Web MCP Bridge
Connects Google's Gemini web interface to local MCP servers through the extension/bridge, allowing the chat to request and run approved tools on the user's machine and continue the conversation with the returned results.
Connects OpenAI's ChatGPT web interface to local MCP servers through the extension/bridge, letting the chat request tools that are approved by the user and run on their own machine (e.g. reading files, controlling programs, querying local data), with results injected back into the chat.
Listed among the supported web chat platforms, allowing Perplexity's web interface to request approved tools from local MCP servers and receive their results in the conversation.
Web MCP Bridge
Use your local MCP servers with ChatGPT, Gemini, Claude Web and DeepSeek: no API keys, no extra subscriptions.
Web MCP Bridge lets the free web versions of ChatGPT, Gemini, Claude and DeepSeek use tools on your own computer: read files, control programs, query your data… with no API keys and no extra subscriptions. You approve every action.
Only connect MCP servers you trust. A tool with filesystem access can read whatever you allow it to.
Jump to: Install · First use · Add my MCPs · Troubleshooting
🧩 How it works (in 20 seconds)
Two pieces work together:
Piece | What it is | Where it lives |
🌐 The extension | Installed in your browser. It reads what the AI asks for and shows you the buttons and permissions. | Chrome, Edge or Brave |
🌉 The bridge | A small Python program that connects the extension to your tools (MCP servers). | Your computer, in the background |
flowchart LR
A["💬 Chat<br/>ChatGPT · Gemini · Claude · DeepSeek"] <--> B["🌐 Extension"]
B <-->|"local WebSocket"| C["🌉 Bridge (Python)"]
C <--> D["🧰 Your MCP tools"]You ask the AI something in the chat.
The AI answers with an "order" (a JSON block) asking for a tool.
The extension asks if you allow it → runs it on your PC → pastes the result back into the chat so the AI can continue.
🔒 Everything happens on your computer. Nothing is sent to third-party servers.
Related MCP server: browserpilot-mcp
✅ What you need
Requirement | How to check |
Chrome, Edge or Brave (version 116 or newer) | Menu → About. |
Python 3.9 or newer | Open a terminal and type |
This project downloaded | Green Code → Download ZIP button on GitHub, then unzip (or |
Optional: Node.js, if you'll use MCP servers launched with npx (for example the filesystem one).
🚀 Step-by-step installation
🪟 Windows
Step 1 · Install the launcher (once)
Open the server folder and double-click install.cmd. Wait until it says Done.
It does three things for you: installs what's missing (websockets), makes the bridge start automatically when you log in, and starts it right now.
Step 2 · Load the extension in your browser
Type
chrome://extensionsin the address bar (Edge:edge://extensions).Turn on Developer mode (top right).
Click Load unpacked and pick the project folder (the one containing
manifest.json).A welcome page opens by itself, guides you and checks each step live. We recommend pinning the extension with the puzzle icon 🧩.
Step 3 · Check everything is green Open the extension icon: the top should say “Puente conectado” (bridge connected) with a green dot and your servers below.
Done! Continue with Your first time.
🍎 macOS / 🐧 Linux
python3 server/install_service.pyIt installs what's needed and makes the bridge start with your session (launchd on macOS, systemd on Linux). Then load the extension as in Step 2. The popup's Start / Stop buttons need the launcher, which is currently Windows-only. On macOS/Linux the bridge still works and restarts itself if it crashes.
🎛️ Control the bridge from the extension
No terminal needed for everyday use. In the popup, bridge card:
Button | What it does |
Start | Turns the bridge on (if it was off). |
Stop | Turns it off and keeps it off until you start it again (even after rebooting your PC). |
Restart | Closes and reopens it. Use it after changing something or if it got stuck. |
Edit servers.json | Opens the file that lists your MCPs. It reloads by itself when you save. |
💡 Header switch vs. “Stop”. The big switch in the header only makes the extension stop acting (the icon shows
OFF). “Stop” closes the program on your PC.
If Start/Stop is greyed out, the launcher is missing: double-click server/install.cmd.
💬 Your first time (60 seconds)
The project ships with a demo server (demo) so you can try it without installing anything else.
Open the popup → Servers tab → turn on the demo switch.
Type something like: “What time is it? Use your tools.” (the instructions are added automatically to your first message; if not, open the Web MCP Bridge panel at the bottom-left and click Inject instructions).
The AI asks for a tool → a prompt appears → click Allow.
The result is pasted into the chat and the AI answers you. 🎉
By default permission is “Ask every time”: nothing runs unless you approve it. You can change it per server or for all of them.
➕ Add your own MCP servers
Your servers are defined in server/servers.json (created automatically on install). Each one needs a name, a unique port and the command that starts it:
{
"servers": [
{ "name": "demo", "port": 8090, "command": ["python", "server/examples/demo_mcp_server.py"] },
{ "name": "my-mcp", "port": 8081, "command": ["python", "-m", "my_mcp_server"] },
{ "name": "files", "port": 8082, "command": ["npx", "-y", "@modelcontextprotocol/server-filesystem", "C:/Users/you/Documents"] }
]
}More examples in
server/servers.example.json.Click Edit servers.json in the popup, save, and within ~2 seconds it shows up in the list. Turn it on with its switch (up to 5 at once; 1 costs fewer tokens).
To disable one without deleting it: add
"disabled": true.In paths use
/(C:/Users/...) instead of\.
🩺 Something not working?
Symptom | Fix |
Popup says “Puente apagado” (bridge off) | Click Start. If the button is greyed out, double-click |
“Falta el lanzador” (launcher missing) | Normal the first time: run |
| Reinstall Python ticking Add Python to PATH, or try |
“Port in use” (8080, 8090…) | Click Restart. If it persists, change that server's |
A server shows an error (e.g. | It's just an example: if you don't have it installed, delete it from |
Red notice “servers.json tiene un error” | A comma or quote is misplaced. Fix it and save: the bridge reloads by itself. |
The chat doesn't react / panel missing | Reload the tab (F5) and make sure the header switch is on. If the site changed its UI, open an issue. |
I moved or renamed the project folder | Run |
I want to remove everything |
|
Still stuck? Tell us in the Telegram channel or open an issue.
🧩 Supported platforms
Platform | Status | Adapter |
✅ Supported |
| |
✅ Supported |
| |
✅ Supported |
| |
✅ Supported |
| |
| 🗺️ Roadmap |
✨ Skills at a glance
Skill | What it does | |
Context control | Register many servers, 1 active by default (up to 5). Only active servers' tools reach the model; the popup shows the approximate token cost. | |
Per-MCP permissions | 3-state selector — Allow always · Ask every time · Don't allow — global and per server, in the popup and the in-page panel. | |
Nothing is dropped | Images, audio and binary resources are attached to the chat as real files; long text is attached in full instead of truncated. | |
No preinstalled MCP | Add your own, or the bundled demo server with one click. | |
Reliable in the background | No step relies on page timers (throttled when hidden); delivery is verified and retried. | |
The AI doesn't forget | A one-line reminder per message plus periodic full re-injection. | |
≈ 50 % fewer tokens | Tools are described as | |
~40 lines per platform | A new platform is just a set of selectors. | |
Locked down | The Python bridge listens on | |
No duplicates, auto-reconnect | Per-call IDs, exponential backoff, keep-alive for the MV3 Service Worker, call history, light/dark UI. | |
Badly escaped JSON never hangs the chat | Windows paths with | |
Servers detected automatically | The extension reads | |
No more "port 8080 in use" |
| |
Reconnect without duplicates | If the server was down before the call was sent, the extension waits for the reconnection and retries. If the AI sends several calls in one message, it's told only the first one ran. |
🧰 For advanced users
Everything above can also be done from the terminal.
# Launcher (Windows): start, stop and restart
python server/start_bridge_loop.pyw --ctl start | stop | restart | status | quit
# Bridge directly
python server/mcp_ws_bridge.py --config server/servers.json --restart # restart (closes the old one even if it holds :8080)
python server/mcp_ws_bridge.py --config server/servers.json --status # status of every server
python server/mcp_ws_bridge.py --config server/servers.json --reload # re-read servers.json
python server/mcp_ws_bridge.py --config server/servers.json --stop # stop the bridge
python server/install_service.py --uninstall # remove auto-startOn Windows you can also double-click server\restart_bridge.cmd / server\bridge_status.cmd.
Port | Purpose |
| One port per MCP server (you define them in |
| Bridge control ( |
| Launcher ( |
If a bridge is already running,
--configreloads it instead of failing with "port in use".--restartonly closesmcp_ws_bridgeprocesses; if another program owns the port it tells you which and leaves it alone.servers.jsonaccepts a BOM (added by PowerShell), a top-level"control_port"/"launcher_port"and"disabled": trueper server.A single server without a config file:
python server/mcp_ws_bridge.py --port 8080 --name demo -- python server/examples/demo_mcp_server.py
📡 Call protocol
{ "mcp_call": { "server": "server_name", "name": "tool_name", "arguments": { "arg1": "value" } } }Results come back as:
[MCP_RESULT server="…" tool="…" status="ok|error|rejected"]
…
[/MCP_RESULT]The content ofMCP_RESULT is presented to the AI as data, not instructions (prompt-injection mitigation).
