# Public Browser (npm · public-browser)

Browse your real profile: -30% tokens, -25% cost, -41% tool calls, -34% tool defs, +40% faster

- Trust score: 79/100 (medium)
- Change this week: +4
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-09-20

## Components

- npm · `public-browser`: 79/100 (this document), [markdown](https://verifymcp.io/servers/silbercue-public-browser/public-browser.md), [page](https://verifymcp.io/servers/silbercue-public-browser/public-browser)

## Channel facts

- Registry: `npm`
- Package: `public-browser`
- Version: `2.10.6`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-09-20.

- **Supply Chain Security**: 98/100
  - No malware found by supply-chain analysis.
  - No known CVEs affecting this package version or its production dependencies.
  - No install/post-install scripts declared.
  - 32 of 98 dependencies flagged as unhealthy.
- **Provenance & Transparency**: 48/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 5 days ago).
  - Publishes a security disclosure policy (SECURITY.md).
- **Schema Quality & AI Usability**: 77/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 3716 tokens (~148/item across 25 items; 25 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 57/100
  - Stability observed for 17 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 25 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 26 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### How do I install the Public Browser MCP server?

Public Browser runs locally as an npm package, launched with npx -y public-browser. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add silbercue-public-browser -- npx -y public-browser
```

### Cursor

```json
{
  "mcpServers": {
    "silbercue-public-browser": {
      "command": "npx",
      "args": [
        "-y",
        "public-browser"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "silbercue-public-browser": {
      "command": "npx",
      "args": [
        "-y",
        "public-browser"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add silbercue-public-browser -- npx -y public-browser
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "silbercue-public-browser": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "public-browser"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add silbercue-public-browser --command npx --arg -y --arg public-browser
```

### Hermes

```yaml
mcp_servers:
  silbercue-public-browser:
    command: "npx"
    args: ["-y", "public-browser"]
```

### Netclaw

```json
{
  "McpServers": {
    "silbercue-public-browser": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "public-browser"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add silbercue-public-browser -t stdio -c npx -a -y public-browser
```

### Other

```json
{
  "mcpServers": {
    "silbercue-public-browser": {
      "command": "npx",
      "args": [
        "-y",
        "public-browser"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-09-20 (score 79, +1)

No change was recorded against any check on this day. Stability & Change Management went from 53 to 57. That category is still filling its 30-day observation window: 16 days of observed history at the previous scan, 17 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-18 (score 78, +1)

No change was recorded against any check on this day. Stability & Change Management went from 47 to 50. That category is still filling its 30-day observation window: 14 days of observed history at the previous scan, 15 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-16 (score 77, +1)

No change was recorded against any check on this day. Stability & Change Management went from 40 to 43. That category is still filling its 30-day observation window: 12 days of observed history at the previous scan, 13 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-15 (score 76, +15)

- [security improvement] Malware scan: unverified → pass

### 2026-09-14 (score 61, −14)

- [security regression] Malware scan: pass → unverified
- [security regression] Tool safety: pass → unverified
- [security regression] Stability: 0.33 → unverified
- [functional regression] Capabilities: pass → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional] First check of Schema quality: unverified
- [functional] Package version: 2.10.5 → 2.10.6

### 2026-09-11 (score 75, +1)

No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-09 (score 74, +1)

No change was recorded against any check on this day. Stability & Change Management went from 17 to 20. That category is still filling its 30-day observation window: 5 days of observed history at the previous scan, 6 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-07 (score 73, +1)

No change was recorded against any check on this day. Stability & Change Management went from 10 to 13. That category is still filling its 30-day observation window: 3 days of observed history at the previous scan, 4 at this one. The score rises as the window fills, whether or not the server changes.

## MCP tools (25)

### `virtual_desk` (~51 tokens)

List all open tabs with IDs, URLs and state. Call it first in every session, after a reconnect, or when unsure; reuse a listed tab ID instead of opening duplicates. Cheap, call liberally.

### `view_page` (~153 tokens)

See what is on the page: text plus stable element refs for click/type/fill_form. Default filter 'interactive' lists actionable elements; for paragraphs or table cells call view_page(ref, filter: 'all'). Collapsed containers show as [eXX role, N items] — expand with view_page(ref: 'eXX', filter: 'all').

Input parameters:

- `depth` (number): Tree levels shown; indentation only, hidden sections need a click
- `filter` (string): interactive | all | landmark | visual (bounds, click point, visibility)
- `max_tokens` (integer): Token budget; content downsampled. Omit for full output
- `ref` (string): Element ref for a subtree

### `click` (~183 tokens)

Click an element by ref, CSS selector, visible text, or viewport x/y (canvas, pixel-precise targets). Dispatches real CDP mouse events. A click that opens a new tab is reported in the response. The DOM diff (NEW/REMOVED/CHANGED) arrives with the next response, or in this one with wait_for_diff: true.

