
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
ridealong-mcp
Advanced tools
A browser your AI drives. Ride along, grab the wheel anytime. MCP server for Claude Code with a real Chrome and a live H.264 view.
RIDEALONG |
A browser your AI drives. Ride along, grab the wheel anytime.
MCP server for Claude Code · real Google Chrome · live H.264 view · human-in-the-loop by design
Website · Quick start · Site en français · README en français

Every browser MCP lets an agent click around in the dark. Ridealong puts you in the passenger seat. Claude drives a real Chrome; you open one link and see exactly what it sees, where it clicks, what it typed — and when it hits a login, a CAPTCHA or a payment, you take the wheel from your phone, then hand it back.
Ridealong is an MCP server: Claude calls its tools like any other, but every step is visible on the live view, William's pointer and messages come back into the transcript, and sensitive actions wait for an approval.

![]() | ![]() |

| Typical browser MCP | Ridealong | |
|---|---|---|
| Browser | headless Chromium | real Google Chrome (codecs, extensions, your profile) |
| Watch the agent | screenshots on request | live stream, GPU-encoded H.264, ~150 ms behind |
| Intervene | stop the run | Manual mode: your clicks, keys and scroll go straight into the page |
| Sensitive actions | hope | ask_approval: Approve / Deny on your phone, the tool waits |
| Guide the agent | type a long prompt | tap the element on the live view, or send a one-line message |
| Secrets | in the transcript | never: Manual input is not stored, logged, or visible to Claude |
| Session dies | reconnect by hand | self-healing relay + zombie-proof live view |
On the machine Claude drives — nothing to host:
git clone https://github.com/williamblaismedia-create/ridealong && cd ridealong && npm ci && npm run build
claude mcp add ridealong -- "$PWD/scripts/ridealong-local.sh"
Then, in Claude Code: "open timeliner.io and give me the live view".
You get a signed link (http://127.0.0.1:9400/#token=…). Open it once on a
device and the bare address works for 30 days — bookmark it.
In Docker (Chrome under Xvfb, ffmpeg, persistent profile):
docker build -t ridealong . && claude mcp add ridealong -- docker run -i --rm -p 9400:9400 -v ridealong-data:/data ridealong
On an always-on server with an NVIDIA GPU, a Cloudflare tunnel and a
relay that survives your laptop sleeping: the reference setup is in
docs/DEPLOIEMENT-W-AGENT.md (French).
ffmpeg installed → H.264 video (NVENC · VideoToolbox · libx264, auto-detected).
No ffmpeg → JPEG frames. Either way it works.
ask_approval.--dangerously-load-development-channels server:ridealong
(also relays "took the wheel" / "paused").| Perceive | Act | Tabs | Live view |
|---|---|---|---|
state snapshot find read | navigate reload act fill scroll | tabs_list tabs_open tabs_select tabs_close | live_start live_mode live_stop |
diff screenshot console_errors | ask_approval inbox | ||
network_requests fetch_with_session |
Everything follows one target tab. Elements carry stable [ref]s from
snapshot/find, so Claude acts by reference, never by brittle selectors.
Chrome's HTTP cache and service workers are bypassed: a site you just
deployed is what Claude sees.
Claude Code ──stdio──▶ ridealong (MCP) ──CDP──▶ Google Chrome
│
└─ live view ── ws ──▶ your browser / phone
JPEG frames, or CDP screencast → ffmpeg (GPU) → fMP4 → MSE
input relay ◀── Manual mode (never stored)
Two Claude Code sessions on one Chrome? The second follows the first as a
control client and promotes itself if the first goes away. A local relay
(scripts/ridealong-mcp-relay.mjs) keeps the MCP session alive across a dead SSH
link by replaying the handshake.
RIDEALONG_LIVE_SECRET to revoke everything.npx ridealong-mcpIssues and PRs welcome — see CONTRIBUTING.md.
npm test runs 131 tests against a real Chromium (and ffmpeg when present).
Built by W Automatisations · Montréal · MIT
FAQs
A browser your AI drives. Ride along, grab the wheel anytime. MCP server for Claude Code with a real Chrome and a live H.264 view.
The npm package ridealong-mcp receives a total of 29 weekly downloads. As such, ridealong-mcp popularity was classified as not popular.
We found that ridealong-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.