Control a real Chrome browser to complete any task: fill forms, extract data, book flights.
Nothing to run from here
Domshell is installed from its publisher's own source and answers where it runs, so this marketplace is not in the path of a single call. There is no address here to send one to, and a panel that pretended otherwise would be showing you an answer we made up. Install it and call it from your own client — the Installation tab has the entry for each one.
93/100
trust score
14
downloads a day
local
runs on your machine
613
downloads in 30d
What it does
MCP server that gives AI agents Unix-style filesystem commands (ls, cd, grep, click, type) to drive Chrome. Single-tool interface, concurrent multi-agent isolation, per-lane tab groups.
Quickstart
# 1 — add it to Claude Code
claude mcp add --scope user domshell-mcp '--' npx -y @apireno/domshell
# 2 — ask your agent for something these tools do
# domshell_tabs, domshell_here, domshell_ls and 36 more
Domshell costs nothing on mcprush: there is no plan to choose here, no cap to set and nothing mcprush can bill you for.
Publishernot claimed
APAll 1 server
@apireno1 server
1 category
Collected from a public index. Nobody has claimed this account, so nothing here was written by its author — claim it if it is yours.
Installation
Where are you running it?
Every route below installs the same thing and ends at the same approval screen. This one runs on your machine: your client starts Domshell as a process under your own user, with your files and your network, so the tool surface below is what it can do to your computer rather than to a server somewhere else. Its scan result is on the Security tab — read the surface before you approve it.
Claude Codedeclared by this listing
This is a public server: you run it yourself and this marketplace is not in the path. You need Node.js — the current LTS (24) is the safe choice; npx comes with it. Claude Code registers it in one command; --scope user makes it available in every project. The '--' is in quotes so that PowerShell passes it on.
claude mcp add --scope user domshell-mcp '--' npx -y @apireno/domshellReconnect, or start a new session, and the tools appear in the model’s tool list.
Free on mcprush, and it runs from its publisher’s own package: this marketplace is not in the path, so there is no key of ours to hold and no card to add.
What it writes
One config entry your client uses to start the process locally. A local server runs with your file system and your network, which is why it is priced without metering.
What you approve
39 tools, with what each one reads, writes and reaches shown before you agree — the same list on every route above. Read the tool surface.
Tool surface
What the model actually sees. Descriptions are diffed on every release — see version history.
List all open browser tabs with their IDs, titles, URLs, and window info. Use this to find the right tab before switching. Equivalent to 'ls ~/tabs/'.
No parameter schema on file.
Jump to the active tab in the last focused Chrome window. Use this to quickly enter whichever tab the user is currently looking at, without needing to know the tab ID.
No parameter schema on file.
List children of the current directory. In the DOM tree: shows elements as files and directories. At the browser level (~): shows tabs/windows. Flags: -l Long format (more detail per element) --meta Show DOM properties (href, src, id) inline — great for extracting links…
No parameter schema on file.
Change directory — sets your scope for all subsequent commands (ls, find, grep, text all operate relative to current directory). Paths: 'main/form', '..', '~' (browser root), '~/tabs/<id>', '~/tabs/<pattern>', '%here%' (focused tab). When to cd: - cd into a SECTION (article, main, sidebar) to…
No parameter schema on file.
Print the current working directory path in the DOM tree.
No parameter schema on file.
Read detailed metadata about a DOM element: role, type, AX ID, DOM backend ID, value, child count, text content (textContent), visible text (innerText — only rendered text, respects CSS visibility), and outerHTML snippet.
No parameter schema on file.
Deep recursive search from the CURRENT DIRECTORY downward. Scope matters: cd into a section first, then find, to get only that section's elements (fewer, more relevant results). Returns full paths to matching elements. Key flags: --type ROLE Filter by AX role. Accepts exact roles (link,…
No parameter schema on file.
Search for elements matching a pattern. Matches against name, role, and value. Case-insensitive. By default, searches only IMMEDIATE children. Use recursive: true to search all descendants — this is almost always what you want for finding sections or elements by name. grep is the primary…
No parameter schema on file.
