Kitewright MCP

Kitewright

Browser automation for AI agents as a single small binary. An MCP server (Streamable HTTP + stdio) that gives LLM clients navigate / screenshot / extract — without carrying the Node.js + Playwright stack.

Install in one line:

claude mcp add kitewright -- npx -y @kitewright/mcp

Why — measured, not claimed

Head-to-head vs @playwright/mcp 0.0.78, same machine, same Chromium headless-shell build, same page (full methodology):

The browser itself (Chromium) costs the same in any language — warm latency is a tie because both speak CDP to the same browser. The wins are everything around it: startup, distribution, idle footprint, and lifecycle management. The honest gap: playwright-mcp ships ~25 tools today, we ship 21 — closing that is the roadmap.

Reliability — actionability auto-waiting

click / type / fill_form / select_option / hover don't fire blindly. Before acting, the engine polls (100 ms, up to a 5 s per-op budget) until the target element is present, visible (not display:none / visibility:hidden / zero-size), enabled (no disabled / aria-disabled), not covered by another element at its click point, and geometrically stable across two consecutive frames. A settled element passes on the first poll, so this is invisible when things are fine — but when an action can't happen, you get a *cause-specific* error (not found / not visible / disabled / covered / unstable) instead of a silent misclick or a generic timeout. Transient CDP errors are retried twice. Pass timeout_ms on any interaction tool to override the 5 s per-op budget (e.g. a short timeout to fail fast when you expect an element to already be there).

Performance

External-site latency is network-bound — DNS + TLS + TTFB (~400–600 ms) is a floor no tool beats, and Kitewright does not claim to. What it *does* attack is every controllable cost around the network:

• Prewarm + warm-context pool. The moment an MCP session initializes, the server launches the browser and fills a small pool of pre-created blank browser contexts (MCP_CONTEXT_POOL, default 2) in the background. A new session is then handed a ready context+page, so its first navigate pays zero browser-launch *and* zero context-creation cost. Measured localhost first-navigate: ~31 ms prewarmed vs ~709 ms cold (Apple Silicon; details). The pool drains with the browser on idle-reap and refills lazily on next demand, so idle footprint stays at the ~8 MB baseline.
• Lite mode. browser_navigate {lite:true} (and the default for extract / extract_markdown) blocks images/media/fonts + ad/analytics hosts before the load — 30–70 % faster DOM-ready on heavy pages by skipping the bulk of the bytes. Screenshots/PDF never block resources.
• Shared disk cache + connection pre-warm. A stable --disk-cache-dir (KITE_CACHE_DIR) lets repeat asset fetches hit cache across runs; KITE_PREWARM_URL establishes DNS+TLS to a known origin during prewarm.

The honest framing: the wins are browser launch, page weight, session start, and connection setup — not the network round-trip to a remote origin.

Architecture

crates/

├── engine/ kitewright-engine — CDP core (chromiumoxide): lazy launch, idle reaper, │ per-session browser contexts, capped text extraction + AX snapshots. │ Shared by all frontends. └── server/ kitewright — rmcp Streamable HTTP server exposing the engine as MCP tools. bindings/ └── node/ @kitewright/node — napi-rs bindings exposing a Puppeteer-compatible (experimental) API over the same engine (built separately; kept out of the core cargo workspace). See "@kitewright/node" below.

Each MCP session owns one persistent page inside its own Chromium browser context (cookie isolation between agents): log in once, keep clicking. The page and context are closed when the session ends; the browser itself is still reaped after the idle TTL and transparently relaunched on the next call.

Install

The zero-install way — run it straight from npx, like @playwright/mcp:

claude mcp add kitewright -- npx -y @kitewright/mcp

npx @kitewright/mcp resolves the prebuilt kite binary for your platform (an optional per-platform dependency, esbuild-style) and starts a stdio MCP server — no Rust toolchain, no build. See npm/kitewright-mcp.

Prefer the raw kite binary? (npx above is the easy path; these need a Rust toolchain.)

# From the public repo — builds + installs the `kite` binary:

cargo install --git https://github.com/kitewright/kitewright kitewright # → ~/.cargo/bin/kite

From a local checkout:

cargo install --path crates/server

Docker (headless Chromium bundled in the image):

docker run --rm -p 8090:8090 kitewright # build locally: docker build -t kitewright .

Not yet published to crates.io or Homebrew — cargo binstall/brew aren't wired up. Use npx @kitewright/mcp (no toolchain) or the cargo install --git line above.

Get a browser

Kitewright drives Chromium over CDP but does not embed one. It uses a system Chrome/Chromium when present, honors BROWSER_EXECUTABLE, and — if neither is found — falls back to a browser downloaded by kite install:

kite install    # fetch the latest stable chrome-headless-shell into the kite cache

kite install downloads the current Chrome-for-Testing chrome-headless-shell build for your platform into $KITE_CACHE_DIR (or the OS cache dir) and the engine picks it up automatically — no BROWSER_EXECUTABLE needed. Re-running is a no-op once a build is present. The Docker image already ships Chromium.

Run & connect

kite with no arguments serves MCP over Streamable HTTP (networked, default, supports auth + many sessions); kite --stdio serves a single session over stdio for local clients.

kite

→ kitewright listening on http://0.0.0.0:8090/mcp

HTTP transport — connect from Claude Code:

claude mcp add kite --transport http http://localhost:8090/mcp

stdio transport — MCP client config (Claude Desktop, Cursor, …):

{

"mcpServers": { "kite": { "command": "kite", "args": ["--stdio"] } } }

Configuration

Security

Kitewright drives a real browser, so treat the endpoint as privileged. The defaults are safe for local use; harden before exposing it.

• Binds loopback (`127.0.0.1:8090`) by default. It's only network-reachable if you set MCP_HTTP_BIND explicitly. If you expose it, set `MCP_AUTH_TOKEN` — without it the /mcp endpoint is unauthenticated (logged as a warning at boot). Auth uses a constant-time compare; requests are rate-limited; and cross-origin browser requests are rejected (DNS-rebinding protection).
• SSRF is inherent to a browser tool. A caller can navigate to internal or cloud-metadata addresses (169.254.169.254, RFC-1918, localhost) — which is *the point* for local/dev automation, but a risk on an exposed instance. Kitewright does not block these (doing so by default would break local automation). On an exposed deployment, put it behind auth and network policy that can't reach sensitive internal endpoints.
• Local-file access is off by default. file:// navigation requires KITE_ALLOW_FILE_URLS=1; browser_fill_secret file reads require KITE_ALLOW_SECRET_FILES=1 and a KITE_SECRET_DIR fence (reads are canonicalized and must stay under it).
• Dependencies are scanned in CI (Trivy + cargo audit). The shipped kite binary carries no known-vulnerable crates; see .cargo/audit.toml for two DoS advisories confined to the (server-unused) kite-pdf crate.

Tools (v0.4)

All tools operate on the session's persistent page.

Read

• browser_navigate {url, lite?} — title, final URL, visible text (capped). lite:true enables lite mode: block images/media/fonts + common ad/analytics hosts (doubleclick, google-analytics, GTM, facebook pixel, …) via CDP Network.setBlockedURLs for a faster DOM-ready on heavy pages (30–70 % on heavy sites — text-only, do not use before a screenshot). Sticky for the session until changed. extract / extract_markdown default to lite when navigating (pixels irrelevant); screenshot / pdf never block resources
• browser_extract {url?, selector, attribute?} — text/attribute from elements matching a selector
• browser_extract_markdown {url?} — main content as Markdown ("readability" mode: headings/links/lists/code/tables, nav/script/style stripped, capped at ~20k chars)
• `browser_