Building a browser automation MCP server safely

# Building a browser automation MCP server safely Browser automation is powerful—and risky. Here’s how to wrap it in an MCP server with clear guardrails so agents can browse, click, and extract data without chaos. ## Capabilities, not carte blanche - Expose explicit tools: `navigate(url)`, `query(selector)`, `click(selector)`, `extract(table|links)`. - Require allowlisted domains; block raw `eval`. ## Validate inputs hard - URL parsing + domain checks; CSS selector whitelists for critical apps. ## Stream telemetry - Emit navigation events, DOM match counts, and error classes. ## Sandbox & scope - Run headless browser in a jailed process; cap time and memory. ## Logs and redaction - Log URLs and selectors; redact secrets; attach screenshots only when approved. --- A little discipline at the protocol edge turns risky crawling into a reliable capability agents can trust.