Architecture
No relay, no hosted runner, no browser in someone else’s data centre. The extension dials out to a daemon on loopback, because a Manifest V3 service worker cannot listen for connections. One daemon owns the browser link, so several MCP clients can share one browser.
The path an instruction takes
Each hop below is a separate process on your own machine. Nothing leaves it except the traffic your agent CLI already makes on its own.
Speak, type, or show it once
Dictate hands-free in the side panel, hold to talk in the popup, or just type. Work through a tedious job yourself once and it keeps every step.
Manifest V3, Chrome & Firefox
Weighs your instruction against a local grammar before anyone spends a token. Confident one-step commands fire right here, in milliseconds. Everything else travels on untouched.
Local WebSocket, loopback only
The extension dials out, because an MV3 service worker cannot listen. One daemon owns the browser link, so several MCP clients can share one browser.
claude, codex or agy
Reasons locally, spawned against the login you already have. Claude Code, Codex or Antigravity, switched with one click. No API client in the repository, no key to configure, no third-party relay.
The constraint that shapes everything
Manifest V3 replaced the persistent background page with a service worker that the browser is free to kill at any moment, and which cannot open a listening socket. So the extension dials out instead: it opens the WebSocket to a daemon already running on loopback.
Because the daemon owns the single connection, several MCP clients can share one browser without fighting over it. Claude Code in one terminal, Cursor in another, the side panel in the browser: all of them reach the same logged-in tab.
There is no relay to sign up for and no runner in a data centre. The daemon binds loopback, the extension is the only paired peer, and the agent CLI is the one you already installed and signed in to.
Before any of it connects
Any web page can open a WebSocket to loopback. That is why classification comes first, and a credential second.
The daemon classifies every peer by the Origin header, which the browser sets itself and a page cannot forge. A page fails here and never reaches the second gate.
A single-use code, valid for ten minutes, that you redeem yourself. It is traded for a long-lived session key bound to that same origin, which survives restarts and dies only when you revoke it.
Free and MIT licensed. Nothing to sign up for, no key to paste, and a fresh install connects to nothing until you redeem a pairing code yourself.
claude mcp add browsentic -- browsentic-mcp