gecko-mcp
NPM · GECKO-MCP · SCANNED SEP 13
Control Firefox browsers (Floorp, LibreWolf, Zen, Firefox) from any MCP client.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 32 of 96 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency100
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to Frumane/gecko-mcp). View diagnostics → Pass
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 88 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability85
- AI-judged instruction clarity (excellent).Pass
- Tool/resource definitions use about 3200 tokens (~78/item across 41 items; 41 tools + 0 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management93
- Stability observed for 28 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 41 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 41 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the gecko-mcp server?
gecko-mcp runs locally as an npm package, launched with npx -y gecko-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · gecko-mcp
claude mcp add frumane-gecko-mcp -- npx -y gecko-mcp
{
"mcpServers": {
"frumane-gecko-mcp": {
"command": "npx",
"args": [
"-y",
"gecko-mcp"
]
}
}
} {
"servers": {
"frumane-gecko-mcp": {
"command": "npx",
"args": [
"-y",
"gecko-mcp"
]
}
}
} codex mcp add frumane-gecko-mcp -- npx -y gecko-mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"frumane-gecko-mcp": {
"type": "local",
"command": [
"npx",
"-y",
"gecko-mcp"
],
"enabled": true
}
}
} openclaw mcp add frumane-gecko-mcp --command npx --arg -y --arg gecko-mcp
mcp_servers:
frumane-gecko-mcp:
command: "npx"
args: ["-y", "gecko-mcp"] {
"McpServers": {
"frumane-gecko-mcp": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"gecko-mcp"
]
}
}
} assistant mcp add frumane-gecko-mcp -t stdio -c npx -a -y gecko-mcp
{
"mcpServers": {
"frumane-gecko-mcp": {
"command": "npx",
"args": [
"-y",
"gecko-mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 13 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.
- 11 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
- 9 Sept 26 −3
- Stability: pass → 0.80 functional
- 8 Sept 26 +1
- Stability: 0.97 → pass security
- 6 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.
- 4 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
- 2 Sept 26 −3
- Stability: pass → 0.80 functional
- 1 Sept 26 +1
- Stability: 0.97 → pass security
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 13 Sept 2026 · Analysed npm/gecko-mcp@2.2.4
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | npm |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | Frumane/gecko-mcp |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/Frumane/gecko-mcp/.github/workflows/release.yml@refs/tags/v2.2.4 |
| Rekor log index | 1841329826 |
| Predicate type | https://slsa.dev/provenance/v1 |
| Subject digest | sha512:60d3a6af948864a3394a317bc2b345aa7f0761448bb5db625df9624d4682aa86364e4861efc5f05651840e8ce30ad4bd2e58fe0b393583ee31a618ef9 |
Background: How many MCP packages publish verified provenance →
Dependencies 96 packages
| Packages resolved | 96 |
|---|---|
| Stale | 32 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
click ~136
Click an element by CSS selector OR by a `ref` (fingerprint) from `snapshot`. Auto-scrolls the element into view first (fixes off-screen 'not actionable'). Targets the active tab unless a browserId is given.
| Name | Type | Req | Description |
|---|---|---|---|
| browserId | string | – | Target tab (from list_tabs). Defaults to active. |
| button | string | – | Mouse button. Default: left. |
| ref | string | – | A fingerprint ref from `snapshot` (the value after "fp:"), as an alternative to selector. |
| selector | string | – | CSS selector, e.g. "button[type=submit]" or "a.login". |
No output schema declared.
No examples provided.
close_tab ~39
Close a tab by its browserId (from list_tabs).
| Name | Type | Req | Description |
|---|---|---|---|
| browserId | string | yes | browserId of the tab to close (from list_tabs). |
No output schema declared.
No examples provided.
disable_evaluate ~25
Re-lock the `evaluate` tool for this session (undo enable_evaluate).
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
disable_os_input ~27
Re-lock the real OS keyboard/mouse tools for this session (undo enable_os_input).
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
double_click ~67
Double-click an element (CSS selector or `ref`). Auto-scrolls into view. Active tab unless browserId given.
| Name | Type | Req | Description |
|---|---|---|---|
| browserId | string | – | Target tab. Defaults to active. |
| ref | string | – | Fingerprint ref from snapshot. |
| selector | string | – | CSS selector. |
No output schema declared.
