Oh My Browser Lite Chrome extension security report

Oh My Browser Lite turns your browser into an actionable surface for the AI agent you already use — Claude Desktop, Cursor, Continue, Cline, or any MCP-compatible client running on your local machine. Why it exists ───────────── Most AI agents can read documents and write code, but they cannot interact with your real, authenticated apps. Notion, Linear, Gmail, internal dashboards, your company's homegrown SaaS — none of them have public APIs the agent can hit, and headless browser automation can't replay your login state. Oh My Browser bridges that gap by letting the agent drive the actual Chrome window where you're already signed in. What it does ──────────── • Reads the active tab — DOM text, element structure, optional screenshot — and forwards a single-shot summary to your AI agent. • Performs structured actions on your behalf: click, type, scroll, navigate, extract. • Talks to a local-only MCP relay running on your own machine. Cookies, login state, and browsing history never leave your device. What "Lite" means ───────────────── The Lite distribution is the public Chrome Web Store build: • No chrome.debugger — no Chrome DevTools Protocol attach. Actions are performed via standard chrome.scripting APIs only. • No webRequest header rewriting. • No anti-detection content scripts. If you need the full DevTools-protocol features (e.g. for QA automation in dev environments), see the unlisted full-version distribution on our website. How to use it ───────────── 1. Install the extension. 2. Install the OMB CLI on your machine (one-line install at omb.org.cn). 3. The CLI exposes an MCP server that your agent client (Claude Desktop, Cursor, etc.) connects to over stdio. 4. Ask your agent something like "open my Notion task list and summarize today's items." The agent calls the MCP server, the server pushes the request to the extension over a local WebSocket, and the extension carries it out in the tab you're focused on. Privacy ─────── Your browser session, cookies, and login credentials stay on your machine — they are never transmitted to OMB servers. The only data the extension sends to OMB servers is account auth (email/JWT) and aggregate telemetry (anonymous install funnel, error reports). Page contents and DOM data are forwarded only to the local MCP relay running on your own computer, where your AI agent reads them. Full privacy policy: https://omb.org.cn/privacy