TMSSS05/google-flow-browser-mcp

JavaScript·37 files·commit 0c8e80a·scanned 2h ago·cached ✓

70/100

DANGEROUS

Sensitive capability combinations reachable from entry points. Do not run without review.

This repository contains patterns associated with malware. Do NOT run this code.

verdict accurate?

threat-state: dangerouslive

FINDINGS ░▒▓

criticalSuspicious code is reachable from an entry pointFlagged files are imported by the application's entry path: src/browser/connect.js, src/browser/launch-profile.js, src/navigation/project-navigator.js. This means the suspicious code can execute when the app runs.+8

warningCluster of suspicious files reachable from entry4 flagged files form a connected cluster that is reachable from an entry point, suggesting coordinated malicious behavior rather than isolated false positives.+5

criticalBrowser credential store accessAccessing Chrome, Firefox, Edge, or Brave profile directories to steal cookies, passwords, and session tokens.scripts/start-browser.sh

CHROME="/opt/google/chrome/chrome"
USER_DATA_DIR="$HOME/.config/google-chrome"
PROFILE="Profile 3"
CDP_PORT=9222

+10

criticalBrowser credential store accessAccessing Chrome, Firefox, Edge, or Brave profile directories to steal cookies, passwords, and session tokens.src/browser/connect.js

  const headless = options.headless ?? get('headless', false);
  const profileSource = options.profileSource || path.resolve(process.env.HOME, '.config/google-chrome/Profile 3');

  if (isConnected &&...

+10

criticalBrowser credential store accessAccessing Chrome, Firefox, Edge, or Brave profile directories to steal cookies, passwords, and session tokens.src/browser/launch-profile.js


  const profileSource = path.resolve(process.env.HOME, '.config/google-chrome/Profile 3');

  if (!fs.existsSync(profileSource)) {

+10

warningHigh-entropy string literalsFound 9 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.src/index.js+3

warningHigh-entropy string literalsFound 4 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.src/navigation/project-navigator.js+3

warningHigh-entropy string literalsFound 5 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.src/utils/logger.js+3

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

34 files scanned @ 0c8e80a | 9/25/2026 | heuristic scan — always review manually

risk by category

code execution13

network & exfiltration0

file system access20

obfuscation9

supply chain0

owasp / injection0

telemetry

files 34/37rules hit 8engine v6commit 0c8e80a

github

TMSSS05/google-flow-browser-mcp

MCP server for controlling Google Flow via browser automation (Playwright + CDP)

JavaScript

118d

37 files

34 scanned(92%)

0c8e80a

architecture░▒▓

entry (1) flagged (5) pkg (4)

30 nodes · 133 edgesscroll to zoom · click node to jump to finding