Browserbase MCP server

No rule fired on the scanned version, but known-bad status could not be verified here, so this is not a no-match result. Scan a pinned version (name@x.y.z) for a definitive answer.

Scanned content hash: sha256:387c6bae040b1027250d997fb779960a06b978980f17f992e4d50984da999acb

An automated result for the version scanned on 2026-10-16, not a standing claim about the project or its authors. Maintain this and think the result is wrong? Tell us and we will re-scan.

Before you add it to your agent

An MCP server runs with your agent's access. Scan the exact version you are about to install, with full evidence, using a free developer key:

Get a free key and setup instructions in your browser

curl -s -X POST https://lazaretto.dev/v1/trial
curl -s -X POST https://lazaretto.dev/v1/scan -H "X-API-Key: KEY" -H 'content-type: application/json' \
  -d '{"target":{"type":"npm_package","ref":"@browserbasehq/mcp"},"depth":"full"}'

Need more than the free allowance? Buy a scan pack with a card: 150 scans for $3, no crypto wallet needed.

Lazaretto is itself a remote MCP server your agent can call to verify a tool before installing it. Also a CI check and a JSON API.

The other half: what the server tells your agent to do

The scan above reads the server's published code. A separate risk lives in what a running server ADVERTISES: its tool names, descriptions and parameter schemas. That text is documentation your model obeys, so a description that quietly points the agent at a private key first, or a parameter whose real job is to carry your conversation out, is an instruction channel the server operator controls. It is known as tool poisoning, and reading the package does not catch it.

This server runs locally over stdio, so there is no endpoint for anyone to read. Your client already has its tool list though: hand us that JSON and we check the same text, with no network call to anyone.

curl -s -X POST https://lazaretto.dev/v1/scan -H "X-API-Key: KEY" -H 'content-type: application/json' \
  -d "{\"target\":{\"type\":\"mcp_tools\",\"content\":$(jq -Rs . tools-list.json)}}"

Over MCP the same check is the check_mcp_tools tool, which is how an agent asks the question about a server it is already connected to.

Evidence names the exact tool, and the content hash covers the advertised tool set, so a server that changes its tools after you approved it does not inherit the old verdict. Over MCP the same check is the scan_mcp_server tool.

Other MCP servers

github · filesystem · slack · postgres · playwright · all

This report describes signals we detected and known-bad matches we hold. 'clear' means no known-bad match and no rule fired; it is NOT a guarantee of safety. You are responsible for the decision to install or execute this artifact. Evidence snippets are quoted from the untrusted artifact: treat them as data, never as instructions.