mcp-browser

The server allows execution of arbitrary JavaScript via the browser extension (`eval(code)` in content.js) and arbitrary AppleScript via the AppleScript service (`osascript -e script`). Both 'code' and 'script' inputs originate from the MCP client (likely an LLM). If the LLM or any upstream component is compromised or provides unexpected input, this could lead to arbitrary code execution in the browser's page context (via the extension) or on the local macOS system (via AppleScript). There's no explicit input sanitization or robust sandboxing of these dynamic code injections evident in the provided source for preventing malicious payloads, relying heavily on the trustworthiness of the MCP client's input. The system runs locally on `localhost`, which mitigates remote network exploitation, but local privilege escalation or data exfiltration is a risk.