browser-bridge

Bridge opencode into your browser. Read pages, execute JavaScript, and audit for security flaws — all from your terminal. Purpose-built for bug bounty hunting.

Why

Bug bounty hunters spend half their time switching between browser and tools. browser-bridge puts opencode directly inside the page. Browse normally, then ask opencode to read the DOM, run JS, or scan for vulnerabilities — no proxies, no manual export, no context switching.

Related MCP server: opencode-lens

Architecture

opencode ──▶ MCP server (stdio) ──▶ Unix socket ──▶ host.js (native messaging) ──▶ browser addon ──▶ page

The MCP server talks to opencode over stdio. It forwards commands through a Unix socket to the native messaging host, which relays them into the browser's active tab. Responses flow back the same way.

Requirements

• opencode

• Firefox

• Node.js ≥ 18

Install

git clone https://github.com/jordandubu/browser-bridge
cd browser-bridge
npm install
./install.sh

install.sh registers the native messaging host with Firefox. Then add this to ~/.config/opencode/opencode.jsonc:

"mcp": {
  "browser-bridge": {
    "type": "local",
    "command": "node",
    "args": ["/path/to/browser-bridge/host/mcp-server.js"]
  }
}

Install the addon from the Firefox Add-ons store. Restart opencode.

Tools

Example: security audit

User: audit this page for vulnerabilities
opencode → browser_security → returns forms, scripts, cookies, external domains
opencode: "Found 3 issues:
  1. Login form submits over HTTP (no TLS)
  2. No CSP meta tag detected
  3. Inline script uses innerHTML with user-controlled input"

CLI

For testing without opencode:

node host/bridge.js              # read page text
node host/bridge.js html         # get page HTML
node host/bridge.js js "document.title"  # run JS
node host/bridge.js security     # extract security data

Files

Contributing

PRs welcome. Only opencode is supported — if you want Cursor, Claude Code, or another MCP client, add it yourself. The bridge is client-agnostic (stdio MCP), so it should just work. Test with node host/bridge.js and npm run lint.

License

MIT