Cat Burglar

Name: Cat Burglar
Author: DrMkdaddy

作者：DrMkdaddy版本 0.3.3i★ –i在你的电脑上运行

注册名称io.github.DrMkdaddy/cat-burglar

安装

概览

作者提供的说明（英文原文）

Stealth browser MCP with three engines, diff observations, site memory, and benchmarks.

PopNx MCP 的三大支柱

这三项永远不会合并成一个分数：意见、测量和人气是不同的东西。

用户评价i暂无评价评价功能将在后续阶段与账户功能一起开放
我们的基础检查i1 项中通过 1 项依据公开信息检查；尚未扫描代码
使用情况i非常新★ –

它能帮你做什么

我们还没有为它写通俗的介绍。下面是我们从注册中心读取到的事实。

连接方式: 在你的电脑上运行
传输方式: stdio
分类: 网页与浏览器

安装

选择你使用的 AI 应用，然后复制设置。

安装之前

基础检查：1 项中通过 1 项
在你的电脑上运行，拥有你的用户账户的权限（文件、网络、应用）。
需要你自己填写： BROWSER_MCP_ALLOW_PRIVATE_NETWORK, BROWSER_MCP_OBSCURA_PATH, BROWSER_MCP_PROFILE

你需要

Docker已安装 Docker

你用的是哪个应用？

ClaudeClaude CodeCursorVS CodeChatGPT

在上方选择你的应用。我们会记住它，下次按钮会显示“安装到 …”。

打开 Claude Desktop → Settings → Developer → Edit Config，把下面的内容粘贴到 claude_desktop_config.json

{
  "mcpServers": {
    "cat-burglar": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "-e",
        "BROWSER_MCP_ALLOW_PRIVATE_NETWORK",
        "-e",
        "BROWSER_MCP_OBSCURA_PATH",
        "-e",
        "BROWSER_MCP_PROFILE",
        "ghcr.io/drmkdaddy/cat-burglar:v0.3.3"
      ],
      "env": {
        "BROWSER_MCP_ALLOW_PRIVATE_NETWORK": "your-value",
        "BROWSER_MCP_OBSCURA_PATH": "your-value",
        "BROWSER_MCP_PROFILE": "your-value"
      }
    }
  }
}

在终端中运行这条命令

claude mcp add cat-burglar --env BROWSER_MCP_ALLOW_PRIVATE_NETWORK=your-value --env BROWSER_MCP_OBSCURA_PATH=your-value --env BROWSER_MCP_PROFILE=your-value -- docker run -i --rm -e BROWSER_MCP_ALLOW_PRIVATE_NETWORK -e BROWSER_MCP_OBSCURA_PATH -e BROWSER_MCP_PROFILE ghcr.io/drmkdaddy/cat-burglar:v0.3.3

运行前请先填写空着的值。

在 Cursor 中打开

或者自己复制设置

粘贴到项目中的 .cursor/mcp.json，或 ~/.cursor/mcp.json

{
  "mcpServers": {
    "cat-burglar": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "-e",
        "BROWSER_MCP_ALLOW_PRIVATE_NETWORK",
        "-e",
        "BROWSER_MCP_OBSCURA_PATH",
        "-e",
        "BROWSER_MCP_PROFILE",
        "ghcr.io/drmkdaddy/cat-burglar:v0.3.3"
      ],
      "env": {
        "BROWSER_MCP_ALLOW_PRIVATE_NETWORK": "your-value",
        "BROWSER_MCP_OBSCURA_PATH": "your-value",
        "BROWSER_MCP_PROFILE": "your-value"
      }
    }
  }
}

浏览器会先询问是否打开应用，然后应用会显示设置并请你确认。密钥的值会留空，由你自己填写。

在 VS Code 中打开

或者自己复制设置

粘贴到项目中的 .vscode/mcp.json

{
  "servers": {
    "cat-burglar": {
      "type": "stdio",
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "-e",
        "BROWSER_MCP_ALLOW_PRIVATE_NETWORK",
        "-e",
        "BROWSER_MCP_OBSCURA_PATH",
        "-e",
        "BROWSER_MCP_PROFILE",
        "ghcr.io/drmkdaddy/cat-burglar:v0.3.3"
      ],
      "env": {
        "BROWSER_MCP_ALLOW_PRIVATE_NETWORK": "your-value",
        "BROWSER_MCP_OBSCURA_PATH": "your-value",
        "BROWSER_MCP_PROFILE": "your-value"
      }
    }
  }
}

浏览器会先询问是否打开应用，然后应用会显示设置并请你确认。密钥的值会留空，由你自己填写。

这个服务器在你的电脑上运行，而 ChatGPT 只能连接互联网上的服务器。请选择其他应用。

你的选择通过 Cookie 保存在这台设备上，无需账户。

需要你填写的值

BROWSER_MCP_ALLOW_PRIVATE_NETWORK env
Set to 1 to allow localhost and private-network pages.
BROWSER_MCP_OBSCURA_PATH env
Path to the Obscura binary when it is not on PATH.
BROWSER_MCP_PROFILE env
Observation profile: local, flash, frontier, or auto.