Show a tree view of the current directory in the DOM, displaying the hierarchy of elements with type prefixes [d]=directory, [x]=interactive, [-]=static.
No parameter schema on file.
Extract ALL text content from the current directory or a named child, including every descendant. Returns full textContent in a single call. The name parameter lets you read any child without cd'ing into it first: text paragraph_2994 Read a paragraph's text without cd'ing into it text…
No parameter schema on file.
Structured subtree extraction — returns the hierarchy of elements under the current directory or a named child, with roles, names, and values in one call. Think of it as 'tree' + 'cat' combined: you get the structure AND the content. Excellent for tables, lists, and nested sections. A single read…
No parameter schema on file.
Force re-fetch the Accessibility Tree. Use after page navigation or significant DOM changes. Note: the tree also auto-refreshes when changes are detected.
No parameter schema on file.
Compare the current AX tree against the snapshot taken before the last write/navigate action (click, type, submit, select, navigate, open, back, forward, scroll). Shows added, removed, and changed elements. Use after a click or form submission to see exactly what changed on the page instead of…
No parameter schema on file.
Evaluate a JavaScript expression in the tab context. Returns the result. WRITE TIER as of 2.0.8 — the expression runs via CDP Runtime.evaluate with no side-effect gate, so any JavaScript can mutate DOM/window/global state. Requires --allow-write, same as domshell_js. Use for one-off expressions…
No parameter schema on file.
List callable global JavaScript functions on the current page. Shows function name, arity (parameter count), and parameter names. Useful for discovering page APIs (e.g. MediaWiki's mw.config.get on Wikipedia). Examples: functions All non-standard window functions functions mw…
No parameter schema on file.
Re-run a command periodically and collect results. Useful for monitoring dynamic content changes within a single tool call instead of making N separate calls. Options: --interval N Seconds between runs (default: 2, min: 0.5) --times N Number of iterations (default: 5, max: 100)…
No parameter schema on file.
Iterate over command output lines. Runs a source command, splits output into lines, and for each line replaces {} in the action template and executes it. Capped at 50 items and 120 seconds. Separator is ' : ' (space-colon-space) to avoid conflicts with URL colons. Examples: for "find --type…
No parameter schema on file.
Save and run multi-command scripts. Scripts persist across service worker restarts. Subcommands: script list List saved scripts script save <name> cmd1 ; cmd2 Save commands (separated by ' ; ') script show <name> Show commands in a script script run <name>…
No parameter schema on file.
Run a command across multiple open tabs. Iterates over all non-chrome tabs (optionally filtered by title/URL pattern), switches into each, runs the command, and collects results. Restores the original tab when done. Options: --pattern FILTER Only tabs whose title or URL contains FILTER…
No parameter schema on file.
Extract all links under the current directory or a named child as a clean numbered list in [text](url) format. Purpose-built for link extraction — returns display text and URLs in one call. Examples: extract_links All links under current directory extract_links main -n 20 First…
No parameter schema on file.
Extract a table element as structured markdown or CSV. Reads all rows and cells, returns formatted output. First row is treated as the header. Examples: extract_table table_1234 Markdown table extract_table table_1234 --format csv CSV format extract_table table_1234 -n 10…
No parameter schema on file.
Click a DOM element. May trigger navigation, form submission, or page changes. The DOM tree auto-refreshes on the next command. After clicking: use domshell_ls or domshell_pwd to verify the page actually changed. Some clicks (like search buttons) may need a domshell_refresh to see updated…
No parameter schema on file.
Focus an input element. Use before 'domshell_type' to direct keyboard input to the right field.
No parameter schema on file.
Scroll the page or scroll a specific element into view. Use this when content is below the fold or when you need to reach elements not currently visible. Modes: scroll down [N] Scroll page down by N viewport heights (default: 1) scroll up [N] Scroll page up by N viewport heights…
No parameter schema on file.