Tolerant formats and error feedback
The parser reads the call in three layers: 1) strict JSON, 2) repaired JSON (backslash paths, raw newlines, unescaped or typographic quotes, trailing commas) and 3) flags: server, name and arguments are located separately and each argument is extracted by name using the tool schema. A call is only accepted if the server and tool exist among the active MCPs and the message isn't cut off.
If the AI clearly tried to call a tool but the block can't be read, the extension answers (max. 3 consecutive notices) instead of leaving the chat waiting:
[MCP_RESULT server="bridge" tool="mcp_call" status="format_error"]
Nothing was executed: your mcp_call block could not be read. Reason: invalid escape sequence (... near: ...)
[/MCP_RESULT]A path such asC:\new\test is ambiguous for any JSON parser (\n, \t), which is why the prompt always asks for / in paths.
🔐 Security model
Risk | Mitigation |
A website opens | The bridge rejects any |
The AI runs unwanted actions | “Ask every time” is the default; “Allow always” is an explicit choice per MCP (or global); “Don't allow” blocks the MCP. |
Hidden instructions in results (prompt injection) | The prompt marks |
Network exposure | Listens on |
A website reads or shuts down the control ( | They only accept extension |
🛠️ If a website changes its interface
Selectors live at the top of each adapter (content_scripts/adapters/*.js). Add the new selector at the start of the matching list (composer, sendButton, assistantMessages, stopButton) and open an issue: it's usually a one-line fix.
🛠️ Development
npm test # syntax, parser, prompt builder and bridge integration tests
npm run pack # dist/web-mcp-bridge.zip🤝 Community & Contributing
Astrax is open source and grows with its community. You're welcome to open issues, send pull requests, suggest ideas, try Astrax on other systems or MCP clients, and report bugs. Read CONTRIBUTING.md to get started — new adapters are the best first contribution.
Please also read our Code of Conduct before taking part, and report security issues privately by following our Security Policy (never in a public issue).
Looking for more MCP servers to plug into the bridge? Browse the community-curated Awesome MCP Servers list.
If you find the project useful, leave a ⭐ on the repository and subscribe to the channel.
Made with 💙 by Rufus · @AstraxOf · astrabots.pro
Available Tools
4 toolsecoA
Devuelve el mismo texto que recibe.
| Name | Required | Description | Default |
|---|---|---|---|
| texto | Yes | Texto a repetir |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full disclosure burden, and it states the complete observable behavior: the output is identical to the input. That fully implies a side-effect-free, deterministic operation. It stops short of saying this is a diagnostic/round-trip tool, which would have made it a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single short sentence with zero padding, and the essential behavior is front-loaded. Nothing could be removed without losing meaning.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter pure function with full schema coverage and no output schema, the description says enough to invoke it correctly. The only gap is that it never hints at the intended use case, such as verifying connectivity or round-tripping text.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and the single parameter already documents itself as 'Texto a repetir'. The description only restates that the received text is returned, adding no format, length, or encoding details beyond the schema. Baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a concrete behavior: it returns exactly the text it receives, which disambiguates the terse name 'eco'. It does not distinguish itself from the siblings, but those (info_sistema, hora_actual, sumar) are unrelated utilities, so differentiation is less critical here.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use guidance at all: nothing says whether this is meant for connectivity checks, round-trip testing, or echoing values back to a caller. The usage is only implicit from the echo semantics.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
hora_actualA
Devuelve la fecha y hora actuales del equipo del usuario.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden, but this is an inherently safe read with zero parameters. It does add one genuinely useful behavioral detail: the time comes from the user's equipo, implying local timezone rather than server time. It says nothing about output format or precision.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler or redundancy. Everything stated earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a trivial zero-parameter tool this is mostly sufficient, but there is no output schema, so the description is the only place to state the return format (string, ISO 8601, timezone handling) and it omits that.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so there is nothing for the description to disambiguate; baseline 4 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
"Devuelve la fecha y hora actuales del equipo del usuario" names a specific verb (devuelve) and resource (fecha y hora actuales), and clarifies the source as the user's machine. It is distinguishable from siblings like info_sistema or sumar, though it does not explicitly contrast with them.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit when-to-use or when-not-to-use guidance is given, and no sibling such as info_sistema is named as an alternative. The usage is only implied by the self-evident nature of a clock tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
info_sistemaA
Muestra informacion real del equipo: sistema operativo, procesador, memoria, disco, tiempo encendido y version de Python. Es la prueba mas rapida de que todo funciona.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are supplied, so the description carries the full burden, but the tool takes zero parameters and is plainly a read-only informational call. The description usefully adds that it returns *real* (not mocked) machine data and frames it as a quick health probe, yet it says nothing about latency, sandboxing, or side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, with the data payload front-loaded and the purpose framing second. No filler or redundant restatement of the tool name.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no parameters, no output schema, and no annotations, the description supplies everything an agent needs: the returned fields, the fact that values are real, and the practical reason to call it. Nothing material is missing for such a simple tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero input parameters, which is the baseline-4 case; there is nothing for the description to disambiguate. It does at least preview which values the response contains, adding a little value beyond the empty schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description pairs a specific verb ("Muestra") with an enumerated set of resources (OS, processor, memory, disk, uptime, Python version), so the agent knows exactly what data comes back. None of the siblings (hora_actual, sumar, eco) overlap with this scope, making it distinguishable without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
"Es la prueba mas rapida de que todo funciona" implies a health-check/smoke-test use case, which is a genuine usage hint. However, it never names alternatives or states when not to use it, so guidance remains implied rather than explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sumarC
Suma dos numeros.