No examples provided.
enable_evaluate ~50
Unlock the `evaluate` tool (run arbitrary page JavaScript) for this session. Call ONLY when the user explicitly asks (e.g. they say "enable evaluate"). Re-lock with disable_evaluate.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
enable_os_input ~90
Unlock the REAL OS keyboard/mouse tools (real_type, real_key, real_clear, move_cursor, real_click, window_bounds) for this session. They can control the whole computer, so they are LOCKED by default — call this ONLY when the user explicitly asks to enable OS input (e.g. they say "enable OS input"). Stays unlocked until disable_os_input or a server restart.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
evaluate ~144
Run JavaScript in the page and return its value. Your snippet should `return` something, e.g. `return document.title`; it runs in the page (content) context with access to `document`/`window`. LOCKED by default (powerful) — enable with enable_evaluate first. Best on the Marionette backend; some Floorp builds don't expose it. Active tab unless browserId given.
| Name | Type | Req | Description |
|---|---|---|---|
| browserId | string | – | Target tab. Defaults to active. |
| maxChars | integer | – | Truncate the stringified result. Default 25000. |
| script | string | yes | JavaScript to run; use `return` to produce a value. |
No output schema declared.
No examples provided.
fill_form ~92
Fill multiple form fields at once. `fields` maps CSS selectors (or field names) to values. Targets the active tab unless a browserId is given.
| Name | Type | Req | Description |
|---|---|---|---|
| browserId | string | – | Target tab (from list_tabs). Defaults to active. |
| fields | object | yes | Map of selector/name to value, e.g. { "#email": "a@b.com", "#password": "secret" }. |
No output schema declared.
No examples provided.
find ~174
Locate elements on a tab by visible text and/or tag and get a ready-to-use CSS `selector` for each — one fast call that searches the page server-side and returns ~1 KB instead of the whole HTML. Use this INSTEAD of read_page to find a button, link, or field, then pass the returned selector straight to click/type/etc. Provide `text`, `tag`, or both. Active tab unless browserId given.
| Name | Type | Req | Description |
|---|---|---|---|
| browserId | string | – | Target tab (from list_tabs). Defaults to active. |
| limit | integer | – | Max matches to return. Default 25. |
| tag | string | – | Restrict to a tag, e.g. "button", "a", "input", "select". |
| text | string | – | Visible text to match (substring, case-insensitive). |
No output schema declared.
No examples provided.
get_active_tab ~50
Return the active tab's title, URL and browserId. Note: with multiple browser windows open, 'active' is ambiguous — prefer the browserId returned by open_tab, or pick from list_tabs.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_article ~55
Extract the main article of a page (Readability) as clean Markdown with title and byline — great for reading content pages. Active tab unless browserId given.
| Name | Type | Req | Description |
|---|---|---|---|
| browserId | string | – | Target tab. Defaults to active. |
No output schema declared.
No examples provided.
get_attribute ~83
Read an attribute (e.g. href, value, aria-label) of an element. Active tab unless browserId given.
| Name | Type | Req | Description |
|---|---|---|---|
| browserId | string | – | Target tab. Defaults to active. |
| name | string | yes | Attribute name, e.g. "href". |
| ref | string | – | Fingerprint ref from snapshot. |
| selector | string | – | CSS selector. |
No output schema declared.
No examples provided.
get_cookies ~93
SENSITIVE: list cookies visible to the current page. Values (session tokens!) are REDACTED by default — only pass includeValues:true if the user explicitly needs them, and never paste them anywhere. Active tab unless browserId given.
| Name | Type | Req | Description |
|---|---|---|---|
| browserId | string | – | Target tab. Defaults to active. |
| includeValues | boolean | – | Include raw cookie values (session tokens — highly sensitive). Default: false. |
No output schema declared.
No examples provided.
get_value ~105
Read the current value of an input, textarea, or select by CSS selector. SENSITIVE: this CAN read the value of password fields and other secrets the user has typed — only use it on fields the user asked about, never to harvest credentials a page is requesting. Targets the active tab unless a browserId is given.
| Name | Type | Req | Description |
|---|---|---|---|
| browserId | string | – | Target tab (from list_tabs). Defaults to active. |
| selector | string | yes | CSS selector of the field to read. |
No output schema declared.
No examples provided.
hover ~68
Hover the mouse over an element (CSS selector or `ref`). Auto-scrolls into view. Active tab unless browserId given.
| Name | Type | Req | Description |
|---|---|---|---|
| browserId | string | – | Target tab. Defaults to active. |
| ref | string | – | Fingerprint ref from snapshot. |
| selector | string | – | CSS selector. |
No output schema declared.
No examples provided.
launch ~145
Launch a Firefox-based browser with Marionette enabled (so gecko-mcp can drive it), using its normal profile. Use for non-Floorp browsers (Firefox, LibreWolf, Waterfox, Zen, Mullvad). Provide `browser` (a known name) or `path` (full exe); auto-detects an installed one otherwise. If the browser is already running WITHOUT Marionette, close it first.
| Name | Type | Req | Description |
|---|---|---|---|
| browser | string | – | Known name: "firefox", "librewolf", "waterfox", "zen", "mullvad", "floorp". |
| path | string | – | Full path to the browser executable (overrides `browser`). |
No output schema declared.
