By Paul Derrington, Jr.
CEO | Chief Engineer | Research Engineer | Editor, D-CSIL
5 min read
Key Takeaways
OpenCode Browse combines an MCP server with a Chromium extension so coding agents can work in your signed-in browser. Its documentation lists clients including OpenCode, Claude Code, Cursor, Codex, and Zed, and describes a handoff workflow for human steps. This guide covers installation and the limits of its controls: browser access can expose account data and allow actions in your name.
What Browse is, in one paragraph
Browse is an MCP server and a Chromium extension from Anomaly, the maker of OpenCode. The agent talks to the server, which passes commands to a relay; the extension runs them through Chrome's debugger. Agents can open their own tabs in your existing browser profile or use a tab you explicitly lend through the toolbar button, taking advantage of existing sessions where available. That does not guarantee a site will accept an existing login or permit automation.
The project README lists Chrome, Edge, Brave, Arc, Helium, Vivaldi, Opera, and Chromium. It requires a Chromium browser and lists setup support for OpenCode, Claude Code, Cursor, Codex, Zed, and other clients. Other compatible stdio MCP clients can be configured manually. The repository is MIT-licensed. These are the project's documented capabilities, not results of independent compatibility testing.
Install it in four steps
1. Review the installer before running it. The README gives curl -fsSL https://opencode.ai/browse/install | bash for macOS or Linux, and irm https://opencode.ai/browse/install.ps1 | iex in Windows PowerShell. Both download and execute a script. The Node alternative is npx @opencode/browse install and requires Node.js 22.19 or newer. The documented binary installer uses ~/.local/bin, or $XDG_BIN_HOME when set, and checks the download's size and SHA-256. Those checks verify the download against the release manifest; they are not a security audit.
2. Pick your agents. In an ordinary interactive shell, detected agents start checked; use the arrow keys, Space, and Enter to select them. The command browse install -a claude cursor names clients explicitly. Outside a recognized agent, browse install -y selects detected clients without the picker; inside a recognized agent, installation can target that caller automatically. For another compatible stdio MCP client, configure command browse with argument mcp.
3. Add the extension and pair it. The installer opens the Chrome Web Store listing and attempts pairing after installation. Review the extension permissions, which include debugger access and access to all sites. If needed, rerun browse install for a pairing link, or run browse pair and enter its code in Extensions > browse > Options under advanced, then click Connect. The README says each browser receives its own key and a manually generated pairing code is single-use and expires after ten minutes.
4. Try a low-risk task. The README's example asks the agent to open news.ycombinator.com and report the top story. Check the result yourself and use browse status or the extension's options page to inspect the connection. Review update settings too: the documented default installs updates automatically; the extension offers Only tell me and Don't check options.
What a job looks like once it's running
By default, agents open background tabs in the last-used window and group them together. The documented default closes tabs after ten minutes without use, with exceptions for running scripts, handoffs, and recordings; these settings can be changed. The toolbar button lends an existing tab to an agent and takes it back on another click. The badge shows ON, RUN, or WAIT to indicate its state.
Browse provides a handoff workflow: the agent calls handoff when a person needs to take over, such as for a login, 2FA prompt, or payment confirmation. A card identifies the site's origin, and the person clicks Continue or the toolbar button when finished. This is not a blanket guarantee that Browse detects and blocks every sensitive action. Set explicit limits with the agent and review consequential actions yourself. For bot checks, the documentation describes waiting up to 15 seconds for non-interactive checks, then recommending a handoff for interactive challenges or a stop for access blocks; Browse does not solve CAPTCHAs.
The documented tools include Playwright execution, network capture to a redacted HAR, MP4 or WebM recording, and a rolling video buffer. An optional session allowlist restricts where tabs navigate. It does not block all subresource requests, including images, fetch requests, iframes, and workers, so it is not a complete network isolation boundary.
The controls and their limits
The relay listens on 127.0.0.1:19988 by default, with authenticated HTTP and CDP access and browser pairing. Remote relay configuration is also documented; Browse does not itself encrypt that connection. Agent execution withholds several Node APIs and restricts file access, but shares the relay's process. The README explicitly says this is not a security boundary and to treat agent code as code running as you. Some restrictions also have environment-variable overrides.
The extension requests broad browser permissions. Its privacy policy says page content, screenshots, network traffic, and actions can reach the user's configured AI model provider through the agent. Stored site secrets are designed to stay out of agent transcripts, but the README warns that a page script could read a secret after it is typed. The project documents redaction and retention limits for session journals; those controls do not guarantee that every captured page, screenshot, or recording is free of sensitive information.
Use a narrowly scoped session and avoid sensitive accounts unless the task requires them. Keep 2FA under your control, review the agent's permission settings, and do not treat page text as authorization to spend, send messages, disclose data, or change accounts. Browse supplies browser controls; it does not replace the user's instructions or the agent's confirmation requirements.