Skills/PyPI/mcp-stealth-chrome

mcp-stealth-chrome@0.24.0

CAUTION· not started

Publisher claims: "MCP server with 173 tools: a real Chrome browser over CDP with nodriver, HTTP with Chrome's TLS fingerprint, Cloudflare Turnstile handling, session reuse, and web research without API keys" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry PyPI (MCP server)Publisher robithyusuf · publishing for 211 daysInstalls 7,213Last detonated 25 min ago
What would fix thisWatchDispute verdict

Coverage

Not started: dependency install failed; the server itself was not observed.
Tested
the dependency install step · every file read, file written and host contacted by what ran
Not tested
server startup · the tool list · tool behavior

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
AI_VISION_API_KEYANTHROPIC_API_KEYEXA_API_KEYGH_TOKENGITHUB_TOKENOPENAI_API_KEYConfiguration, not credentials: AI_VISION_BASE_URL, AI_VISION_MODEL, AI_VISION_PROVIDER, ALL_PROXY, ANTHROPIC_MODEL, ASSET_MAX_BYTES, B64_INLINE_LIMIT, BROWSER_IDLE_REAPER_INTERVAL, BROWSER_IDLE_TIMEOUT, CAPSOLVER_KEY, DISPLAY, HTTP_BODY_MAX, HTTP_CONNECT_TIMEOUT, HTTP_COOKIE_TIMEOUT, HTTP_DEADLINE_GRACE, HTTP_MAX_INFLIGHT, HTTP_MAX_TIMEOUT, HTTP_TRACK_MAX, HTTP_TRACK_TTL, INLINE_IMAGE_B64_LIMIT, INLINE_IMAGE_MAX_DIM, MCP_STEALTH_DOCK_ICON, MCP_STEALTH_PROFILE_GC_DELAY, MCP_STEALTH_PROFILE_GC_MIN_AGE, MCP_STEALTH_QUIT_WATCH_DIR, MCP_STEALTH_QUIT_WATCHER, OPENAI_BASE_URL, OPENAI_MODEL, ProgramFiles, PYTEST_CURRENT_TEST, RESEARCH_PROXY, USERNAME, WAYLAND_DISPLAY, XDG_SESSION_TYPE
Where it talks to
no vendor host named in the codeAlso brave.com, google.com, easylist.to, capsolver.com, unpkg.com, duckduckgo.com, bing.com, exa.ai, reddit.com, youtube.com, threads.com, facebook.com, x.com — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
server startup · the tool list · tool behavior

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names brave.com, google.com, easylist.to, capsolver.com, unpkg.com, duckduckgo.com, bing.com, exa.ai, reddit.com, youtube.com, threads.com, facebook.com, x.com as well as its own vendor. The guard injects AI_VISION_API_KEY, ANTHROPIC_API_KEY, EXA_API_KEY, GH_TOKEN, GITHUB_TOKEN, OPENAI_API_KEY only into requests to the host you bind (and its subdomains) and refuses the rest.

$vet-skills run --net declared -- uvx mcp-stealth-chrome

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-15 and scored it 70/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Privileged sudo command; Credential pass-through configuration; Credential pass-through configuration. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.2sprocessdependency install exit 1 ·
0.2sclaimednot started: dependency install failed (exit 1); the server itself was not observed
0.2sprocessscript backend runs setup only
0.2sprocessno install scripts to re-run