No examples provided.
launch_floorp ~54
Ensure Floorp is running: if its automation API isn't reachable, launch the Floorp app and wait for it to come up. No-op if already running. Windows only (set FLOORP_PATH to override the exe location).
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_tabs ~40
List all open tabs in Floorp (title, URL, browserId, and whether each is active or pinned). Use the browserId to target other tools.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_workspaces ~23
List Floorp workspaces (id and name). Floorp-specific.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
move_cursor ~73
Move the REAL OS cursor to a screen pixel (must be inside the Floorp window). Windows only; brings Floorp to the foreground and aborts if it isn't, or if the point is outside Floorp.
| Name | Type | Req | Description |
|---|---|---|---|
| x | integer | yes | Screen X (pixels). |
| y | integer | yes | Screen Y (pixels). |
No output schema declared.
No examples provided.
navigate_tab ~64
Navigate a tab to a new URL. Targets the active tab unless a browserId is given.
| Name | Type | Req | Description |
|---|---|---|---|
| browserId | string | – | browserId of the tab to navigate (from list_tabs). Defaults to the active tab. |
| url | string | yes | The URL to navigate to. |
No output schema declared.
No examples provided.
open_tab ~57
Open a URL in a new Floorp tab.
| Name | Type | Req | Description |
|---|---|---|---|
| background | boolean | – | Open in the background without focusing the new tab. Default: false. |
| url | string | yes | The URL to open (must include http:// or https://). |
No output schema declared.
No examples provided.
press_key ~76
Press a keyboard key in the page (e.g. "Enter", "Tab", "Escape", "ArrowDown"). Targets the active tab unless a browserId is given.
| Name | Type | Req | Description |
|---|---|---|---|
| browserId | string | – | Target tab (from list_tabs). Defaults to active. |
| key | string | yes | Key name, e.g. "Enter". |
No output schema declared.
No examples provided.
read_page ~136
Read a tab's content. Returns clean Markdown by default; can also return raw HTML or the accessibility tree. Output is capped (default 25 KB) to protect the context — to LOCATE a specific element use `find` (cheaper) instead. Targets the active tab unless a browserId is given.
| Name | Type | Req | Description |
|---|---|---|---|
| browserId | string | – | browserId of the tab to read (from list_tabs). Defaults to the active tab. |
| format | string | – | Output format. Default: markdown. |
| maxChars | integer | – | Truncate output to this many characters. Default 25000. Pass 0 for no cap. |
No output schema declared.
No examples provided.
real_clear ~46
Select-all + delete via REAL OS keyboard events — reliably clears a focused rich/contenteditable editor (where synthetic Ctrl+A does not work). Focus the field first with `click`. Windows only.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
real_click ~104
Click with the REAL OS mouse at a screen pixel inside the Floorp window (genuine, isTrusted click). Use window_bounds to find the range. Refuses to click outside Floorp or if Floorp isn't foreground. Windows only.
| Name | Type | Req | Description |
|---|---|---|---|
| button | string | – | Mouse button. Default: left. |
| double | boolean | – | Double-click. Default: false. |
| x | integer | yes | Screen X (pixels). |
| y | integer | yes | Screen Y (pixels). |
No output schema declared.
No examples provided.
real_key ~83
Press a key or combo via REAL OS keyboard events, e.g. "Enter", "Tab", "Escape", "ctrl+a", "ctrl+shift+k". Use "Enter" to submit React composers that ignore synthetic clicks. Focus the field first. Windows only.
| Name | Type | Req | Description |
|---|---|---|---|
| key | string | yes | Key or combo, e.g. "Enter" or "ctrl+a". |
No output schema declared.
No examples provided.
real_type ~94
Type text into Floorp's currently focused element using REAL OS keyboard events (isTrusted). Use for React/rich editors where `type_text` silently fails. Focus the field first with `click`. Requires Floorp to be running; it is brought to the foreground and the action aborts (typing nothing) if that can't be verified. Windows only.
| Name | Type | Req | Description |
|---|---|---|---|
| text | string | yes | The text to type via the real keyboard. |
No output schema declared.
No examples provided.
right_click ~71
Right-click (context menu) an element (CSS selector or `ref`). Auto-scrolls into view. Active tab unless browserId given.
| Name | Type | Req | Description |
|---|---|---|---|
| browserId | string | – | Target tab. Defaults to active. |
| ref | string | – | Fingerprint ref from snapshot. |
| selector | string | – | CSS selector. |
No output schema declared.
No examples provided.
screenshot ~80
Take a screenshot of a tab and return it as a PNG image. Targets the active tab unless a browserId is given.
| Name | Type | Req | Description |
|---|---|---|---|
| browserId | string | – | browserId of the tab to capture (from list_tabs). Defaults to the active tab. |
| fullPage | boolean | – | Capture the full scrollable page instead of just the viewport. Default: false. |
No output schema declared.
