High Risk
    0.4.1

    io.github.xidik12/oculo

    AI-powered native browser with 12 MCP tools. ~30 tokens per page.

    Manifest20
    Lineage88
    Safety20
    Rank#0
    xidik12mcp-registryBrowser automationLast scanned Aug 17, 2026, 02:49 AMhttps://github.com/xidik12/oculo

    Security Findings

    Tool name/behavior mismatch

    act: The handler supports an 'evaluate' action that executes arbitrary JavaScript expressions in the page context via webContents.executeJavaScript, which is not mentioned in the tool's description's action list (click, navigate, scroll, press key, hover, type, login).

    Tools out of server's stated scope

    shell: The server is described as an 'AI-powered native browser,' but the shell tool executes arbitrary system shell commands (ls, npm, git, node, python), which is outside the browser automation domain.

    Missing permission declaration

    Server declares no permissions across 18 tools

    Dangerous parameter surface

    1 tool(s) expose a command-execution parameter: shell.command

    Releaser has low repo tenure

    Release author 'xidik12' has no commits in the repo older than 30d before the release

    Tools

    18 tools exposed by this MCP server

    18 high risk

    abort

    Cancel a pending tool call by callId, or pass callId="all" to cancel everything.

    High Risk
    bin/oculo-mcp.mjs

    act

    Perform an action in Oculo browser: click, navigate, scroll, press key, hover, type, login. Elements found by ref (from a11y snapshot), text, role, label, placeholder, or CSS selector. After click/navigate/back/forward/reload, returns fresh ref-tagged snapshot. Use newTab with background=true to open tabs without switching, then use tabId to run actions in parallel.

    High Risk
    bin/oculo-mcp.mjs

    devtools

    DevTools: console, inspect, evaluate, errors, performance, network, dom.

    High Risk
    src/main/ai/agent.ts

    fill

    Fill form fields in Oculo browser by label, placeholder, or data-placeholder text. Handles text, select, checkbox, textarea, and contenteditable (DraftJS, ProseMirror). Use visible labels as keys.

    High Risk
    bin/oculo-mcp.mjs

    learn

    Save a lesson for future sessions. Call when the user corrects you or you discover how a website works.

    High Risk
    src/main/ai/agent.ts

    lens

    Visual analysis of the current page via screenshot. Describe what you see or answer questions about the page visually.

    High Risk
    bin/oculo-mcp.mjs

    media

    Generate images (Nano Banana 2 / DALL-E 3) or videos (Veo 3.1) via Oculo. Returns saved file path. Supports image-to-image editing with reference image.

    High Risk
    bin/oculo-mcp.mjs

    page

    Describe the current page in Oculo browser. Default: compact (~30-80 tokens). Use detail="a11y" for ref-tagged accessibility tree — interactive elements get [ref=e1],[ref=e2]... refs usable in act tool. Use detail="markdown" for full article content as clean markdown.

    High Risk
    bin/oculo-mcp.mjs

    preview

    Pre-fetch a URL without navigating. Returns page description without leaving current page.

    High Risk
    bin/oculo-mcp.mjs

    read

    Extract structured data from the page in Oculo browser (search results, tables, lists, articles).

    High Risk
    bin/oculo-mcp.mjs

    research

    Deep web research on a topic. Opens multiple tabs, reads pages, synthesizes findings.

    High Risk
    bin/oculo-mcp.mjs

    run

    PREFERRED for any task with 2+ actions. Executes a multi-step pipeline in a SINGLE call — use this instead of multiple act/fill calls. Example — post on X: run({steps:[{act:{action:"navigate",url:"https://x.com/compose/post"}},{wait:{timeout:2000}},{act:{action:"type",text:"Hello world",role:"textbox"}},{act:{action:"click",text:"Post",role:"button"}}]}). Each step is an object with exactly ONE key: page, act, fill, read, wait, or if. Cached for replay. Manage cached workflows: run({manage:"list"}) or run({manage:"delete", workflow:"id"}).

    High Risk
    bin/oculo-mcp.mjs

    shell

    Execute a shell command (ls, npm, git, node, python, etc.) via Oculo and return stdout+stderr. Non-interactive only.

    High Risk
    bin/oculo-mcp.mjs

    status

    List all pending tool calls with their callId, toolName, and elapsed time.

    High Risk
    bin/oculo-mcp.mjs

    tabs

    List all open browser tabs with their URLs and titles.

    High Risk
    bin/oculo-mcp.mjs

    translate

    Translate page content or specific text to another language.

    High Risk
    bin/oculo-mcp.mjs

    webmcp_call

    Call a WebMCP tool registered by the current page. Use webmcp_list first to discover available tools.

    High Risk
    bin/oculo-mcp.mjs

    webmcp_list

    Discover WebMCP tools registered by the current page via navigator.modelContext.registerTool() or <form toolname="..."> elements. Returns list of available page-declared tools.

    High Risk
    bin/oculo-mcp.mjs

    Versions

    1
    • 0.4.1
      Scanned Aug 17, 2026, 02:49 AM20
      High Risk