Input parameters:

- `ref` (string): Element ref (preferred)
- `selector` (string): CSS selector (fallback)
- `text` (string): Visible text (a11y name); no view_page needed, prefers interactive
- `wait_for_diff` (boolean): Wait for the DOM diff before returning (default false, slower)
- `x` (number): Viewport X in px; with y, not ref/selector
- `y` (number): Viewport Y in px; use with x

### `type` (~94 tokens)

Type text into an input identified by ref or CSS selector. For 2+ fields use fill_form; for special keys (Enter, Escape, Tab, arrows) or shortcuts (Ctrl+K) use press_key.

Input parameters:

- `clear` (boolean): Clear the field first
- `ref` (string): Element ref (preferred)
- `selector` (string): CSS selector (fallback)
- `text` (string, required): Text to type

### `fill_form` (~82 tokens)

Fill a whole form in one call: text inputs, <select> (by value or visible label), checkboxes (boolean) and radio buttons. One round-trip; partial errors do not abort and each field reports its own status. On per-field errors call view_page and retry the failing fields.

Input parameters:

- `fields` (array, required): Each needs ref or selector plus value

### `press_key` (~95 tokens)

Press a key or shortcut (Enter, Escape, Tab, arrows, Ctrl+K). Optionally focus an element first via ref or selector.

Input parameters:

- `key` (string, required): Key to press, e.g. 'Enter'; printable chars as-is
- `modifiers` (array): Modifier keys held during the press
- `ref` (string): Element ref to focus first
- `selector` (string): CSS selector to focus first

### `scroll` (~151 tokens)

Scroll the page, a container, or an element into view. Reports the position and content growth (scrollHeight delta — detects lazy-loaded content) and handles settle timing. Use container_ref/container_selector plus direction to scroll inside a container.

Input parameters:

- `amount` (number): Pixels per scroll (default 500); only with direction
- `container_ref` (string): Scrollable container ref (scrolls it, not the page)
- `container_selector` (string): Scrollable container CSS selector
- `direction` (string): up or down (default down); used when no ref/selector
- `ref` (string): Element ref to scroll into view
- `selector` (string): CSS selector to scroll into view

### `drag` (~235 tokens)

Drag via native CDP mouse events. Works for CSS-driven drag: slider thumbs, resize handles, text selection, mouse-based reorder lists (SortableJS in mouse mode). NOT for the HTML5 Drag&Drop API (draggable=true with dragstart/drop listeners, React DnD HTML5Backend, Vuedraggable, ng2-dnd) — that needs Input.dispatchDragEvent. Source: from_ref/from_selector or from_x+from_y; target: to_ref/to_selector or to_x+to_y.

Input parameters:

- `from_ref` (string): Source element ref
- `from_selector` (string): Source CSS selector
- `from_x` (number): Source viewport X in px (with from_y)
- `from_y` (number): Source viewport Y in px
- `steps` (integer): Native mouseMoved events between press and release; minimum 5
- `to_ref` (string): Target element ref
- `to_selector` (string): Target CSS selector
- `to_x` (number): Target viewport X in px (with to_y)
- `to_y` (number): Target viewport Y in px

### `navigate` (~109 tokens)

Navigate the active tab to a URL, or action 'back' / 'reload' (all refs become stale after reload). Waits for settle. Overwrites the user's active tab — check virtual_desk first; the first call per session is redirected to virtual_desk.

Input parameters:

- `action` (string): goto (default) | back | reload
- `settle_ms` (number): Extra wait in ms after load (default 500)
- `url` (string): URL to open (required for goto)

### `switch_tab` (~114 tokens)

Open a new tab, switch to a tab by ID (from virtual_desk), or close one. Prefer 'open' over navigate when the user's active tab must stay untouched. Refs from the previous tab are invalid afterwards — call view_page before acting.

Input parameters:

- `action` (string): open | switch | close
- `tab` (string): Tab ID or 1-based number (switch/close; close: active tab)
- `url` (string): URL for a new tab (open); default about:blank

### `tab_status` (~43 tokens)

Active tab's cached URL, title, ready state and errors — a cheap mid-workflow sanity check ('did my click navigate?'). Not for tab discovery or page content.

### `wait_for` (~207 tokens)

Wait until a condition holds: element visible, page text present, URL match, network idle, or a JS expression true. Prefer condition 'text' over a JS expression for 'has the page said X yet'. assert: true checks once and fails instead of waiting.

