MCP server
Let Claude Code, Codex, Cursor, and other AI apps read and act on your pages in 1zero Browser.
The MCP server lets other AI apps drive your own 1zero Browser: read and act on the pages you have open, signed in as you, and arrange your tabs and folders. They get the same tools as the AI chat, plus a few of their own, such as waiting for a page to load and searching your browsing history.
It's off by default, and while it's off nothing listens.
Turning it on
Turn AI on in Settings → AI with Enabled.
In Settings → AI → MCP server, switch on Let apps use the browser.
Under Connect an app, press Connect next to the app. It's added to that app's MCP servers for every project, and your other servers stay as they are.
Start a new session in the app (quit and reopen Claude Desktop) so it loads the browser's tools.
Connect an app sets up Claude Code, Codex, Cursor, VS Code, Gemini CLI, and Claude Desktop. Each row says whether the app is connected, set up with an old address (press Update), or not on this computer (press Copy config to set it up by hand). For any other app that speaks MCP over HTTP, Other apps copies the address and token.
Connected now lists the apps that have used the browser since it started.
Where the tools work
An app works on the tab in view in your front window, and follows you as you switch tabs. It can also pick a tab of its own and stay on it. Incognito windows are never reached.
Approvals
| Approvals | Does |
|---|---|
| Ask first | The default. Clicks, typing, key presses, going to a page, and closing tabs ask you in the Dynamic Island, naming the app. Scripts and sign-ins ask in a dialog that shows the code or the account. |
| Don't ask | Nothing asks, except signing in with a saved login, which always does |
An approval you don't answer in 3 minutes is declined.
The switches in Settings → AI → What AI can do apply to apps too: with Act on pages off, an app can only read. Two more switches are only for apps, both off by default:
- Browsing history: apps can search the pages you've visited.
- AI memory: apps can read the facts in AI memory. They can't change them.
Keeping it safe
- The server only listens on your own computer, and a web page can't reach it.
- Every app needs the Access token. Anyone with it can use your browser while it's open. New token… makes another, and the old one stops working at once. Connected apps are updated to the new token.
- Apps never see a saved password. When a sign-in is allowed, the browser fills the login itself.
- The Port is fixed so apps can find it again. If another app or another profile already uses it, Settings says so: pick another.