Name: pilotfish (local)
Author: gai-ventures

pilotfish (local) MCP

A real Chromium on your machine for any MCP agent: ref-based tools, evidence per action, no API key.

Grade A Local · stdio No auth needed 16 tools v0.1.50 · 15 Nov 2026 MIT

No reviews yet by gai-venturesnpm 10,275 Runs on your machine, nothing hosted

93/100

trust score

587

downloads a day

local

runs on your machine

10k

downloads in 30d

What it does

A real Chromium on your machine for any MCP agent: ref-based tools, evidence per action, no API key.

Quickstart

# 1 — add it to Claude Code
claude mcp add --scope user pilotfish-local-mcp '--' npx -y @gaiventures/pilotfish-mcp

# 2 — ask your agent for something these tools do
#   browser_navigate, browser_snapshot, browser_click and 13 more

pilotfish (local) costs nothing on mcprush: there is no plan to choose here, no cap to set and nothing mcprush can bill you for.

Publisher

gai-ventures2 servers

1 category

All 2 servers

Installation

Where are you running it?

Every route below installs the same thing and ends at the same approval screen. This one runs on your machine: your client starts pilotfish (local) as a process under your own user, with your files and your network, so the tool surface below is what it can do to your computer rather than to a server somewhere else. Its scan result is on the Security tab — read the surface before you approve it.

Claude Codedeclared by this listing

This is a public server: you run it yourself and this marketplace is not in the path. You need Node.js — the current LTS (24) is the safe choice; npx comes with it. Claude Code registers it in one command; --scope user makes it available in every project. The '--' is in quotes so that PowerShell passes it on.

claude mcp add --scope user pilotfish-local-mcp '--' npx -y @gaiventures/pilotfish-mcp

Reconnect, or start a new session, and the tools appear in the model’s tool list.

Free on mcprush, and it runs from its publisher’s own package: this marketplace is not in the path, so there is no key of ours to hold and no card to add.

What it asks of you

Nothing is required, but it can take PILOTFISH_HEADLESS (1 hides the browser window (sign-ins and CAPTCHAs then cannot be done by hand)), PILOTFISH_ALLOWED_HOSTS (Comma-separated hostname globs the browser may visit (default: any public host)), PILOTFISH_SECRETS (JSON of values typed as {{name}} placeholders, never shown to the model, e.g. {"pw": "..."}) if you want to set them.

What it writes

One config entry your client uses to start the process locally. A local server runs with your file system and your network, which is why it is priced without metering.

What you approve

16 tools, with what each one reads, writes and reaches shown before you agree — the same list on every route above. Read the tool surface.

Tool surface

What the model actually sees. Descriptions are diffed on every release — see version history.

Only tools that write or reach the network

Open an http(s) URL in the current tab. Returns evidence and a snapshot of the visible screen (elements carry refs like e12), with counts of what is above and below. Words like cheapest, latest, highest-rated or most mean the site's own sort or tab for that order (a list's default order is usually something else, e.g. 'Best' or 'Featured'): apply it, then read the top. Over several sites, finish o

Parameter	Type	Required	Notes
url	string	yes	Absolute http(s) URL
snapshot	boolean	no	Default true. false: no page snapshot, only what happened (title, counts). Only when this same reply also reads the page with browser_query and you will not act on it; keep it for a page you have not

The current page as a compact tree of headings, text and elements with refs (e12) to act on: three screens around the viewport, or everything with whole_page. Refs stay valid while their element is on the page.

Parameter	Type	Required	Notes
whole_page	boolean	no	—

Click an element by ref. Refuses with a reason (obscured, stale, not visible) instead of clicking the wrong thing. Returns evidence of what changed.

Parameter	Type	Required	Notes
ref	string	yes	From the latest snapshot, e.g. "e12" or "f1e3"

Type into an input, textarea or editable element by ref, replacing its text. Returns evidence.

Parameter	Type	Required	Notes
ref	string	yes	From the latest snapshot, e.g. "e12" or "f1e3"
text	string	yes	—
submit	boolean	no	Press Enter afterwards

Choose option(s) of a <select> by label or value. Returns evidence.

Parameter	Type	Required	Notes
ref	string	yes	From the latest snapshot, e.g. "e12" or "f1e3"
values	array	yes	—

Press a key or shortcut on the focused element. Returns evidence.

Parameter	Type	Required	Notes
key	string	yes	e.g. "Enter", "Escape", "Tab", "ArrowDown", "Control+a"

Scroll about one screen. Returns evidence and the newly visible elements.

Parameter	Type	Required	Notes
direction	string	yes	—

JPEG of the current viewport. Prefer browser_snapshot (cheaper, has refs); use this when layout or images matter.

Takes no parameters.

Readable text of the page (PDFs too), secrets masked, without refs. To read a few values or a list, browser_query is far smaller.

