browser-auth

browser-auth is a skill for Claude Code, Codex from mock-server/mockserver-monorepo. It costs 93 tokens per session (1,768 once invoked), scanned A, original, Apache-2.0.

Instructions for using Chrome DevTools, a browser inspection tool, with pages that require a login. It explains how to use the existing signed-in Chrome session to browse pages, read data, take screenshots, and complete login flows.

In plain words
What is it for?
Use it when working in signed-in Buildkite, AWS Console, GitHub, or other web interfaces, especially to inspect pages, collect configuration values, or capture screenshots.
Why use it?
It avoids having to copy credentials or set up a separate browser session when working with authenticated websites. It also documents the Chrome and tool settings needed for access.

Skill for Claude CodeCodex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/mock-server/mockserver-monorepo/browser-auth
Any agent
npx skills add mock-server/mockserver-monorepo --skill browser-auth
Clone the repo
git clone --depth 1 https://github.com/mock-server/mockserver-monorepo

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for browser-auth

README.md
[![agentmods](https://agentmods.dev/badge/skills/mock-server/mockserver-monorepo/browser-auth.svg)](https://agentmods.dev/skills/mock-server/mockserver-monorepo/browser-auth)
Your own site
<a href="https://agentmods.dev/skills/mock-server/mockserver-monorepo/browser-auth"><img src="https://agentmods.dev/badge/skills/mock-server/mockserver-monorepo/browser-auth.svg" alt="Measured on agentmods" height="20"></a>
Per session 93 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,768 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00093 $0.01768
Opus 5 $0.00046 $0.00884
Sonnet 5 $0.00019 $0.00354
Haiku 4.5 $0.00009 $0.00177

Measured 4d ago against content hash 15b2d7655e84, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

browser-auth scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.opencode/skills/browser-auth/SKILL.md · 214 lines

How it starts

The opening of the file, as written. The whole thing — 214 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Chrome DevTools MCP — Browser Authentication Patterns

Use the Chrome DevTools MCP server to interact with authenticated web pages (Buildkite, AWS Console, GitHub, etc.) through the user's existing Chrome browser session.

Prerequisites

  • Chrome 144+ installed (check chrome://version)
  • Chrome DevTools MCP configured in OpenCode (see Configuration below)
  • User logged into target sites in their Chrome browser

Configuration

The MCP server is configured in ~/.config/opencode/opencode.json:

{
  "mcp": {
    "chrome-devtools": {
      "type": "local",
      "command": ["npx", "-y", "chrome-devtools-mcp@latest", "--autoConnect"]
    }
  }
}

Connection Modes

Mode Config When to Use
--autoConnect Connects to running Chrome via DevTools discovery Recommended. Uses existing browser with cookies/sessions. Requires Chrome 144+ and enabling remote debugging in chrome://inspect/#remote-debugging.
--browserUrl --browserUrl http://127.0.0.1:9222 When Chrome is launched with --remote-debugging-port=9222. Requires restarting Chrome with the flag.
(default) No flags Launches a fresh Chrome instance with no cookies, extensions, or password manager. Not suitable for authenticated pages.

Enabling --autoConnect

  1. Open Chrome
  2. Navigate to chrome://inspect/#remote-debugging
  3. Enable the "Allow remote debugging connections" toggle
  4. Restart OpenCode so the MCP server reconnects

Using --browserUrl (Alternative)

If --autoConnect doesn't work, restart Chrome with the debugging port:

# Quit Chrome first, then relaunch:
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome \
  --remote-debugging-port=9222 \
  --user-data-dir="$HOME/Library/Application Support/Google/Chrome"

Update the MCP config:

"command": ["npx", "-y", "chrome-devtools-mcp@latest", "--browserUrl", "http://127.0.0.1:9222"]

Note: On macOS, --remote-debugging-port requires --user-data-dir to be explicitly set (even if it's the default path). Without it, Chrome prints "DevTools remote debugging requires a non-default data directory" and the debugging server does not start.

Read the full file on GitHub · 214 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 4d ago First seen · 214 lines · 93 tokens per session scan A 15b2d7655e84

Subscribe to this mod's changes

browser-auth is a skill published in the GitHub repository mock-server/mockserver-monorepo (4,964 stars, last pushed today), licensed Apache-2.0. It adds 93 tokens to every session and 1,768 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

js-in-html-testing

Test JS logic embedded in HTML using two-layer strategy - Python unit tests + Playwright browser integration tests.

liaohch3/claude-tap · 25 tokens

playwright-screen-recording

Record browser test videos with Playwright for PR review and bug fix verification.

liaohch3/claude-tap · 20 tokens

e2e-verify

面向 Bifrost 管理端的端到端 UI 与 API 验证工具。 适用于浏览器测试、场景回归、管理端接口验证与页面快照排查。 Use when: 端到端验证、功能验证、E2E 测试、UI 测试、浏览器测试、API 测试、接口验证.

bifrost-proxy/bifrost · 84 tokens

site-cookie-login

Open a target website, wait for user login, verify login with required cookies plus an HTTP probe, and save cookies into .env for later automation. Use this when a site needs controlled browser login, cookie persistence, and automatic login-state checks.

bifrost-proxy/bifrost · 53 tokens

aluvia

Use Aluvia when a cloud agent is in the wrong country for a site; when a page says not available in your region, this content is not available in your country, we don’t ship to your location, or other geo-restriction; when you need the browser to use an IP in a specific country (aluvia proxy-on --geo US; run aluvia…

aluvia-connect/aluvia · 143 tokens

browser-stealth

Browser automation stealth and residential proxy routing — patchright anti-detection, Playwright proxy at correct context level, sticky residential sessions, navigator.webdriver masking, datacenter vs residential IP fingerprinting, and page.evaluate fetch fallback.

LuuOW/meridian-mcp · 47 tokens