Umbra - Browser Control for AI Agents

Give a local agent scripted control of tabs it owns in your signed-in Chrome. No focus theft. Requires a local companion server.

Umbra lets your AI agent drive the Chrome you are already signed into, without taking over your whole browser. It only touches tabs it owns. Install this extension, then tell your bot or agent to finish setup for you. It will walk you through the companion server, pairing, and config. You mostly paste what it prints and click Save / Grant Site Access. REQUIRES A LOCAL COMPANION SERVER The extension alone does not automate anything. It pairs with a free open-source companion server on your machine that speaks the Model Context Protocol, so any MCP client can drive only the tabs Umbra owns. Quick path 1. Install this extension 2. Ask your agent to set up Umbra for you, or follow https://robertjohnlora.com/umbra 3. Run the companion pair command when it asks 4. Paste the shared key into Options, then click Save And Reconnect 5. Paste the config into your MCP client, click Grant Site Access, and restart the client The pair command already created the shared key, so do not also click Generate Key. The options page shows connection status throughout. HOW THE BOUNDARY WORKS Unlike remote debugging, which hands an agent every tab and cookie jar at once, Umbra uses tab groups and ownership. Before any Chrome call, Umbra checks that the target tab belongs to that session. A session can read, click, and close only the tabs it created or that you handed it. It cannot touch any other tab, including tabs owned by other sessions. It can list unowned tabs by title and URL, which is how you point it at one you want to hand over. That boundary is what makes this usable against a browser you are already logged into. An agent can read a dashboard you are signed into, fill a form, and close its own tabs when it finishes, while your other windows stay untouched and unreadable. WHAT YOU GET - 51 browser tools: navigation, page reads, an accessibility-based list of visible controls, clicking, typing, form fill, select, hover, keyboard input, file upload, scrolling, screenshots, console reads, and multi-step batches that run in a single call. - Background operation. Opening, navigating, and DOM interaction default to inactive tabs, so routine agent work never pulls Chrome to the foreground. Ask for focus explicitly when a task genuinely needs it. - Many sessions in one browser. Each agent session gets its own tab group and its own view of the browser, and several can run at once in the same profile. - Tab adoption. Open a page by hand, sign in, then hand that exact tab to the agent instead of making it navigate there itself. - Background window create is refused. Umbra attaches an inactive tab to an existing window. Opening a new Chrome window is blocked unless you explicitly allow foreground, because that steals focus on macOS. - Ownership-based cleanup. One call closes the session's whole tab group, and it closes a window only when every tab in it belongs to that session. HOW IT TALKS TO THE COMPANION SERVER A WebSocket on 127.0.0.1, on ports 47821 to 47852 unless you change that range on the options page. Both sides prove they hold the same shared key through an HMAC challenge before a single command is accepted, and a connection from anything other than loopback is refused. The extension contains no fetch and no XMLHttpRequest, and its content security policy allows no remote host. Nothing it reads leaves the machine. WHAT IT WILL NOT DO - no cookie dump and no cookie sync - no token extraction - no storage read or write tools - no background fetching on a page's behalf - no CAPTCHA solving - no access to bookmarks, history, or the clipboard - no native messaging - no analytics, no telemetry, no account, no remote configuration PERMISSIONS Site access is optional and is not granted at install. The options page asks for it with a Grant Site Access button, and Chrome lets you revoke it at any time. Until it is granted, page reads and screenshots stop with a message naming that button rather than failing quietly. The debugger permission is the widest one declared, and it does three things: capture a screenshot without activating the tab, populate a file input, and run JavaScript that a caller supplied. Attachment happens only against a tab the calling session already owns, it is released as soon as the work finishes, and Chrome shows its automation banner for as long as it lasts. Caller-supplied code runs through the debugger API rather than being compiled inside the extension. Requires Chrome 121 or later. Source, architecture notes, threat model, and a per-permission justification: https://robertjohnlora.com/umbra