Docs: tool descriptions for browser-embedding servers do not mention the browser's own background traffic

Fermée Adaptée aux débutants
  • Quelque chose ne va pas ?
#4,829 0 commentaires 0 réactions 0 personnes assignées Voir sur GitHub

Les mainteneurs répondent en général sous 1 jour

@AbhiPra24 y travaille déjà.

Depuis le 24/9/2026.

  • #4843 par @AbhiPra24 — ouverte

Évaluation

Difficulté
2/5
Temps estimé
1-3 heures
Accessibilité débutants
68/100
Type d'issue
Documentation
Clarté
Plutôt claire
Activité
Active
Domaine
documentation, web-dev

Piste de recherche

Commencez par consulter le README et les descriptions des outils du serveur src/puppeteer archivé, puis recherchez la documentation concernant les futurs serveurs qui intègrent des moteurs de navigateur. Ajoutez une note concise indiquant que le navigateur intégré peut effectuer des requêtes en arrière-plan au-delà de la navigation demandée, et confirmez que la formulation convient à l’emplacement de documentation choisi.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Description

Hello, and thanks for the reference servers: having a set of them with real schemas is what made
the measurement below possible at all.

While measuring where MCP tool calls cause outbound traffic to go, I ran
@modelcontextprotocol/[email protected] in a container behind a terminating proxy and
drove a single puppeteer_navigate call at one URL. Besides the requested navigation, the run
recorded connections to two destinations that the tool's description does not mention:
clients2.google.com and accounts.google.com.

These are the embedded Chromium's own background requests, not something the server asks for. I
checked rather than assumed: launching the same browser binary with the same flags through the
same proxy, with no MCP server in the process tree and the same navigation, reproduces both
destinations. Neither request carried any of the call's arguments.

So this is not a report about the server doing something unexpected with a user's data. It is a
documentation gap, and I think it is worth a line because of where these servers get deployed:

  • puppeteer_navigate is documented as navigating to a URL. A reader reasonably concludes that
    the destinations a call produces are the URL they passed.
  • Anyone deploying an MCP server in an environment where egress is reviewed (a regulated network,
    an allowlisted proxy, an air-gapped-ish build system) will size their allowlist from that
    reading, and the first background request will fail or will show up in an audit as unexplained.
  • The property belongs to the class, not to this package: any MCP server that embeds a browser
    engine will carry the same background traffic, whoever writes it.

A sentence in the README or in the tool description, along the lines of "this server runs a full
browser; the browser makes its own background requests (update and connectivity checks) in
addition to the navigation you request", would close the gap.

I realise src/puppeteer has moved to the archived set, so this may be better framed as a
convention for any future server that embeds a browser engine rather than as a fix to that
package. Happy to send a PR against whichever document you think is the right home for it, or to
drop it if you would rather not document archived servers.

Measurement details, if useful: container-only, no real credentials, a single navigation to an
RFC 2606 reserved domain, three repetitions of the control. I am not publishing anything that
identifies a deployment, and I am happy to share the method.

Thanks again.

Langage dominant
TypeScript
Étoiles
91.7k
Forks
11.9k
Merge moyen
3 h 30 min
PR mergées (30 j)
199

Préparer son environnement

Par où commencer

  1. Lisez l'issue en entier, puis le guide de contribution du projet.
  2. Signalez en commentaire que vous la prenez — cela évite que deux personnes fassent le même travail.
  3. Forkez le dépôt et travaillez sur une branche.
  4. Ouvrez une pull request qui référence le numéro de l'issue.

Autres issues de modelcontextprotocol/servers

Toutes les issues de modelcontextprotocol/servers

Issues similaires

Plus d'issues TypeScript

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.