Run two coding agents and you get two Chromes. Run four and you get a mess.
Browsergator
A client-neutral MCP gateway so several agents can work in one browser without fighting over it.
One shared Chrome
Every agent connects to the same browser, so they share one set of logins instead of each starting cold.
Connect once, not per agent
A single long-lived service over Streamable HTTP, rather than a separate process spawned by every client.
Leases and FIFO queues
Different tabs run in parallel; writes to the same tab queue in order, and a lease locks a tab that must not be touched.
Client-neutral
Codex, Claude Code and Gemini CLI connect directly. Copilot CLI goes through a stdio adapter to the same gateway.
Every agent starts its own Chrome. You end up with a pile of processes, none of them sharing a login, and no way to hand a tab from one agent to another.
Browsergator is one long-lived service that owns a single Chrome connection. Agents connect to it instead of to the browser, and it decides who gets to touch which tab.
How it connects
Why it holds up with four agents
Sharing a browser is easy until two agents write to the same tab. Tabs are addressed by their explicit Chrome target ID, so nothing is ever inferred from a notion of a current tab.
Work on different tabs runs in parallel. Writes to one tab are serialized through a FIFO queue so they land in order. Reads normally bypass that queue, so a screenshot never waits behind someone else’s form fill. A tab that matters can be claimed with a lease, which blocks other writers until it is released.
- Explicit pageId, never an inferred current tab
- Parallel across tabs, FIFO within a tab
- Leases for tabs that must not be touched
- Reads bypass the mutation queue
- Chrome tab groups left alone unless a client asks
Getting started
You need Node.js 22.12 or newer, a Chrome already listening on a loopback CDP URL, and a long random bearer token.
git clone https://github.com/TheJesper/browsergator
cd browsergator && npm install
$env:BROWSER_GATEWAY_TOKEN = ([Convert]::ToBase64String(
[Security.Cryptography.RandomNumberGenerator]::GetBytes(32)))
npm run build && npm start
# MCP endpoint: http://127.0.0.1:8788/mcpDetails
How is this different from running a browser MCP server per agent?
A per-agent server gives each client its own browser and no shared state. Browsergator is the coordination layer instead: one Chrome, explicit tab identity, per-tab FIFO queues and leases, so several agents can work at once without overwriting each other.
Which MCP clients work with it?
Codex, Claude Code and Gemini CLI connect directly over Streamable HTTP. GitHub Copilot CLI uses the included stateless stdio adapter, because direct HTTP configuration did not surface the gateway tools in the installed CLI during end-to-end verification. The adapter forwards to the same gateway and never owns Chrome.
Does it launch Chrome for me?
No. The gateway never launches or stops Chrome. You point it at a Chrome already listening on a loopback CDP URL and it holds one WebSocket to it.
What happens when two agents target the same tab?
The writes are serialized through that tab’s FIFO queue and land in order rather than interleaving. If one agent needs exclusive access it claims a lease, which blocks other writers until it releases.
Why does every call carry agentId, taskId and leaseOwnerId?
One MCP client connection may contain several subagents, so the connection alone does not identify the caller. Passing logical identity explicitly is what makes coordination and the audit trail meaningful.
What tools does it expose?
Tabs: list_tabs, open_tab, close_tab, navigate. Interaction: click, click_at, fill, fill_form, type_text, press_key, hover, drag, wait_for, handle_dialog. Inspection: snapshot, screenshot, console_list, network_list, network_get_response_body. Coordination: claim_tab, release_tab, run_atomic. The MCP server ID stays browser-gateway for compatibility with existing configs.
How is it secured?
Every request to /mcp and /status needs a bearer token, and supplied Origin and Host headers are restricted to loopback. Native clients may omit Origin.
Is it safe to let an agent drive my browser?
An agent driving a real browser acts with your sessions and your permissions. The operator stays responsible for the accounts, data and actions they delegate. Use it only against systems you are authorised to use, keep a human in the loop for anything consequential, and never use it to work around security controls. It can also help people who need an AI-assisted browser interface, including people with disabilities.
Contribute directly, rather than forking and drifting
Browsergator uses the Slowgun workflow: contributions go into the shared project instead of a fork that quietly falls behind and gets abandoned. Bring an idea, test it with a client we have not tried yet, fix a rough edge, or improve the docs.
The quality gates are lint, typecheck, test and build, and they are all in CONTRIBUTING.md.