Input parameters:

- `assert` (boolean): Check once, fail if it does not hold; timeout 0, _meta.code 'assertion_failed'
- `condition` (string, required): element | text | url | network_idle | js
- `expression` (string): Expression that should become true; required for condition 'js'
- `selector` (string): CSS selector or ref; required for condition 'element'
- `text` (string): Substring of document.body.innerText, case-sensitive; required for condition 'text'
- `timeout` (number): Max wait in ms (default 10000; 0 when assert is true)
- `url` (string): Substring of the page URL; required for condition 'url'

### `observe` (~217 tokens)

Watch an element for changes instead of polling with MutationObserver/setInterval code in evaluate. collect: record text/attribute changes for 'duration' ms. until: wait for a condition, then optionally click at once (then_click). click_first fires the triggering action after the observer is armed, so nothing is missed.

Input parameters:

- `click_first` (string): Selector or ref to click once the observer is armed
- `collect` (string): text (textContent) | attributes | all
- `duration` (number): Collect window in ms (default 5000); exclusive with until
- `interval` (number): Polling fallback interval in ms
- `selector` (string, required): CSS selector or ref of the element to observe
- `then_click` (string): Selector or ref to click immediately when until holds
- `timeout` (number): Max observation time in ms (max 25000)
- `until` (string): JS expression checked on each change, 'el' is the element, e.g. el.textContent === '8'

### `capture_image` (~101 tokens)

Pixel-level screenshot (WebP, max 800px, <100KB). Only for canvas or chart content without DOM text, pixel-level rendering or animation checks, or when the user explicitly asks for a screenshot. Returns no refs and reads no text — that is view_page.

Input parameters:

- `full_page` (boolean): Capture the full scrollable page, not just the viewport
- `som` (boolean): Overlay numbered labels matching view_page refs (Set-of-Mark)

### `dom_snapshot` (~59 tokens)

Structured layout data: bounding boxes, computed styles, paint order, colors; refs match view_page. Only for spatial questions view_page cannot answer (is A above B? what color?).

Input parameters:

- `ref` (string): Element ref for a subtree snapshot

### `handle_dialog` (~82 tokens)

Configure handling of alerts, confirms and prompts. Set it BEFORE triggering the action that opens the dialog. Uses CDP Page.javascriptDialogOpening, so it works even while the dialog blocks all JS.

Input parameters:

- `action` (string, required): accept or dismiss the next dialog; get_status: pending ones
- `text` (string): Text entered into prompt dialogs (with action accept)

### `file_upload` (~91 tokens)

Upload file(s) to an <input type='file'> identified by ref or CSS selector; file paths must be absolute.

Input parameters:

- `path` (required): Absolute path(s) of the file(s) to upload
- `ref` (string): Element ref of the file input
- `selector` (string): CSS selector of the file input; needed for hidden inputs (display:none, off-screen), which have no ref

### `console_logs` (~70 tokens)

Read collected browser console logs; filter by level (info/warning/error/debug) and/or regex; optionally clear the buffer after reading.

Input parameters:

- `clear` (boolean): Clear the buffer after reading
- `level` (string): Filter by log level
- `pattern` (string): Regex matched against log text

### `network_monitor` (~83 tokens)

Capture network requests via CDP, including those the page issues itself. Workflow: start → trigger the action → get(pattern: 'api').

Input parameters:

- `action` (string, required): start recording | get results | stop: return and clear
- `filter` (string): 'failed': only HTTP >= 400 or network errors
- `pattern` (string): Regex for request URLs

### `download` (~141 tokens)

Wait for pending downloads or list this session's downloaded files. Downloads start by themselves when you click a download link or open a file URL (PDF, CSV, …); this tool never triggers them. download() waits for a pending download to finish; download({ action: 'list' }) returns at once.

Input parameters:

- `action` (string): status waits for pending downloads; list: history, never waits (use for polling)
- `settle` (number): Ms to wait for a download to START before reporting none — Chrome fires downloadWillBegin a few ms after the click; 0 = instant
- `timeout` (number): Max wait in ms for pending downloads

### `configure_session` (~135 tokens)

View or set session defaults for recurring parameters (tab, timeout, …). Without params: show current defaults and auto-promote suggestions; autoPromote: true applies them. Set profile BEFORE any browser interaction to launch Chrome with a named profile.

