From 7d7eb46ac43851b5c9a95fa88d7e404b335eab3c Mon Sep 17 00:00:00 2001 From: "Tommy D. Rossi" Date: Sun, 16 Nov 2025 13:29:20 +0100 Subject: [PATCH] Update README.md --- README.md | 52 ++++++++++++++++++++++++++-------------------------- 1 file changed, 26 insertions(+), 26 deletions(-) diff --git a/README.md b/README.md index 6b1abad..70581a0 100644 --- a/README.md +++ b/README.md @@ -60,32 +60,6 @@ Once enabled on one or more tabs, your AI assistant can: The MCP will automatically start a relay server and connect to your enabled browser tabs. -## Security - -Playwriter is designed with security in mind, ensuring that only you can control your browser. - -### How It Works - -1. **Local WebSocket Server**: When the MCP starts, it launches a singleton WebSocket server on `localhost:19988` -2. **Dual Connection**: Both the Chrome extension and MCP client connect to this local server -3. **User-Controlled Access**: The extension can only control tabs where you explicitly clicked the extension icon (green icon indicates connected tabs) -4. **Localhost-Only**: The WebSocket server does not send CORS headers, preventing any web pages or remote servers from connecting to it - only processes running on your local machine can establish a connection -5. **Explicit Consent**: Chrome displays an "automation banner" on controlled tabs, making it obvious when a tab is being automated - -### What Can Be Controlled - -- **Only enabled tabs**: Tabs you explicitly connected by clicking the extension icon -- **New tabs created by automation**: Tabs created programmatically through Playwright commands -- **Nothing else**: Other browser tabs, your browsing history, or any tabs you haven't explicitly connected remain inaccessible - -### What Cannot Happen - -- **No remote access**: External websites or servers cannot connect to the WebSocket (localhost-only) -- **No passive monitoring**: The extension cannot read or monitor tabs you haven't connected -- **No automatic spreading**: The debugger won't automatically attach to new tabs you open manually - -This architecture ensures that browser automation only happens with your explicit permission on tabs you choose. - ### Using with Playwright You can use playwriter programmatically with playwright-core: @@ -148,3 +122,29 @@ Navigation: - `browsermcp_browser_press_key` - Press a key on the keyboard Utilities: - `browsermcp_browser_wait` - Wait for a specified time in seconds + +## Security + +Playwriter is designed with security in mind, ensuring that only you can control your browser. + +### How It Works + +1. **Local WebSocket Server**: When the MCP starts, it launches a singleton WebSocket server on `localhost:19988` +2. **Dual Connection**: Both the Chrome extension and MCP client connect to this local server +3. **User-Controlled Access**: The extension can only control tabs where you explicitly clicked the extension icon (green icon indicates connected tabs) +4. **Localhost-Only**: The WebSocket server does not send CORS headers, preventing any web pages or remote servers from connecting to it - only processes running on your local machine can establish a connection +5. **Explicit Consent**: Chrome displays an "automation banner" on controlled tabs, making it obvious when a tab is being automated + +### What Can Be Controlled + +- **Only enabled tabs**: Tabs you explicitly connected by clicking the extension icon +- **New tabs created by automation**: Tabs created programmatically through Playwright commands +- **Nothing else**: Other browser tabs, your browsing history, or any tabs you haven't explicitly connected remain inaccessible + +### What Cannot Happen + +- **No remote access**: External websites or servers cannot connect to the WebSocket (localhost-only) +- **No passive monitoring**: The extension cannot read or monitor tabs you haven't connected +- **No automatic spreading**: The debugger won't automatically attach to new tabs you open manually + +This architecture ensures that browser automation only happens with your explicit permission on tabs you choose.