The short version

Keys stay in the extension. The MCP hub listens on loopback only. One extension is trusted at a time. Page text is data, never instructions. Every run is visible and stoppable. There is no account and no telemetry.

Keys

Provider keys are stored in chrome.storage.local and sent only to the provider you selected: Anthropic, OpenAI, OpenRouter, Google, Together, Groq, DeepSeek, Inception, or a local runtime such as Ollama or LM Studio.

There is no HailBrowser proxy and no sign-in server.
Keys are never written to a page, a report or a task note.
A key you paste into an issue or a screenshot is exposed. Revoke it with the provider first.
Removing the extension removes chrome.storage.local, and the keys in it.

A hub on loopback

hailbrowser-mcp listens on 127.0.0.1:12306. Loopback is not reachable from another machine, and the server refuses WebSocket connections whose Origin is not a Chrome extension. A normal web page in your browser therefore cannot call the hub, even though it can reach localhost.

Several clients share one hub: the first process binds the port, the rest relay through it. When the host exits, another process takes over within a second and the extension reconnects.

Which extension is trusted

The first HailBrowser extension that connects is trusted, and its ID is remembered in ~/.hailbrowser/trusted-extension.json. A different extension that tries to claim the browser is rejected. Reinstalling the extension from another folder produces a new ID, so:

Managing the trust file

# accept the extension you just installed
npx hailbrowser-mcp trust <extension-id>

# forget the remembered ID entirely
npx hailbrowser-mcp trust --reset

# or pin it before the server starts
HAILBROWSER_EXTENSION_ID=<extension-id> npx hailbrowser-mcp

Run these from the checkout while the MCP client is closed. The extension ID is on chrome://extensions, under the HailBrowser card.

Switches you control

Allow external agents: Settings → Safety. When off, MCP clients cannot reach the browser at all; the side panel still works.
JavaScript tool: A separate switch. When off, javascript is refused for MCP clients, even if the rest of the tools are allowed.
Glow and tab grouping: Cosmetic, but useful: the border and the purple tab group are how you notice a run you did not expect.
Stop: The status pill on the driven tab. It halts the run and tells a coding agent that the person stopped it.

Page text is untrusted

A web page can contain text aimed at the model: “ignore previous instructions”, a fake system message, a hidden instruction in a comment. HailBrowser treats all page content as data. Prompts say so explicitly, and agents are told never to enter passwords or payment details and never to complete a purchase without an explicit instruction.

That reduces the risk. It does not remove it. A weak model can still be persuaded, and a well-crafted page is hard to distinguish from a legitimate one. The reliable defence is the same as with any automation: keep the run visible, do not leave it unattended on a site that can move money, and check the result.

Runs end by themselves

When a side-panel run finishes, the border, the tab group and the controlling strip clear.
When a coding agent makes no call for 12 seconds, control is released the same way.
If a call times out or is cancelled, the action in flight is stopped rather than completed later.
Screenshots taken for the model hide the overlay, so the model sees the page as it is rather than the annotation.
Scheduled runs are stricter: they never send, buy, post or delete anything unless the goal says so, and they report what needs you instead of waiting.

What is stored

Chats, tasks, research reports, memories and schedules are stored in chrome.storage.local. They stay on your machine, survive a browser restart, and disappear when you remove the extension. Chats and reports export as Markdown.

Memories are a short list of facts you asked it to keep. They are added to side-panel chats, tasks and scheduled jobs, but never to runs started by an external coding agent.

There is no analytics, no crash reporting and no account to create.

What this does not protect

A malicious page and a compliant model. Prompt injection is mitigated, not solved.
A key copied elsewhere. The extension cannot revoke a key; your provider can.
Another extension with debugger access. Chrome's permission model is the boundary, not HailBrowser.
Your own instructions. If you tell it to buy something, it will try to buy it.
Provider retention. Page text you send to a model is governed by that provider's policy.

Found something? Report it privately through GitHub security advisories, not a public issue.