feat(agent): add bounded local browser use#3564
Conversation
Add an opt-in isolated Playwright MCP server for every local agent adapter. Generated-By: PostHog Code Task-Id: 18a0ed17-2c63-4288-98b3-65563803ac72
|
Merging to
After your PR is submitted to the merge queue, this comment will be automatically updated with its status. If the PR fails, failure details will also be posted here |
|
React Doctor found no issues in the changed files. 🎉 Reviewed by React Doctor for commit |
Generated-By: PostHog Code Task-Id: 18a0ed17-2c63-4288-98b3-65563803ac72
Keep browser automation on accessibility snapshots so repeated screenshots cannot inflate model requests past the gateway limit. Generated-By: PostHog Code Task-Id: 64d16b4c-2c25-4e05-ba9d-824311186124
richardsolomou
changed the title
![veria-ai[bot]](https://avatars.githubusercontent.com/in/1723776?s=60&v=4){kind=small}
| name: BROWSER_USE_MCP_NAME, | ||
| command: process.execPath, | ||
| args: [ | ||
| resolvePlaywrightMcpCli(), |
There was a problem hiding this comment.
High: Codex can execute the MCP server's host-code tool without approval
@playwright/mcp@0.0.78 includes every core* tool, including browser_run_code_unsafe, which the package describes as RCE-equivalent. Codex has no MCP-specific approval gate and runs with danger-full-access on Windows and Linux, so a malicious repository or web page can prompt-inject the agent into invoking this tool and execute Node.js on the host without a permission dialog. --codegen none does not remove the tool; expose a filtered MCP surface that omits and rejects it, or do not attach this server to Codex until per-tool approval is enforced.
PR overviewThis PR adds bounded local browser-use support for the agent by wiring in a Playwright MCP-based browser service. The changed code introduces the MCP server integration that lets the agent drive a local browser during tasks. There is one open security issue, and it is significant: the exposed Playwright MCP tool surface includes a host-code execution tool that the agent can invoke without a separate approval gate. A malicious repository or web page could prompt the agent into running Node.js code on the host, giving this a clear remote-code-execution-style impact in the local agent environment. No issues have been addressed yet, so the PR still needs a tool-filtering or isolation change before this integration is safe to ship. Open issues (1)
Fixed/addressed: 0 · PR risk: 8/10 |
1 participant
Problem
Local agents need browser automation without tying the capability to one model adapter. Image-heavy browser responses can also make long conversations exceed the gateway request limit.
Changes
I added opt-in isolated Playwright MCP support for local adapters, packaged its runtime, and kept responses on accessibility snapshots instead of embedding screenshots in conversation history.
How did you test this?
pnpm build.Automatic notifications
Created with PostHog Code