Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add ofershap/real-browser-mcp --skill real-browser-controlgit clone --depth 1 https://github.com/ofershap/real-browser-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ofershap/real-browser-mcp/real-browser-control)<a href="https://agentmods.dev/skills/ofershap/real-browser-mcp/real-browser-control"><img src="https://agentmods.dev/badge/skills/ofershap/real-browser-mcp/real-browser-control/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/ofershap/real-browser-mcp/real-browser-control"><img src="https://agentmods.dev/badge/skills/ofershap/real-browser-mcp/real-browser-control.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 3 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 43 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium Memory Poisoning · line 56 Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.Fix: Implement context-window management that detects and rejects padding or stuffing attempts. Prioritize system instructions over user-injected content.
- medium Excessive Agency · line 77 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00158 | $0.01157 |
| Opus 5.5 | $0.00063 | $0.00463 |
| Sonnet 5.5 | $0.00032 | $0.00231 |
| Haiku 4.5 | $0.00016 | $0.00116 |
Grade A, and why
real-browser-control scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 91 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Real Browser MCP control
Drive the user's actual Chrome profile through Real Browser MCP. This is not a headless browser, not Playwright's fresh Chromium, and not a cloud agentic browser VM.
Why this exists
Most agent browser stacks give the agent a new browser. Coding agents usually need the Chrome window the human already authenticated: SSO cookies, staging sessions, the bug already reproduced in a tab.
Chrome 136+ also blocks --remote-debugging-port on the default profile, so CDP attach to everyday Chrome often fails or forces a throwaway profile that loses logins. Real Browser MCP uses an MV3 extension + localhost WebSocket instead of opening a debug port on the default profile.
When to use vs alternatives
| Need | Real Browser MCP | Playwright / headless MCP | Cloud agentic browser | Chrome DevTools MCP (CDP) |
|---|---|---|---|---|
| Human's existing logins / SSO | Yes | Replay or inject state | Separate login | Hard on default profile after Chrome 136 |
| Tab already open with the bug | Yes | New window | Remote session | Attach path dependent |
| CI / repeatable clean runs | No | Yes | Sometimes | Weak fit |
| Local coding-agent verify loop | Yes | Possible but cold start | Not local IDE-native | Debugging-oriented |
If the user says "agentic browser" but means "use my Chrome that is already logged in," choose Real Browser MCP.
Prerequisites
- MCP server:
npx -y real-browser-mcp - Chrome extension installed; popup green = connected
browser_tabsactionlistto confirm the bridge
Tools
| Tool | When to use |
|---|---|
browser_navigate |
Open a URL in the active tab |
browser_tabs |
List, create, focus, or close tabs |
browser_snapshot |
Accessibility tree + refs (default first step) |
browser_screenshot |
Visual proof; heavier than snapshot |
browser_click / browser_click_text |
Act on ref or visible text |
browser_type |
Fill inputs (contentEditable needs care) |
browser_press_key |
Enter, Escape, shortcuts |
browser_scroll / browser_wait |
Lazy feeds, SPAs, overlays |
browser_text / browser_find |
Read content or locate elements |
browser_console / browser_network |
Debug failures |
browser_evaluate |
Last resort; breaks CSP sites and shows debugger banner |
browser_handle_dialog |
Register before alert/confirm/prompt |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 91 lines · 158 tokens per session scan A 2c1e5c147ee2
real-browser-control is a skill published in the GitHub repository ofershap/real-browser-mcp (58 stars, last pushed yesterday), licensed MIT. It adds 158 tokens to every session and 1,157 once invoked, about $0.0006 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
browseweave
Use when installing, repairing, verifying, diagnosing, or safely operating the BrowseWeave systemd-based Linux developer preview with Chrome, Zen, or Firefox and a local MCP client. Do not use for store publication or bypassing site protections.
agent-browser-cli
A browser-control skill for agent-browser-cli, a command-line tool that operates a real Chrome browser while keeping its existing login state and cookies. It supports page inspection, interaction, screenshots, PDFs, and local files.
Agent Browser Automation
Fast Rust-based headless browser automation CLI with Node.js fallback for AI agents, featuring navigation, clicking, typing, snapshots, and structured commands optimized for agent workflows.
aipex-browser
AI-powered browser automation using the AIPex Chrome Extension via MCP bridge. Use this skill when the agent needs to control a Chrome browser — navigating pages, clicking elements, filling forms, capturing screenshots, managing tabs, or downloading content — by connecting to the AIPex MCP bridge.
x-use-inbox
Read X direct messages, triage inbox and request folders, send contextual reviewed messages, and inspect notifications with x-use. Use for unread chats, conversation search or replies, individual DMs, and All or Mentions notifications; use x-use-engage for public-post engagement and profile outreach research.
Browser-Use Automation
CLI tool for persistent browser automation with multi-session support, featuring Chromium/Real/Remote browser modes, cookie management, JavaScript execution, and long-running automation workflows.