Tenmomo Browser Broker

Security model

Browser Agent treats pages and MCP clients as untrusted callers. The Chrome extension and local broker are the control plane.

Local seams

• The persistent broker binds Chrome WebSocket 32145 and Streamable HTTP MCP 32146 to 127.0.0.1 only.
• Chrome upgrades require an extension origin, protocol marker, and 256-bit pairing token. Tokens live in mode-0600 local files or trusted extension storage and are never logged.
• Each standard MCP transport session is a separate authority principal. It may list every tab read-only but may mutate only tabs created by that session.
• The broker serializes commands per tab. Session GC releases ownership without closing the user’s tabs; broker restart marks all existing tabs unowned.
• As with any same-user local tool, loopback and file modes do not defend against a fully compromised operating-system account.

Explicit local threat-model choices

• mcp-session-id is a bearer credential. Anyone who obtains a live session ID can act with that session’s authority. Session IDs are server-generated 128-bit UUIDs, are not exposed by broker status/list responses, and the MCP listener is hard-bound to 127.0.0.1. Separate, mutually hostile users on one OS account are out of scope; multiple local agents operating as that same user are an accepted deployment assumption.
• tabs.list is intentionally global and read-only. Local agents can see the titles and URLs of owned, other-session, and human tabs, but broker-side checks keep all non-owned tabs uncontrollable. Deployments needing tab-title/URL confidentiality should not share one broker across those agents.
• closeSession is idempotent. Closing an unknown or already-closed session succeeds with an empty released-tab list. This supports safe transport cleanup and does not create, restore, or transfer tab authority.

The two broker hard lines

1. Password manager/autofill store: permanently inaccessible. The broker rejects store-related methods and URLs, and manifest validation rejects private store permissions. Public MV3 APIs do not expose Chrome’s password database; the policy remains explicit so future tools fail closed.
2. Finance-transaction domains: default-deny. Every non-listing action on a configured finance suffix requires a native macOS owner dialog. The extension rereads the tab URL immediately before execution and asks the broker to check that observed URL, closing the broker-to-extension dispatch race. Allow Once authorizes only that request; denial, cancellation, timeout, or an unavailable UI rejects it. There is no MCP method that grants an exception.

Chrome internal/Web Store injection restrictions and password-value redaction are technical safeguards, not additional broker authority lines.

Browser authority

The local owner profile grants all HTTP(S) hosts and all Chrome permissions the current implementation uses. MAIN-world browser_evaluate can execute arbitrary page-context code with the visited page’s logged-in authority, subject to page CSP and the two broker hard lines.

The Chrome Web Store profile minimizes static review surface: activeTab, sidePanel, storage, and tabs are core; scripting and <all_urls> are requested together from a user gesture. sidePanel and storage must be core because extension initialization uses them before any permission prompt. tabs is core so the read-only inventory can include titles and URLs. activeTab is core for user-invoked temporary page/screenshot access.

The extension stores account tokens only in trusted extension contexts. Login passwords remain in memory only for the request. Snapshot serialization omits password input values, and activity entries omit typed text and evaluation code.

This site is open source. Improve this page.