browser-firefox-mcp

Security-focused Firefox browser MCP server for penetration testing agents. Built on Playwright with a Python-native API designed for vulnerability scanning, session manipulation, network inspection, and reconnaissance.

Features

Firefox-first: Uses Playwright's native Firefox engine for accurate rendering (especially useful for anti-bot detection)
Security tooling: XSS payload injection, form enumeration, DOM analysis, sensitive data leak detection
Session management: Cookie export/inject, token extraction, storage manipulation
Network inspection: Request/response interception and capture via CDP
Reconnaissance: Technology stack fingerprinting, framework detection, metadata extraction
MCP stdio transport: Works with cyberstrikeai, Claude Code, Cursor, and any MCP-compatible client

Quick Start (Kali Linux)

git clone https://your-repo/browser-firefox-mcp.git
cd browser-firefox-mcp
uv venv && source .venv/bin/activate
uv pip install -e .
playwright install firefox
python server.py  # or: browser-firefox-mcp

Integration with cyberstrikeai

Add to your ~/.config/cyberstrikeai/config.json (or equivalent):

{
  "mcp_servers": {
    "firefox-browser": {
      "command": "python",
      "args": ["server.py"],
      "cwd": "/path/to/browser-firefox-mcp"
    }
  }
}

The agent will automatically discover tools: navigate, click, fill, screenshot, inject_payload, scan_forms, capture_network, get_session_info, recon_technology_stack, etc.

Architecture

┌──────────────────┐     JSON-RPC (stdio)     ┌──────────────────┐
│  cyberstrikeai   │ ◄──────────────────────► │     server.py    │
│   (agent)        │                          │ (MCP stdio)      │
└──────────────────┘                          └────────┬─────────┘
                                                       │
                                          ┌────────────▼─────────┐
                                          │  core/ modules        │
                                          │  engine | page        │
                                          │  security | session   │
                                          │  network | recon      │
                                          └────────────┬─────────┘
                                                       │
                                               ┌───────▼───────┐
                                               │ Firefox (headless) │
                                               └─────────────────┘

License

MIT