Execute arbitrary JavaScript in the current tab and return the result. Use this for complex DOM queries, CSS selector extraction, or any operation that would take multiple DOMShell commands. The code runs in the page context with full DOM access. Promises are automatically awaited. Results are…
No parameter schema on file.
Type text into the currently focused element. Use domshell_focus first to target an input field. For search forms: after typing, you may need to either: 1. click the submit/search button, OR 2. type ' ' to simulate pressing Enter If the page doesn't navigate after form submission, use…
No parameter schema on file.
Navigate the current tab to a URL. Automatically rebuilds the accessibility tree after navigation completes. Requires a tab context (cd into a tab first). Use this to go to a specific website without opening a new tab.
No parameter schema on file.
Open a URL in a new tab and enter it (path becomes ~/tabs/<id>). Automatically builds the accessibility tree after page loads. Works from any location. After opening a page, a typical extraction workflow is: 1. open URL 2. find the section you need (find --type heading, or grep section_name…
No parameter schema on file.
Atomic form submission — focuses input, clears existing value, types new value, then submits (clicks button or presses Enter). Replaces the 3-step focus → type → click pattern in one reliable call. Examples: submit search_input 'machine learning' Type and press Enter submit…
No parameter schema on file.
Navigate back in browser history. Equivalent to the browser back button. Automatically refreshes the AX tree after navigation. Use this instead of domshell_navigate when returning to a previously visited page — it's faster (uses browser cache) and doesn't require remembering the URL.
No parameter schema on file.
Navigate forward in browser history. Only works after a 'back' command. Automatically refreshes the AX tree after navigation.
No parameter schema on file.
Close a tab. With no arguments, closes the current tab and returns to browser root. With a tab ID, closes that specific tab. Use after extracting data from a page to keep the tab count manageable.
No parameter schema on file.
Select an option from a <select> dropdown element. Matches by option value first, then by visible text (case-insensitive). Dispatches change and input events to trigger form updates. Examples: select language_dropdown en select country_select United States
No parameter schema on file.
Capture a PNG screenshot of the current tab. Returns the image for visual inspection. Useful for understanding page layout on unfamiliar sites — one screenshot can replace multiple exploration calls (tree, ls, find) by showing you exactly what the page looks like.
No parameter schema on file.
Wait for an element to appear in the AX tree. Polls the tree every 500ms until the element is found or timeout is reached. Use after clicks or navigation that trigger async content loading (SPAs, AJAX). Examples: wait results_list Wait for search results wait submit_btn…
No parameter schema on file.
Call a global JavaScript function by name. Arguments are auto-parsed as JSON if valid, otherwise passed as strings. Write-tier — requires --allow-write. Examples: call getCount call getMessage Agent call resetCount call setConfig {"key": "value"}
No parameter schema on file.
Check authentication status by examining cookies for the current page. Shows session cookies and expiry.
No parameter schema on file.
Report DOMShell runtime identity: MCP server version, bridged extension version (from HELLO handshake), whether an extension is currently connected, and connection timestamp. Use this at drive startup to pin-verify what you're actually talking to, and again on any surprising failure (silent…
No parameter schema on file.
Run DOMShell commands to browse and read web pages — the primary DOMShell interface. DOMShell maps a page
No parameter schema on file.
Free
$0 forever
- Every tool, no call limit
- No card, and mcprush charges nothing for it
- Source published under MIT
- Runs on your machine — nothing of it reaches our gateway
- Nothing to cap, because mcprush bills nothing
What counts against your monthly calls
| Tool | Unit | Calls used | Out of the allowance |
|---|
Nothing here is billable: mcprush charges nothing to install Domshell or to call it, at any volume.
Call allowance · this installenforced at the gateway
Monthly allowance, in calls
—
—
Alert at 80% · then the tool returns a normal MCP error
Used this month: —
ATrust score 93 / 100
Release 2.0.10 · scanned 14 Oct 2026
Two independent axes, because powerful and malicious are different questions. The grade is threat only. The capability level is blast radius, and it is never a penalty on the grade — it is priced as one subtract-only term in the score, where you can see it.
