Off by default
A fresh install connects to nothing. An unpaired extension never contacts the daemon at all, and pairing takes a single-use code you redeem yourself.
Security model
An agent driving your real browser has to earn it
Everything below is a property of how it is built, not a promise in a policy document. It is a local daemon, an extension that dials out to it, and no third party in between.
Properties, not promises
Six things that are true because of how it is built
Two independent gates
Any web page can open a WebSocket to loopback, so the daemon first classifies the peer by handshake Origin, which browsers set themselves and pages cannot forge, then requires a pairing token or a session key bound to that same origin. A web page can never reach the control path.
Consequential actions ask first
Approval prompts appear in the side panel with the action named. Form submission is gated by default, because it is the one effect that reaches someone other than you. Cancelling a run stops it mid-flight.
Recordings capture what you do, not what you type
A recording stores the identity of each field and a placeholder for its value. Keeping literal values is per-recording and off by default. Recording only ever starts from your own click or your own words.
Speech uses the browser’s own recognition
No model is bundled and nothing is downloaded. Chrome’s Web Speech API streams audio to Google to transcribe it, and replacing the speech engine is a one-file change.
State stays outside the repository
Pairing keys, logs, config, skills and screenshots live under ~/.browsentic and ~/browsentic. Never in your checkout, never in a commit.
Stated plainly
Two limits worth stating
Neither of these is a bug with a fix pending. They are the shape of the problem, and you should know them before you rely on any of this.
Pairing controls which browser, not which process
Anything running as your user can read the daemon lockfile and drive an already-paired browser.
A hostile page is still a hostile page
An agent reading one is susceptible to prompt injection. Treat page content as data, never as instructions.
On disk
Everything it writes lives outside your checkout
Pairing keys, logs, config, skills and screenshots go under your home directory. Never in your repository, never in a commit.
~/.browsentic
Config, the daemon lockfile, pairing keys and session keys, and logs. This is the private half.
~/browsentic
Skills, site maps, recordings, screenshots and files you attached. The half you are meant to read and edit.
Disclosure
Found something?
Report it privately through GitHub security advisories rather than a public issue, and it gets looked at before it gets published.
Stop describing the page. Hand it over.
Free and MIT licensed. Nothing to sign up for, no key to paste, and a fresh install connects to nothing until you redeem a pairing code yourself.
claude mcp add browsentic -- browsentic-mcp