What an agent can and cannot do

What it can do

List the addresses and titles of every tab you have open, capture any of them, and open an address of its own choosing and capture that. It captures whatever the browser renders, which on a logged-in tab means whatever you are logged in as.

That is real reach, and worth being clear about: a tool that can read your open tabs can read your mail if your mail is open.

What stops it

Connecting. The bridge is off until you press Connect in the extension's settings, and through the helper, until you also allow Chrome's prompt. Disconnect there closes the connection immediately.

Chrome decides who starts the helper. The helper's manifest names the Page Scanner extension's id, and Chrome starts the helper for that extension and no other. The helper holds no secret of its own: it reads the pairing from ~/.page-scanner/config.json, the same file a command reads.

Loopback only. The listener binds 127.0.0.1, never 0.0.0.0. Nothing outside the machine can reach it.

Three checks on every connection. The Origin has to be a chrome-extension:// one, which stops a web page in any browser talking to the server. The first frame has to carry the shared token, which stops any other program on the machine doing so, and is the one that matters: a local process can forge an Origin header. And the protocol number has to match, so an extension and a server that disagree say so instead of misbehaving.

No port discovery from the extension. Loopback fetch is blocked for an extension origin by Local Network Access, so probing for a port would need a host permission the extension does not have and does not want. The helper reads the port from the pairing on disk; on the older path, the port is whatever you pasted.

Chrome's own notice. A scan attaches the debugger, so Chrome shows its "started debugging this browser" bar for as long as the scan takes. An extension cannot suppress it. A scan an agent started is never invisible. A page an agent opens also sits in a green Page Scanner tab group while it is scanned, unless Group an agent's tabs is off.

Tabs Chrome will not lend. chrome:// pages, the Web Store, other extensions' pages and the PDF viewer are off limits to any extension, including this one.

Where the token lives

~/.page-scanner/config.json, mode 0600. On macOS and Linux that means owner-only. On Windows it does not: NTFS does not implement the mode, so the file is readable by anything running as you. On a shared machine, restrict the directory yourself.

A loopback port is reachable by every process running as you, so the token is not decoration. If you think it has leaked, page-scanner-mcp pair --rotate invalidates it everywhere; the helper picks up the new one by itself, and a browser paired by hand needs it pasted again.