Threat score100
Client score93
Findings0 threat · 13 capability
Capabilityhigh
Coveragesource
Verificationrepo
Surface digest31c7db505966a37c5ae3ebc33204020e238ae5054b341f6fe1d418bac0eb5b9f
Score vectorthreat 100 → client 93
| Term | Level | What it prices | Points |
|---|---|---|---|
| capability-exposure | high | capability blast radius (high) — client exposure if the model is manipulated | −6 |
| verification-discount | repo | publisher verification (public source) — no provenance, but the source is public and inspectable | −1 |
| coverage-honesty | source | inspection depth (source) — how much of the target the scan could see | −0 |
score = clamp(round(threatScore − E_cap − E_ver − E_cov), 0, 100). No model, no opinion, no network call at scoring time: the same methodology version against the same bytes always produces this number, and every line above is a field of the report rather than a summary of it.
What the scan could actually read
A grade is only as meaningful as its coverage, so the scanner publishes its own depth before it publishes its result.
Tool surfaceread
Implementation sourceread
Package metadataread
Live transportnot available
Tools were statically extracted from the published source (39 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".
21 of the 39 recovered tools are registered only when GRANULAR holds (dist/index.js:746) — typically when a key or option is configured. They are part of the server's surface and were analysed; a server started without that configuration exposes none of the recovered tools.
15 of the 39 recovered tools are registered only when ALLOW_WRITE holds (dist/index.js:908) — typically when a key or option is configured. They are part of the server's surface and were analysed; a server started without that configuration exposes none of the recovered tools.
1 of the 39 recovered tools are registered only when ALLOW_SENSITIVE holds (dist/index.js:1005) — typically when a key or option is configured. They are part of the server's surface and were analysed; a server started without that configuration exposes none of the recovered tools.
2 of the 39 recovered tools are registered only when !sessionId && isInitializeRequest(req.body) holds (dist/index.js:1262) — typically when a key or option is configured. They are part of the server's surface and were analysed; a server started without that configuration exposes none of the recovered tools.
Capability — what it could do if the model were manipulated
Tags derived from each tool’s schema and the implementation, not from what the tool calls itself. high is the level these add up to.
No tool is registered unconditionally · (1) 21 only when GRANULAR holds (dist/index.js:746) · (2) 15 only when ALLOW_WRITE holds (dist/index.js:908) · (3) 1 only when ALLOW_SENSITIVE holds (dist/index.js:1005) · (4) 2 only when !sessionId && isInitializeRequest(req.body) holds (dist/index.js:1262) — typically when a key or option is configured. All 39 are in the table below and were analysed; the conditional ones are marked.
| Tool | Capability tags | Why the tag was assigned |
|---|---|---|
| domshell_tabs conditional (1) | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| domshell_here conditional (1) | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| domshell_ls conditional (1) | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| domshell_cd conditional (1) | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| domshell_pwd conditional (1) | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| domshell_cat conditional (1) | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| domshell_find conditional (1) | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| domshell_grep conditional (1) | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| domshell_tree conditional (1) | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| domshell_text conditional (1) | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| domshell_read conditional (1) | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| domshell_refresh conditional (1) | untrusted-input | untrusted-input: keyword "fetch", declares openWorldHint: true (interacts with entities outside the server) |
| domshell_diff conditional (1) | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| domshell_eval conditional (1) | code-execexternal-sink | code-exec: keyword "eval" in tool name; external-sink: declares readOnlyHint: false, destructiveHint: true, openWorldHint: true |
| domshell_functions conditional (1) | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| domshell_watch conditional (1) | code-execexternal-sink | code-exec: parameter "command"; external-sink: declares readOnlyHint: false, destructiveHint: true, openWorldHint: true |
