[ssricardo]

Hey Namu!

My 2nd suggestion for this tool is about security.
And IMO that's a very important aspect, especially after the changes for version 2.x.

Version 2 allows the agent to have access to all tabs in the browser.
I understand the side of making the process simpler, but I think this presents a high security risk.

Think of a case that you have you internet banking open in a tab (which you aren't looking atm), and your focus is somewhere else, but your agent has access to that too.
Especially consider that it's not only a matter of trusting the agent.
In several case (in companies and also at home) the access is done through a Gateway, so there's somebody already in the middle. Or even on the PC itself, it's not too hard that a malicious app would impersonate the AI agent.

Another vulnerability is that currently all header are available.
That includes cookies and session ID.

Then think again of the case above, with the Internet banking and possible men in the middle.
Now he can steal the users's session...

Changes

• Restrict the access to a single Tab
• Have a timeout for the allow access (it easy to forget that you allowed it)
• Redact sensitive headers values

The changes are optional, done in the settings.

Commits

Hide credential headers from agents and let the user limit which tabs they can use

• the extension hides the values of cookie, set-cookie, authorization and CSRF-token headers it relays, keeping the names, unless the user turns it off in Settings
• Settings can limit agents to the tabs they open and the ones the user enables from the popup for a while; other tabs are hidden from tab list, with a note saying how many

Description (from AI)

This branch adds two security controls to Browser MCP: it hides credential headers before they leave the browser, and it lets the user restrict which tabs AI agents are allowed to see and use.

What changed

1. Redaction of credential headers

• The extension now redacts sensitive HTTP header and cookie values from CDP events it relays to the daemon:
  • Cookie, Set-Cookie
  • Authorization, Proxy-Authorization
  • X-XSRF-Token, X-CSRF-Token
  • X-Api-Key, X-Auth-Token, X-Amz-Security-Token
• For cookies, the names are preserved so agents still know which cookies exist, but their values are hidden.
• For Authorization, the scheme (e.g. Bearer, Basic) is preserved but the token is hidden.
• Redaction is on by default and can be disabled in the extension's Settings.
• The service worker defaults to redacting until the setting is loaded, so nothing leaks during startup.

2. Tab access restrictions

• A new Settings option lets the user restrict agents to only the tabs they open and the tabs the user explicitly enables from the popup.
• When restricted, hidden tabs are omitted from tab list and the popup shows a note saying how many are hidden.
• The popup can enable a tab for a configurable number of minutes; after that, access automatically expires.
• Tabs opened by an agent remain accessible. Tabs opened by an enabled tab inherit the same access window.

Files most affected

• packages/extension-core/src/background/redact.ts (new)
• packages/extension-core/src/background/tab-access.ts (new)
• packages/extension-core/src/background/browser-control.ts
• apps/extension/src/components/settings-screen.tsx
• apps/extension/src/components/browser-control-panel.tsx
• packages/extension-core/src/storage.ts
• packages/extension-core/src/types.ts
• packages/extension-core/src/messages.ts
• packages/mcp/src/contracts.ts
• packages/protocol/src/index.ts