Trust Card · Static snapshot

browserbase__mcp-server-browserbase U

Ungraded — insufficient static coverage · 3 findings (3 critical) · scope excessive · Not ranked: insufficient static coverage.

Scanned 2026-10-19 · engine v0.1.3 (8 regex rules, OWASP-mapped) · upstream browserbase/mcp-server-browserbase @ 3e6f534 (2026-07-20)

Score breakdown

No numeric score or breakdown: insufficient static coverage. Findings remain actionable; absence of findings is not evidence of safety.

Insufficient static coverage: Unsupported source present. Findings remain actionable; absence of findings is not evidence of safety.

Coverage: limited

Static-heuristic scope: 37 analyzed / 53 discovered files; 3 unsupported source files; 17 excluded; 0 read errors; 0 truncations. This is not a semantic coverage percentage or proof of safety.

Unsupported source present
Coverage describes the files read and regex rules applied, not semantic, runtime, or dependency coverage.
Supported code is JavaScript, TypeScript, and Python; JSON/YAML receive only the credential rule.
Skill instructions and other prose are not code-analyzed; declared controls are not verified enforcement.
Ignored directories, declarations, and non-implementation assets are outside rule scope.

File coverage, applied rules and scan limits

{
  "mode": "static-heuristic",
  "status": "limited",
  "reasons": [
    "Unsupported source present"
  ],
  "limitations": [
    "Coverage describes the files read and regex rules applied, not semantic, runtime, or dependency coverage.",
    "Supported code is JavaScript, TypeScript, and Python; JSON/YAML receive only the credential rule.",
    "Skill instructions and other prose are not code-analyzed; declared controls are not verified enforcement.",
    "Ignored directories, declarations, and non-implementation assets are outside rule scope."
  ],
  "discoveredFiles": 53,
  "analyzedFiles": [
    {
      "path": ".changeset/config.json",
      "scope": "data",
      "bytes": 271,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-002"
      ]
    },
    {
      "path": ".github/workflows/ci.yml",
      "scope": "data",
      "bytes": 1059,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-002"
      ]
    },
    {
      "path": ".github/workflows/publish-mcp.yml",
      "scope": "data",
      "bytes": 1259,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-002"
      ]
    },
    {
      "path": ".github/workflows/release.yml",
      "scope": "data",
      "bytes": 1048,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-002"
      ]
    },
    {
      "path": "cli.js",
      "scope": "code",
      "bytes": 48,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    },
    {
      "path": "eslint.config.js",
      "scope": "code",
      "bytes": 802,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    },
    {
      "path": "evals/mcp-eval-basic.config.json",
      "scope": "data",
      "bytes": 2310,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-002"
      ]
    },
    {
      "path": "evals/mcp-eval-minimal.config.json",
      "scope": "data",
      "bytes": 1209,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-002"
      ]
    },
    {
      "path": "evals/mcp-eval.config.json",
      "scope": "data",
      "bytes": 2310,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-002"
      ]
    },
    {
      "path": "evals/run-evals.ts",
      "scope": "code",
      "bytes": 8185,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    },
    {
      "path": "gemini-extension.json",
      "scope": "data",
      "bytes": 183,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-002"
      ]
    },
    {
      "path": "index.js",
      "scope": "code",
      "bytes": 81,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    },
    {
      "path": "package.json",
      "scope": "data",
      "bytes": 2568,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-002"
      ]
    },
    {
      "path": "pnpm-lock.yaml",
      "scope": "data",
      "bytes": 228645,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-002"
      ]
    },
    {
      "path": "server.json",
      "scope": "data",
      "bytes": 2192,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-002"
      ]
    },
    {
      "path": "src/config.test.ts",
      "scope": "code",
      "bytes": 1018,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    },
    {
      "path": "src/config.ts",
      "scope": "code",
      "bytes": 4702,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    },
    {
      "path": "src/context.ts",
      "scope": "code",
      "bytes": 3645,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    },
    {
      "path": "src/index.ts",
      "scope": "code",
      "bytes": 6127,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    },
    {
      "path": "src/mcp/resources.ts",
      "scope": "code",
      "bytes": 456,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    },
    {
      "path": "src/mcp/sampling.ts",
      "scope": "code",
      "bytes": 1021,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    },
    {
      "path": "src/program.ts",
      "scope": "code",
      "bytes": 3201,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    },
    {
      "path": "src/server.ts",
      "scope": "code",
      "bytes": 666,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    },
    {
      "path": "src/sessionManager.ts",
      "scope": "code",
      "bytes": 15797,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    },
    {
      "path": "src/tools/__tests__/tools.test.ts",
      "scope": "code",
      "bytes": 3146,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    },
    {
      "path": "src/tools/act.ts",
      "scope": "code",
      "bytes": 1282,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    },
    {
      "path": "src/tools/extract.ts",
      "scope": "code",
      "bytes": 1429,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    },
    {
      "path": "src/tools/index.ts",
      "scope": "code",
      "bytes": 731,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    },
    {
      "path": "src/tools/navigate.ts",
      "scope": "code",
      "bytes": 1555,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    },
    {
      "path": "src/tools/observe.ts",
      "scope": "code",
      "bytes": 1367,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    },
    {
      "path": "src/tools/session.ts",
      "scope": "code",
      "bytes": 3178,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    },
    {
      "path": "src/tools/tool.ts",
      "scope": "code",
      "bytes": 895,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    },
    {
      "path": "src/transport.ts",
      "scope": "code",
      "bytes": 3589,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    },
    {
      "path": "src/types/types.ts",
      "scope": "code",
      "bytes": 1040,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    },
    {
      "path": "tests/smoke.test.ts",
      "scope": "code",
      "bytes": 1203,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    },
    {
      "path": "tsconfig.json",
      "scope": "data",
      "bytes": 402,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-002"
      ]
    },
    {
      "path": "vitest.config.ts",
      "scope": "code",
      "bytes": 192,
      "nonEmpty": true,
      "ruleIds": [
        "AT-SEC-001",
        "AT-SEC-002",
        "AT-SEC-003",
        "AT-SEC-004",
        "AT-SEC-005",
        "AT-SEC-006",
        "AT-SEC-007",
        "AT-COMP-001"
      ]
    }
  ],
  "unsupportedSourceFiles": [
    ".husky/pre-commit",
    "Dockerfile",
    "tests/.gitkeep"
  ],
  "excludedFiles": [
    {
      "path": ".git",
      "reason": "ignored-directory"
    },
    {
      "path": ".changeset/README.md",
      "reason": "outside-rule-scope"
    },
    {
      "path": ".changeset/rename-advanced-stealth-to-verified.md",
      "reason": "outside-rule-scope"
    },
    {
      "path": ".dockerignore",
      "reason": "outside-rule-scope"
    },
    {
      "path": ".gitattributes",
      "reason": "outside-rule-scope"
    },
    {
      "path": ".gitignore",
      "reason": "outside-rule-scope"
    },
    {
      "path": ".husky/pre-commit",
      "reason": "unsupported-implementation"
    },
    {
      "path": ".npmrc",
      "reason": "outside-rule-scope"
    },
    {
      "path": "CHANGELOG.md",
      "reason": "outside-rule-scope"
    },
    {
      "path": "Dockerfile",
      "reason": "unsupported-implementation"
    },
    {
      "path": "LICENSE",
      "reason": "outside-rule-scope"
    },
    {
      "path": "README.md",
      "reason": "outside-rule-scope"
    },
    {
      "path": "assets/browserbase-mcp.png",
      "reason": "outside-rule-scope"
    },
    {
      "path": "assets/cover.png",
      "reason": "outside-rule-scope"
    },
    {
      "path": "config.d.ts",
      "reason": "type-declaration"
    },
    {
      "path": "index.d.ts",
      "reason": "type-declaration"
    },
    {
      "path": "tests/.gitkeep",
      "reason": "unsupported-implementation"
    }
  ],
  "readErrors": [],
  "truncation": [],
  "limits": {
    "maxFiles": 4000,
    "maxDepth": 12,
    "maxFileBytes": 1048576
  }
}

