OpenCode's Browse lets any MCP agent drive your real browser, logins included

Anomaly, the company behind OpenCode, has a new tool called Browse: an MCP server plus a Chromium extension that let coding agents work in your own browser, with your tabs, logins and extensions. The code is MIT-licensed. The npm package first appeared on 30 October and reached version 0.0.14 on 7 November, so this is an early release that updates itself often.

What it does

Agents get a browse MCP server. They open and drive tabs with Playwright, take screenshots, record the screen and capture network traffic as a HAR file. Agent tabs open in the background, in collapsed tab groups, so they stay out of your way. When a step needs you, such as a login, a 2FA prompt or a payment, the agent hands the tab back and waits until you click Continue. You can also lend an agent a tab you already have open from the toolbar button.

It works in Chrome, Edge, Brave, Arc, Helium, Vivaldi, Opera and Chromium, and the installer can register the MCP server with OpenCode, Claude Code, Cursor, Codex, Zed and other clients. Install starts from the Chrome Web Store extension, which walks you through pairing; a curl install script and npm install -g @opencode/browse also exist.

The safety design

Because agents act inside sessions you are signed in to, the README assumes that pages and emails an agent reads may try to steer it. Its documented guardrails:

• The local relay listens on 127.0.0.1 only and needs a token; each browser pairs once with a one-time code and gets its own key.
• Agents only use tabs they opened or you lent them, and only a real click finishes a handoff, so a page cannot fake one.
• Cookie reads are limited to the session’s own pages, and clearing cookies or site data, or closing the browser, is always refused.
• Opt-in domain allowlists keep a session’s tabs on the sites you name. The README notes that subresources such as images, fetches and iframes are not blocked.
• Stored site secrets are typed only into fields on a matching origin and never enter results or logs. The README is blunt that agent code in its execute sandbox “is not a security boundary”: treat it as code running as you.

Browse also updates itself automatically by default, every hour at most; you can switch that to notify-only or off.

Why this matters

Browse’s pitch is that agents stop stalling at login pages because they use sessions you already have. That also puts an agent inside your real accounts, which is exactly where prompt injection through the data agents read does the most damage. If you try it, turn on allowlists for each session and keep 2FA and payments as handoffs rather than stored secrets, as the README itself advises. For the agent itself, see what changed in OpenCode 2.0.