mcp-server-browserbase

browserbase/mcp-server-browserbase

This MCP server provides cloud browser automation powered by Browserbase and Stagehand, allowing an AI agent to navigate websites, interact with elements, and extract page content. Its biggest risk is that running it in HTTP mode (--port) without specifying --host binds an unauthenticated server to all network interfaces (0.0.0.0 / ::), exposing the browser sessions and API keys to the local network.

What it can reach

Network

Connects to Browserbase cloud APIs and LLM provider APIs (Google Gemini or custom models), and optionally listens on a TCP port when --port is specified.

Browser

Creates and controls remote cloud browser sessions in Browserbase, including navigating to arbitrary URLs, interacting with page elements, and extracting page data.

Secrets

Reads BROWSERBASE_API_KEY, BROWSERBASE_PROJECT_ID, GEMINI_API_KEY, and GOOGLE_API_KEY from environment variables, .env files, or CLI arguments.

Files

Reads local .env configuration files and package.json on startup.

Findings

1. MediumHTTP transport binds to all network interfaces without authentication by default

   src/transport.ts:85

   Although the CLI help text and documentation state that --host defaults to localhost, no default value is set in src/program.ts or src/config.ts. When --port is used without --host, hostname is undefined, causing Node's httpServer.listen to bind to all network interfaces (0.0.0.0 / ::) while misleadingly printing localhost in the startup log. Because the /mcp endpoint has no authentication or Origin header check, anyone on the local network (or a malicious webpage via cross-origin requests or DNS rebinding) can connect, control browser sessions, and use the configured Browserbase and LLM API keys.

   Fix: Default hostname to "127.0.0.1" when --host is not provided, validate the Origin header to prevent DNS rebinding, and require authentication on the /mcp endpoint.

2. LowCustom model API keys must be passed via CLI arguments, exposing them in process listings

   src/config.ts:49

   When resolving modelApiKey, the code only checks GEMINI_API_KEY and GOOGLE_API_KEY in the environment (even though a warning message later mentions MODEL_API_KEY, process.env.MODEL_API_KEY is never read). Consequently, users configuring a non-Google model must pass --modelApiKey <key> as a command-line argument as shown in the README, which exposes the secret key in the system process table (ps) to other users on the machine.

   Fix: Read process.env.MODEL_API_KEY in resolveConfig before falling back to GEMINI_API_KEY or GOOGLE_API_KEY, and recommend environment variables instead of CLI arguments for secrets.