Browserbase MCP server: setup & sharing

Cloud browser sessions for remote teammates — page actions need your approval.

Run on your machine

Start the server on your host machine. Tools not listed in --allow are completely hidden from the agent.

Terminal · Host machine

npx -y @mcpwire/cli share \
  --name browserbase \
  --allow "start,navigate,observe,extract,end" \
  --redact-secrets \
  -- npx -y @browserbasehq/mcp@3.0.0

Exposes 5 default tools with pattern-based secret redaction. Optionally set an expiry with --ttl 30m, prompt for approvals with --confirm, or limit calls with --max-calls 20.

Connect your teammate’s agent

MCPWire prints a unique wire://... ticket in your terminal. Send it privately to your teammate to paste into their MCP client:

Claude Desktop · Cursor · Windsurf config

{
  "mcpServers": {
    "browserbase": {
      "command": "npx",
      "args": [
        "-y",
        "@mcpwire/cli",
        "join",
        "wire://<TICKET_FROM_HOST>"
      ]
    }
  }
}

Replace <TICKET_FROM_HOST> with the active session ticket. The agent can only discover and call the tools exposed above.

Scoped tool permissions

MCPWire acts as a Layer 7 JSON-RPC firewall. Requests for blocked tools are dropped on the wire before ever touching your machine.

Tool	Default Policy	Notes
`start`	Allowed	Starts a cloud browser session.
`navigate`	Allowed	Opens a URL in the session.
`observe`	Allowed	Lists actionable elements on the current page.
`extract`	Allowed	Reads structured content from the current page.
`end`	Allowed	Ends the browser session.
`act`	Blocked (Review)	Clicks, types, and submits on live pages — a prompt-injected page can steer it, so review each action.

Test and verify

Try these recommended prompts to confirm the agent receives expected outputs and that restricted actions fail safely.

Try Browserbase

Set BROWSERBASE_API_KEY and BROWSERBASE_PROJECT_ID in the host environment. This is Browserbase’s official server; sessions run in your cloud project.

Ask the agent to start a session, navigate to a page, and extract its content. Reading is fine to delegate; act performs real clicks and form submissions on whatever page is loaded, including pages a guest chooses, so it stays outside the default allowlist. Content from hostile pages is untrusted input for the agent — keep sessions to sites you accept exposing.

The generated command above contains the catalog’s explicit default allowlist. Check the guest’s tool list before making calls and use the server’s argument schema for required fields. See the CLI guide for guest configuration and session controls for approvals, redaction, and expiry.

Review the session in your browser: Add --record session.wirelog to your host command. Drop the resulting file into the Session Replay Viewer to inspect timestamps, latency, blocked attempts, and secret scrubbing.

← All server guides Open in command builder