Input parameters:

- `autoPromote` (boolean): Apply all current auto-promote suggestions
- `defaults` (object): Param name → default value; null removes a default
- `profile` (string): Chrome profile name (list them with: public-browser profiles); restart: true switches mid-session
- `restart` (boolean): Restart Chrome with the new profile even if running; closes all tabs

### `run_plan` (~195 tokens)

Batch the next 2+ known actions (click, type, scroll, view_page chains) here instead of N separate calls: a sequence of tool steps, executed server-side in one call. Variables via vars and saveAs ($name), conditions (if), suspend/resume to ask the agent mid-plan, errorStrategy abort | continue | capture_image, and parallel groups per tab: parallel: [{ tab, steps }].

Input parameters:

- `errorStrategy` (string): abort stops at the first error; continue runs all steps; capture_image screenshots, then aborts
- `parallel` (array): Tab groups to run in parallel
- `resume` (object): Resume a suspended plan
- `steps` (array): Tool steps to run in order
- `use_operator` (boolean): Operator mode (rule engine + micro-LLM); needs the executeOperator hook
- `vars` (object): Initial variables, available as $name

### `batch_evaluate` (~133 tokens)

Visit several URLs in sequence and run the same JS expression on each. For controlled checks across known pages where view_page/run_plan would be too chatty; not for normal reading, clicking or form work.

Input parameters:

- `continue_on_error` (boolean): Continue with the remaining URLs if one fails
- `evaluate_per_page` (string, required): JS expression evaluated on each page
- `settle_ms` (number): Wait in ms after each page load before evaluating
- `timeout_per_page_ms` (number): Timeout per page in ms (navigate+settle+evaluate)
- `urls` (array, required): URLs to visit in order

### `set_page_data` (~219 tokens)

Write a payload larger than 1 MB into window.__pb_data[key], chunked past the CDP 1 MB message limit. Source: inline (`data`) or file (absolute `path`, read as binary). The page reads window.__pb_data[key] (string or ArrayBuffer per encoding) and window.__pb_data[key + '__complete'] === true. Never write one key from parallel calls — they race. Under ~200 KB use evaluate; for a real <input type=file> use file_upload.

Input parameters:

- `chunkSize` (integer): Raw bytes per chunk before base64 (default 500000; max 700000)
- `encoding` (string): utf8 (inline default) keeps a string; binary (file default) gives an ArrayBuffer for FileReader/Blob/fetch; base64 keeps the base64 string
- `key` (string, required): Property name under window.__pb_data (JS identifier, see pattern)
- `source` (required): inline: pass data. file: pass an absolute path, read as binary

### `evaluate` (~112 tokens)

Run JavaScript in the page. Good uses: computation, style mutations (.style.X = ..., classList), shadow-root traversal, in-page fetch(), app-specific side effects no dedicated tool covers. Scope is shared between calls; top-level const/let/class are wrapped in an IIFE. If/else blocks may return undefined — use a ternary or an explicit return.

Input parameters:

- `await_promise` (boolean): Whether to await Promise results
- `expression` (string, required): JavaScript code to execute in the page context

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/silbercue-public-browser/public-browser#diagnostics

## Score history

- 2026-09-20: 79
- 2026-09-19: 78
- 2026-09-18: 78
- 2026-09-17: 77
- 2026-09-16: 77
- 2026-09-15: 76
- 2026-09-14: 61
- 2026-09-13: 75
- 2026-09-12: 75
- 2026-09-11: 75
- 2026-09-10: 74
- 2026-09-09: 74
- 2026-09-08: 73
- 2026-09-07: 73
- 2026-09-06: 72
- 2026-09-05: 72
- 2026-09-04: 71
- 2026-09-03: 53

## Common questions

### What is the Public Browser MCP server?

Public Browser is an MCP server listed in the public MCP registry as io.github.Silbercue/public-browser. Browse your real profile: -30% tokens, -25% cost, -41% tool calls, -34% tool defs, +40% faster. This page covers its npm package (public-browser).

### Is the Public Browser MCP server safe to use?

Public Browser scores 79 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the Public Browser MCP server expose?

Public Browser exposes 25 tools: virtual_desk, view_page, click, type, fill_form, and 20 more. Their descriptions and schemas cost roughly 3,155 tokens of context every time the server is loaded.

### Is the Public Browser MCP server still maintained?

Public Browser is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What licence is the Public Browser MCP server under?

Public Browser declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

## Links

- npm package: https://www.npmjs.com/package/public-browser
- Socket report: https://socket.dev/npm/package/public-browser
- Repository: https://github.com/Silbercue/public-browser
- Changelog RSS feed: https://verifymcp.io/servers/silbercue-public-browser/public-browser.xml
- Changelog JSON feed: https://verifymcp.io/servers/silbercue-public-browser/public-browser.json
- HTML version of this page: https://verifymcp.io/servers/silbercue-public-browser/public-browser