This server gives an MCP agent tools to manage real-browser website sessions without the agent ever seeing your password.
sign_in: Opens a real browser profile at a URL under a durable session name so you can log in yourself.
complete_sign_in: After you confirm login, saves the session and closes the login window.
browse: Reads a page using a named session; omitting URL reuses the sign-in URL and can detect when login is required again.
list_sessions: Lists saved website sessions and shows whether a login window is currently open.
revoke: Deletes a named session and its local browser profile.
Runs as a local daemon, reuses your existing Chromium-based browser profile, and keeps cookies on your machine only.
Allows reuse of an existing Arc browser profile for passwordless sign-in and session-based browsing.
Allows reuse of an existing Brave browser profile for passwordless sign-in and session-based browsing.
Allows reuse of an existing Opera browser profile for passwordless sign-in and session-based browsing.
Allows reuse of an existing Vivaldi browser profile for passwordless sign-in and session-based browsing.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@session-broker Sign into https://example.com and show the dashboard"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
MCP tools so an agent can sign into a website without seeing your password.
You stay in the browser you already use. We open that app with your existing profile (cookies and all) so a fresh Chromium does not force a new login. Tools: sign_in, complete_sign_in, browse, list_sessions, revoke.
Local only. Not a cloud vault.
Needs Node (for npx). Nothing else — the first run installs its Python runtime by itself.
Add to ~/.cursor/mcp.json (merge with your existing servers):
{
"mcpServers": {
"session-broker": {
"command": "npx",
"args": ["-y", "github:om-divyatej/session-broker"]
}
}
}Reload MCP / restart Cursor. You should see sign_in, complete_sign_in, browse.
claude mcp add session-broker -- npx -y github:om-divyatej/session-brokerFirst launch takes a minute: it installs uv (a Python runner) if you don't have it, then fetches the server. After that it's instant.
Related MCP server: browser-auth-mcp
Ask the agent:
Use session-broker. Sign into https://example.com/login as session
demo, then tell me what you see.
Quit the browser if it is already running (one process per profile).
We pick the Chromium-based browser you actually use (freshest cookies: Chrome, Brave, Arc, Edge, Vivaldi, Opera, …) and open that profile — you should already be logged in.
Only sign in if that site still asks. Do not paste the password in chat.
Tell the agent you are signed in.
It calls complete_sign_in, then browse. Leave that window alone while the agent works.
Safari (and Firefox) are not in this path — Playwright cannot reuse Safari's profile. If Safari is your only browser, install Chrome/Brave/Edge or set SESSION_BROKER_ISOLATED=1 (empty profile, you log in once).
Force a browser with SESSION_BROKER_BROWSER=chrome|brave|arc|msedge|…. Isolated empty profiles: SESSION_BROKER_ISOLATED=1. Attach to a browser started with remote debugging: SESSION_BROKER_CDP=http://127.0.0.1:9222.
Daemon on 127.0.0.1:19876 owns Playwright and named profiles.
MCP stdio is a thin client. If the daemon is down, it starts one.
mcp is the default command. We open whatever Chromium browser you already live in; we only download Playwright Chromium if none is installed. Sessions live in ~/.session-broker/. Delete a site with revoke, or rm that folder.
Skip Node and run the Python entry point directly:
{
"mcpServers": {
"session-broker": {
"command": "uvx",
"args": ["--from", "git+https://github.com/om-divyatej/session-broker", "session-broker"]
}
}
}CLI checks:
npx -y github:om-divyatej/session-broker status
npx -y github:om-divyatej/session-broker serveThis is session-sharing with your consent. Sites that bind logins to device/IP (Google, banks, some shops) may reject the headless replay. Device-bound cookies cannot be copied off the machine by design.
Read a page using a named session. Omit url to reuse the sign_in url.
If the result is LOGIN_REQUIRED, call sign_in, wait, complete_sign_in, retry.
| Name | Required | Description | Default |
|---|---|---|---|
| url | No | ||
| name | Yes |
| Name | Required | Description |
|---|---|---|
| result | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It discloses that the tool is session-based, reads a page, can return LOGIN_REQUIRED, and defines a retry flow. It does not mention failure modes for missing sessions, but the read behavior and auth handling are transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short paragraphs with no filler. The core purpose is front-loaded, and the auth-failure workflow is compressed into a precise instruction sequence.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description is complete for a simple read tool: it states what it reads, how the session/url interact, and how to recover from LOGIN_REQUIRED. The only minor omission is explicitly pointing to list_sessions or defining where a named session comes from.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, but both parameters are addressed in prose: 'named session' defines name, and 'Omit url to reuse the sign_in url' gives meaningful semantics for url beyond its optional/null schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description opens with 'Read a page using a named session,' which names a specific verb, resource, and mechanism. This clearly differentiates browsing from the sibling sign_in/complete_sign_in/list_sessions/revoke operations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives two explicit usage rules: omit url to reuse the sign_in url, and if the result is LOGIN_REQUIRED, call sign_in, wait, complete_sign_in, then retry. This routes the agent to the correct sibling workflow without inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Call after the user says they finished logging in. Saves the session (cookies stay in a local browser profile) and closes the login window.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes |
| Name | Required | Description |
|---|---|---|
| result | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It discloses key side effects: saving the session, cookies staying in a local browser profile, and closing the login window. It does not mention error conditions or idempotency, but the main behavior is transparent for a simple completion action.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences with no wasted words. The most important trigger condition ('Call after the user says they finished logging in') is front-loaded, followed by specific side effects.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple and the output schema exists, so return values are covered. However, the required 'name' parameter is a meaningful gap, and there is no guidance on when not to use it or how it relates to sign_in. Acceptable for a minimal tool but not fully complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The required parameter 'name' is completely unexplained in both the description and the schema (0% schema_description_coverage). The agent has no way to know what value to supply. With low schema coverage, the description was obligated to compensate and did not.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states a specific action with a timing trigger ('after the user says they finished logging in') and concrete outcomes ('Saves the session... closes the login window'). It distinguishes itself from siblings like sign_in (which presumably initiates the login) by focusing on the completion step.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says when to use the tool: after the user says they finished logging in. It does not name alternatives or exclusions, but the trigger condition provides clear contextual usage guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
