Hackbrowser MCP

The first browser MCP built for security testing.

Other browser MCPs let your AI fill forms and take screenshots.

This one lets it find vulnerabilities.

What It Does • How It's Different • Quick Start • Examples • Tools • Architecture

______________________________________________________________________

它的作用

Hackbrowserv mcp 为您的AI代理提供一个真正的Firefox浏览器和39个安全测试工具 模型上下文协议代理可以启动浏览器、浏览目标、捕获所有流量并测试漏洞——所有这些都可以通过自然语言完成。

You: "Log in as admin and as a regular user. Find endpoints the user shouldn't access."

Agent: → launches Firefox
       → creates two isolated containers (admin + user)
       → logs in both accounts
       → browses the app, captures traffic
       → compares responses across roles
       → "User can access GET /api/admin/users — should return 403, returns 200"

AI处理整个工作流程：启动浏览器、管理会话、发现端点、测试参数和生成安全报告。你描述要测试什么。它做剩下的。

______________________________________________________________________

这有什么不同

有几十个浏览器MCP。它们都做同样的事情：让LLM浏览页面、单击按钮和提取文本。它们是为 自动化 --填写表单、抓取数据、运行UI测试。

它们都不能测试漏洞。 这就是hackbrowser mcp填补的空白。

Other Browser MCPs hackbrowser-mcp

Purpose Web automation, scraping, form filling Security testing, vulnerability assessment

Sessions Single session 2-4 isolated containers with separate cookies, storage, and auth

Traffic Read-only network tab (if any) Full HAR capture + replay with modifications

Security tools None 14 tools: injection testing, CSRF, IDOR, access matrix, report generation

Injection testing Not possible 7 types, 60+ payloads, technique-labeled results

Access control Not possible Cross-role comparison, endpoint access matrix, IDOR detection

Browser Chromium (CDP) Firefox (WebDriver BiDi) — different engine catches different bugs

Anti-detection Varies Stealth mode built-in (fingerprint, UA, WebGL spoofing)

Specific comparisons with popular projects

所有这些都是达到预期目的的优秀工具。hackbrowser mcp并没有取代它们，它提供了一个完全不同的用例。

______________________________________________________________________

核心能力

多容器隔离

同时运行2-4个浏览器会话，每个会话 完全孤立 国家。这是访问控制测试的基础。

┌────────────────────────────────────────────────────────┐
│                     Firefox Instance                    │
├───────────────┬───────────────┬────────────────────────-┤
│  Container 1  │  Container 2  │  Container 3            │
│  role: admin  │  role: user   │  role: guest             │
│               │               │                         │
│  cookies: A   │  cookies: B   │  cookies: none          │
│  storage: A   │  storage: B   │  storage: none          │
│  session: ✓   │  session: ✓   │  session: ✗             │
└───────────────┴───────────────┴─────────────────────────┘

compare_access → "GET /api/admin/users returns 200 for user (expected 403)"
access_matrix  → role × endpoint grid showing every authorization gap

交通情报

每个HTTP请求和响应都被捕获、存储和查询。重新播放任何修改后的请求。

Browser → Network Interceptor → In-Memory Store (10K max, FIFO)
                                       │
                             ┌─────────┴──────────┐
                             │                     │
                       Auto-save (60s)       Replay / modify
                             │                     │
                             ▼                     ▼
                       HAR file (disk)      replay_request
                             │              (change method,
                       Resume on restart     headers, body)

主动安全测试

从捕获的流量中发现注入点，然后使用7种漏洞类型的60多个有效载荷对其进行测试。

当内置有效载荷被阻止时，AI代理会分析WAF响应，并使用 replay_request.

______________________________________________________________________

快速开始

安装

git clone https://github.com/user/hackbrowser-mcp.git
cd hackbrowser-mcp
bun install

连接到您的AI代理

Claude Desktop / Claude Code

添加到MCP配置(~/.claude/claude_desktop_config.json):

{
  "mcpServers": {
    "hackbrowser": {
      "command": "bun",
      "args": ["run", "/path/to/hackbrowser-mcp/src/index.ts", "--mcp"]
    }
  }
}

Cursor / Continue / other MCP clients

配置格式相同。将命令指向您的安装路径。

Standalone (no AI agent)

bun run src/index.ts --launch              # GUI mode
bun run src/index.ts --launch --headless   # headless
bun run src/index.ts --mcp                 # MCP server (stdio)

开始测试

You: "Launch the browser and scan https://target.com for vulnerabilities"

就这样，剩下的就交给特工了。

______________________________________________________________________

工作流示例

全面安全扫描

You: "Crawl https://app.com, find injection points, test them, generate a report."

