Browser agents

This guide is for readers who want a model to operate a web browser for them, whether to fill in a form, check a page or collect information. Three approaches are covered. Claude in Chrome works in your own Chrome window with your existing sign-ins. Playwright MCP gives a model structured page snapshots through a standard protocol. The computer use tool lets a model work from screenshots and mouse and keyboard actions through the API. Each has a different setup and a different risk profile.

The three approaches

Claude in Chrome is a browser extension that Claude Code connects to. Claude opens new tabs for browser tasks and shares the browser's login state, so it can reach any site you are already signed into.^[1] Browser actions run in a visible Chrome window in real time.^[1]

Playwright MCP is a Model Context Protocol (MCP) server. It lets an LLM interact with web pages through structured accessibility snapshots, so the model does not need screenshots or a vision model. It uses Playwright's accessibility tree rather than pixel-based input.^[3]

The computer use tool is an API tool. It provides screenshots and mouse and keyboard control for autonomous desktop interaction. A single {"type": "computer_toolset_20260801"} entry in the tools array gives Claude 17 member tools, including screenshot, left_click, type and zoom.^[4]

Before you start

Claude in Chrome needs Google Chrome or Microsoft Edge. It also detects the extension in Brave, Arc, Vivaldi and Opera, but it does not run under Windows Subsystem for Linux (WSL).^[1] The prerequisites are the Claude in Chrome extension version 1.0.36 or later from the Chrome Web Store, and a direct Anthropic plan: Pro, Max, Ultra, Team or Enterprise.^[1]

Playwright MCP needs Node.js 18 or newer, and an MCP client such as VS Code, Cursor, Windsurf, Claude Desktop, Goose, Grok or Junie.^[3]

The computer use tool is called through the Messages API. The quickstart sets ANTHROPIC_API_KEY and sends requests with content-type: application/json and x-api-key: $ANTHROPIC_API_KEY.^[4] The demo runs in Docker, which needs its own setup.^[5]

Claude in Chrome: step by step

1. Install the Claude in Chrome extension from the Chrome Web Store and confirm it is version 1.0.36 or later.^[1]
2. Start Claude Code with the Chrome flag: claude --chrome.^[1]

claude --chrome

1. Sign in with /login. Chrome integration requires that sign-in. If you authenticate with an API key or a long-lived token from claude setup-token, Claude Code keeps Chrome integration off even when --chrome is passed.^[1]
2. Run /chrome at any time to check the connection status, manage permissions, reconnect the extension or choose which connected browser to use.^[1]

Site permissions are inherited from the Chrome extension and managed in its settings. Before a browser action starts, a permission dialog reading Claude in Chrome wants to appears, and it offers to allow all actions on that site for the session.^[1]

Playwright MCP: step by step

Playwright MCP is set up as an MCP server. The README's standard config works in most tools:^[3]

{
  "mcpServers": {
    "playwright": {
      "command": "npx",
      "args": [
        "@playwright/mcp@latest"
      ]
    }
  }
}

For Claude Code, the README gives the CLI install claude mcp add playwright npx @playwright/mcp@latest. Codex and Amp have their own commands, which the README also lists.^[3]

Server arguments go in the "args" list. A configuration file can be passed with npx @playwright/mcp@latest --config path/to/config.json.^[3] The flags that matter most are --headless, which runs the browser without a window; --browser <browser>, which accepts chrome, firefox, webkit or msedge; and --caps <caps>, which enables vision, pdf or devtools.^[3]

The main tool is browser_snapshot, which captures the accessibility snapshot of the current page. The README describes it as better than a screenshot. Coordinate-based tools such as browser_mouse_click_xy are opt-in through --caps=vision.^[3]

Computer use: step by step

The computer use tool runs on the Messages API. Add {"type": "computer_toolset_20260801"} to the tools array of a request, and no beta header is needed.^[4] Screenshots come from screenshot, which captures the full display and returns it as an image. left_click takes an optional coordinate of [x, y]. Coordinates are in screenshot pixels, with the origin at the top left.^[4]

The demo recommends XGA resolution, 1024x768, and does not recommend sending screenshots at resolutions above XGA or WXGA. Relying on the API to resize images gives lower accuracy and slower performance than scaling in the tools directly.^[5]

Older beta tool versions are a different case. computer_20251124 requires the header computer-use-2025-11-24, and computer_20250124 requires computer-use-2025-01-24, sent on every request.^[4]

The demo launches from the image ghcr.io/anthropics/anthropic-quickstarts:computer-use-demo-latest and maps ports 5900, 8501, 6080 and 8080. Its combined interface is at http://localhost:8080.^[5]

Safety limits

The biggest risk in browser agents is prompt injection. Malicious actors hide instructions in websites, emails or documents to trick an AI into harmful actions, such as deleting files, stealing data or making financial transactions.^[2]

Claude in Chrome relies on permissions first. Users can grant or revoke Claude's access to specific sites at any time in Settings, and Claude asks before high-risk actions such as publishing, purchasing or sharing personal data.^[2] Anthropic's announcement recommends starting with trusted sites, keeping in mind the data Claude can see, and avoiding sensitive sites with financial, legal or medical information.^[2] In adversarial testing covering 123 test cases across 29 attack scenarios, browser use without safety mitigations had a 23.6% attack success rate. With safety mitigations in autonomous mode, the rate fell to 11.2%.^[2] A lower number is still not zero.

A project cannot turn on Claude in Chrome. Claude Code ignores CLAUDE_CODE_ENABLE_CFC when it is set in a project's .claude/settings.json or .claude/settings.local.json, because a repository you check out must not be able to connect Claude to your browser.^[1] File uploads are capped at 10 MB in total, and Claude refuses files whose names or folders hold credentials, such as .env, .pem, .key files and anything under .ssh.^[1]

Playwright MCP is not a security boundary, according to its README. The --allowed-origins and --blocked-origins options do not serve as a security boundary and do not affect redirects. The secrets and redactUrlParams options are a convenience, not a security feature.^[3] By default file system access is limited to workspace root directories, and navigation to file:// URLs is blocked unless --allow-unrestricted-file-access is set. The tool browser_run_code_unsafe runs arbitrary JavaScript in the Playwright server process and is equivalent to remote code execution.^[3]

The computer use guidance is equally direct. Anthropic recommends a dedicated virtual machine or container with minimal privileges, no access to sensitive data such as account logins, internet access limited to an allowlist of domains, and a human confirming decisions with real-world consequences such as financial transactions.^[4] Claude sometimes follows commands found in content even when they conflict with the user's instructions, including text on webpages or inside images. Classifiers scan what the tool returns, such as screenshots, to flag possible prompt injections.^[4]

Limits and common problems

Playwright MCP's persistent profile can be used by only one browser instance at a time, so concurrent MCP clients sharing one workspace will conflict. The Docker build only supports headless chromium for now.^[3]

Computer use has its own limits. Latency may be too slow for interactive use. Claude can make mistakes or hallucinate when outputting specific coordinates. Reliability drops on niche applications. It has limited ability to create accounts or generate content on social media platforms.^[4] The documentation says to review Claude's computer use actions and logs carefully, and not to use it for tasks needing perfect precision or sensitive information without human oversight.^[4]

Claude in Chrome does not work under WSL, and sign-in through an API key switches off the Chrome integration.^[1]

Next steps

For Claude in Chrome, read the Chrome integration guide in Claude Code's docs.^[1] For the Playwright server options, read the Playwright MCP README.^[3] For the computer use tool's request format and the tool list, read the computer use tool page.^[4] For the demo, read its README before you run it.^[5]