| Name | Required | Description | Default |
|---|---|---|---|
| a | Yes | ||
| b | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full disclosure burden, yet it says nothing about return format (number vs string), error handling for missing/non-numeric inputs, or precision behavior. The operation is trivially simple, which limits the practical risk, but the description itself adds no behavioral context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single short sentence with no filler, and the purpose is front-loaded. It is arguably too terse rather than padded, so the only cost is omitted information, not wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a two-number arithmetic utility with no output schema and no annotations, the description covers the core action, which is the minimum needed to call it. It stops short of stating the return value or input constraints, which would complete the picture for an agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% and the parameter names (a, b) are uninformative on their own, but the phrase "suma dos numeros" implies both parameters are the addends, giving partial semantic grounding. It does not clarify ordering, accepted numeric range, or whether either operand is optional, so it only marginally compensates for the missing schema descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
"Suma dos numeros" states a specific verb (sum) and the operands involved, which is enough to distinguish it from the unrelated siblings (info_sistema, hora_actual, eco). It does not explicitly contrast with siblings, but none of them are arithmetic so no confusion arises.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this versus anything else, no note on operand types (integers, floats, negatives) and no mention of what it returns. Usage is inferable only from the one-line purpose statement.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
4 tool updates
v0.1.0- First observed
eco - First observed
hora_actual - First observed
info_sistema - First observed
sumar
TDQS
Scored across 4 tools
Each tool has a completely distinct purpose: system info, current time, arithmetic addition, and text echo. There is essentially no way to confuse them, and descriptions reinforce the boundaries clearly.
All names are lowercase snake_case, which is consistent, but they mix noun-style names (info_sistema, hora_actual, eco) with verb-style names (sumar), so there is no predictable verb_noun pattern.
Four tools is a reasonable count, but they read as demo/smoke-test utilities rather than a scoped toolset for a 'Web MCP Bridge.' The surface feels thin and trivial rather than purposeful.
The tools are disconnected demo primitives (echo, sumar, hora_actual, info_sistema) with no coherent domain lifecycle or CRUD coverage. For a bridge server, there are no meaningful bridge operations, leaving significant functional gaps.
Maintenance
Related MCP Connectors
Zero-setup MCP gateway securely connecting AI to your tools with authentication and workflows
A comprehensive Model Context Protocol (MCP) server that enables AI assistants to interact with yo…
Connect AI agents to your own Chrome with scoped access, approvals, and verified task results.
Live browser debugging for AI assistants — DOM, console, network via MCP.
Related MCP Servers
- AlicenseNot gradedqualityBmaintenanceEnables browser-based AI chat interfaces to use local MCP tools by injecting a tool-call protocol into the page and executing approved filesystem, shell, and downstream MCP tool calls from a local daemon.465 npmMIT
- AlicenseNot gradedqualityBmaintenanceEnables remote AI agents to control a local, authenticated desktop browser over MCP through an outbound WebSocket bridge and Chrome extension, supporting tab management, navigation, page reading, clicking, typing, scrolling, screenshots, and JavaScript evaluation.1MIT
- AlicenseNot gradedqualityBmaintenanceConnects ChatGPT Web chat directly to a local computer, enabling verified file editing, terminal command execution, Playwright browser automation, code intelligence, and desktop control through the Model Context Protocol. Every operation is backed by pre- and post-condition checks such as SHA-256 byte readback and live DOM validation, so agents can trust that reported successes actually happened.64 npm1MIT
- FlicenseNot gradedqualityAmaintenanceEnables web-based AI chat clients such as Claude, ChatGPT, and Grok to operate a user's local machine through a single OAuth-gated, whitelist-protected MCP endpoint exposing tools for file editing, shell commands, search, Git, SQLite, browser automation, DevTools, background tasks, localhost service fetching, clipboard, notifications, ports, and Postman control.-