| domshell_for conditional (1) | external-sink | external-sink: declares readOnlyHint: false, destructiveHint: true, openWorldHint: true |
| domshell_script conditional (1) | code-execexternal-sink | code-exec: parameter "command"; external-sink: declares readOnlyHint: false, destructiveHint: true, openWorldHint: true |
| domshell_each conditional (1) | code-execexternal-sink | code-exec: parameter "command"; external-sink: declares readOnlyHint: false, destructiveHint: true, openWorldHint: true |
| domshell_extract_links conditional (1) | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| domshell_extract_table conditional (1) | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| domshell_click conditional (2) | external-sink | external-sink: declares readOnlyHint: false, destructiveHint: true, openWorldHint: true |
| domshell_focus conditional (2) | external-sink | external-sink: declares readOnlyHint: false, destructiveHint: true, openWorldHint: true |
| domshell_scroll conditional (2) | external-sink | external-sink: declares readOnlyHint: false, destructiveHint: true, openWorldHint: true |
| domshell_js conditional (2) | external-sink | external-sink: declares readOnlyHint: false, destructiveHint: true, openWorldHint: true |
| domshell_type conditional (2) | external-sink | external-sink: declares readOnlyHint: false, destructiveHint: true, openWorldHint: true |
| domshell_navigate conditional (2) | external-sink | external-sink: declares readOnlyHint: false, openWorldHint: true |
| domshell_open conditional (2) | external-sink | external-sink: declares readOnlyHint: false, openWorldHint: true |
| domshell_submit conditional (2) | external-sink | external-sink: declares readOnlyHint: false, destructiveHint: true, openWorldHint: true |
| domshell_back conditional (2) | external-sink | external-sink: declares readOnlyHint: false, openWorldHint: true |
| domshell_forward conditional (2) | external-sink | external-sink: declares readOnlyHint: false, openWorldHint: true |
| domshell_close conditional (2) | external-sink | external-sink: declares readOnlyHint: false, destructiveHint: true, openWorldHint: true |
| domshell_select conditional (2) | external-sink | external-sink: declares readOnlyHint: false, destructiveHint: true, openWorldHint: true |
| domshell_screenshot conditional (2) | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| domshell_wait conditional (2) | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| domshell_call conditional (2) | external-sink | external-sink: declares readOnlyHint: false, destructiveHint: true, openWorldHint: true |
| domshell_whoami conditional (3) | external-sink | external-sink: declares readOnlyHint: false, destructiveHint: true, openWorldHint: true |
| domshell_about conditional (4) | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| domshell_execute conditional (4) | untrusted-inputcode-execexternal-sink | untrusted-input: keyword "browse"; code-exec: parameter "command"; external-sink: declares readOnlyHint: false, destructiveHint: true, openWorldHint: true |
Toxic-flow graph
The lethal trifecta, checked as a graph rather than as a checklist: untrusted input, a sensitive source and an external sink have to meet before there is a path worth worrying about.
flow-1
Untrusted input can drive an external action even though no sensitive source is exposed.
Supply chain and provenance
Integrityfirst-seen
Surface digest31c7db505966a37c
Scanned2026-10-14
This is the first scan of this surface here, so there is nothing yet to compare it against.
Every result on this tab comes from one deterministic pass over the published package — offline, rule by rule, and auditable line by line above. Same methodology version, same bytes, same score.
Release history
Always latest — the install command names no version, so it installs the newest release when it runs; the current release on file is 2.0.10. Pin a release below and the command asks for exactly that one.
2.0.10
undated
latestNo release note was published with this version.
—
no reviews yet
Who can review
One review per account, from a signed-in account that does not publish this listing. Nothing else is asked — you can say what you think before you install it. Publishers can reply once per review, and a review can be edited or deleted by whoever wrote it.
Sign in to write one
Any signed-in account that does not publish Domshell can review it, once — before installing it or after. A review from an account that has installed it is marked as one.
No reviews yet
Nobody has reviewed this listing. The rating on the card is the mean of the reviews written here and nothing else, so there is no rating until somebody writes the first — which takes a signed-in account that does not publish it, and nothing else.