Skills/PyPI/mcp-stealth-chrome

mcp-stealth-chrome@0.15.2

CAUTION· not started

Publisher claims: "MCP server with 173 tools: a real Chrome browser over CDP with nodriver, HTTP with Chrome's TLS fingerprint, Cloudflare Turnstile handling, session reuse, and web research without API keys" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry PyPI (MCP server)Publisher robithyusuf · publishing for 210 daysInstalls 795Last detonated 38 h ago
What would fix thisWatchDispute verdict

Coverage

Not started: dependency install failed; the server itself was not observed.
Tested
the dependency install step · every file read, file written and host contacted by what ran
Not tested
server startup · the tool list · tool behavior

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
AI_VISION_API_KEYANTHROPIC_API_KEYEXA_API_KEYGH_TOKENGITHUB_TOKENOPENAI_API_KEYConfiguration, not credentials: AI_VISION_BASE_URL, AI_VISION_MODEL, AI_VISION_PROVIDER, ALL_PROXY, ANTHROPIC_MODEL, ASSET_MAX_BYTES, B64_INLINE_LIMIT, BROWSER_IDLE_REAPER_INTERVAL, BROWSER_IDLE_TIMEOUT, BROWSER_LAUNCH_TIMEOUT, BROWSER_NAV_TIMEOUT, CAPSOLVER_KEY, CAPTURE_MAX_EVENTS, CAPTURE_MAX_INDEXED, DISPLAY, HTTP_BODY_MAX, HTTP_CONNECT_TIMEOUT, HTTP_COOKIE_TIMEOUT, HTTP_DEADLINE_GRACE, HTTP_MAX_INFLIGHT, HTTP_MAX_TIMEOUT, HTTP_TRACK_MAX, HTTP_TRACK_TTL, INLINE_IMAGE_B64_LIMIT, INLINE_IMAGE_MAX_DIM, MCP_STEALTH_CLOSE_WAIT, MCP_STEALTH_PROFILE_GC_DELAY, MCP_STEALTH_PROFILE_GC_MIN_AGE, MCP_STEALTH_QUIT_WATCH_DIR, MCP_STEALTH_QUIT_WATCHER, MCP_WINDOWLESS_CLOSE_SECONDS, OPENAI_BASE_URL, OPENAI_MODEL, ProgramFiles
Where it talks to
no vendor host named in the codeAlso google.com, capsolver.com, unpkg.com, duckduckgo.com, bing.com, exa.ai, brave.com, reddit.com, youtube.com, threads.com, facebook.com, x.com — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
server startup · the tool list · tool behavior

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names google.com, capsolver.com, unpkg.com, duckduckgo.com, bing.com, exa.ai, brave.com, reddit.com, youtube.com, threads.com, facebook.com, x.com as well as its own vendor. The guard injects AI_VISION_API_KEY, ANTHROPIC_API_KEY, EXA_API_KEY, GH_TOKEN, GITHUB_TOKEN, OPENAI_API_KEY only into requests to the host you bind (and its subdomains) and refuses the rest.

$vet-skills run --net declared -- uvx mcp-stealth-chrome

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-12 and scored it 70/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Privileged sudo command; Privileged sudo command; URL with embedded credentials. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.1sprocessdependency install exit 1 ·
0.1sclaimednot started: dependency install failed (exit 1); the server itself was not observed
0.1sprocessscript backend runs setup only
0.1sprocessno install scripts to re-run

