
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
firekey-mcp
Advanced tools
MCP server for FireKey browser profile management. Allows AI tools like Claude Desktop, Cursor, and Claude Code to manage browser profiles through natural language.
The server exposes 15 tools through stdio and connects to FireKey's authenticated localhost API. It manages browser profiles and returns automation connection information; it does not itself read web pages or click page elements. FireKey's desktop app also communicates with its backend, so a local MCP connection does not mean the product is fully offline.
npx firekey-mcp --api-key YOUR_API_KEY
Edit claude_desktop_config.json:
{
"mcpServers": {
"firekey": {
"command": "npx",
"args": ["-y", "firekey-mcp", "--api-key", "YOUR_API_KEY"]
}
}
}
Add to .mcp.json:
{
"mcpServers": {
"firekey": {
"command": "npx",
"args": ["-y", "firekey-mcp", "--api-key", "YOUR_API_KEY"]
}
}
}
Add to MCP settings:
{
"mcpServers": {
"firekey": {
"command": "npx",
"args": ["-y", "firekey-mcp", "--api-key", "YOUR_API_KEY"]
}
}
}
| Option | Env Variable | Description | Default |
|---|---|---|---|
--port | FIREKEY_PORT | FireKey Local API port | Auto-detect |
--api-key | FIREKEY_API_KEY | API key for authentication | — |
Port is auto-discovered from FireKey's data directory. Manual override only needed if running multiple instances.
To avoid putting the key in command-line arguments, you can use the supported FIREKEY_API_KEY environment variable in your MCP client's local configuration:
{
"mcpServers": {
"firekey": {
"command": "npx",
"args": ["-y", "firekey-mcp"],
"env": {
"FIREKEY_API_KEY": "YOUR_API_KEY"
}
}
}
}
Keep configurations containing a real key private. Never commit them or include keys, cookies, proxy credentials, or live automation endpoints in public logs or screenshots. Tools such as profile deletion, cache clearing, and cookie reading should only be invoked for an explicitly authorized target.
A programmatic MCP client test on September 9, 2026 successfully created a blank profile with no proxy, started it in headless mode, received Puppeteer/Selenium connection information, verified its running state, stopped it, and verified it was no longer running. The desktop UI also showed the demo profile as stopped. This test did not cover long-term session persistence or a Claude/Cursor conversation.
Once configured, you can use natural language in Claude:
cd mcp-server
npm install
npm run build
node dist/index.js --api-key YOUR_KEY
FAQs
MCP server for FireKey browser profile management
The npm package firekey-mcp receives a total of 13 weekly downloads. As such, firekey-mcp popularity was classified as not popular.
We found that firekey-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.