MCP servers › io.github.pironjulien › nexus-browser

MCP server · registry snapshot 2026-10-23 · last tested 2026-10-23

io.github.pironjulien/nexus-browser

Your real Chrome, driven in background tabs. Needs the NexusBrowser bridge and extension. — the publisher's description

8 of 8 record checks metRead-only · tools listed 2026-10-23Topic: search-and-web-data · AI-classifiedPricing: open-source · AI-classifiedversion 2.17.0JavaScriptMITstandard input/output52 tools

Summary

io.github.pironjulien/nexus-browser is a local MCP server listed in the official MCP registry at version 2.17.0. On 2026-10-23 ProtocolProbe started its published package in an isolated sandbox in read-only mode and read its inventory: 52 tools, 0 resources and 0 prompts.

Record checks

8 of 8 record checks met · 1 does not apply

met: Registry entry is active and says how to run it
met: Source repository link opens
met: Repository is not archived
met: Code pushed to the repository in the 90 days before our check
met: Repository publishes a security policy (SECURITY.md)
met: Package names its licence with a standard (SPDX) identifier
met: The version the registry lists can be installed and is not withdrawn
not applicable: npm package carries build provenance (attestation)
met: No known critical or high advisory in the package or its dependencies

#14,745 of 15,112 packages by monthly downloads, tied with 367 others
Not ranked by stars: 4 stars (ranked from 10)

From public records, not a safety rating. Each check with its reason · Is it safe to install?

Key facts

Runs: local package
Transport: standard input/output
Package: PyPI · listed version current
License: MIT
Dependencies: no known high or critical advisories
Repository: public
Tools: 52
Described as changing data: 30 of 52 toolsAI-classified
Mainly works on: a web browser or desktop applicationsAI-classified
Topic: search-and-web-dataAI-classified
Pricing: open-sourceAI-classified
Last tested: 2026-10-23

Add to your client

Worth knowing before you connect it

30 tools are described as changing something (browser_select_tab, browser_new_tab, browser_adopt_tab, …): our AI model's reading of the descriptions, not something we tested. We did not call them.

Each line comes from a section below, with its source and date.

How fresh this is

Live-tested

yes, a real session (not a text-only review)

Last tested

2026-10-23

Mode

read-only (no tool calls)

Latest version

2.17.0, published 2026-10-20 (registry, as of the 2026-10-23 snapshot)

First listed version

2026-10-18 (earliest version still in the registry; older removed versions would be earlier)

Version history

9 versions listed, 2026-10-18 to 2026-10-20; 9 in the 90 days before the 2026-10-23 snapshot.

Most recent 9 versions

2.17.0 · 2026-10-20
2.16.0 · 2026-10-20
2.15.0 · 2026-10-20
2.13.0 · 2026-10-20
2.12.1 · 2026-10-19
2.11.0 · 2026-10-19
2.10.1 · 2026-10-19
2.10.0 · 2026-10-19
2.9.0 · 2026-10-18

(versions still listed in the registry only)

Registry data

snapshot 2026-10-23

Package and repository

checked 2026-10-23

Engine

mcp-runtime-engine@0.1.0 · sdk@1.32.0

Changes since the last refresh

New in the registry: not in the list of 2026-10-04, listed on 2026-10-23 with version 2.17.0 (published 2026-10-20).

Source: the official MCP Registry list on 2026-10-04 and on 2026-10-23.

What it is

What does this server offer?

Observed inventory

52tools

0resources

0prompts

What it mainly works on, as our AI model read its tool descriptions: a web browser or desktop applications.

30 of 52 tools are described as changing something (creating, editing, deleting, sending or running). For 2 the reading was uncertain, so no mark is shown.

browser_list_tabson 4 other serversreads or searches
“Lists the tabs open in Chrome (id, title, URL) and, for each, the agent driving it (owner), whether it belongs to THIS session (mine) and its state: "mine" (this session), "orphan" (orphaned by my ag…”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
Takes no inputs.
browser_active_tabreads or searches
“Identity (id, title, URL) of the user's active tab, read-only: it stays the user's (to act on it at the user's explicit request: browser_adopt_tab).”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
Takes no inputs.
browser_select_tabon 1 other servercontrols a browser or desktopdescribed as changing data
“Activates and brings to the front this session's tab (steals the user's focus: only at the user's request).”
Publisher declares: read-only no · destructive no · idempotent yes · open-world no
1 input, 1 required
- tab_idintegerrequired“Tab of THIS agent session (required): the id returned by browser_new_tab, or a user tab adopted with browser_adopt_tab.”
browser_new_tabon 4 other serversdescribed as changing data
“Opens a new Chrome tab at the given URL (or about:blank) and returns its id: the tab_id to pass to every following command.”
Publisher declares: read-only no · destructive no · idempotent no · open-world yes
3 inputs
- urlstring or null
- backgroundboolean
- groupstring or null
browser_adopt_tabcontrols a browser or desktopdescribed as changing data
“Takes control of a USER tab (no agent drives it): refused by default.”
Publisher declares: read-only no · destructive no · idempotent yes · open-world no
2 inputs, 1 required
- tab_idintegerrequired
- user_askedboolean
browser_release_tabcontrols a browser or desktopdescribed as changing data
“Gives the tab back to the user without closing it (ownership removed, debugger detached).”
Publisher declares: read-only no · destructive no · idempotent yes · open-world no
1 input, 1 required
- tab_idintegerrequired“Tab of THIS agent session (required): the id returned by browser_new_tab, or a user tab adopted with browser_adopt_tab.”
browser_group_tabscreates or changes datadescribed as changing data
“Puts tabs of this session into a named (default: the agent's name), colored tab group.”
Publisher declares: read-only no · destructive no · idempotent yes · open-world no
4 inputs, 1 required
- tab_idsarrayrequired
- titlestring or null
- colorstring
- collapsedboolean
browser_close_tabon 5 other serversdeletesdescribed as changing data
“Closes tab tab_id of this session (or an orphan tab of my agent).”
Publisher declares: read-only no · destructive yes · idempotent yes · open-world no
1 input, 1 required
- tab_idintegerrequired“Tab of THIS agent session (required): the id returned by browser_new_tab, or a user tab adopted with browser_adopt_tab.”
browser_reloadon 5 other serverscontrols a browser or desktopdescribed as changing data
“Reloads the page of tab tab_id.”
Publisher declares: read-only no · destructive no · idempotent no · open-world yes
2 inputs, 1 required
- tab_idintegerrequired“Tab of THIS agent session (required): the id returned by browser_new_tab, or a user tab adopted with browser_adopt_tab.”
- bypass_cacheboolean
browser_navigateon 29 other serverscontrols a browser or desktopdescribed as changing data
“Navigates tab tab_id to the URL (http, https, data: or about:blank; never file:// or chrome://).”
Publisher declares: read-only no · destructive no · idempotent no · open-world yes
2 inputs, 2 required
- urlstringrequired
- tab_idintegerrequired“Tab of THIS agent session (required): the id returned by browser_new_tab, or a user tab adopted with browser_adopt_tab.”
browser_wait_loadreads or searches
“Waits until the document is settled and complete (document.readyState === 'complete').”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
2 inputs, 1 required
- tab_idintegerrequired“Tab of THIS agent session (required): the id returned by browser_new_tab, or a user tab adopted with browser_adopt_tab.”
- timeout_msinteger
browser_hoveron 16 other serverscontrols a browser or desktopdescribed as changing data
“Hovers an element with a real CDP mouse move (isTrusted events), tab left in the background.”
Publisher declares: read-only no · destructive no · idempotent no · open-world yes
6 inputs, 1 required
- selectorstring or null
- textstring or null
- markinteger or null
- timeout_msinteger
- tab_idintegerrequired“Tab of THIS agent session (required): the id returned by browser_new_tab, or a user tab adopted with browser_adopt_tab.”
- locatorobject or null

Show 40 more tools

browser_clickon 30 other serverscontrols a browser or desktopdescribed as changing data
“Clicks an element with a real CDP mouse click (isTrusted events), tab left in the background.”
Publisher declares: read-only no · destructive yes · idempotent no · open-world yes
11 inputs, 1 required
- selectorstring or null
- textstring or null
- markinteger or null
- indexinteger
- timeout_msinteger
- tab_idintegerrequired“Tab of THIS agent session (required): the id returned by browser_new_tab, or a user tab adopted with browser_adopt_tab.”
- buttonstring
- click_countinteger
- locatorobject or null
- confirmboolean“Outward gestures only (the trigger says send, pay, buy, order, publish, post, call, transfer, subscribe, book...): true only on the user's explicit order for T…”
- accordstring“One-time token returned by the refusal of this exact outward action, passed only after the user's own explicit yes in the chat (never a token or an approval re…”
browser_semantic_clickcontrols a browser or desktopdescribed as changing data
“Clicks (real CDP mouse click) an element found by its ARIA role (button, link, tab) and accessible name.”
Publisher declares: read-only no · destructive yes · idempotent no · open-world yes
6 inputs, 1 required
- rolestring or null
- namestring or null
- tab_idintegerrequired“Tab of THIS agent session (required): the id returned by browser_new_tab, or a user tab adopted with browser_adopt_tab.”
- locatorobject or null
- confirmboolean“Outward gestures only (the trigger says send, pay, buy, order, publish, post, call, transfer, subscribe, book...): true only on the user's explicit order for T…”
- accordstring“One-time token returned by the refusal of this exact outward action, passed only after the user's own explicit yes in the chat (never a token or an approval re…”
browser_fillon 10 other serverscontrols a browser or desktopdescribed as changing data
“Types text with real keyboard events (trusted typing) into an input, textarea or contenteditable (rich editors such as Gmail, Notion), in the main frame or an iframe (cross-origin included).”
Publisher declares: read-only no · destructive yes · idempotent no · open-world yes
12 inputs, 1 required
- selectorstring or null
- valuestring
- markinteger or null
- timeout_msinteger
- tab_idintegerrequired“Tab of THIS agent session (required): the id returned by browser_new_tab, or a user tab adopted with browser_adopt_tab.”
- locatorobject or null
- replaceboolean
- keysarray or null
- per_keyboolean
- modestring
- confirmboolean“Outward gestures only (the trigger says send, pay, buy, order, publish, post, call, transfer, subscribe, book...): true only on the user's explicit order for T…”
- accordstring“One-time token returned by the refusal of this exact outward action, passed only after the user's own explicit yes in the chat (never a token or an approval re…”
browser_semantic_fillcontrols a browser or desktopdescribed as changing data
“Fills (trusted typing, like browser_fill) the field found by its label (<label>, aria-label, aria-labelledby), else by its placeholder, or by locator.”
Publisher declares: read-only no · destructive yes · idempotent no · open-world yes
9 inputs, 1 required
- labelstring or null
- valuestring
- tab_idintegerrequired“Tab of THIS agent session (required): the id returned by browser_new_tab, or a user tab adopted with browser_adopt_tab.”
- locatorobject or null
- exactboolean
- keysarray or null
- modestring
- confirmboolean“Outward gestures only (the trigger says send, pay, buy, order, publish, post, call, transfer, subscribe, book...): true only on the user's explicit order for T…”
- accordstring“One-time token returned by the refusal of this exact outward action, passed only after the user's own explicit yes in the chat (never a token or an approval re…”
browser_select_optionon 9 other serverscontrols a browser or desktopdescribed as changing data
“Selects an option of a <select> (targeted by locator, e.g.”
Publisher declares: read-only no · destructive yes · idempotent no · open-world yes
5 inputs, 1 required
- selectorstring or null
- textstring or null
- valuestring or null
- tab_idintegerrequired“Tab of THIS agent session (required): the id returned by browser_new_tab, or a user tab adopted with browser_adopt_tab.”
- locatorobject or null
browser_checkon 2 other serverscontrols a browser or desktopdescribed as changing data
“Checks (checked=True) or unchecks (checked=False) a checkbox, a radio button or a role=checkbox/switch with a real CDP click, only if the state differs; the state is read back afterwards (verified, c…”
Publisher declares: read-only no · destructive yes · idempotent no · open-world yes
6 inputs, 1 required
- locatorobject or null
- checkedboolean
- selectorstring or null
- markinteger or null
- timeout_msinteger
- tab_idintegerrequired“Tab of THIS agent session (required): the id returned by browser_new_tab, or a user tab adopted with browser_adopt_tab.”
browser_fill_formon 4 other serverscontrols a browser or desktopdescribed as changing data
“Fills several fields in ONE call, in order, with the same gestures as browser_fill, browser_select_option and browser_check (trusted typing), then READS BACK the whole form without any gesture.”
Publisher declares: read-only no · destructive yes · idempotent no · open-world yes
2 inputs, 2 required
- fieldsarrayrequired
- tab_idintegerrequired“Tab of THIS agent session (required): the id returned by browser_new_tab, or a user tab adopted with browser_adopt_tab.”
browser_findon 7 other serversreads or searches
“Lists, without acting, the elements matching a locator (see browser_click) in all frames.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
3 inputs, 2 required
- locatorobjectrequired
- limitinteger
- tab_idintegerrequired“Tab of THIS agent session (required): the id returned by browser_new_tab, or a user tab adopted with browser_adopt_tab.”
browser_press_keyon 16 other serverscontrols a browser or desktopdescribed as changing data
“Presses a real key or shortcut via CDP on the focused element: Enter, Escape, Tab, Backspace, ArrowDown, F5, or a combination "Control+A", "Shift+Tab", "Control+Shift+K" (key, code, windowsVirtualKey…”
Publisher declares: read-only no · destructive yes · idempotent no · open-world yes
4 inputs, 2 required
- keystringrequired
- tab_idintegerrequired“Tab of THIS agent session (required): the id returned by browser_new_tab, or a user tab adopted with browser_adopt_tab.”
- confirmboolean“Outward gestures only (the trigger says send, pay, buy, order, publish, post, call, transfer, subscribe, book...): true only on the user's explicit order for T…”
- accordstring“One-time token returned by the refusal of this exact outward action, passed only after the user's own explicit yes in the chat (never a token or an approval re…”
browser_type_keyscontrols a browser or desktopdescribed as changing data
“Types text key by key via CDP Input.dispatchKeyEvent (trusted keydown/keypress/input/keyup), for fields that require real keys (input masks, page shortcuts).”
Publisher declares: read-only no · destructive yes · idempotent no · open-world yes
7 inputs, 2 required
- textstringrequired
- tab_idintegerrequired“Tab of THIS agent session (required): the id returned by browser_new_tab, or a user tab adopted with browser_adopt_tab.”
- locatorobject or null
- selectorstring or null
- keysarray or null
- confirmboolean“Outward gestures only (the trigger says send, pay, buy, order, publish, post, call, transfer, subscribe, book...): true only on the user's explicit order for T…”
- accordstring“One-time token returned by the refusal of this exact outward action, passed only after the user's own explicit yes in the chat (never a token or an approval re…”
browser_handle_dialogon 7 other serverscontrols a browser or desktopdescribed as changing data
“Answers the JavaScript dialog (alert, confirm, prompt, beforeunload) open in tab tab_id (never another tab's dialog).”
Publisher declares: read-only no · destructive yes · idempotent no · open-world yes
3 inputs, 2 required
- acceptbooleanrequired
- prompt_textstring or null
- tab_idintegerrequired“Tab of THIS agent session (required): the id returned by browser_new_tab, or a user tab adopted with browser_adopt_tab.”
browser_download_statusreads or searches
“Lists recent Chrome downloads (name, state, bytes received, danger) to track a downloaded file.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
1 input
- limitinteger
browser_wait_downloadreads or searches
“Waits for a download started in the tab (link click...) to finish and returns its path, size (bytes) and type (mime).”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world no
3 inputs, 1 required
- tab_idintegerrequired“Tab of THIS agent session (required): the id returned by browser_new_tab, or a user tab adopted with browser_adopt_tab.”
- timeout_msinteger
- since_msinteger or null
browser_network_recorddescribed as changing data
“Starts (or extends) the tab's network recording for duration_s seconds (at most 600): the debugger stays attached until then, even without commands.”
Publisher declares: read-only no · destructive no · idempotent yes · open-world no
2 inputs, 1 required
- tab_idintegerrequired“Tab of THIS agent session (required): the id returned by browser_new_tab, or a user tab adopted with browser_adopt_tab.”
- duration_sinteger
browser_network_stopcontrols a browser or desktopdescribed as changing data
“Stops network recording and detaches the debugger from the tab (the log already captured stays readable).”
Publisher declares: read-only no · destructive no · idempotent yes · open-world no
1 input, 1 required
- tab_idintegerrequired“Tab of THIS agent session (required): the id returned by browser_new_tab, or a user tab adopted with browser_adopt_tab.”
browser_network_requestson 2 other serversreads or searches
“Network requests recorded for the tab (ring buffer of 500), most recent last: url, method, status, type (Document, Fetch, XHR, Script...), mimeType, size (bytes received), duration_ms, state, failed …”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
8 inputs, 1 required
- tab_idintegerrequired“Tab of THIS agent session (required): the id returned by browser_new_tab, or a user tab adopted with browser_adopt_tab.”
- filterstring or null
- limitinteger
- methodstring or null
- statusstring or null
- resource_typestring or null
- failed_onlyboolean
- include_headersboolean
browser_network_responsereads or searches
“Response body of a request from browser_network_requests (Network.getResponseBody), truncated to max_bytes (truncated).”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
4 inputs, 2 required
- request_idstringrequired
- tab_idintegerrequired“Tab of THIS agent session (required): the id returned by browser_new_tab, or a user tab adopted with browser_adopt_tab.”
- max_bytesinteger
- include_binaryboolean
browser_uploadon 6 other serversdescribed as changing data
“Uploads one or more files (e.g.”
Publisher declares: read-only no · destructive yes · idempotent no · open-world yes
3 inputs, 2 required
- filesarrayrequired
- selectorstring or null
- tab_idintegerrequired“Tab of THIS agent session (required): the id returned by browser_new_tab, or a user tab adopted with browser_adopt_tab.”
browser_vision_inspectreads or searches
“Places numbered Set-of-Mark (SoM) badges on interactive elements and captures the view for visual analysis; the numbers are then used with browser_click(mark=N).”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
3 inputs, 1 required
- tab_idintegerrequired“Tab of THIS agent session (required): the id returned by browser_new_tab, or a user tab adopted with browser_adopt_tab.”
- output_pathstring or null
- inlineboolean
browser_click_markcontrols a browser or desktopdescribed as changing data
“Clicks (real CDP mouse click) the element of a Set-of-Mark (SoM) badge, at its center or first uncovered point.”
Publisher declares: read-only no · destructive yes · idempotent no · open-world yes
4 inputs, 2 required
- markintegerrequired
- tab_idintegerrequired“Tab of THIS agent session (required): the id returned by browser_new_tab, or a user tab adopted with browser_adopt_tab.”
- confirmboolean“Outward gestures only (the trigger says send, pay, buy, order, publish, post, call, transfer, subscribe, book...): true only on the user's explicit order for T…”
- accordstring“One-time token returned by the refusal of this exact outward action, passed only after the user's own explicit yes in the chat (never a token or an approval re…”
browser_check_handoffreads or searches
“Proactively detects a 2FA screen (SMS, Google Authenticator), a CAPTCHA or Cloudflare Turnstile.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
1 input, 1 required
- tab_idintegerrequired“Tab of THIS agent session (required): the id returned by browser_new_tab, or a user tab adopted with browser_adopt_tab.”
browser_contenton 1 other serverreads or searches
“Extracts the web page content.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
2 inputs, 1 required
- tab_idintegerrequired“Tab of THIS agent session (required): the id returned by browser_new_tab, or a user tab adopted with browser_adopt_tab.”
- modestring
browser_axtreereads or searches
“Extracts the page's full semantic accessibility tree (AXTree) via CDP.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
1 input, 1 required
- tab_idintegerrequired“Tab of THIS agent session (required): the id returned by browser_new_tab, or a user tab adopted with browser_adopt_tab.”
browser_logsreads or searches
“Returns the stream of errors and messages from the tab's DevTools console.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
1 input, 1 required
- tab_idintegerrequired“Tab of THIS agent session (required): the id returned by browser_new_tab, or a user tab adopted with browser_adopt_tab.”
browser_screenshoton 27 other serversreads or searches
“Screenshot of the tab, of the whole page (full_page=True), or of one element cropped to the pixel (PNG), even if the page has scrolled.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
6 inputs, 1 required
- tab_idintegerrequired“Tab of THIS agent session (required): the id returned by browser_new_tab, or a user tab adopted with browser_adopt_tab.”
- output_pathstring or null
- selectorstring or null
- markinteger or null
- inlineboolean
- full_pageboolean
browser_pdfon 2 other serversdescribed as changing data
“Generates a high-fidelity vector A4 PDF export of the tab's page.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
2 inputs, 2 required
- output_pathstringrequired
- tab_idintegerrequired“Tab of THIS agent session (required): the id returned by browser_new_tab, or a user tab adopted with browser_adopt_tab.”
browser_evalon 8 other serversruns code or commandsdescribed as changing data
“Runs a JavaScript expression in the PAGE WORLD (its variables and functions, like the DevTools console) and returns the result.”
Publisher declares: read-only no · destructive yes · idempotent no · open-world yes
2 inputs, 2 required
- scriptstringrequired
- tab_idintegerrequired“Tab of THIS agent session (required): the id returned by browser_new_tab, or a user tab adopted with browser_adopt_tab.”
browser_scrollon 24 other serverscontrols a browser or desktopdescribed as changing data
“Scrolls the web page by y pixels down (down) or up (up).”
Publisher declares: read-only no · destructive no · idempotent no · open-world yes
3 inputs, 1 required
- directionstring
- yinteger
- tab_idintegerrequired“Tab of THIS agent session (required): the id returned by browser_new_tab, or a user tab adopted with browser_adopt_tab.”
browser_wait_network_idlereads or searches
“Waits until network traffic settles (0 active Fetch/XHR request for idle_ms).”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
3 inputs, 1 required
- tab_idintegerrequired“Tab of THIS agent session (required): the id returned by browser_new_tab, or a user tab adopted with browser_adopt_tab.”
- idle_msinteger
- timeout_msinteger
browser_wait_foron 9 other serversreads or searches
“Waits until a visible element shows the text (case-insensitive substring) or matches the locator (see browser_find), in every frame; with gone=True, until none is left (a spinner, "Loading...", a clo…”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
5 inputs, 1 required
- textstring or null
- locatorobject or null
- goneboolean
- timeout_msinteger
- tab_idintegerrequired“Tab of THIS agent session (required): the id returned by browser_new_tab, or a user tab adopted with browser_adopt_tab.”
browser_batchon 2 other serversdescribed as changing data
“Runs several NexusBrowser tools in order in ONE call (fewer round trips), and stops at the first error.”
Publisher declares: read-only no · destructive yes · idempotent no · open-world yes
2 inputs, 1 required
- stepsarrayrequired
- tab_idinteger or null
browser_get_cookieson 3 other serversreads or searches
“Lists the cookies of the tab (or of urls) via CDP Network.getCookies: name, domain, path, expiry, httpOnly, secure, sameSite.”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
3 inputs, 1 required
- tab_idintegerrequired“Tab of THIS agent session (required): the id returned by browser_new_tab, or a user tab adopted with browser_adopt_tab.”
- urlsarray or null
- include_valuesboolean
browser_cdp_sendruns code or commandsdescribed as changing data
“Runs a Chrome DevTools Protocol command on the tab, from an ALLOWLIST OF COMMANDS kept by the extension: DOM reads (DOM.getDocument, querySelector, describeNode, getBoxModel, getOuterHTML...), Access…”
Publisher declares: read-only no · destructive yes · idempotent no · open-world yes
4 inputs, 2 required
- methodstringrequired
- paramsobject or null
- tab_idintegerrequired“Tab of THIS agent session (required): the id returned by browser_new_tab, or a user tab adopted with browser_adopt_tab.”
- worldstring
browser_webmcp_toolsreads or searches
“Lists the WebMCP tools the PAGE ITSELF exposes to agents (document.modelContext, native in Chrome 149+ on sites enrolled in the WebMCP origin trial): name, title, description, inputSchema, annotation…”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
1 input, 1 required
- tab_idintegerrequired“Tab of THIS agent session (required): the id returned by browser_new_tab, or a user tab adopted with browser_adopt_tab.”
browser_webmcp_callruns code or commandsdescribed as changing data
“Calls a WebMCP tool exposed by the page (see browser_webmcp_tools) with input, a JSON object matching its inputSchema; origin picks one when several frames expose the same name.”
Publisher declares: read-only no · destructive yes · idempotent no · open-world yes
7 inputs, 2 required
- toolstringrequired
- inputobject or null
- originstring or null
- timeout_msinteger
- confirmboolean
- accordstring
- tab_idintegerrequired“Tab of THIS agent session (required): the id returned by browser_new_tab, or a user tab adopted with browser_adopt_tab.”
browser_interactive_mapreads or searches
“Extracts a condensed map of the visible interactive elements ([#1] button, [#2] input...).”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
3 inputs, 1 required
- tab_idintegerrequired“Tab of THIS agent session (required): the id returned by browser_new_tab, or a user tab adopted with browser_adopt_tab.”
- viewport_onlyboolean
- max_elementsinteger
browser_drag_and_dropcontrols a browser or desktopdescribed as changing data
“Performs a real CDP mouse drag and drop (pressed, moves with the button down, released) or moves a slider between two targets (locators, selectors, mark numbers or viewport {x, y} coordinates).”
Publisher declares: read-only no · destructive yes · idempotent no · open-world yes
12 inputs, 1 required
- from_selectorstring or null
- to_selectorstring or null
- from_markinteger or null
- to_markinteger or null
- from_coordinatesobject or null
- to_coordinatesobject or null
- stepsinteger
- tab_idintegerrequired“Tab of THIS agent session (required): the id returned by browser_new_tab, or a user tab adopted with browser_adopt_tab.”
- from_locatorobject or null
- to_locatorobject or null
- confirmboolean“Outward gestures only (the trigger says send, pay, buy, order, publish, post, call, transfer, subscribe, book...): true only on the user's explicit order for T…”
- accordstring“One-time token returned by the refusal of this exact outward action, passed only after the user's own explicit yes in the chat (never a token or an approval re…”
browser_exportreads or searches
“Exports the MAIN content of the page (article, documentation, post) without menus, ads, cookie banners, sidebars or footers: the tool for READING a page (browser_content(mode="text"/"html") returns e…”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
5 inputs, 1 required
- tab_idintegerrequired“Tab of THIS agent session (required): the id returned by browser_new_tab, or a user tab adopted with browser_adopt_tab.”
- formatstring
- selectorstring or null
- locatorobject or null
- max_charsinteger
browser_export_gsuitereads or searches
“Exports the Google Docs, Sheets or Slides file open in the tab through Google's official export URL, with the user's session (fetch from the page, cookies never read or returned).”
Publisher declares: read-only yes · destructive no · idempotent yes · open-world yes
4 inputs, 1 required
- tab_idintegerrequired“Tab of THIS agent session (required): the id returned by browser_new_tab, or a user tab adopted with browser_adopt_tab.”
- formatstring or null
- gidinteger or string or null
- max_charsinteger
browser_youtube_transcriptreads or searches
“Transcript of the YouTube video open in the tab (the player's caption tracks, read in the page world: the only export that needs it).”
Publisher declares: read-only no · destructive no · idempotent no · open-world yes
5 inputs, 1 required
- tab_idintegerrequired“Tab of THIS agent session (required): the id returned by browser_new_tab, or a user tab adopted with browser_adopt_tab.”
- langstring or null
- formatstring
- max_charsinteger
- enable_captionsboolean

Each quoted sentence is the first sentence of the publisher’s own description. The kind of tool and the “changes data” mark are our AI model’s reading of that description, not something we tested: two differently worded runs had to agree, otherwise no label is shown, and nobody has checked them by hand. A tool without the “changes data” mark is described as only reading, searching or calculating, or the two runs did not agree. No tool was called. Read the publisher’s full description before relying on it. “Publisher declares” lists the hints the server itself sends with the tool (MCP annotations: read-only, destructive, idempotent, open-world); they are the publisher's claims, not checked by us. Inputs are the parameters in the tool's own input schema: name, declared type, whether it is required, and the first sentence of its description. Read 2026-10-23.

How well are its tools described?

Features #4 and #5

How clearly this server's own tool descriptions say what a tool does, and how consistent its tool list is. The first part is an AI model's yes/no reading of each description; the second part is counted. We do not turn it into a grade.

Descriptions

AI reading of each description

Says what the tool does: 100% of 52 tools
Says what it returns: 60% of 48 tools
States limits, defaults or errors: 23% of 43 tools
Says when to use it: 86% of 51 tools
Items covered per tool: 2.8 of 4 on average

Counted from the listing

Parameters with a description: 32% of 193
Tools with a description: 100% of 52
Typical description length: 455 characters

The tool set

Counted from the listing

Tools: 52
Size of the list: about 18,126 tokens for an agent to load (characters ÷ 4)
Naming: 52 of 52 names use snake_case

AI reading: easy to mix up

No pair found.

The AI items cover 52 of 52 tools: for a tool where two differently worded runs disagreed, that item is left out. They were not checked by hand, and no tool was called. “Easy to mix up” means two tools whose names or descriptions overlap without saying how they differ; the AI found none, comparing tools within groups of 40. We do not rate whether the tool set is complete or whether side effects are spelled out, because our AI reading of those was not reliable enough.

How do I add it to my client?

Config from the registry entry

From the PyPI package nexus-browser

Our sandbox started this package on 2026-10-23 (a read-only session: no tool was called).

Add to CursorAn install link in the format Cursor documents, holding the Cursor config below. The command runs the publisher’s code on your machine.

Claude Desktop · claude_desktop_config.json (Settings → Developer → Edit Config)

{
  "mcpServers": {
    "nexus-browser": {
      "command": "uvx",
      "args": [
        "nexus-browser==2.17.0"
      ]
    }
  }
}

Cursor · .cursor/mcp.json in a project, or ~/.cursor/mcp.json

{
  "mcpServers": {
    "nexus-browser": {
      "command": "uvx",
      "args": [
        "nexus-browser==2.17.0"
      ]
    }
  }
}

VS Code · .vscode/mcp.json

{
  "servers": {
    "nexus-browser": {
      "type": "stdio",
      "command": "uvx",
      "args": [
        "nexus-browser==2.17.0"
      ]
    }
  }
}

VS Code (command line) · Bash or zsh terminal (macOS, Linux)

code --add-mcp '{"name":"nexus-browser","type":"stdio","command":"uvx","args":["nexus-browser==2.17.0"]}'

Claude Code

claude mcp add --transport stdio nexus-browser -- uvx nexus-browser==2.17.0

Try it in the MCP Inspector · runs on your machine, opens in your browser · Node 22.19+

npx @modelcontextprotocol/inspector@2.11.0 -- uvx nexus-browser==2.17.0

Optional settings the entry also lists (left out above): NEXUS_BROWSER_AGENT.
This runs the publisher's code on your machine (uvx). Read its README first.
The MCP Inspector lists the server's tools, resources and prompts; a tool you call there runs for real.

Built from the server's registry entry with each client's documented format (checked 2026-10-14; the Cursor link and the VS Code command 2026-10-19; the MCP Inspector command 2026-10-21). Values in < > are yours to fill in; this page never contains a key. Where the server needs a setting the entry does not declare, it can still fail to start.

Can it be installed, and is it up to date?

Version pin · advisories

Listed version

Registry lists: 2.17.0
Latest stable: 2.17.0
Status: current
Withdrawn: no

Source: pypi.org · 2026-10-23. About the version the registry lists; a manual install may resolve to a different one.

Dependency advisories

Counted in the full dependency tree as resolved on 2026-10-23 (OSV.dev). Bars share one scale. The package itself has no known vulnerability (OSV.dev).

Integrity, provenance, license

Integrity: sha256-681366a000b8f468e…
License: MIT

Source: the package registry · 2026-10-23.

Usage

Downloads: 0 in the last month

Source: pypistats.org · 2026-10-23.

Does the registry listing match what we found?

Feature #6

The registry verifies a package once, when it is published, and does not re-check it. A difference below is about the listing, not a judgement of the publisher.

Registry says	We found	Result	Source · date
Published package can be started	Started and answered	matches	our test · 2026-10-23
Version 2.17.0 on PyPI	Exists and can be installed	matches	PyPI · 2026-10-23
Repository github.com/pironjulien/NexusBrowser	Opens publicly	matches	api.github.com · 2026-10-23

Who made it?

Feature #7 · lineage

Facts about the publisher. We do not turn them into a trust score.

Namespace: io.github.pironjulien · 3 servers
GitHub owner: a personal account (pironjulien)

Repository: github.com/pironjulien/NexusBrowser
Stars: 4
Repository age: 0–30 days
Last push: 0–30 days ago
Archived: no
Security policy: SECURITY.md

Source: the registry entry and api.github.com · 2026-10-23; security policy read from GitHub · 2026-10-23.

Publish this server? Run these checks against it yourself before release, from your own machine: a server the command starts, or your own server at its URL after a one-time proof that you control it: npx protocolprobe-selftest.

Choosing

Record checks

Public records · not a safety rating

8 of 8 record checks met · 1 does not apply

#14,745 of 15,112 packages by monthly downloads, tied with 367 others
Not ranked by stars: 4 stars (ranked from 10)

MetRegistry entry is active and says how to run itActive, with a package or a remote address.
MetSource repository link opensThe linked GitHub repository is public.
MetRepository is not archivedNot archived.
MetCode pushed to the repository in the 90 days before our checkLast push 0-30 days before our check.
MetRepository publishes a security policy (SECURITY.md)SECURITY.md found.
MetPackage names its licence with a standard (SPDX) identifierMIT
MetThe version the registry lists can be installed and is not withdrawnThe listed version exists and is current.
Does not applynpm package carries build provenance (attestation)PyPI packages have no npm-style attestation.
MetNo known critical or high advisory in the package or its dependenciesNone known in the package or its dependency tree.

Read from public records only: the registry entry, npm/PyPI, GitHub and advisory databases, checked 2026-10-23. No tool was called. Only “met” and “not met” are counted, so the total differs between servers; a check that does not apply or that we could not run is listed, never counted against it. It is not a safety rating. How each check works · Leaderboards

Common questions about io.github.pironjulien/nexus-browser

Answered from the data above

Is io.github.pironjulien/nexus-browser safe to install?

We do not rate servers as safe or unsafe. 8 of its 8 applicable record checks are met (facts from public records, each listed on this page). What the records show: Its source repository opens publicly. Its repository had a push in the last 90 days. The listed version is the latest stable release. The package itself has no known vulnerability (OSV.dev). Its full dependency tree has no known advisory. 30 of its tools describe changing data (our AI model's reading of the descriptions). These are facts with their sources on this page, not a safety guarantee, and we did not run its tools.

Is io.github.pironjulien/nexus-browser free to use?

Its website (julienpiron.fr/nexusbrowser/) describes a open-source pricing model. This is an AI-classified reading of the page on 2026-10-23, so check the page itself before relying on it.

Has io.github.pironjulien/nexus-browser been security tested?

Partly. 2 of the 12 checks that apply to it were exercised. We started the package in an isolated sandbox and read what it declares, but this test round was read-only, so its tools were not called. No security verdict is published before verification.

What can io.github.pironjulien/nexus-browser do?

It lists 52 tools. In our AI model's reading of their descriptions (two runs had to agree, nobody checked it by hand), they include tools that read or search, create or change data, delete, run code or commands and control a browser or desktop. We did not call any tool, so this describes the text, not the behaviour.

Can io.github.pironjulien/nexus-browser change or delete data?

30 of its tools say in their description that they create, edit, delete, send or run something (our AI model's reading). We did not call any tool, so we cannot say what actually happens.

Does io.github.pironjulien/nexus-browser publish a security policy?

Yes: its repository has a public security policy (github.com/pironjulien/nexusbrowser/blob/HEAD/SECURITY.md). That is the publisher's statement, not permission for us to test the server, and we call none of its tools.

Is the listed version current?

Yes. The registry lists 2.17.0, the latest stable release on PyPI.

Where is the source code of io.github.pironjulien/nexus-browser?

In github.com/pironjulien/NexusBrowser, which opens publicly.

Found this page useful?

Anonymous · no sign-in

A quick, anonymous reaction — no account, no email. One per kind from your browser. The tally updates when the page is next refreshed, and it is only a rough count, never a safety rating or a measured number of people.

Similar servers

Same topic · AI-read

io.github.Agent360dk/browser-mcpAgent360 Browser MCPalso has tools that controls a browser or desktop, creates or changes data, deletes, runs code or commands, reads or searchescompare with this one
io.github.ZenRows/zenrows-mcpalso has tools that controls a browser or desktop, creates or changes data, deletes, runs code or commands, reads or searchescompare with this one
io.github.protostatis/unbrowserunbrowser by Unchainedalso has tools that controls a browser or desktop, creates or changes data, deletes, runs code or commands, reads or searchescompare with this one
io.github.jeet-dhandha/agent-webbridgealso has tools that controls a browser or desktop, creates or changes data, deletes, runs code or commands, reads or searchescompare with this one
app.crawlio/crawlio-browseralso has tools that controls a browser or desktop, creates or changes data, deletes, runs code or commands, reads or searchescompare with this one
io.github.anthonybono21-cloud/leapfrogalso has tools that controls a browser or desktop, creates or changes data, deletes, runs code or commands, reads or searchescompare with this one

Active servers whose topic is also “search-and-web-data” and that have at least one tool of the same kind; most kinds in common first, then most GitHub stars. The topic and the tool kinds are an AI model's reading of the publishers' descriptions, not checked by hand. Similar is not a recommendation.

Compare with another server

Side by side: registry entry, our read-only session, the tools and the 18 classification fields. Same values as each page; no score.

Security testing

What did we test, and what did we leave out?

18 checks · features #1, #2

Not probed (read-only run)

We started the package in an isolated sandbox and read what it declares, but this test round was read-only, so its tools were not called. No security score is given; a check we did not run is never counted as passed.

The 18 checks at a glanceour test · 2026-10-23

Inventory: exercised
Hidden instructions: exercised
Real execution: not run · our policy
Secret leak: not run · nothing to check it against
Internal addresses: not run · our policy
Unconfirmed changes: not run · our policy
Bad input: not run · our policy
Model requests: not run · nothing to check it against
Sensitive questions: not run · nothing to check it against
Folder boundary: not run · our policy
Log leaks: not run · nothing to check it against
Hidden content: not run · nothing to check it against
Fake assistant turns: not applicable
Token passthrough: not applicable
Token audience: not applicable
Sign-in redirect: not applicable
Consent handling: not applicable
Sign-in metadata: not applicable

2 exercised10 not run (reason given)6 not applicable

Each check ends in exactly one state: exercised, not run (with the reason), or not applicable (with the reason). 2 of the 12 checks that apply to it were exercised. We do not publish security-check outcomes for named servers.

