Browser Automation

The browser tool wraps a Playwright MCP server. Multi-layered security — SSRF guard, DNS-rebinding backstop, input sanitization, JS execution restrictions, audit logging.

Setup

npx playwright install chromium

Actions

Action	Args	Purpose
`navigate`	`url`	Open a URL
`click`	`ref`	Click an element by accessibility reference
`type`	`ref`, `text`	Type text into an input
`select_option`	`ref`, `value`	Select from a dropdown
`hover`	`ref`	Hover an element
`press_key`	`key`	Press a keyboard key
`screenshot`	—	Capture the current page as an image
`snapshot`	—	Accessibility tree (structured page content)
`evaluate`	`expression`	Execute JS in the page context
`wait`	`time`	Wait for a duration
`tabNew`	`url?`	Open a new tab
`tabClose`	—	Close the current tab
`tabSwitch`	—	Switch between open tabs
`tabList`	—	List open tabs
`goBack` / `goForward`	—	Navigation history

Security layers

SSRF + DNS-rebinding

NavigationGuard before every navigate:

Address blocklist: RFC 1918 (10.x, 172.16-31.x, 192.168.x), loopback (127.x, ::1), link-local (169.254.x), IPv6 unique-local (fc00::/7).
Encoding-obfuscation resistant — catches octal, decimal, hex IP encodings.
Post-navigation DNS backstop — verifies resolved IP didn’t switch to a private range after page load.
Protocol allowlist — http: / https: only.
Length caps — hostname ≤ 253, path ≤ 2048, total URL ≤ 8192.

Full DNS-rebinding pinning at socket-connect is tracked as follow-up work (see Security).

Input sanitization

InputGuard before every browser call:

Element refs — max 512 chars, shell metacharacters blocked.
Key names — must match ^[A-Za-z0-9+\-_]{1,64}$.
No raw user input reaches evaluate() without sanitization.

JS execution restrictions

The evaluate action blocks a set of dangerous patterns via regex:

fetch() + XMLHttpRequest — data exfiltration
eval() + Function() — arbitrary code
localStorage, sessionStorage, document.cookie — credential theft
WebSocket — covert channels

The regex blocklist is trivially obfuscatable in principle (see Security tracked H3). Migration to a proper AST allow-list is a known follow-up.

Example prompts

Open localhost:3000, take a screenshot of the login page, and check if the form is accessible

Navigate to our staging site, fill in the registration form with test data, and verify the success page

Open the dashboard, click the "Export" button, and verify the CSV download contains the expected columns

Settings

Agent-driven browsing runs through the Playwright MCP server and needs no dedicated CodeBuddy settings — configure the server under codebuddy.mcp.servers like any other MCP integration.

The one related setting controls how CodeBuddy opens plain external URLs (news links, reader):

{ "codebuddy.browserType": "system" }

Value	Behavior
`system`	Open in the OS default browser (default)
`simple`	Open in a lightweight built-in webview
`reader`	Open in the Smart Reader panel

Security — SSRF guards, DNS-rebinding status, planned H3 refactor
Tools — the browser tool in the broader tool list