Savage MCP Reads Your Logged-In Chrome Sessions Without Full Browser Control
yazoodd · reddit · 2026-09-15
A developer released Savage MCP plus a Chrome extension, Savage Scraper — an open-source way to let MCP clients read sites you're logged into without handing the LLM unrestricted browser automation.
Key design:
- Reuses your existing Chrome profile/session instead of launching a separate browser
- Access restricted via explicit allowedhosts and optional allowedpaths
- Localhost-only communication with mutual HMAC auth between extension and MCP
- No generic clicking, typing, form submission, or arbitrary JS — read-only surface
- Rendered pages are simplified into smaller, LLM-friendly HTML before being returned
Example use: allow an agent to read one specific GitHub repo or an authenticated internal app without exposing the rest of the browser. Fully local and open source; the author is soliciting feedback on the security model versus full Playwright-style control.
More from coding & agent
- Papers with Code Adds 'Edit with your Agent' Button for Coding Agents — NielsRogge · 2026-09-15
- Developer Wakes Up to Find AI Agent Made a Bunch of Game Improvements Overnight — PurzBeats · 2026-09-15
- Cline Desktop hands-on: scheduled background review catches real data-loss risk — HowDevelop · 2026-09-15
- Trigger.dev's chat.agent turns AI chats into durable tasks that survive crashes and redeploys — CodeByPoonam · 2026-09-15
- davidfowl: AI is proving most developers are pretty awful testers — iamKierraD · 2026-09-15
- Developer builds a persistent AI memory prototype in regular ChatGPT chat, state stored on Google Drive — epicskyes · 2026-09-15