Chrome Mcp Secure

Chrome MCP Server (Security Hardened)

Enterprise-grade Chrome automation for AI agents with compliance-ready logging

Enterprise Features • Compliance Logging • Security Features • Quick Start • Docker Deploy

Enterprise Ready

Built for corporate environments where security, compliance, and auditability are non-negotiable.

Compliance Standards Support

Compliance Logging

SIEM-ready logging in industry-standard formats. Every tool execution, credential access, and security event is logged.

Output Formats

Event Categories (OWASP-Compliant)

• authentication - Login attempts, session creation
• authorization - Access control decisions
• credential - Vault operations (store, retrieve, delete)
• audit - Tool executions with timing
• security - Rate limits, injection attempts, anomalies
• data_access - Sensitive data retrieval

Quick Configuration

# Enable CEF logging for Splunk
COMPLIANCE_LOG_FORMAT=cef
COMPLIANCE_LOG_DIR=./logs/compliance

# Forward to remote syslog
SYSLOG_HOST=siem.company.com
SYSLOG_PORT=514

Example CEF Output

CEF:0|Pantheon-Security|Chrome-MCP-Secure|2.3.0|audit:tool:navigate|tool:navigate|3|rt=1702732800000 outcome=success msg=Tool navigate executed: success request=https://internal.company.com cn1=1702732800-abc123 cn1Label=correlationId

Security-hardened fork of lxe/chrome-mcp Maintained by Pantheon Security

Real-World Results

"We used this MCP for hours building out our security dashboard - the reliability was incredible. The amount of work we produced was huge compared to manual browser interaction." — Pantheon Security team

Production Tested

This isn't just a security enhancement - it's a reliable workhorse for AI-assisted browser automation. When you need Claude to interact with web apps for extended sessions, this MCP delivers.

Security Features

Core Security (v2.1.0)

Advanced Security Modules (v2.2.0+)

Post-Quantum Ready

Traditional encryption will be broken by quantum computers. This fork uses hybrid encryption:

ML-KEM-768 (Kyber) + ChaCha20-Poly1305

• ML-KEM-768: NIST-standardized post-quantum key encapsulation
• ChaCha20-Poly1305: Modern stream cipher (immune to timing attacks)

Even if one algorithm is broken, the other remains secure.

Why Post-Quantum Now?

Your browser credentials stored today could be decrypted in 10 years. This fork protects against that future threat now.

Docker Deployment

Recommended for production environments.

# Clone and start
git clone https://github.com/Pantheon-Security/chrome-mcp-secure.git
cd chrome-mcp-secure
docker-compose up -d

Production Configuration

# Copy example config
cp env.example .env

# Edit for your environment
vim .env

# Start with custom config
docker-compose up -d

Key Environment Variables

# SIEM Integration
COMPLIANCE_LOG_FORMAT=cef              # cef, syslog, jsonl, json
SYSLOG_HOST=siem.company.com           # Remote syslog server
SYSLOG_PORT=514

# Encryption (REQUIRED for production)
CHROME_MCP_ENCRYPTION_KEY=$(openssl rand -base64 32)

# Session Security
CHROME_MCP_SESSION_MAX_LIFETIME=28800000   # 8 hours
CHROME_MCP_SESSION_INACTIVITY=1800000      # 30 minutes

Log Collection

Logs are written to ./logs/compliance/ in your chosen format:

# View compliance logs
tail -f logs/compliance/compliance-2025-12-16.cef

# Forward to Splunk via syslog
docker-compose logs chrome-mcp | nc -u siem.company.com 514

See env.example for all configuration options.

Installation

One-Command Setup (Recommended)

Linux / macOS:

git clone https://github.com/Pantheon-Security/chrome-mcp-secure.git
cd chrome-mcp-secure
./setup.sh

Windows (PowerShell):

git clone https://github.com/Pantheon-Security/chrome-mcp-secure.git
cd chrome-mcp-secure
.\setup.ps1

This will:

1. Install dependencies and build the project
2. Register the MCP server with Claude Code
3. Start Chrome with remote debugging
4. Create an isolated Chrome profile

Manual Setup

npm install && npm run build
claude mcp add chrome-mcp-secure --scope user -- node /path/to/chrome-mcp-secure/dist/index.js
google-chrome --remote-debugging-port=9222 --user-data-dir=~/.chrome-mcp-profile

Platform-Specific Notes

Quick Start

1. Start Chrome with debugging

./setup.sh --start-chrome

2. Use in Claude Code

"Check Chrome connection with health tool"
"Navigate to https://example.com"
"Take a screenshot"

3. Secure Login Flow

"Store a credential for my GitHub account"
"Navigate to github.com/login"
"Use secure_login with the stored credential"

Available Tools

Browser Automation (15 tools)

Secure Credential Tools (7 tools)

Secure Credential Usage

Storing Credentials

Store a credential for my Google account:
- Name: "Google Work"
- Type: google
- Email: me@example.com
- Password: mypassword123
- Domain: google.com

Using Credentials for Login

1. Navigate to https://accounts.google.com
2. Use secure_login with the credential ID from list_credentials

The secure_login tool will:

• Retrieve and decrypt the credential from the vault
• Auto-fill the username/email field
• Auto-fill the password field
• Click the submit button
• Wipe credentials from memory after use

What Gets Protected

Configuration

Environment Variables

# Chrome connection
CHROME_HOST=localhost
CHROME_PORT=9222
CHROME_PROFILE_DIR=~/.chrome-mcp-profile

# Encryption (recommended for production)
CHROME_MCP_ENCRYPTION_KEY=<base64-32-bytes>
CHROME_MCP_USE_POST_QUANTUM=true

# Credential vault
CHROME_MCP_CONFIG_DIR=~/.chrome-mcp
CHROME_MCP_CREDENTIAL_TTL=300000  # 5 minutes

# Logging
LOG_LEVEL=info
AUDIT_LOGGING=true

Generate Strong Encryption Key

openssl rand -base64 32

See [SECURITY.md](./S

…