这些设置是根据作者在注册中心的条目生成的。如果 README 的写法不同，请以 README 为准。

它能做什么

它在你的电脑上运行；安装后，工具列表会显示在你的 AI 应用中。

基础检查i

我们检查的是任何人都能看到的信息；我们没有阅读代码。不适用的检查项不计入总数。 · 检查于 2026年11月10日

✓ 通过
作者与仓库一致
注册名称已通过 GitHub 账户 DrMkdaddy 验证，该账户拥有此仓库
… 尚未检查
仍在维护
我们还没有从 GitHub 读取这个仓库
… 尚未检查
有许可证
我们还没有从 GitHub 读取这个仓库
– 不适用
端点有响应
它在你的电脑上运行，没有互联网端点
– 不适用
使用 OAuth 登录
在你的电脑上运行，改用本地设置
… 尚未检查
工具描述中没有隐藏指令
它在你的电脑上运行；我们只能读取互联网端点的工具列表

与“网页与浏览器”中的其他服务器比较i

星标数多于此分类中其他 1422 个服务器的 0%
发布到注册中心的时间比此分类中其他 1422 个服务器的 99% 更新
基础检查结果等于或优于此分类中其他 1422 个服务器的 100%

与注册中心里这个分类中所有活跃的服务器比较。只有当发布者拥有该仓库时，星标数才计入。

常见问题

Cat Burglar 安全吗？

它在 1 项适用的基础检查中通过了 1 项。我们没有阅读代码。在添加密钥或令牌之前，请先看看这个服务器要求哪些权限，并使用只具备所需权限的密钥。

它需要哪些密钥或代码？

注册中心没有列出必需的密钥，不过有些服务器会在首次使用时要求你登录。

它在我的电脑上运行还是在云端？

它在你的电脑上运行。你的 AI 应用会在需要时启动它，数据不会经过作者的服务器（除非它自己调用在线服务）。

它还在维护吗？

GitHub 仓库最后更新于–，最新版本（0.3.3）于今天进入注册中心。

哪些应用可以使用它？

支持 MCP 的应用，例如 Claude Desktop、Claude Code、Cursor 和 VS Code。你的电脑上还需要有 Docker。

有什么可以替代它？

同一分类中有：Browser Use, Chrome DevTools MCP, MCP Server Browser

替代选择

同一分类中其他作者的服务器，按星标数排序。

如何看卡片：↓ 每周下载量i★ GitHub 星标i三大支柱：评价 · 检查 · 使用情况i更新 = 最新版本发布到注册中心的时间i

Browser Use

Browser agents and stealth cloud browsers for AI: run web tasks, fill forms, extract data.

作者：browser-use广泛使用↓ 155.2万/周★ 12万20天前更新

电脑或云端✓ browser-use.com

安装

Chrome DevTools MCP

MCP server for Chrome DevTools

作者：ChromeDevTools广泛使用↓ 188.4万/周★ 5.5万19天前更新

在你的电脑上运行

安装

MCP Server Browser

MCP server for browser use access

作者：bytedance广泛使用↓ 792/周★ 4万14个月前更新

在你的电脑上运行

安装

作者的 README

打开 README

按原文从作者的仓库复制。PopNx MCP 没有审查或背书其内容。HTML、图片和脚本已被移除。链接会离开本站。

Cat Burglar

Three browsers. One MCP. Only the changes.

Cat Burglar plugs a real browser into your agent. It can run patched stealth Chromium, stock Chromium for devtools, or Obscura's 43 MB Rust engine behind one session. It sends diffs instead of full DOM dumps, remembers per-site workflows, and gates high-impact actions.

