hackbrowser-mcp - The first browser MCP built for security testing.

项目说明

<p align="center">
<br>
<picture>
<source media="(prefers-color-scheme: dark)" srcset="
<source media="(prefers-color-scheme: light)" srcset="
<img alt="hackbrowser-mcp" src=" width="700">
</picture>
</p>

<h3 align="center">The first browser MCP built for security testing.</h3>

<p align="center">
Other browser MCPs let your AI fill forms and take screenshots.<br>
This one lets it <b>find </b>.
</p>

<br>

<p align="center">
<a href="#what-it-does">What It Does</a> &bull;
<a href="#how-its-different">How It's Different</a> &bull;
<a href="#quick-start">Quick Start</a> &bull;
<a href="#workflow-examples">Examples</a> &bull;
<a href="#tools-reference-39-tools">Tools</a> &bull;
<a href="#architecture">Architecture</a>
</p>

<p align="center">
<a href="LICENSE"><img src=" alt="License"></a>
<img src=" alt="Bun">
<img src=" alt="Firefox">
<img src=" alt="MCP">
<img src=" alt="39 Tools">
<img src=" alt="60+ Payloads">
</p>

---

What It Does

hackbrowser-mcp gives your AI agent a real Firefox browser and 39 security testing tools via the Model Context Protocol. The agent can launch the browser, browse a target, capture all traffic, and test for &mdash; all through natural language.

The AI handles the entire workflow: launching the browser, managing sessions, disco endpoints, testing parameters, and generating a security report. You describe what to test. It does the rest.

---

How It's Different

There are dozens of browser MCPs. They all do the same thing: let an LLM na pages, click buttons, and extract text. They're built for automation &mdash; filling forms, scraping data, running UI tests.

None of them can test for . That's the gap hackbrowser-mcp fills.

<table>
<thead>
<tr>
<th></th>
<th>Other Browser MCPs</th>
<th>hackbrowser-mcp</th>
</tr>
</thead>
<tbody>
<tr>
<td><b>Purpose</b></td>
<td>Web automation, scraping, form filling</td>
<td>Security testing, assessment</td>
</tr>
<tr>
<td><b>Sessions</b></td>
<td>Single session</td>
<td>2-4 isolated containers with separate cookies, storage, and auth</td>
</tr>
<tr>
<td><b>Traffic</b></td>
<td>Read-only network tab (if any)</td>
<td>Full HAR capture + replay with modifications</td>
</tr>
<tr>
<td><b>Security tools</b></td>
<td>None</td>
<td>14 tools: injection testing, CSRF, IDOR, access matrix, report generation</td>
</tr>
<tr>
<td><b>Injection testing</b></td>
<td>Not possible</td>
<td>7 types, 60+ payloads, technique-labeled results</td>
</tr>
<tr>
<td><b>Access control</b></td>
<td>Not possible</td>
<td>Cross-role comparison, endpoint access matrix, IDOR detection</td>
</tr>
<tr>
<td><b>Browser</b></td>
<td>Chromium (CDP)</td>
<td>Firefox (WebDriver BiDi) &mdash; different engine catches different bugs</td>
</tr>
<tr>
<td><b>Anti-detection</b></td>
<td></td>
<td>Stealth mode built-in (fingerprint, UA, WebGL spoofing)</td>
</tr>
</tbody>
</table>

<br>

<details>
<summary>Specific comparisons with popular projects</summary>

<br>

| Project | Stars | What it does | What it can't do |
|---|---|---|---|
| playwright-mcp | 29k | Na, click, type, screenshot tree | No multi-session, no traffic capture, no security testing |
| browser-use | 81k | AI completes web tasks (shopping, forms, research) | Single agent action, no HAR, no injection testing |
| stagehand | 22k | act/extract/observe SDK for browser automation | No security tools, no container isolation |
| chrome-de | 29k | De debugging, performance analysis, network monitoring | Read-only network, no replay, no acti |
| browser-tools-mcp | 7k | Console, network, audit monitoring for coding agents | IDE-focused, no offensi capability |
| mcp-playwright | 5k | Multi-browser test automation + scraping | No security awareness, no access control analysis |

All of these are excellent tools for their intended purpose. hackbrowser-mcp doesn't replace them &mdash; it serves a completely different use case.

</details>

---

Core Capabilities

Multi-Container Isolation

Run 2-4 browser sessions simultaneously, each with completely isolated state. This is the foundation for access control testing.

Traffic Intelligence

Every HTTP request and response is captured, stored, and queryable. Replay any request with modifications.

