reflex-browser@0.4.12
VERIFIED· startup onlyPublisher claims: "Browser automation for AI agents: compressed page snapshots, batched actions, fewer tokens." Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Registry npm (MCP server) · listed in the official MCP RegistryPublisher reflexmcp · publishing for 154 daysInstalls 0Last detonated 12 h ago
Coverage
Startup only; authenticated tool behavior not tested.- Tested
- server startup over stdio (initialize sent) · every file read, file written and host contacted by what ran
- Not tested
- the tool list (the server exited before answering) · what the tools do when called with real credentials
What this means for the label: Verified here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.
Before you give it your token
- It will ask for
REFLEX_API_KEYConfiguration, not credentials: PLAYWRIGHT_BROWSERS_PATH, REFLEX_ALLOW_CROSS_ORIGIN_FETCH, REFLEX_API_BASE, REFLEX_CHROME_PROFILE, REFLEX_CHROME_USER_DATA, REFLEX_FAIL_SHOT, REFLEX_HEADED, REFLEX_HOME, REFLEX_IDLE_EXIT_MIN, REFLEX_MCP_EVAL, REFLEX_METER, REFLEX_OP_TIMEOUT_MS, REFLEX_PROFILE, REFLEX_PROFILE_DIR, REFLEX_PUBKEY_K1, REFLEX_REAP_INTERVAL_MIN, REFLEX_SESSION, REFLEX_SITE_BASE, REFLEX_SITE_MEMORY, REFLEX_STOP_ON_EXIT, REFLEX_TEST_SEAMS, REFLEX_VIEWPORT- Where it talks to
- reflexmcp.com (its own)Also workers.dev — not the publisher's domain; check what for before connecting.
- What the honeypot saw
- no credential files read · no network
- What we could not test
- the tool list (the server exited before answering) · what the tools do when called with real credentials
Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names workers.dev as well as its own vendor. The guard injects REFLEX_API_KEY only into requests to reflexmcp.com (and its subdomains) and refuses the rest.
$vet-skills run --secrets REFLEX_API_KEY=reflexmcp.com -- npx -y reflex-browser
Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; startup only; authenticated tool behavior not tested) on 2026-11-14 and scored it 83/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 27 s · 2 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
6.9sprocessdependency install exit 0
27sclaimedstartup only: exited (0) before answering · REFLEX_IDLE_EXIT_MIN minutes of no activity before the daemon exits (default 240; 0 = never) REFLEX_SITE_MEMORY set to 0 to disable per-site action-path priming on open (default on) REFLEX_OP_TIMEOUT_MS per-operation wall-clock cap in ms before abort + browser recycle (default 120000) REFLEX_REAP_INTERVAL_MIN how often to reap orphaned browsers from dead daemons (default 30;
27sprocessscript backend runs setup only
27sprocessno install scripts to re-run
Static findings
MEDIUM
File type combined with upload actionpackage.json:29 · File type combined with upload action — agent may exfiltrate local data files
AST07"check:web": "bash -c 'set -o pipefail; cd web && npm run typecheck 2>&1 | tee ../checks-outputs/web-type.txt && rm -rf .next && npm run build 2>&1 | tee ../checks-outputs/web-build.txt'",Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actionpackage.json:28 · File type combined with upload action — agent may exfiltrate local data files
AST07"check:server": "bash -c 'set -o pipefail; cd server && npm test 2>&1 | tee ../checks-outputs/server-test.txt && npm run typecheck 2>&1 | tee ../checks-outputs/server-type.txt'",Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actiondist/mcp.js:13 · File type combined with upload action — agent may exfiltrate local data files
AST07…on/json"},body:r?JSON.stringify(r):void 0,signal:s.signal}),c=null;try{c=await l.json()}catch{}return{status:l.status,json:c}}finally{clearTimeout(i)}}async function J(){let{status:e,json:t}=await Ue("POST","/v1/validate",{client_version:X…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actiondist/mcp.js:6 · File type combined with upload action — agent may exfiltrate local data files
AST07…reflex.js stop 2>/dev/null || true; npm test 2>&1 | tee checks-outputs/root-test.txt'","check:server":"bash -c 'set -o pipefail; cd server && npm test 2>&1 | tee ../checks-outputs/server-test.txt && npm run typecheck 2>&1 | tee ../checks-o…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actiondist/reflex.js:2 · File type combined with upload action — agent may exfiltrate local data files
AST07…)||"default",w=E(process.env.REFLEX_SESSION),b=e=>N.join(B,e==="default"?"daemon.json":`daemon-${e}.json`),he=b(w),J=N.join(__dirname,"daemon.js");function j(e){try{return JSON.parse(M.readFileSync(b(e?E(e):w),"utf8"))}catch{return null}}f…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actiondist/mcp.js:1 · File type combined with upload action — agent may exfiltrate local data files
AST07…|"default",q=C(process.env.REFLEX_SESSION),X=e=>oe.join(Ee,e==="default"?"daemon.json":`daemon-${e}.json`),ut=X(q),Se=oe.join(__dirname,"daemon.js");function ne(e){try{return JSON.parse(ke.readFileSync(X(e?C(e):q),"utf8"))}catch{return nul…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
npx invocation of non-well-known packagedist/daemon.js:10 · npx invocation of non-well-known package — may execute untrusted code
AST06…?"Automatic browser download failed. Install Google Chrome and restart, or run: npx playwright install chromium":l.message;throw new Error(`Reflex: could not start a browser.…Fix: Pin versions and sources; vendor anything fetched at install time.HIGH
Collapsed <details> block carrying instructionsREADME.md:63 · Collapsed <details> block carrying instructions
AST01<summary>Install from source</summary> ```bash git clone <this repo> && cd reflex npm install ln -s "$PWD/bin/reflex.js" /usr/local/bin/reflex # optional, for CFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.MEDIUM
File type combined with upload actiondist/reflex.js:76 · File type combined with upload action — agent may exfiltrate local data files
AST07…=process.argv.slice(2),t=e[0];if(!t||t==="help"||t==="--help"||t==="-h"){console.log(Xe);return}let{flags:o,pos:r}=He(e.slice(1));if(t==="login"||t==="logout"||t==="whoami"){let n=ee();if(t==="logout"){console.log(n.logout()?"signed out":"…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actiondist/daemon.js:7 · File type combined with upload action — agent may exfiltrate local data files
AST07…reflex.js stop 2>/dev/null || true; npm test 2>&1 | tee checks-outputs/root-test.txt'","check:server":"bash -c 'set -o pipefail; cd server && npm test 2>&1 | tee ../checks-outputs/server-test.txt && npm run typecheck 2>&1 | tee ../checks-o…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.Cost to the agent
Instructions loaded
≈71 tok
1 file · 8 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0
Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.
Known vulnerabilities
No advisories in OSV for reflex-browser@0.4.12 as of 12 h ago. This is the package itself, not its dependencies.