Browserbase MCP Server: Tools, Setup and Security

The Browserbase MCP server lets an AI app drive a real web browser in the cloud. It can open pages, click and type using plain-English instructions, and pull data out. Browserbase hosts it at https://mcp.browserbase.com/mcp, and it uses Browserbase's Stagehand library under the hood.

Checked against: Browserbase MCP setup guide on 28 October 2026. eSEOspace did not install or test this server.

At a glance

What it can do

The setup guide documents six tools:

• start: creates or reuses a browser session and makes it active. It returns a sessionId.
• end: closes a session.
• navigate: goes to a URL.
• act: performs an action described in natural language, such as clicking a button.
• observe: finds actionable elements on the page.
• extract: pulls data from the current page, with an optional instruction.

Every tool accepts an optional sessionId. The docs recommend passing it on every call for clients like ChatGPT that do not keep the same MCP session across requests. Without it, calls can fail with No active session.

The Browserbase MCP overview also mentions session persistence for login states and cookies, proxy support, and session replays for debugging.

How to connect it

For Claude Code, the setup guide gives:

claude mcp add --transport http browserbase "https://mcp.browserbase.com/mcp?browserbaseApiKey=YOUR_BROWSERBASE_API_KEY"

For a generic MCP client:

{
  "mcpServers": {
    "browserbase": {
      "url": "https://mcp.browserbase.com/mcp?browserbaseApiKey=YOUR_BROWSERBASE_API_KEY"
    }
  }
}

Optional URL parameters include modelName, modelApiKey, keepAlive, proxies and verified. The docs warn that boolean values "must be exact strings: "true" or "false"." The guide also has a Cursor one-click link.

The guide still shows local setups with npx @browserbasehq/mcp. But the GitHub repository now says: "This repository is archived and no longer maintained." It adds that it "should not be interpreted as representative of Browserbase's current production services." Use the hosted server for new setups.

Security notes

Key in the URL. The hosted server takes your API key as a URL parameter. URLs can end up in config files, logs and screenshots. Keep configs private and out of source control, and rotate the key if one leaks. See MCP secret leakage.

Real actions on real sites. act can click buttons and submit forms. A prompt hidden on a page could try to steer it. Keep approval prompts on for act and navigate, and read prompt injection through MCP tool results.

Saved logins. Sessions can persist cookies and login states. Only give the browser accounts you are comfortable letting an agent use. Our page on excessive permissions in MCP covers least privilege.

Third-party model. By default, Stagehand uses a Gemini model that Browserbase pays for on the hosted server. If you choose another model, its provider also sees page content. The MCP security center has the wider checklist.

Pricing

Browserbase's pricing page does not mention MCP. As of October 2026 it lists:

The setup guide notes that the verified option requires the Scale plan.

Alternatives

• Bright Data MCP server: 14 remote browser tools plus scraping.
• Firecrawl MCP server: firecrawl_interact for clicks and typing, alongside scraping.
• Microsoft's Playwright MCP server, if you prefer a local browser.

More on our MCP server profiles hub.

Next step

Browser agents will try to use your site's forms and checkout. Our MCP readiness audit checks whether your site works for them, and whether it should.

Frequently asked questions