Static findings

HIGH
Privileged sudo commandsrc/mcp_stealth_chrome/state.py:102 · Privileged sudo command — agent may execute with elevated privileges" Ubuntu/Debian: sudo apt install -y google-chrome-stable (add Google's APT repo first)\n"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Privileged sudo commandsrc/mcp_stealth_chrome/state.py:104 · Privileged sudo command — agent may execute with elevated privileges" Fedora: sudo dnf install -y chromium"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
URL with embedded credentialssrc/mcp_stealth_chrome/server.py:2040 · URL with embedded credentials — may be phishing or credential leakingproxy: "http://user:pass@host:port" or "socks5://host:port"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
HIGH
Privileged sudo commandsrc/mcp_stealth_chrome/state.py:103 · Privileged sudo command — agent may execute with elevated privileges" Or Chromium: sudo apt install -y chromium-browser\n"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_stealth_chrome/_quit_watcher.py:40 · Python subprocess execution detectedout = subprocess.run(["ps", "-ww", "-o", "stat=,command=", "-p", str(int(pid))],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Process kill commandsrc/mcp_stealth_chrome/server.py:2858 · Process kill command — agent can terminate processeswould silently kill a concurrent network_start / auth_capture capture.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_stealth_chrome/quit_watch.py:100 · Python subprocess execution detectedproc = subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Process kill commandsrc/mcp_stealth_chrome/server.py:502 · Process kill command — agent can terminate processes# Windows has no SIGKILL; os.kill with any other signal is TerminateProcess there.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandsrc/mcp_stealth_chrome/server.py:5839 · Process kill command — agent can terminate processesthe event on nodriver 0.48.1, which would kill a concurrent capture."""Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
URL with embedded credentialssrc/mcp_stealth_chrome/tools/research.py:188 · URL with embedded credentials — may be phishing or credential leaking`export RESEARCH_PROXY=http://user:pass@host:port` and every fetch uses it.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
Python subprocess execution detectedsrc/mcp_stealth_chrome/server.py:1722 · Python subprocess execution detectedfront = subprocess.run(["lsappinfo", "front"], capture_output=True, text=True,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Process kill commandsrc/mcp_stealth_chrome/server.py:530 · Process kill command — agent can terminate processesf"now orphaned — kill them manually")Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_stealth_chrome/os_input.py:63 · Python subprocess execution detectedresult = subprocess.run(["xdotool", "getmouselocation"], capture_output=True, timeout=3)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_stealth_chrome/dock_icon.py:408 · Python subprocess execution detecteddone = subprocess.run([sys.executable, "-c", _SET_ICON_PY, str(icon), str(app)],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_stealth_chrome/profile_gc.py:77 · Python subprocess execution detectedout = subprocess.run(["ps", "-ax", "-ww", "-o", "pid=,command="],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Credential pass-through configurationsrc/mcp_stealth_chrome/tools/vision.py:264 · Credential pass-through configuration — agent relays sensitive credentials"ANTHROPIC_API_KEY, or pass api_key= to the tool."Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
MEDIUM
Python subprocess execution detectedsrc/mcp_stealth_chrome/server.py:1724 · Python subprocess execution detectedinfo = subprocess.run(["lsappinfo", "info", "-only", "pid", front], capture_output=True,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_stealth_chrome/server.py:300 · Python subprocess execution detectedr = subprocess.run(["ps", "-ww", "-o", "command=", "-p", str(pid)],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File permission modification commandsrc/mcp_stealth_chrome/http_transport.py:46 · File permission modification command — agent changes file ownership/permissionsf"Run: chmod 600 {path}"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
document.cookie accesssrc/mcp_stealth_chrome/tools/network_http.py:1029 · document.cookie access — can steal session cookiesout.cookies = document.cookie;Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Python subprocess execution detectedsrc/mcp_stealth_chrome/server.py:1757 · Python subprocess execution detectedfront = subprocess.run(["lsappinfo", "front"], capture_output=True, text=True,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_stealth_chrome/os_input.py:293 · Python subprocess execution detectedresult = subprocess.run(["xdotool", "search", "--onlyvisible", "--pid", str(pid)],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Credential pass-through configurationsrc/mcp_stealth_chrome/tools/stealth.py:106 · Credential pass-through configuration — agent relays sensitive credentialsNeeds CAPSOLVER_KEY env var (or pass api_key). Returns solved token.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
MEDIUM
Python subprocess execution detectedsrc/mcp_stealth_chrome/os_input.py:253 · Python subprocess execution detectedsubprocess.run(["xdotool", "windowactivate", "--sync", wid],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_stealth_chrome/os_input.py:161 · Python subprocess execution detectedsubprocess.run(["xdotool", *args], check=True, capture_output=True, timeout=3)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_stealth_chrome/dock_icon.py:417 · Python subprocess execution detecteddone = subprocess.run(["/usr/bin/osascript", "-l", "JavaScript", "-e", _SET_ICON_JXA,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_stealth_chrome/os_input.py:250 · Python subprocess execution detectedresult = subprocess.run(["xdotool", "search", "--onlyvisible", "--pid", str(pid)],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_stealth_chrome/profile_version.py:86 · Python subprocess execution detecteddone = subprocess.run([executable, "--version"], capture_output=True, text=True, timeout=10)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_stealth_chrome/dock_icon.py:497 · Python subprocess execution detectedlisting = subprocess.run(["ps", "-ax", "-ww", "-o", "command="],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_stealth_chrome/server.py:333 · Python subprocess execution detectedr = subprocess.run(["ps", "-ax", "-ww", "-o", "pid=,ppid=,command="],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_stealth_chrome/dock_icon.py:490 · Python subprocess execution detectedsubprocess.run([_LSREGISTER, "-u", str(app)], capture_output=True, timeout=20)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_stealth_chrome/state.py:242 · Python subprocess execution detectedr = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Process kill commandsrc/mcp_stealth_chrome/state.py:448 · Process kill command — agent can terminate processesUsed by browser_recover to kill zombie Chromes whose CDP path is wedgedFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_stealth_chrome/state.py:309 · Python subprocess execution detectedr = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_stealth_chrome/tools/turnstile_oscursor.py:174 · Python subprocess execution detectedresult = subprocess.run(["taskkill", "/PID", str(process.pid), "/T", "/F"],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_stealth_chrome/tools/navigation.py:120 · Python subprocess execution detectedcompleted = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_stealth_chrome/state.py:330 · Python subprocess execution detectedr = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_stealth_chrome/state.py:462 · Python subprocess execution detectedr = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_stealth_chrome/tools/turnstile_oscursor.py:285 · Python subprocess execution detectedprocess = subprocess.Popen(args, stdin=subprocess.DEVNULL, stdout=subprocess.DEVNULL,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05

Cost to the agent

Instructions loaded
≈87 tok
1 file · 40 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for mcp-stealth-chrome@0.15.2 as of 37 h ago. This is the package itself, not its dependencies.

What would make this Verified

10 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim robithyusuf: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  3. URL with embedded credentials≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  4. Credential pass-through configuration≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  5. document.cookie access≈ +4 on the totalReplace encoded or assembled strings with plain literals and remove undeclared network calls.
  6. Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
Publish a new version to PyPI, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim robithyusufPropose a patch to the maintainer