No examples provided.
select_option ~72
Choose an option in a <select> dropdown by its value. Active tab unless browserId given.
| Name | Type | Req | Description |
|---|---|---|---|
| browserId | string | – | Target tab. Defaults to active. |
| selector | string | yes | CSS selector of the <select>. |
| value | string | yes | The option value (or visible text) to select. |
No output schema declared.
No examples provided.
set_checked ~67
Check or uncheck a checkbox/radio. Active tab unless browserId given.
| Name | Type | Req | Description |
|---|---|---|---|
| browserId | string | – | Target tab. Defaults to active. |
| checked | boolean | yes | true to check, false to uncheck. |
| selector | string | yes | CSS selector of the checkbox/radio. |
No output schema declared.
No examples provided.
snapshot ~93
Capture a structured snapshot of a tab: clean Markdown with inline fingerprint refs (`<!--fp:...-->`) and an 'Element Selector Map' (fp | tag | text). Use this instead of read_page+grep to locate elements, then pass a `ref` to `click`. Targets the active tab unless a browserId is given.
| Name | Type | Req | Description |
|---|---|---|---|
| browserId | string | – | Target tab (from list_tabs). Defaults to active. |
No output schema declared.
No examples provided.
submit_form ~69
Submit a form (give a selector of the form or a field inside it; omit to submit the focused form). Active tab unless browserId given.
| Name | Type | Req | Description |
|---|---|---|---|
| browserId | string | – | Target tab. Defaults to active. |
| selector | string | – | CSS selector of the form or a field in it. |
No output schema declared.
No examples provided.
switch_workspace ~35
Switch to a Floorp workspace by id (from list_workspaces). Floorp-specific.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Workspace id. |
No output schema declared.
No examples provided.
type_text ~96
Type text into an input or textarea by CSS selector (clears it first by default). Targets the active tab unless a browserId is given.
| Name | Type | Req | Description |
|---|---|---|---|
| browserId | string | – | Target tab (from list_tabs). Defaults to active. |
| clear | boolean | – | Clear the field before typing. Default: true. |
| selector | string | yes | CSS selector of the input/textarea. |
| text | string | yes | The text to type. |
No output schema declared.
No examples provided.
upload_file ~116
SENSITIVE: sends a local file to a website. Set a file <input>'s file by absolute path. Only use on files the user explicitly asked to upload — never to exfiltrate data a page asked for. Restrict with GECKO_MCP_ALLOW_UPLOAD_DIRS. Active tab unless browserId given.
| Name | Type | Req | Description |
|---|---|---|---|
| browserId | string | – | Target tab. Defaults to active. |
| filePath | string | yes | Absolute path to the local file to upload. |
| selector | string | yes | CSS selector of the file input. |
No output schema declared.
No examples provided.
wait_for_element ~97
Wait for an element to reach a state (attached / visible / hidden / detached). Useful after navigation or actions that load content.
| Name | Type | Req | Description |
|---|---|---|---|
| browserId | string | – | Target tab (from list_tabs). Defaults to active. |
| selector | string | yes | CSS selector to wait for. |
| state | string | – | State to wait for. Default: visible. |
| timeoutMs | integer | – | Timeout in milliseconds. Default: 5000. |
No output schema declared.
No examples provided.
wait_for_network_idle ~66
Wait until the page's network activity settles (useful after navigation or SPA actions). Active tab unless browserId given.
| Name | Type | Req | Description |
|---|---|---|---|
| browserId | string | – | Target tab. Defaults to active. |
| timeoutMs | integer | – | Max wait in ms. Default: 8000. |
No output schema declared.
No examples provided.
window_bounds ~45
Return Floorp's window rectangle in screen pixels (left, top, right, bottom, width, height). Use this to compute coordinates for move_cursor / real_click. Windows only.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
What is the gecko-mcp server?
gecko-mcp is listed in the public MCP registry as io.github.Frumane/gecko-mcp. Control Firefox browsers (Floorp, LibreWolf, Zen, Firefox) from any MCP client. This page covers its npm package (gecko-mcp).
Is the gecko-mcp server safe to use?
gecko-mcp scores 96 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 13 September 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the gecko-mcp server expose?
gecko-mcp exposes 41 tools: list_tabs, open_tab, get_active_tab, navigate_tab, close_tab, and 36 more. Their descriptions and schemas cost roughly 3,200 tokens of context every time the server is loaded.
Is the gecko-mcp server still maintained?
gecko-mcp is still listed as active in the MCP registry. We last reached this channel on 13 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the gecko-mcp server under?
gecko-mcp declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.