Skip to content

Protect browser credentials in MCP responses - #130

Draft
IlyaasK wants to merge 3 commits into
mainfrom
hypeship/redact-browser-cdp
Draft

Protect browser credentials in MCP responses#130
IlyaasK wants to merge 3 commits into
mainfrom
hypeship/redact-browser-cdp

Conversation

@IlyaasK

@IlyaasK IlyaasK commented Jul 31, 2026

Copy link
Copy Markdown
Contributor

Summary

  • omit CDP websocket URLs from browser tool responses
  • add a hosted-only Managed Auth tool that cannot accept credentials, MFA values, or raw field submissions
  • preserve live-view and hosted-auth URLs needed for user takeover

Testing

  • bun test src/lib/mcp/tools/browsers.test.js src/lib/mcp/tools/hosted-auth.test.js
  • bunx tsc --noEmit
  • focused files pass Prettier
  • production compilation passes; page-data collection requires the existing KERNEL_CLI_PROD_CLIENT_ID build environment

@vercel

vercel Bot commented Jul 31, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
mcp Ready Ready Preview Jul 31, 2026 2:30am

@IlyaasK IlyaasK changed the title Hide browser CDP URLs from MCP results Protect browser credentials in MCP responses Jul 31, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant