MCP browser automation

Browser automation MCP servers let an agent drive a real browser — navigating, clicking, and reading pages. This ability carries significant responsibility because a browser can act on arbitrary web content and reach authenticated sessions.

Browser servers typically expose navigation and interaction tools and return page state for the agent to read. That read-back of live pages is where untrusted content can introduce prompt-injection risk.

A browser connected to a logged-in session can act as the user. Run browser automation in a constrained session and treat everything it reads as potentially hostile content.