Ridealong

Every browser MCP lets an agent click around in the dark. Ridealong puts you in the passenger seat. Claude drives a real Chrome; you open one link and see exactly what it sees, where it clicks, what it typed — and when it hits a login, a CAPTCHA or a payment, you take the wheel from your phone, then hand it back.

In Claude Code

Ridealong is an MCP server: Claude calls its tools like any other, but every step is visible on the live view, William's pointer and messages come back into the transcript, and sensitive actions wait for an approval.

Related MCP server: mcp-helm

On your phone

Not just another browser MCP

Why Ridealong

Quick start

On the machine Claude drives — nothing to host:

claude mcp add ridealong -- npx -y -p ridealong-mcp ridealong

Or as a Claude Code plugin: claude plugin marketplace add williamblaismedia-create/ridealong then claude plugin install ridealong@ridealong. From source: git clone … && npm ci && npm run build && claude mcp add ridealong -- "$PWD/scripts/ridealong-local.sh".

Then, in Claude Code: "open timeliner.io and give me the live view". You get a signed link (http://127.0.0.1:9400/#token=…). Open it once on a device and the bare address works for 30 days — bookmark it.

In Docker (Chrome under Xvfb, ffmpeg, persistent profile):

docker build -t ridealong . && claude mcp add ridealong -- docker run -i --rm -p 9400:9400 -v ridealong-data:/data ridealong

On an always-on server with an NVIDIA GPU, a Cloudflare tunnel and a relay that survives your laptop sleeping: the reference setup is in docs/DEPLOIEMENT-W-AGENT.md (French).

ffmpeg installed → H.264 video (NVENC · VideoToolbox · libx264, auto-detected). No ffmpeg → JPEG frames. Either way it works.

Examples

Three copy-pasteable scenarios in examples/, each with the exact prompt, what you see on the live view and where you step in:

• QA after deploy — reload with the cache bypassed, click through the flow, read console_errors and network_requests, report. Includes a CLAUDE.md snippet to run it after every deploy.

• Approval-gated purchase — Claude fills the checkout, ask_approval blocks before "Place order", you tap Approve on your phone.

• Login handoff — Claude hits a login or 2FA wall, switches to Manual, you type on your own device, Claude never sees the keystrokes.

What you get on the live view

• Claude's cursor gliding to each target, a ripple on click, the action label — and a journal with timestamps.

• Auto | Manual toggle. In Manual, mouse, keyboard, trackpad scroll and pinch are relayed; Claude's perception is suspended while you type.

• Pause Claude without taking control.

• Approval cards when Claude calls ask_approval.

• Point at things (Auto mode tap → "William points at: button « Login »") and message Claude from the page. They reach Claude at the end of his next tool result — or instantly, as a Claude Code channel, if you start Claude with --dangerously-load-development-channels server:ridealong (also relays "took the wheel" / "paused").

• Real tabs: the strip mirrors Chrome; tap one to move Claude's target.

• Resolution picker (720p → 2K), applied live and remembered.

• Capture, fullscreen, video/JPEG switch, reconnects by itself, phone-ready.

Tools

Everything follows one target tab. Elements carry stable [ref]s from snapshot/find, so Claude acts by reference, never by brittle selectors. Chrome's HTTP cache and service workers are bypassed: a site you just deployed is what Claude sees.

How it works

Claude Code ──stdio──▶ ridealong (MCP) ──CDP──▶ Google Chrome
                          │
                          └─ live view ── ws ──▶ your browser / phone
                              JPEG frames, or CDP screencast → ffmpeg (GPU) → fMP4 → MSE
                              input relay ◀── Manual mode (never stored)

Two Claude Code sessions on one Chrome? The second follows the first as a control client and promotes itself if the first goes away. A local relay (scripts/ridealong-mcp-relay.mjs) keeps the MCP session alive across a dead SSH link by replaying the handshake.

Guarantees

• No capture. Manual-mode input is relayed straight to Chrome and never retained; perception tools refuse to run while you have control; password fields never expose values in snapshots. A test suite pins this down.

• Signed, expiring links (HMAC, 30 s – 1 h). Device tokens (30 days) live only in your browser. Rotate RIDEALONG_LIVE_SECRET to revoke everything.

• Loopback by default. The live view listens on 127.0.0.1; you choose how to expose it.

Roadmap

• Session recording (video + journal as chapters)

• Adaptive bitrate for weak mobile links

• Profiles: one Chrome context per client / task, incognito

• Annotated screenshots (refs drawn on the image)

• npx ridealong-mcp

Contributing

Issues and PRs welcome — see CONTRIBUTING.md. npm test runs 131 tests against a real Chromium (and ffmpeg when present).