What you get

Feature	Why it matters
Three engines, one server	Pick stealth, devtools fidelity, or a 43 MB footprint for the task. Switch without changing clients.
Diffs, not dumps	Stable refs, diff snapshots, and bounded change observations after every action. Less context, fewer round trips.
Site memory	Per-origin hints and workflows learned after a successful run. Repeated tasks get shorter.
Guardrails on by default	SSRF protection, origin lists, untrusted-content markers, tracker blocking, and a confirmation gate for destructive actions.
Works with your agent	Claude Desktop, Claude Code, Cursor, Codex, Gemini CLI, VS Code, Windsurf, Cline, OpenCode, Docker, and any stdio client.
Measured	A 12-task local suite with state verification. Adaptive observation cuts text by 29.9% and calls by 15% at the same success rate.

Install

One line:

curl -fsSL https://raw.githubusercontent.com/DrMkdaddy/cat-burglar/main/scripts/install.sh | bash

From the official MCP Registry: io.github.DrMkdaddy/cat-burglar (OCI image). From GHCR: docker run -i --rm ghcr.io/drmkdaddy/cat-burglar:latest.

The installer adds a cat-burglar binary to your PATH. Install globally with pnpm if you prefer:

pnpm add -g https://github.com/DrMkdaddy/cat-burglar/releases/download/v0.3.3/cat-burglar-mcp-0.3.3.tgz

cat-burglar doctor

The install command prints a ready config for: claude-code, claude-desktop, cursor, codex, gemini, vscode, windsurf, cline, opencode, or generic.

Works with

Client	Setup
Claude Code	`claude mcp add catburglar -- cat-burglar`
Claude Desktop, Cursor, Windsurf, Cline	Paste the `mcpServers` JSON from `docs/install.md`
Codex	`codex mcp add catburglar -- cat-burglar`
Gemini CLI	Add the `mcpServers` entry to `~/.gemini/settings.json`
VS Code	Add the `servers` entry to `.vscode/mcp.json`
OpenCode	Add `catburglar` under `mcp.servers`
Docker	`docker run -i --rm ghcr.io/drmkdaddy/cat-burglar:latest`

Do not name the server browser. OpenCode has a built-in browser toolset with that name, and Code Mode hides overlapping tools.

Copy this prompt into your agent

Quick version:

Install Cat Burglar from https://github.com/DrMkdaddy/cat-burglar as a local MCP server named catburglar.

Run: curl -fsSL https://raw.githubusercontent.com/DrMkdaddy/cat-burglar/main/scripts/install.sh | bash

Then run cat-burglar doctor.

Add the server with command cat-burglar (add --slim if the client loads every tool schema), restart or reconnect the client, and verify by navigating to https://example.com and taking a snapshot. Report the tool count, engine, and page title.

Full base prompt with client-specific steps, verification, and security rules: docs/agent-prompt.md.

<system_context>

You are installing Cat Burglar, a local browser MCP server, for this project.

Add Cat Burglar to the current MCP client and verify that it can drive a browser.

Run: curl -fsSL https://raw.githubusercontent.com/DrMkdaddy/cat-burglar/main/scripts/install.sh | bash Then run cat-burglar doctor and report the output.
Add a local stdio MCP server named catburglar that runs cat-burglar. If the client loads every tool schema into context, add --slim.
Do not use the name browser. It collides with OpenCode's built-in browser tools.
Enable BROWSER_MCP_ALLOW_PRIVATE_NETWORK=1 only if the user needs localhost.
Restart or reconnect the MCP client.
Verify with navigate to https://example.com, then snapshot, then close.

Report the server name, the tool count, the engine, and the title returned by the test page.

Do not commit secrets. Do not enable private-network access without asking. Use the measured 12-task local numbers if numbers are needed. Do not invent a head-to-head result.

Install and verify Cat Burglar for my agent.

Example prompts

Research:

Use catburglar. Open https://news.ycombinator.com, take a snapshot, read the top five stories with markdown, and give me the titles and links.

Forms and workflows:

Use catburglar. Open the staging signup page, fill the form with test data, submit it, and tell me exactly what changed on the page.

Local app testing:

Use catburglar with engine chromium. Open http://localhost:3000, log in with the seeded test user, open the billing page, capture a screenshot, and report console errors.

Performance:

Use catburglar with engine chromium. Open the product page, start a performance trace, reload, stop the trace, and summarize the long tasks and the three slowest scripts.

Three browsers

Engine	Best for	Footprint
`patchright`	Protected sites, logins, anti-bot work	Full Chromium
`chromium`	Devtools, console, traces, PDF, local app testing	Full Chromium
`obscura`	High-volume reads and low-memory work	About 43 MB

{ "engine": "obscura", "restart": true }

A running browser cannot change engines in place. Call open with restart: true.