Fix first (3 critical/high)

Severity	Rule	Finding	Remediation
CRITICAL	`AT-SEC-002` (LLM02)	Hardcoded Credential or API Secret `evals/run-evals.ts:120` Evidence: `" export ANTHROPIC_API_KEY='sk-ant-your_key_here'",`	Move credentials to secure environment variables or a key vault. Never commit API keys.
CRITICAL	`AT-SEC-002` (LLM02)	Hardcoded Credential or API Secret `evals/run-evals.ts:126` Evidence: `chalk.yellow(" export GEMINI_API_KEY='your_gemini_key_here'"),`	Move credentials to secure environment variables or a key vault. Never commit API keys.
CRITICAL	`AT-SEC-002` (LLM02)	Hardcoded Credential or API Secret `src/config.ts:59` Evidence: `mergedConfig.browserbaseApiKey = "dummy-browserbase-api-key";`	Move credentials to secure environment variables or a key vault. Never commit API keys.

Permissions

Scope: excessive · Shell: disabled · Network egress: no · File deletion: enabled · Human approval: none

Provenance

License: Apache-2.0 · Lockfile: yes · Security policy: no · Signals: present (documentary, not a safety verdict)

Independently scanned by the OpenTrustBench registry (not self-reported by the project). Static analysis only — no code executed, findings need human triage, counts may include test/example code. Static snapshot; re-scan before relying on it: npx @opentrustbench/cli scan https://github.com/browserbase/mcp-server-browserbase. Scores move with every upstream commit; pages refresh weekly. How scoring works.