alt Hacker NewsHow do you handle credentials and sessions for sites behind a login, like the bank and insurance portals you mention? Is the user's password or session cookie stored on your side, or does the generated MCP run against a session the user keeps locally?
Related: page content is untrusted input that now flows straight into an agent's context. Do the deterministic tools return only structured fields you've extracted, or can arbitrary page text (reviews, messages, product descriptions) pass through? That seems like the main prompt-injection surface for anything that can also perform actions like checkout.
For our hosted version, the session runs in our hosted browser. For the open source, it runs on a local browser.
In the hosted version, users can choose to pass logins at runtime or store them in our vault. Once a user logs in, we keep their session as a Chrome profile and attach it to a sticky IP, so that they stay logged in for longer.
Deterministic tools return only the structured fields, and don't parse the whole browser DOM. Since tools are deterministic, we also reduce the risk of prompt injections.