Why MCP Browser Automation Security Matters — and How a Hosted API Changes the Equation

Security researchers just found 8,000+ exposed MCP servers on the internet. Some have active exploitation attempts documented.

If you're building AI agents with browser automation, this matters to you. A lot.

The Self-Hosted MCP Browser Problem

Open-source MCP browser servers (Playwright MCP, Puppeteer MCP, browser-use) are fantastic. They're free, auditable, and you own the code. But they come with a security model that's fundamentally risky at scale:

Direct access: Your AI agent gets direct access to the browser. Every cookie, every form field, every page visit can be logged or exfiltrated by a compromised LLM, a prompt injection attack, or a malicious user input.

Local filesystem exposure: Many browser MCPs expose your local filesystem to the agent via page inspection APIs. Your agent can now read arbitrary files if it navigates the right DOM.

Credential leakage: If your agent is running in an untrusted environment (cloud, shared infrastructure, customer devices), any credentials it accesses during browser automation can leak.

Supply chain risk: If the MCP server itself is compromised or exposed on the internet (like the 8,000 servers researchers found), attackers have direct browser and filesystem access to your agent's infrastructure.

This isn't hypothetical. Attackers are actively scanning for exposed MCP servers and using them to steal data, pivot into infrastructure, and harvest credentials.

How Hosted Browser Automation Changes This

PageBolt's hosted MCP model inverts the security model:

No direct browser access: Your AI agent doesn't get a browser instance. It gets a tool that calls our API. We handle the browser.

Rate limiting and audit trails: Every call is logged, rate-limited, and traceable. We can see what pages were visited, what screenshots were taken, what videos were recorded.

No credential exposure: Your agent never handles credentials directly. Session cookies, API keys, and auth tokens stay in our managed environment. You pass them to us via headers, we never log or store them.

No filesystem access: The agent can't inspect or enumerate your machine's filesystem. Browser automation stays scoped to web pages only.

No supply chain risk: Even if your agent's code is compromised, attackers can't use it to get direct browser access to your infrastructure. All they get is a rate-limited API call.

Real Example: Why This Matters

Self-hosted scenario:

Attacker → Compromise AI agent code
         → Agent now has direct browser access
         → Attacker screenshots your admin dashboard
         → Attacker extracts session cookies
         → Attacker pivots into your infrastructure

Hosted API scenario:

Attacker → Compromise AI agent code
         → Agent can only call screenshot API
         → Rate limits kick in after 10 calls/min
         → Audit log flags suspicious activity
         → You revoke the API key
         → Attacker's access is instantly terminated

The Tradeoff Is Real

Self-hosted MCP gives you code visibility and full control. That's valuable. But visibility doesn't prevent attacks — it just makes them auditable after the fact.

Hosted APIs trade some control for:

• Instant attack mitigation (revoke an API key, not a compromised LLM)
• Rate limiting (automatic DDoS/brute-force protection)
• Audit trails (compliance, incident response)
• Zero credential exposure (no cookies on your machines)

Timing Matters

The 8,000 exposed MCP servers weren't exposed because the code was bad. They were exposed because self-hosted anything on the internet without proper access controls is a target. Researchers found them in minutes.

Your browser automation doesn't need to be on the internet. It just needs to call an API that is. And that API should be rate-limited, audited, and credential-isolated.

Getting Started

PageBolt's MCP server is hosted. When you call take_screenshot, inspect_page, or record_video, your agent isn't getting a browser. It's calling an API. All the security guarantees above come for free.

Free tier: 100 requests/month. Enough to understand the difference in security model.