# browser-firefox-mcp

Security-focused Firefox browser MCP server for penetration testing agents. Built on Playwright with a Python-native API designed for vulnerability scanning, session manipulation, network inspection, and reconnaissance.

## Features

- **Firefox-first**: Uses Playwright's native Firefox engine for accurate rendering (especially useful for anti-bot detection)
- **Security tooling**: XSS payload injection, form enumeration, DOM analysis, sensitive data leak detection
- **Session management**: Cookie export/inject, token extraction, storage manipulation
- **Network inspection**: Request/response interception and capture via CDP
- **Reconnaissance**: Technology stack fingerprinting, framework detection, metadata extraction
- **MCP stdio transport**: Works with cyberstrikeai, Claude Code, Cursor, and any MCP-compatible client

## Quick Start (Kali Linux)

```bash
git clone https://your-repo/browser-firefox-mcp.git
cd browser-firefox-mcp
uv venv && source .venv/bin/activate
uv pip install -e .
playwright install firefox
python server.py  # or: browser-firefox-mcp
```

## Integration with cyberstrikeai

Add to your `~/.config/cyberstrikeai/config.json` (or equivalent):

```json
{
  "mcp_servers": {
    "firefox-browser": {
      "command": "python",
      "args": ["server.py"],
      "cwd": "/path/to/browser-firefox-mcp"
    }
  }
}
```

The agent will automatically discover tools: `navigate`, `click`, `fill`, `screenshot`,
`inject_payload`, `scan_forms`, `capture_network`, `get_session_info`,
`recon_technology_stack`, etc.

## Architecture

```
┌──────────────────┐     JSON-RPC (stdio)     ┌──────────────────┐
│  cyberstrikeai   │ ◄──────────────────────► │     server.py    │
│   (agent)        │                          │ (MCP stdio)      │
└──────────────────┘                          └────────┬─────────┘
                                                       │
                                          ┌────────────▼─────────┐
                                          │  core/ modules        │
                                          │  engine | page        │
                                          │  security | session   │
                                          │  network | recon      │
                                          └────────────┬─────────┘
                                                       │
                                               ┌───────▼───────┐
                                               │ Firefox (headless) │
                                               └─────────────────┘
```

## License

MIT