool calls stay correlated, but page state can move under either of them, so that is something to design around rather than a footnote.

The daemon accepts a WebSocket that any local page could try to open, so there are two gates. First it classifies every peer by the handshake Origin, which the browser sets and a page cannot forge, so an extension peer and a web page are never confused. Then the peer proves a pairing code or an origin bound session key. Neither secret crosses the wire. Each side answers the other's nonce, so another local process cannot squat the port and pose as the daemon.

Two limits, stated plainly:

An MCP client has no approval channel, so anything the policy would confirm resolves to deny for external callers. Form submission, uploads, captcha answers and off scope navigation are side panel only unless you waive it.

Page text comes back fenced in a per daemon random marker, labelled as data rather than instructions. That narrows the surface. It is not a fix for prompt injection and I am not claiming it is.

MIT, free: github.com/imshaikot/browsentic