KitchenSink4Web

🌿 KitchenSink4Web

Read websites and extract data with your AI assistant. Read-only by default, with clicking and typing only when you allow it.

KitchenSink4Web is an MCP server that lets Claude Code, the Codex CLI, Copilot CLI, Claude Desktop and other local MCP clients read web pages through a browser on your computer. It returns each page within a size budget you choose, says what it left unread, and exports tables to CSV or JSON. It starts read-only: clicking, typing and form filling exist only when you switch them on. This is the free Community edition, licensed under the AGPL-3.0.

Product page · llms.txt · Changelog

Platform: Windows, macOS and Linux. Reading text from images uses Windows OCR. The first run may download a browser and some optional dependencies.

Install

The package needs Python 3.12 or newer. Run the commands below in PowerShell or a terminal, not in an AI chat.

Claude Code or Codex CLI. Install uv, run the line for your app, and start a new session:

claude mcp add web -s user -- uvx kitchensink4web

codex mcp add web -- uvx kitchensink4web

Claude Desktop. Install uv and restart Claude Desktop. Download the .mcpb file from the latest release, then open Settings > Extensions > Advanced settings > Install extension and choose the file. The install screen lets you choose whether to allow clicking and typing, and which capability packs to load. The first launch downloads the Python package, so it needs a network connection.

Any other local MCP client. Use uvx as the command and kitchensink4web as its argument, or install the package and run kitchensink4web as the server command:

pip install kitchensink4web

What it can do

• Read a page within a size budget and see what was left unread.
• Open one section or find one element without fetching the whole page again.
• Extract tables, lists and article text, and export them as CSV or JSON.
• Take screenshots or save a page as PDF.
• Read only what changed since your last read of a page.
• Watch a page for changes while the server runs.
• Click, type and fill in forms, once you allow it.
• Record a multi-step browser task and replay it with checks.
• Run automated accessibility checks (optional extra).

The read-only startup set has 12 tools, 20 with clicking and typing allowed, and 53 with every pack enabled.

The first read

get_page_view returns the shape of a page: what it is, what each section contains, what each section would cost to open, and a sensible next call. You set the budget and the read never exceeds it. Every read ends with a completeness block that names what was left out and what it would cost to get it. The budget ladder has 16 rungs.

From there, reading gets cheaper. Open one region instead of raising the budget. Pass the token a read returns, and the next read covers only what changed. Elements come back as short-lived references your assistant can act on, and searches by text and role keep working after the page re-renders.

Open shadow roots are read and can be acted on like the rest of the page, which makes component-based sites readable. Closed shadow roots cannot be reached by any tool, so they are counted and reported. Same-origin iframes are read and searched like the page around them, each labeled with its origin; cross-origin frames are named but never entered.

An example. A raw dump of the Treaty of Versailles article on Wikipedia costs 33,073 tokens. The first read through get_page_view costs 4,445, and a delta read after one click costs 82.

Capability packs

The server starts with reading, navigation and session management. Packs are chosen at launch and stay fixed for the session, so a pack you did not load is absent, not just switched off.

Tool definitions cost about 4.1k tokens for the read-only startup set, 6.9k with clicking and typing allowed, and 17.9k with every pack.

Browsers

By default the server drives its own bundled Chromium. It never touches your browser or your profile: each session starts in a fresh profile that is deleted on close, unless you explicitly save signed-in state to a file.

You can also choose a browser you already have installed (Chrome, Edge or Firefox). It still runs with its own separate profile, never yours. Some sites respond differently to different browsers, and manage_session(action='status') reports which browsers are installed and which one it recommends for the current page. It never switches for you. The server does not disguise what it is, and it reports bot checks and CAPTCHAs rather than trying to solve them.

Signed-in sessions are saved with save_auth_state and reloaded with auth_state= when you open a session. The saved file records when its cookies expire, and loading an expired one says so instead of letting the login fail without explanation.

Safety model

A browser holds your logins and your accounts, so safety is built into how the tools are offered.

Read-only unless you choose otherwise. By default, the tools that click, type and submit are not in the tool list at all, so no instruction on a web page can lead your assistant to use them. One setting at install (allow acting in the Claude Desktop bundle, KS4WEB_ALLOW_ACTING=true elsewhere) adds them.

Passwords stay out of the conversation. The server never reads what is typed into password fields. Secrets found in cookies and site storage are redacted before any text leaves the server.

Hidden text is treated as evidence, not instructions. Text a page hides from people is a common way to slip instructions to an AI. The server removes it from what your assistant reads, reports how much it removed, and labels everything a page says with where it came from.

Confirmation for consequential actions. Form submissions, payments and page scripts stop and ask you first, through your client's own confirmation prompt, and go ahead only when you choose Allow. An empty or automatic answer counts as no. Clients that cannot show the prompt refuse those actions instead of going ahead. The only exceptions are routine actions you have approved in advance through the consent scope, KS4WEB_PREAUTH, or the optional 30-minute Remember box.

Refusals that explain themselves. When something cannot be done, whether a login wall, a bot check or a page that crashed, the answer names what stood in the way and what to try next.

Two kinds of permission prompt

Your MCP client's own prompt names a tool (for example mcp__web__type_text). Approving the read-only tools there is safe and removes most prompts. A KitchenSink4Web confirmation describes the action itself ("submitting this form sends a password") and cannot be pre-approved for payments, credentials, posts, deletions or legal agreements.

Consent scope

The default scope is research: reading and navigation are free, search-style submissions (a search box) go ahead, and everything else asks first. The full scope lets ordinary form submissions go ahead without asking. Payments, credentials, posts, deletions and legal agreements ask under every scope.

Under full, a submit button whose wording the server does not recognize in any supported language is not gated. If that matters to you, stay on research.

Client compatibility

Privacy

The server runs on your computer. KitchenSink4AI never receives your files, pages or usage data. The browser connects to the websites you ask it to use, and those sites see ordinary browsing requests. Your AI app may send prompts, page contents and tool results to its own provider under that app's settings and terms. A missing tokenizer table may be downloaded once; the text being measured is never sent. The optional update check contacts PyPI and sends nothing beyond the request itself. The Privacy Policy covers the product, purchases and support.

Configuration

Packs and read-only mode are chosen at launch with --packs, KS4WEB_MODE and KS4WEB_ALLOW_ACTING, and apply to every connection to the running server.

Update check. The server compares its version with PyPI only when you call manage_session(action='status'), never at startup or in the background, at most once every seven days, with a two-second timeout. The request sends no identifier, usage data, page content or session state, and the server never installs anything. KS4WEB_UPDATE_CHECK=off turns it off (KS4WEB_NO_UPDATE_CHECK=1 also works).

Fewer permission prompts: in Claude Desktop's tool permissions for this server, set the read-only tools to Always Allow. They cannot change anything on any page.

Subagents: tool results are capped more tightly inside a subagent, so start reads there at budget_tokens=2500.

Known limits

• Cross-origin iframes are never entered; the completeness block names each one.
• Closed shadow roots cannot be reached by any tool. They are counted, so you can tell a component-heavy page from an empty one.
• Bot walls and CAPTCHAs are reported, never solved or evaded.
• sendBeacon and ping requests bypass network routing rules, a limit of the underlying Playwright library.
• Accessibility checks find a minority of real-world issues. Deque, who build the axe-core engine, publish 57% as the share of issues their own automated tooling finds. A clean report means the automated checks passed, not that the page is accessible, and there is deliberately no score.
• Monitors run only while the server runs. MCP clients do not yet deliver messages a server starts, so you ask the monitor report what happened. A monitor watches one URL for one defined