Agent: browser_launch → navigate → crawl (100 pages)
       → find_injection_points → test_injection (SQLi, XSS)
       → test_csrf → test_rate_limit
       → generate_report
       → "Found 3 XSS, 1 SQLi, 2 missing CSRF tokens"

IDOR/访问控制审计

You: "Login as admin and regular user. Find what the user shouldn't access."

Agent: container_setup (admin + user) → container_login (both)
       → navigate admin pages → compare_access
       → access_matrix
       → "User can reach GET /api/admin/users (200 instead of 403)"

WAF旁路

You: "Test the search param for XSS. Bypass any WAF."

Agent: test_injection {types: ["xss"]} → all blocked
       → analyzes response:  stripped, events filtered
       → replay_request with  → REFLECTED
       → "Confirmed XSS via HTML5 ontoggle event bypass"

离线HAR分析

You: "Import this HAR file and find injection candidates."

Agent: import_har → get_endpoints (87 found)
       → find_injection_points (23 candidates)
       → test_injection → "2 reflected XSS confirmed"

______________________________________________________________________

工具参考（39个工具）

Browser Control (3)

Containers (3)

Navigation (4)

Interaction (7)

Page Inspection (4)

Traffic Capture (5)

Security Analysis (4)

Active Testing (3)

Auth Detection (3)

Discovery (2)

Reporting (1)

______________________________________________________________________

图书馆使用情况

使用hackbrowser mcp作为自定义工具的TypeScript库：

import {
  launchFirefox, closeFirefox,
  NetworkInterceptor, BrowserInteraction, Crawler,
  extractEndpoints, findInjectionPoints, testInjection,
  compareAccess, generateReport,
  buildHar, saveHar, loadHar,
} from "hackbrowser-mcp";

// Offline HAR analysis
const har = await loadHar("./capture.har");
const requests = harEntriesToRequests(har.log.entries);
const endpoints = extractEndpoints(requests);
const points = findInjectionPoints(requests);

console.log(`${endpoints.length} endpoints, ${points.length} injection candidates`);

______________________________________________________________________

建筑

src/
├── browser/                 Firefox control
│   ├── bidi-client.ts       WebDriver BiDi protocol
│   ├── cdp-client.ts        CDP fallback
│   ├── launcher.ts          Binary detection + profile setup
│   ├── container-manager.ts Container isolation + extension WS
│   ├── interaction.ts       Click, type, scroll, hover
│   ├── crawler.ts           BFS spider
│   └── auth-detector.ts     Session detection
├── capture/                 Traffic
│   ├── network-interceptor.ts  Capture + auto-save (10K cap)
│   ├── har-builder.ts          HAR 1.2 builder
│   └── har-storage.ts          HAR I/O + merge
├── analysis/                Security engines
│   ├── active-tester.ts     60+ injection payloads
│   ├── injection-mapper.ts  Param → vuln type mapping
│   ├── endpoint-extractor.ts  API endpoint discovery
│   ├── container-differ.ts  Cross-role comparison
│   ├── access-matrix.ts     Role x endpoint matrix
│   └── report-generator.ts  Report formatting
├── protocol/
│   ├── tools.ts             39 tool definitions (Zod schemas)
│   └── mcp-server.ts        MCP stdio transport
└── types/                   TypeScript types

设计决策：

• 火狐+BiDi先行 --本机Firefox协议。不同的渲染引擎会捕获Chrome工具错过的错误。CDP可作为后备方案。
• 容器隔离 --Firefox多帐户容器，实现真正的会话分离。没有单独的浏览器实例。
• 服务器端获取以进行测试 --主动测试使用 fetch() 在浏览器外部，以避免污染浏览器状态。
• HAR 1.2标准 --导入/导出会话连续性。每60秒自动保存一次，重启后恢复。
• 内存受限 --10K入场上限，FIFO驱逐。30秒获取超时。
• 默认情况下隐藏 — navigator.webdriverUA、插件、WebGL指纹都被欺骗了。

______________________________________________________________________

局限性

• 仅限Firefox（容器隔离需要Firefox多帐户容器）
• macOS/Linux（未测试Windows）
• 每个端口一个Firefox实例
• 未捕获WebSocket帧（仅升级请求）

______________________________________________________________________

For authorized security testing only.

Always obtain proper permission before testing any application.

MIT License • Built with Bun + TypeScript