feat: add cookies, localStorage and sessionStorage

[thepushkarp]

Hi, while working browser-tools-mcp, I felt that having access to cookies, localstorage, and sessionstorage would aid the agent in debugging errors.

@tedjames let me know your thoughts and if I should make any further changes to this.

Thanks!

Overview of Changes

• Adds cookies, localStorage, and sessionStorage to the MCP tools
• Adds Sensitive Data Settings to the Dev Tools Panel to control data security of cookies and local/session storage
• Adds an .editorconfig file to maintain formatting consistency

MCP Functions introduced

• mcp_getCookies - Get cookies from the current page
• mcp_getLocalStorage - Get localStorage data
• mcp_getSessionStorage - Get sessionStorage data

---

This comment was updated to reflect the latest changes introduced in this PR based on further discussions.

[tedjames]

Nice! I was thinking of integrating this as well!! I intentionally did not do this so that users would never send sensitive tokens to an LLM. I'm thinking we could leave this disabled by default and allow it to be configurable in the dev tools panel?

It would also be nice to persist this config to the browser...

On another note, what is everyone's thoughts on the security model for this?

I'm wondering if users opt-in for this, maybe there's a way to "detect" a token in the cookies, local storage and session storage to avoid sending. Then make that a configurable option as well ("include tokens").

Perhaps regex could be a good starting point?

[thepushkarp]

I'm thinking we could leave this disabled by default and allow it to be configurable in the dev tools panel?

This sounds great! Adding to it, we can have three modes to handle these data in the mcp server, all configurable from the dev tools panel:

• no access to cookies and local/session storage tools [default]
• access to cookie and local/storage tools but send no tokens — tokens can be detected and filtered out using a mix of regex (for popular tokens) and entropy techniques
• access to everything — need to add a disclaimer that enabling this would expose your keys to the llms models

Let me know your thoughts on this 👍

[thepushkarp]

Hi,

The server and Chrome extension now supports the three data sensitivity settings:

• Hide All Cookies and Storage (Maximum privacy, no data will be sent to the server) -> default
• Hide Only Sensitive Data (Sensitive cookies and storage will be filtered out, but other cookies and storage will be sent)
• Hide Nothing (All data will be sent to the server, including potentially sensitive information)

The "Hide Only Sensitive Data" uses a mix of regex matching for all cookie and storage values along with filtering based on Shannon entropy. On smaller strings, the entropy method might lead to false-positives on some shorter strings, so it is restricted to strings longer than 16 characters.

All of this filtering is handled by the browser extension itself. None of the sensitive data is sent to the server unless the user has selected the "Hide Nothing" option.

Screenshots

Dev Tools Panel

getCookies with "Hide All Cookies and Storage" checked

getCookies with "Hide Only Sensitive Data" checked

getCookies with "Hide Nothing" checked

[tedjames]

Wow! Incredible work!! 🙏

I'm pushing out a different release now which has taken some time to prepare. Lets get this in for the next release (maybe this weekend?)

If you don't mind, can you resolve any conflicts we have with staging branch today? Happy to tackle them as well later this week - traveling a bunch right now and it's been difficult to keep up with all the updates/PRs 😅

[thepushkarp]

Lets get this in for the next release (maybe this weekend?)

Sure thing. I have merged the latest staging branch and have resolved the merge conflicts so we're good on that regard.
Happy travelling!

[tedjames]

Nice!!! Amazing :)

Will review within the next few days and get this in for a release next Monday at the latest if all goes well!

[thepushkarp]

hey @tedjames did you get time to review this feature? lmk if you think we need to change something