Privacy Policy — BrowserMCP

Last updated: July 4, 2026

BrowserMCP ("the extension", "we") is a browser-automation tool that lets a local AI agent control your Chrome browser via the Model Context Protocol (MCP). This page explains what data the extension accesses, what it stores, and what it transmits.

Summary

• No data leaves your machine. All processing is local.
• No analytics, no tracking, no third parties.
• The only network endpoint is the optional local relay server you start yourself, bound to 127.0.0.1.

Data we access

To provide browser-control tools (click, type, screenshot, extract text, navigate, manage tabs, etc.) the extension needs to read and interact with the content of the web pages you explicitly target through an MCP tool call. This happens only when you invoke a tool — there is no background scraping or polling.

Data we store

The extension stores the following locally on your device via chrome.storage.local:

• Relay server status (on/off) and configured port number
• Optional Pro license key (validated locally; never transmitted)
• Temporary recording sessions for the start_recording / playback tools

No browsing history, no page content, no form input, and no credentials are written to persistent storage.

Data we transmit

The extension communicates only with the local relay server bound to 127.0.0.1 (default port 9275). All traffic stays on your machine.

The Content Security Policy (connect-src) restricts outbound connections to localhost and 127.0.0.1 only — the extension cannot reach any external host.

Permissions explained

• activeTab — only the tab you are currently interacting with is accessed, and only for the duration of a tool call.
• tabs — list, switch, create, and close tabs (no content from other tabs is read).
• scripting — inject JavaScript into a page to power click/type/extract tools, only on explicit tool calls.
• storage — save local preferences listed above.
• debugger — capture pixel-accurate screenshots via the Chrome DevTools Protocol.
• offscreen — host a persistent WebSocket to the local relay (MV3 service workers cannot hold WebSockets directly).
• host_permissions: <all_urls> — the extension is a general browser-control tool, so it must work on any page the user targets.

Children's privacy

BrowserMCP is not directed to children under the age of 13 and we do not knowingly collect any information from children.

Changes to this policy

We may update this policy as the extension evolves. The "Last updated" date above will reflect the most recent change. Material changes will be noted in the extension's release notes on GitHub.

Contact

Questions or concerns: torbi95@gmail.com
Source code & issue tracker: github.com/Tabtii/browser-mcp