The loop

navigate to a page.
snapshot to get URL, title, controls, and stable refs.
click, fill, or select by ref.
Read the change observation returned by the action.
Use markdown to read, extract for structured data, and perf for traces.
Run memory learn after a successful repeatable workflow.

Refs stay valid while the element remains in the DOM. If an element leaves the page, the action fails with a stale-ref error instead of clicking a clone.

Benchmark

Mode	Success	Tool calls	Observation chars	Wall time
Full snapshots	12/12	80	30,029	15.37 s
Diff + change observation	12/12	68	21,057	13.86 s

Measured on a 12-task local suite with server-side state checks. Profile flash, engine chromium, Node 26. Raw JSON: bench/results/2026-11-09-flash.json.

pnpm bench

pnpm bench:compare

Tools

30 tools by default. 14 in --slim mode.

Group	Tools
Lifecycle	`open`, `close`, `navigate`, `back`, `forward`, `reload`, `status`, `tabs`
Reading	`snapshot`, `markdown`, `extract`, `evaluate`, `screenshot`, `pdf`
Interaction	`click`, `fill`, `type`, `press`, `select`, `hover`, `scroll`, `upload`, `wait`
State	`cookies`, `storage`, `stealth`, `memory`
Diagnostics	`network`, `console`, `perf`

extract covers links, tables, JSON-LD, meta tags, text, and CSS field maps. perf covers web vitals, CDP metrics, slow resources, and full Chrome traces.

Safety

SSRF protection on navigation and every request, with DNS checks and redirect coverage.
Private, loopback, link-local, CGNAT, multicast, and reserved ranges are blocked unless explicitly allowed.
Cloud metadata endpoints stay blocked even with private-network access on.
Origin allow and block lists with wildcard hosts.
Page-derived output carries an untrusted-content marker.
High-impact targets such as delete, pay, transfer, send, publish, and deactivate are flagged. Set BROWSER_MCP_RISKY_ACTION_POLICY=ask to require explicit confirmation.
Site memory is agent-authored only. Page text is never ingested, refs are dropped, and typed values become placeholders.
Tracker blocking uses Obscura's 3,520-domain PGL list plus common analytics hosts.

Use these as layers in a defense-in-depth setup. For sensitive accounts, run with the ask policy and review the confirmation before approving.

Research

The design follows a review of 2023 to 2026 web-agent work: evaluation error, observation alignment, change observation, memory, planning, and prompt injection. Full review with 40 sources: docs/research/2026-11-browser-agent-research.md.

The LLM harness can run the same 12 tasks against ours, playwright, chrome-devtools, or obscura:

pnpm bench:llm -- --server ours

Develop

pnpm install

pnpm build pnpm test pnpm smoke pnpm bench pnpm bench:compare node dist/index.js doctor node dist/index.js install --client claude-desktop

Config file: ~/.config/browser-mcp/config.json. Example: cat-burglar.config.example.json. Environment variables override it.

Credits

Source	License	What we used
Obscura	Apache-2.0	Ref-token snapshot ideas, markdown and extract semantics, SSRF posture, tracker list data
Playwright MCP	Apache-2.0	Accessibility-first snapshots, persistent profiles, origin and file policy
Chrome DevTools MCP	Apache-2.0	Performance metrics and traces, network and console inspection
Patchright	Apache-2.0	Stealth Playwright driver
browser-use	MIT	Agent action vocabulary and humanized interaction ideas

The tracker list is the only copied data asset. See NOTICE.

Status

Version 0.3.3. Benchmarked on a 12-task local suite with raw JSON in the repo. The LLM harness can run the same tasks across four servers. Issues and counterexamples are welcome.

License

MIT. See LICENSE.

Cat Burglar

概览

PopNx MCP 的三大支柱

它能帮你做什么

安装

安装之前

需要你填写的值

它能做什么

基础检查i

作者与仓库一致

仍在维护

有许可证

端点有响应

使用 OAuth 登录

工具描述中没有隐藏指令

与“网页与浏览器”中的其他服务器比较i

常见问题

替代选择

Browser Use

Chrome DevTools MCP

MCP Server Browser

作者的 README

Cat Burglar

Three browsers. One MCP. Only the changes.

What you get

Install

Works with

Copy this prompt into your agent

Example prompts

Three browsers

The loop

Benchmark

Tools

Safety

Research

Develop

Credits

Status

License