Acti Testing

Disco points from captured traffic, then test them with 60+ payloads across 7 types.

| Type | Payloads | Techniques |
|------|----------|------------|
| SQLi | 9 | Error-based, union, time-based blind (MSSQL/MySQL/Postgres), boolean-blind |
| XSS | 8 | Reflected script, event handler, SVG, JS context, HTML5 events, iframe |
| SSTI | 8 | Jinja2, Freemarker, ERB, Angular sandbox, Spring EL, Vue |
| SSRF | 8 | Localhost (IPv4/v6/hex/octal), AWS/GCP/Azure metadata, DNS rebind |
| CMDi | 8 | Semicolon, pipe, backtick, subshell, newline, quote-break |
| LFI | 8 | Path tra, double-dot, /proc/environ, PHP filter, double-encode |
| HTML Injection | 6 | Tag injection, form injection, style o, meta redirect |

When built-in payloads get blocked, the AI agent analyzes the WAF response and crafts custom bypass payloads using replay_request.

---

Quick Start

Install

Connect to your AI agent

<details>
<summary><b>Claude Desktop / Claude Code</b></summary>

Add to your MCP config (~/.claude/claude_desktop_config.json):

</details>

<details>
<summary><b>Cursor / Continue / other MCP clients</b></summary>

Same config format. Point the command to your installation path.

</details>

<details>
<summary><b>Standalone (no AI agent)</b></summary>

</details>

Start testing

That's it. The agent handles the rest.

---

Workflow Examples

Full Security Scan

IDOR / Access Control Audit

WAF Bypass

Offline HAR Analysis

---

Tools Reference (39 tools)

<details>
<summary><b>Browser Control (3)</b></summary>

| Tool | Description |
|------|-------------|
| browser_launch | Launch Firefox with managed profile |
| browser_close | Close browser, auto-export HAR |
| browser_status | Protocol, containers, tab count, captured requests |

</details>

<details>
<summary><b>Containers (3)</b></summary>

| Tool | Description |
|------|-------------|
| container_setup | Create 1-4 containers with roles and credentials |
| container_login | Login for a container (programmatic or manual) |
| container_list | List containers with auth status |

</details>

<details>
<summary><b>Na (4)</b></summary>

| Tool | Description |
|------|-------------|
| na | Go to URL in a container tab |
| go_back / go_forward | Browser history na |
| wait_for | Wait for selector, URL, network idle, or JS condition |

</details>

<details>
<summary><b>Interaction (7)</b></summary>

| Tool | Description |
|------|-------------|
| click | Click by CSS selector or text content |
| type_text | Type into input fields |
| select_option | Select dropdown value |
| submit_form | Submit a form |
| scroll | Scroll page or element |
| hover | Hover o |
| press_key | Keyboard keys (Enter, Tab, Escape, etc.) |

</details>

<details>
<summary><b>Page Inspection (4)</b></summary>

| Tool | Description |
|------|-------------|
| screenshot | Capture PNG screenshot |
| get_page_source | Full HTML source |
| get_dom_tree | Simplified DOM tree (LLM-friendly) |
| e | Execute Ja and return result |

</details>

<details>
<summary><b>Traffic Capture (5)</b></summary>

| Tool | Description |
|------|-------------|
| get_requests | List captured requests with filters (URL, method, status, MIME) |
| get_response | Full request/response details by ID |
| get_endpoints | Auto-discovered API endpoints with parameter templates |
| export_har | Sa as HAR 1.2 file |
| import_har | Load HAR from previous session |

</details>

<details>
<summary><b>Security Analysis (4)</b></summary>

| Tool | Description |
|------|-------------|
| compare_access | Cross-container IDOR / broken authorization detection |
| access_matrix | Role x endpoint access grid |
| find_injection_points | Identify injectable params across 10 vuln types |
| replay_request | Replay with modified method, headers, body, URL |

</details>

<details>
<summary><b>Acti (3)</b></summary>

| Tool | Description |
|------|-------------|
| test_injection | 7 types, 60+ payloads, technique-labeled results |
| test_csrf | Replay without CSRF tokens |
| test_rate_limit | Rapid-fire requests, check for 429 |

</details>

<details>
<summary><b>Auth Detection (3)</b></summary>

| Tool | Description |
|------|-------------|
| detect_auth | Check session |
| detect_login_form | Find login form fields and CSRF token |
| auto_login | Auto-fill and submit login |

</details>

<details>
<summary><b>Discovery (2)</b></summary>

| Tool | Description |
|------|-------------|
| crawl | BFS spider with form discovery and API extraction |
| get_sitemap | Return crawl results |

</details>

<details>
<summary><b>Reporting (1)</b></summary>

| Tool | Description |
|------|-------------|
| generate_report | Security report (markdown/HTML) with findings and e |

</details>

---

Library Usage

Use hackbrowser-mcp as a TypeScript library for custom tooling:

---

Architecture

Design decisions:

---

Limitations

---

<p align="center">
<b>For authorized security testing only.</b><br>
Always obtain proper permission before testing any application.
</p>

<p align="center">
<a href="LICENSE">MIT License</a> &bull; Built with Bun + TypeScript
</p>

项目信息

开发语言：TypeScript

Star 数：24

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕The first browser MCP built for security testing. Give your AI agent a real Firefox browser and let it find vulnerabilities.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。