Parameter	Type	Required	Notes
max_chars	integer	no	Default 20000. Ask for less when the start of the page is enough.
selector	string	no	CSS selector: only the first match's text, e.g. "main" or "#results"

Read just the values you need (prices, counts, titles, a results list) with a read-only JavaScript expression returning JSON (at most 4000 characters): the cheapest way to read, far smaller than browser_get_text or a snapshot. It runs in a world of its own where clicks, typing, submits and network writes are refused.

Parameter	Type	Required	Notes
expression	string	yes	e.g. [...document.querySelectorAll('.result')].slice(0,10).map(e => e.innerText)

Refs of elements anywhere on the page, outside the visible screen too, by the words they show or are labelled with, best match first. Separate several targets by commas.

Parameter	Type	Required	Notes
query	string	yes	Words naming the element(s), e.g. "Sort by" or "price max input, Go button"

Several steps in order in one call, e.g. fill a form's fields and submit it; each gets the same checks as its own tool. Stops at the first that fails, or after one that moves the page to another address (later refs would belong to the old page). Returns a line per step and the evidence and visible screen after the last one run.

Parameter	Type	Required	Notes
actions	array	yes	—

When a result says NEEDS A PERSON (a sign-in, a one-time code or 2FA, a device approval, a CAPTCHA), tell the user in your reply what the page needs and that the pilotfish browser window is open on it; when they have done it there (or right after asking), call this and carry on: it waits until the page has moved on, then returns it. BLOCKED and STOP mean the site cannot be continued that way.

Parameter	Type	Required	Notes
timeout_s	integer	no	Default 300

Wait 0.5-10 seconds (until/gone: up to that, returning once the text appears or goes), then return what changed. Only for a page still loading or saying it is working: actions already wait for the requests they start.

Parameter	Type	Required	Notes
seconds	number	yes	—
until	string	no	Return once the page shows this text
gone	string	no	Return once this text is gone

List the open tabs (the current one is marked). switch_to makes another tab current and returns its snapshot.

Parameter	Type	Required	Notes
switch_to	string	no	Tab id to work in from now on, e.g. "t2"

Only to start over: closes the browser, and the next call starts a fresh one (cookies and logins are gone). It closes by itself when the client disconnects.

Takes no parameters.

Free

$0 forever

Every tool, no call limit
No card, and mcprush charges nothing for it
Source published under MIT
Runs on your machine — nothing of it reaches our gateway
Nothing to cap, because mcprush bills nothing

Nothing here is billable: mcprush charges nothing to install pilotfish (local) or to call it, at any volume.

ATrust score 93 / 100

Release 0.1.50 · scanned 15 Nov 2026

Two independent axes, because powerful and malicious are different questions. The grade is threat only. The capability level is blast radius, and it is never a penalty on the grade — it is priced as one subtract-only term in the score, where you can see it.

Threat score100

Client score93

Findings2 threat · 0 capability

Capabilityhigh

Coveragesource

Verificationrepo

Surface digest886bd0af85f66f2968ec06fcc871e0c652cc5bb20b59e05443aafa9a4f6c74fb

Score vectorthreat 100 → client 93

Term	Level	What it prices	Points
capability-exposure	high	capability blast radius (high) — client exposure if the model is manipulated	−6
verification-discount	repo	publisher verification (public source) — no provenance, but the source is public and inspectable	−1
coverage-honesty	source	inspection depth (source) — how much of the target the scan could see	−0

score = clamp(round(threatScore − E_cap − E_ver − E_cov), 0, 100). No model, no opinion, no network call at scoring time: the same methodology version against the same bytes always produces this number, and every line above is a field of the report rather than a summary of it.

What the scan could actually read

A grade is only as meaningful as its coverage, so the scanner publishes its own depth before it publishes its result.

Tool surfaceread

Implementation sourceread

Package metadataread

Live transportnot available

Tools were statically extracted from the published source (1 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".

Capability — what it could do if the model were manipulated

Tags derived from each tool’s schema and the implementation, not from what the tool calls itself. high is the level these add up to.

Tool	Capability tags	Why the tag was assigned
pilotfish	no tags

Toxic-flow graph

The lethal trifecta, checked as a graph rather than as a checklist: untrusted input, a sensitive source and an external sink have to meet before there is a path worth worrying about.

The public result for this release does not print the flow graph, so there is nothing to show here. That is not the same as "no paths were found": what the scan did read is above, under coverage.

Supply chain and provenance

Integrityfirst-seen

Surface digest886bd0af85f66f29

Scanned2026-11-15

This is the first scan of this surface here, so there is nothing yet to compare it against.

Every result on this tab comes from one deterministic pass over the published package — offline, rule by rule, and auditable line by line above. Same methodology version, same bytes, same score.