Back to mcpXBrowser mcpX

Legal · Privacy

Your browser data stays in your workflow.

mcpX is a local bridge between an MCP-compatible AI client and Chrome. This policy explains what the extension can access, what it stores, and where data goes when you run a browser tool.

Effective July 28, 2026 · Last reviewed August 1, 2026

The short version

Local by design

mcpX does not operate a cloud service that receives your page contents or browser commands. The extension connects to an mcpX server bound to your computer's loopback interface. The AI client you choose may process the results under its own privacy terms, so connect only clients you trust.

Runs on your device

Browser commands travel between your MCP client, the local mcpX server, and the extension.

No mcpX tracking

The extension contains no advertising, analytics, or third-party tracking service.

You choose the client

Browser data is returned only through the local MCP connection you configure.

01 · Data

Data mcpX processes

When you or your connected MCP client requests a browser action, mcpX may process the information required to complete it:

  • Tab URLs, titles, identifiers, and navigation state
  • Semantic page text, element metadata, and element locations
  • Text you ask the client to enter and the resulting interaction state
  • Viewport or full-page screenshots you explicitly request
  • Console messages, runtime exceptions, and stack information captured after you start console monitoring
Page output can contain personal or sensitive information already visible in the tab. mcpX cannot determine whether that information is sensitive; review the task and the connected client before use.

02 · Storage

What is stored locally

The extension stores only the state needed to connect and recover:

  • Local server connection configuration
  • A pairing credential for the trusted local connection
  • Your connect or disconnect preference
  • Bounded active console-monitor state in Chrome session storage

mcpX does not build a browsing-history database. Chrome can still retain its normal browser history independently of mcpX.

03 · Network

How information moves

MCP clientLocal mcpX serverChrome extension

The extension connects to the server on 127.0.0.1. Local WebSocket traffic uses authenticated ws:// and is not TLS-encrypted because it remains on the loopback interface. Do not expose the mcpX port through a public interface, tunnel, proxy, or container port mapping.

The website and documentation do not provide user accounts or forms, and the project does not add an analytics or advertising SDK. Your website host or browser may process ordinary request data under its own terms.

04 · Permissions

Why the extension asks for access

tabs and activeTab
Identify, target, and report the tabs involved in your request.
scripting
Inject the page agent only when a DOM operation needs it.
<all_urls>
Run user-requested automation on ordinary web pages.
debugger
Capture requested screenshots and explicit console monitoring.
storage
Keep pairing, preferences, and session recovery state locally.

mcpX rejects Chrome-internal pages and other restricted URL schemes.

05 · Sharing

Sharing and third parties

mcpX does not sell browser data or share it with advertisers. Results are delivered through the local MCP connection to the client you configured. Any onward processing, storage, or model use is controlled by that client and its provider—not by mcpX.

06 · Control

Your controls

  • Disconnect the browser from the extension popup.
  • Use Forget pairing to remove the saved credential.
  • Stop the local server to end browser-control communication.
  • Revoke extension permissions or uninstall mcpX in Chrome.

Uninstalling removes the extension's Chrome-managed local and session storage. It does not erase information already shared with your chosen MCP client.

07 · Changes

Policy changes

We will publish material changes in this policy and the extension documentation. The review date at the top of the page shows when this text was last checked against the product's behavior.

08 · Contact

Questions or concerns

The fastest way to report a privacy concern is through the public repository. Please do not include pairing credentials, screenshots, page contents, or other sensitive data in an issue.

Open an issueSecurity documentation