Static findings

MEDIUM
Python subprocess execution detectedsrc/mcp_stealth_chrome/_quit_watcher.py:77 · Python subprocess execution detectedresult = subprocess.run(["ps", "-o", "pid=,lstart=", "-p", ",".join(str(p) for p in pids)],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Privileged sudo commandsrc/mcp_stealth_chrome/state.py:102 · Privileged sudo command — agent may execute with elevated privileges" Ubuntu/Debian: sudo apt install -y google-chrome-stable (add Google's APT repo first)\n"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Credential pass-through configurationsrc/mcp_stealth_chrome/tools/stealth.py:127 · Credential pass-through configuration — agent relays sensitive credentialsNeeds CAPSOLVER_KEY env var (or pass api_key). Returns solved token.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
MEDIUM
Python subprocess execution detectedsrc/mcp_stealth_chrome/dock_icon.py:441 · Python subprocess execution detecteddone = subprocess.run(["/usr/bin/osascript", "-l", "JavaScript", "-e", _SET_ICON_JXA,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Credential pass-through configurationsrc/mcp_stealth_chrome/tools/vision.py:264 · Credential pass-through configuration — agent relays sensitive credentials"ANTHROPIC_API_KEY, or pass api_key= to the tool."Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Privileged sudo commandsrc/mcp_stealth_chrome/state.py:104 · Privileged sudo command — agent may execute with elevated privileges" Fedora: sudo dnf install -y chromium"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandsrc/mcp_stealth_chrome/_quit_watcher.py:158 · Process kill command — agent can terminate processeschecked even if it ends and its PID is reused meanwhile. Elsewhere the check and the killFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File permission modification commandsrc/mcp_stealth_chrome/http_transport.py:46 · File permission modification command — agent changes file ownership/permissionsf"Run: chmod 600 {path}"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_stealth_chrome/dock_icon.py:432 · Python subprocess execution detecteddone = subprocess.run([sys.executable, "-c", _SET_ICON_PY, str(icon), str(app)],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_stealth_chrome/launcher.py:586 · Python subprocess execution detectedsubprocess.run(["/usr/bin/sips", "-z", str(size * scale), str(size * scale),Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_stealth_chrome/launcher.py:589 · Python subprocess execution detectedsubprocess.run(["/usr/bin/iconutil", "-c", "icns", str(iconset), "-o", str(out)],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
URL with embedded credentialssrc/mcp_stealth_chrome/tools/research.py:188 · URL with embedded credentials — may be phishing or credential leaking`export RESEARCH_PROXY=http://user:pass@host:port` and every fetch uses it.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
Python subprocess execution detectedsrc/mcp_stealth_chrome/dock_icon.py:521 · Python subprocess execution detectedlisting = subprocess.run(["ps", "-ax", "-ww", "-o", "command="],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_stealth_chrome/launcher.py:204 · Python subprocess execution detecteddone = subprocess.run(["/usr/bin/osascript", "-l", "JavaScript", "-e", _ACTIVATE_JXA,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_stealth_chrome/launcher.py:613 · Python subprocess execution detectedsubprocess.run(["/usr/bin/osacompile", "-o", str(app), src.name], check=True,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Privileged sudo commandsrc/mcp_stealth_chrome/state.py:103 · Privileged sudo command — agent may execute with elevated privileges" Or Chromium: sudo apt install -y chromium-browser\n"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_stealth_chrome/_quit_watcher.py:48 · Python subprocess execution detectedout = subprocess.run(["ps", "-ww", "-o", "stat=,command=", "-p", str(int(pid))],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Process kill commandsrc/mcp_stealth_chrome/keep_alive.py:540 · Process kill command — agent can terminate processestransport._proc = None # close() then has no child to killFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_stealth_chrome/dock_icon.py:514 · Python subprocess execution detectedsubprocess.run([_LSREGISTER, "-u", str(app)], capture_output=True, timeout=20)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
document.cookie accesssrc/mcp_stealth_chrome/tools/network_http.py:1265 · document.cookie access — can steal session cookiesout.cookies = document.cookie;Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Python subprocess execution detectedsrc/mcp_stealth_chrome/launcher.py:645 · Python subprocess execution detectedsubprocess.run(["/usr/bin/codesign", "--force", "--deep", "--sign", "-", str(app)],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_stealth_chrome/profile_version.py:86 · Python subprocess execution detecteddone = subprocess.run([executable, "--version"], capture_output=True, text=True, timeout=10)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_stealth_chrome/os_input.py:161 · Python subprocess execution detectedsubprocess.run(["xdotool", *args], check=True, capture_output=True, timeout=3)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_stealth_chrome/quit_watch.py:149 · Python subprocess execution detectedproc = subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_stealth_chrome/state.py:558 · Python subprocess execution detectedr = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_stealth_chrome/os_input.py:63 · Python subprocess execution detectedresult = subprocess.run(["xdotool", "getmouselocation"], capture_output=True, timeout=3)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_stealth_chrome/os_input.py:250 · Python subprocess execution detectedresult = subprocess.run(["xdotool", "search", "--onlyvisible", "--pid", str(pid)],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_stealth_chrome/os_input.py:253 · Python subprocess execution detectedsubprocess.run(["xdotool", "windowactivate", "--sync", wid],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_stealth_chrome/tools/navigation.py:120 · Python subprocess execution detectedcompleted = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_stealth_chrome/profile_gc.py:102 · Python subprocess execution detectedout = subprocess.run(["ps", "-ax", "-ww", "-o", "pid=,command="],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_stealth_chrome/state.py:379 · Python subprocess execution detectedr = subprocess.run(["ps", "-ax", "-ww", "-o", "pid=,ppid=,command="],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Process kill commandsrc/mcp_stealth_chrome/state.py:697 · Process kill command — agent can terminate processesUsed by browser_recover to kill zombie Chromes whose CDP path is wedgedFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_stealth_chrome/state.py:579 · Python subprocess execution detectedr = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_stealth_chrome/state.py:711 · Python subprocess execution detectedr = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_stealth_chrome/tools/turnstile_oscursor.py:174 · Python subprocess execution detectedresult = subprocess.run(["taskkill", "/PID", str(process.pid), "/T", "/F"],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_stealth_chrome/os_input.py:293 · Python subprocess execution detectedresult = subprocess.run(["xdotool", "search", "--onlyvisible", "--pid", str(pid)],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_stealth_chrome/state.py:242 · Python subprocess execution detectedr = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_stealth_chrome/tools/turnstile_oscursor.py:285 · Python subprocess execution detectedprocess = subprocess.Popen(args, stdin=subprocess.DEVNULL, stdout=subprocess.DEVNULL,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05

Cost to the agent

Instructions loaded
≈87 tok
1 file · 51 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

Not checked against OSV yet; the weekly check has not reached this version.

What would make this Verified

10 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim robithyusuf: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  3. Credential pass-through configuration≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  4. URL with embedded credentials≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  5. document.cookie access≈ +4 on the totalReplace encoded or assembled strings with plain literals and remove undeclared network calls.
  6. Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
Publish a new version to PyPI, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim robithyusufPropose a patch to the maintainer