Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/mock-server/mockserver-monorepo/browser-authnpx skills add mock-server/mockserver-monorepo --skill browser-authgit clone --depth 1 https://github.com/mock-server/mockserver-monorepoWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/mock-server/mockserver-monorepo/browser-auth)<a href="https://agentmods.dev/skills/mock-server/mockserver-monorepo/browser-auth"><img src="https://agentmods.dev/badge/skills/mock-server/mockserver-monorepo/browser-auth.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00093 | $0.01768 |
| Opus 5 | $0.00046 | $0.00884 |
| Sonnet 5 | $0.00019 | $0.00354 |
| Haiku 4.5 | $0.00009 | $0.00177 |
Grade A, and why
browser-auth scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 214 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Chrome DevTools MCP — Browser Authentication Patterns
Use the Chrome DevTools MCP server to interact with authenticated web pages (Buildkite, AWS Console, GitHub, etc.) through the user's existing Chrome browser session.
Prerequisites
- Chrome 144+ installed (check
chrome://version) - Chrome DevTools MCP configured in OpenCode (see Configuration below)
- User logged into target sites in their Chrome browser
Configuration
The MCP server is configured in ~/.config/opencode/opencode.json:
{
"mcp": {
"chrome-devtools": {
"type": "local",
"command": ["npx", "-y", "chrome-devtools-mcp@latest", "--autoConnect"]
}
}
}
Connection Modes
| Mode | Config | When to Use |
|---|---|---|
--autoConnect |
Connects to running Chrome via DevTools discovery | Recommended. Uses existing browser with cookies/sessions. Requires Chrome 144+ and enabling remote debugging in chrome://inspect/#remote-debugging. |
--browserUrl |
--browserUrl http://127.0.0.1:9222 |
When Chrome is launched with --remote-debugging-port=9222. Requires restarting Chrome with the flag. |
| (default) | No flags | Launches a fresh Chrome instance with no cookies, extensions, or password manager. Not suitable for authenticated pages. |
Enabling --autoConnect
- Open Chrome
- Navigate to
chrome://inspect/#remote-debugging - Enable the "Allow remote debugging connections" toggle
- Restart OpenCode so the MCP server reconnects
Using --browserUrl (Alternative)
If --autoConnect doesn't work, restart Chrome with the debugging port:
# Quit Chrome first, then relaunch:
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome \
--remote-debugging-port=9222 \
--user-data-dir="$HOME/Library/Application Support/Google/Chrome"
Update the MCP config:
"command": ["npx", "-y", "chrome-devtools-mcp@latest", "--browserUrl", "http://127.0.0.1:9222"]
Note: On macOS, --remote-debugging-port requires --user-data-dir to be
explicitly set (even if it's the default path). Without it, Chrome prints
"DevTools remote debugging requires a non-default data directory" and the
debugging server does not start.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 214 lines · 93 tokens per session scan A 15b2d7655e84
browser-auth is a skill published in the GitHub repository mock-server/mockserver-monorepo (4,964 stars, last pushed today), licensed Apache-2.0. It adds 93 tokens to every session and 1,768 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
js-in-html-testing
Test JS logic embedded in HTML using two-layer strategy - Python unit tests + Playwright browser integration tests.
playwright-screen-recording
Record browser test videos with Playwright for PR review and bug fix verification.
e2e-verify
面向 Bifrost 管理端的端到端 UI 与 API 验证工具。 适用于浏览器测试、场景回归、管理端接口验证与页面快照排查。 Use when: 端到端验证、功能验证、E2E 测试、UI 测试、浏览器测试、API 测试、接口验证.
site-cookie-login
Open a target website, wait for user login, verify login with required cookies plus an HTTP probe, and save cookies into .env for later automation. Use this when a site needs controlled browser login, cookie persistence, and automatic login-state checks.
aluvia
Use Aluvia when a cloud agent is in the wrong country for a site; when a page says not available in your region, this content is not available in your country, we don’t ship to your location, or other geo-restriction; when you need the browser to use an IP in a specific country (aluvia proxy-on --geo US; run aluvia…
browser-stealth
Browser automation stealth and residential proxy routing — patchright anti-detection, Playwright proxy at correct context level, sticky residential sessions, navigator.webdriver masking, datacenter vs residential IP fingerprinting, and page.evaluate fetch fallback.