What an agent can and cannot do
The three checks on every connection, and the honest description of the reach this gives.
What it can do
List the addresses and titles of every tab you have open, capture any of them, and open an address of its own choosing and capture that. It captures whatever the browser renders, which on a logged-in tab means whatever you are logged in as.
That is real reach, and worth being clear about: a tool that can read your open tabs can read your mail if your mail is open.
What stops it
Pairing. The bridge is off until you paste a token into the settings page and press Connect. Turning the toggle off closes the connection immediately.
Loopback only. The listener binds 127.0.0.1, never 0.0.0.0. Nothing outside the machine
can reach it.
Three checks on every connection. The Origin has to be a chrome-extension:// one, which
stops a web page in any browser talking to the server. The first frame has to carry the shared
token, which stops any other program on the machine doing so, and is the one that matters:
a local process can forge an Origin header. And the protocol number has to match, so an
extension and a server that disagree say so instead of misbehaving.
No port discovery. Loopback fetch is blocked for an extension origin by Local Network
Access, so probing for a port would need a host permission the extension does not have and does
not want. The port is whatever you pasted.
Chrome's own notice. A scan attaches the debugger, so Chrome shows its "started debugging this browser" bar for as long as the scan takes. An extension cannot suppress it. A scan an agent started is never invisible.
Tabs Chrome will not lend. chrome:// pages, the Web Store, other extensions' pages and the
PDF viewer are off limits to any extension, including this one.
Where the token lives
~/.page-scanner/config.json, mode 0600. On macOS and Linux that means owner-only. On Windows
it does not: NTFS does not implement the mode, so the file is readable by anything running as
you. On a shared machine, restrict the directory yourself.
A loopback port is reachable by every process running as you, so the token is not decoration. If
you think it has leaked, page-scanner-mcp pair --rotate invalidates it everywhere.