An AI agent can control a browser through an MCP server: the server exposes browser actions such as opening pages, clicking, typing and reading content as tools the model can call. The most direct open-source option in this catalog is Playwright MCP, published by microsoft under Apache-2.0. It gives LLM agents browser automation through structured accessibility snapshots, so the model reads the page as text and does not need screenshots or a vision model. This tutorial walks through a minimal setup and the points to watch before you let an agent act on live websites.

What you need before you start

  • A host application that supports MCP clients, such as an agent framework or a desktop assistant with MCP configuration.
  • Node.js installed, since Playwright MCP runs as a Node-based server.
  • An LLM the host can call. The browser server does not supply the model.
  • A clear task with a bounded set of sites the agent should visit.

The MCP servers category in the MCP servers catalog lists several options. Browser-focused entries include browser-use, a Python library for AI browser agents under MIT that also offers a hosted Browser Use Cloud with stealth browsers and an agent API, and apify-mcp-server, which lets agents run ready-made scrapers and automation tools from the Apify Store under MIT.

Step 1: Register the browser server with your host

Most MCP clients use a JSON configuration block that names the server and the command that starts it. For Playwright MCP, the entry points the host at the Playwright MCP package, which the host launches as a subprocess. Check the server's own README in its repository for the exact package name and arguments, because these change between releases.

Keep the configuration in version control so you can review changes to which servers an agent can reach.

Step 2: Confirm the tools are exposed

Start the host and list the tools the server registers. You should see browser actions for navigation, snapshot reading, clicking and typing. If the list is empty, the server did not start: look at the host logs and confirm Node.js is on the path.

Step 3: Run a read-only test first

Before any form submission or login, give the agent a read-only task, for example: open a public documentation page and report its main heading. This verifies that snapshots come back, that navigation works and that the model is interpreting the accessibility tree correctly.

Step 4: Scope the task and the sites

Write the task as a specific goal with explicit limits:

  • Name the domains the agent may open.
  • State what it must not do, such as submitting payment forms.
  • Set a stopping condition so the loop cannot run indefinitely.

Step 5: Add a human approval step for actions with effects

Reading pages is low risk. Clicking buttons that submit data, change account settings or send messages is not. Route those actions through an explicit confirmation step in your host so a person sees the intended action before it runs.

Step 6: Log every tool call

Keep a record of each navigation and each click with its timestamp and the page it occurred on. Logs make it possible to reconstruct what the agent did and to find failures when a task goes wrong.

What to watch out for

Page content is untrusted input

Web pages can contain text written to manipulate the model, such as instructions to ignore the user's task. Treat everything the agent reads from a page as data, not as commands, and keep high-impact actions behind confirmation.

Authentication and credentials

Do not paste passwords into prompts. Use a dedicated browser profile or test accounts with the minimum permissions needed. Be aware that a browser session that is already logged in gives the agent the same access as you.

Scrapers and data collection

Browser agents overlap with scraping. Scrapling, an adaptive web scraping framework under BSD-3-Clause, and apify-mcp-server target data extraction at scale. Before collecting data, check each site's terms and robots rules, and keep request volume modest.

Cloud versus local execution

Local browsers keep cookies and page content on your machine. Hosted services such as Browser Use Cloud run browsers elsewhere. Decide which data may leave your environment before you choose one.

Licenses

Check the license of every server you wire in. Playwright MCP is Apache-2.0, browser-use is MIT, and some related projects such as XHS-Downloader, under GPL-3.0, carry copyleft terms that matter if you redistribute code.

Other agent-browser projects to know

Broader research and monitoring agents such as gpt-researcher, an Apache-2.0 autonomous research agent that works with many LLM providers, and UI-TARS-desktop, a Apache-2.0 multimodal agent stack from bytedance, take a different approach that relies on vision or research pipelines. worldmonitor, under AGPL-3.0, is a situational awareness dashboard rather than a browser control server. Use the developer tools and libraries catalogs to compare more options.

Recommendation

For most teams starting out, begin with Playwright MCP for its structured snapshots and Apache-2.0 license, run read-only tasks first, scope domains tightly and require approval for any action with side effects. Add logging from the first run. Move to a broader stack only once that baseline works reliably.