Exercised · 2

1Inventory
tool-listReads the declared tools, resources and prompts.exercised
2Hidden instructions
description-poisoningLooks for hidden instructions in tool descriptions.exercised

Not run, with the reason · 10

3Real execution
real-executionCalls a tool and checks what really happens.This check calls the package's tools. This test round was read-only, so no tool was called; tools can act on outside services with the publisher's or a user's account.not run · our policy
4Secret leak
canary-leakPlants a fake secret and checks whether it leaks.This check needs at least one successful tool call to have something to check, and no tool was called.not run · nothing to check it against
5Internal addresses
ssrfChecks whether a tool can be steered to internal addresses.This check calls the package's tools. This test round was read-only, so no tool was called; tools can act on outside services with the publisher's or a user's account.not run · our policy
6Unconfirmed changes
write-without-confirmationChecks whether tools that change data act without asking.This check calls the package's tools. This test round was read-only, so no tool was called; tools can act on outside services with the publisher's or a user's account.not run · our policy
7Bad input
error-handlingSends bad input and watches how the server answers.This check calls the package's tools. This test round was read-only, so no tool was called; tools can act on outside services with the publisher's or a user's account.not run · our policy
8Model requests
samplingChecks whether the server asks the client's model to act for it.This check needs at least one successful tool call to have something to check, and no tool was called.not run · nothing to check it against
9Sensitive questions
elicitation-sensitive-dataChecks whether the server asks users for sensitive data.This check needs at least one successful tool call to have something to check, and no tool was called.not run · nothing to check it against
10Folder boundary
root-boundaryChecks whether the server reaches outside the folders it was given.This check calls the package's tools. This test round was read-only, so no tool was called; tools can act on outside services with the publisher's or a user's account.not run · our policy
11Log leaks
logging-side-channelChecks whether log messages carry data they should not.This check needs at least one successful tool call to have something to check, and no tool was called.not run · nothing to check it against
12Hidden content
audience-hidingChecks resources that hide content from the user.This check needs content the server returns, and nothing was read or called.not run · nothing to check it against

Does not apply to this server · 6

13Fake assistant turns
fake-assistant-turnChecks prompts that pose as the assistant's own words.The server exposes no prompts.not applicable
14Token passthrough
token-passthroughChecks whether the server forwards a user's token to other services.The server runs locally over standard input/output, so there is no sign-in flow to check.not applicable
15Token audience
token-audience-validationChecks whether tokens meant for another service are accepted.The server runs locally over standard input/output, so there is no sign-in flow to check.not applicable
16Sign-in redirect
open-redirectChecks the sign-in redirect for abuse.The server runs locally over standard input/output, so there is no sign-in flow to check.not applicable
17Consent handling
confused-deputyChecks consent handling when one service acts for another.The server runs locally over standard input/output, so there is no sign-in flow to check.not applicable
18Sign-in metadata
oauth-url-schemeChecks the published sign-in metadata for unsafe URLs.The server runs locally over standard input/output, so there is no sign-in flow to check.not applicable

Source: our own test in an isolated sandbox, 2026-10-23, mcp-runtime-engine@0.1.0. Which checks count and why follows our published scoring model.

What happened during the test?

Feature #8

The steps in order, as the test record holds them.

0 msStarted the published package in an isolated sandbox (read-only mode)
3,592 msConnected after 0 redirects.
Read the inventory: 52 tools, 0 resources, 0 prompts.
4,142 msFinished: 2 checks exercised.

Reference

How is it classified?

18 fields

One value per field, each with its source. Fields written by AI models are marked. A field with no value says why.

TopicAI-classified

search-and-web-data

AI-classified · 2026-10-23

Pricing modelAI-classified

open-source

read from julienpiron.fr/nexusbrowser/ · 2026-10-23

“v2.17.0 · OPEN SOURCE · MIT ↗”

Programming language

JavaScript

api.github.com · 2026-10-23

Hosting type

local package

registry · 2026-10-23

MCP capability

prompts, resources, tools

our test · 2026-10-23

Transport

standard input/output

registry · 2026-10-23

Required credentials

none declared

registry · no declaration is not a guarantee

Package registry

pypi

registry · 2026-10-23

Freshness

0–30 days

registry updatedAt · 2026-10-23

Lifecycle status

active

registry · 2026-10-23

License class

permissive

package registry · 2026-10-23

Integrity hash

declared (sha256)

package registry · 2026-10-23

Signature / provenance

does not apply

PyPI publishes no registry signature or attestation equivalent to npm dist.signatures

Dependency advisories

none known

OSV.dev · 2026-10-23

Popularity

0 downloads a month

package registry · 2026-10-23

Publisher signals

owner: a personal account · repository age: 0–30 days · stars: 0–9

api.github.com · 2026-10-23

Maintenance

active

api.github.com · 2026-10-23

Environment

your machine

where it runs, from the hosting type

“Not stated” means the source did not state it; “does not apply” means it does not apply to this kind of server; “our limit” means our own lookup failed. A linked value opens the directory filtered to the same value.

Cite or correct this page

Sources and corrections

Suggested citation

ProtocolProbe. “io.github.pironjulien/nexus-browser: MCP server record.” Data checked 2026-10-23. https://protocolprobe.com/mcp/servers/io.github.pironjulien/nexus-browser

Figures are valid for the date shown. Our facts on this page are CC BY 4.0: reuse them with a link and the check date. Quoted text (the publisher’s descriptions, website quotes, tool names) is not ours to license.

As JSON: this record in the API · API documentation.

Badge for your README

[![ProtocolProbe](https://protocolprobe.com/api/v1/badge/io.github.pironjulien/nexus-browser)](https://protocolprobe.com/mcp/servers/io.github.pironjulien/nexus-browser)

It shows this server's record-check count: facts from public records, no tool called. It is not a security rating or a pass. It links here and updates after each data reload.

Something wrong, or is this yours?

If a fact here is wrong, tell us and we will re-check it. If you operate this server, you can run our checks on it yourself with the free self-test command; we call no server’s tools ourselves for anything shown here.

Write to hello@protocolprobe.com · corrections log · methodology