blueprint-mcp

The server design uses a browser extension for automation, which inherently involves executing JavaScript in the browser context via DevTools Protocol (`Runtime.evaluate`). This means the AI agent effectively has the ability to run arbitrary JavaScript on the web pages it controls. The default local WebSocket connection (`127.0.0.1:5555`) is secure. The PRO tier uses OAuth2 authentication for cloud relay connections, with tokens stored securely using file locking (`proper-lockfile`). JWTs are decoded by the client but not validated, relying on the relay server for validation, which is an appropriate separation of concerns. No obfuscation or obvious malicious patterns were found in the provided code. The project is transparent about the inherent security implication of giving AI control over a browser.