List saved website sessions and whether a login window is open.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
| Name | Required | Description |
|---|---|---|
| result | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the behavioral disclosure burden. The word 'List' clearly signals a non-mutating read operation, and the description reveals what information the tool reports. It does not discuss auth requirements or rate limits, but these are not obviously critical for a zero-parameter listing tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The entire description is one short, front-loaded sentence that says exactly what the tool does and what it returns. There is no filler, redundancy, or unnecessary detail.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter read-only tool with an output schema present, the description is complete enough: it identifies the operation, the resource, and the key output dimension. The agent can select and invoke this tool correctly without additional context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so the schema trivially covers all parameter semantics. The description adds no parameter-level detail, but none is needed. This is the baseline 4 for a zero-parameter tool.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb ('List') and a clear resource ('saved website sessions'), and also specifies the output aspect ('whether a login window is open'). It is easily distinguishable from sibling tools like sign_in, browse, and revoke, which are all action-oriented.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool should be used when an agent needs to inspect saved sessions or login-window status, but it provides no explicit when-to-use guidance, prerequisites, or exclusions naming alternatives. The differentiation from siblings is left to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Delete a named session and its local browser profile.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes |
| Name | Required | Description |
|---|---|---|
| result | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Since no annotations are provided, the description carries the full burden of behavioral disclosure. It clearly reveals the destructive scope: the description does not just say 'revoke' — it says the session and its local browser profile will be deleted. It could add detail about irreversibility or impact on other sessions, but the core destructive behavior is transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single precise sentence with no filler. The action verb and target resource are front-loaded, and every word contributes meaning. It could not be shortened further without losing key information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter destructive tool, the description plus input and output schemas covers the basic operation and result. However, it does not mention where to obtain the session name (such as list_sessions) or provide any caution about the irreversible removal of the local profile, so it is minimally adequate but not fully complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 0% description coverage, so the description must compensate. It weakly implies that the session has a name, but it never explicitly states that the required 'name' parameter is the identifier of the session to delete or how to obtain a valid value. This is a meaningful gap for correct invocation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Delete') and names the exact resource ('a named session and its local browser profile'). It also distinguishes this tool from its siblings: none of sign_in, complete_sign_in, browse, or list_sessions implies deletion, so an agent can clearly see that revoke is the destructive session-removal operation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The intended use is implied: use this tool when you want to delete an existing named session and its local profile. However, the description does not explicitly state when this tool should or should not be used, nor does it point to alternatives like list_sessions for finding valid session names.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Open a real browser so the user can log into a website.
The agent never sees the password. name is a durable session id
(e.g. "western-digital"). After the user finishes logging in, you MUST
call complete_sign_in before browsing.
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | ||
| name | Yes |
| Name | Required | Description |
|---|---|---|
| result | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden. It discloses that a real browser opens, the agent never sees the password, and a mandatory completion step is required. These are critical behavioral traits an agent would not otherwise know.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, each earning its place. The main action is front-loaded, followed by necessary caveats about password privacy and the mandatory complete_sign_in step. No filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers the essential behavior, security boundary, session naming, and mandatory follow-up. It doesn't mention error cases or what the output represents, but an output schema exists, so return-value details are not the description's responsibility.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It thoroughly explains `name` as a durable session id with an example, but `url` is only indirectly implied by 'log into a website.' The description partially compensates but not fully for both parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb and resource: it opens a real browser for the user to log into a website. It clearly distinguishes this tool from sibling tools like browse and complete_sign_in by framing login as a user-driven interactive step.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives strong sequencing guidance: after login, the agent MUST call complete_sign_in before browsing. It also explains that `name` is a durable session id. It doesn't explicitly state when sign_in is preferred over browse, but the login-flow context makes this reasonably clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
v0.1.0browsecomplete_sign_inlist_sessionsrevokesign_inScored across 5 tools
Each tool has a distinct role in the session lifecycle: browsing, listing, deleting, starting login, and completing login. The two-phase sign_in/complete_sign_in flow is clearly separated and not ambiguous.
Most tools follow a clear imperative verb_noun or phrasal-verb pattern like list_sessions, complete_sign_in, and sign_in. Browse and revoke are less descriptive but still readable and not confusing.
Five tools is well-scoped for a session-broker service. Each tool covers a necessary part of the workflow without redundancy.
The tool surface covers the full lifecycle: create a session (sign_in/complete_sign_in), use it (browse), inspect it (list_sessions), and destroy it (revoke). No obvious gaps exist for the stated purpose.
Launch, inspect, control, and share isolated cloud browsers for your agents.
Undetectable cloud browser sessions for AI agents and scrapers. Navigate, extract, click, captcha.
Run multi-step tasks in a real Chrome browser: persistent environments, live view, human takeover.
Stealth web automation for AI agents. Login, signup, navigate, screenshot.
