mcp-browser-use-server

The server includes a 'direct summarizer' feature that fetches content from a user-provided URL using `requests.get()`. This `url_text` parameter is taken directly from the AI agent's input without explicit domain validation or sanitization within this direct path. This creates a potential Server-Side Request Forgery (SSRF) vulnerability, allowing a malicious AI agent to potentially make the server request resources from internal networks or other arbitrary endpoints not intended for public access. Although the `browser-use` agent itself might have `allowed_domains` as a parameter, this direct summarizer bypasses the agent's full execution flow and its associated security controls. Other components, such as `subprocess.Popen` for `mcp-proxy`, execute trusted binaries with arguments controlled by the server's CLI rather than direct AI agent input, which is less of a concern.