io.github.xidik12/oculo
AI-powered native browser with 12 MCP tools. ~30 tokens per page.
- Created
- 8 months ago
- Last commit
- 3 months ago
- Latest release
- v0.4.48 months ago
Security Findings
Tool name/behavior mismatch
MaliciousScanneract: The handler supports an 'evaluate' action that executes arbitrary JavaScript expressions in the page context via webContents.executeJavaScript, which is not mentioned in the tool's description's action list (click, navigate, scroll, press key, hover, type, login).
Tools out of server's stated scope
MaliciousScannershell: The server is described as an 'AI-powered native browser,' but the shell tool executes arbitrary system shell commands (ls, npm, git, node, python), which is outside the browser automation domain.
Missing permission declaration
SuspiciousScannerServer declares no permissions across 18 tools
Dangerous parameter surface
SuspiciousScanner1 tool(s) expose a command-execution parameter: shell.command
Releaser has low repo tenure
SuspiciousLineageRelease author 'xidik12' has no commits in the repo older than 30d before the release
Tools
18 tools exposed by this MCP server
act
Perform an action in Oculo browser: click, navigate, scroll, press key, hover, type, login. Elements found by ref (from a11y snapshot), text, role, label, placeholder, or CSS selector. After click/navigate/back/forward/reload, returns fresh ref-tagged snapshot. Use newTab with background=true to open tabs without switching, then use tabId to run actions in parallel.
shell
Execute a shell command (ls, npm, git, node, python, etc.) via Oculo and return stdout+stderr. Non-interactive only.
abort
Cancel a pending tool call by callId, or pass callId="all" to cancel everything.
devtools
DevTools: console, inspect, evaluate, errors, performance, network, dom.
fill
Fill form fields in Oculo browser by label, placeholder, or data-placeholder text. Handles text, select, checkbox, textarea, and contenteditable (DraftJS, ProseMirror). Use visible labels as keys.
learn
Save a lesson for future sessions. Call when the user corrects you or you discover how a website works.
lens
Visual analysis of the current page via screenshot. Describe what you see or answer questions about the page visually.
media
Generate images (Nano Banana 2 / DALL-E 3) or videos (Veo 3.1) via Oculo. Returns saved file path. Supports image-to-image editing with reference image.
page
Describe the current page in Oculo browser. Default: compact (~30-80 tokens). Use detail="a11y" for ref-tagged accessibility tree — interactive elements get [ref=e1],[ref=e2]... refs usable in act tool. Use detail="markdown" for full article content as clean markdown.
preview
Pre-fetch a URL without navigating. Returns page description without leaving current page.
read
Extract structured data from the page in Oculo browser (search results, tables, lists, articles).
research
Deep web research on a topic. Opens multiple tabs, reads pages, synthesizes findings.
run
PREFERRED for any task with 2+ actions. Executes a multi-step pipeline in a SINGLE call — use this instead of multiple act/fill calls. Example — post on X: run({steps:[{act:{action:"navigate",url:"https://x.com/compose/post"}},{wait:{timeout:2000}},{act:{action:"type",text:"Hello world",role:"textbox"}},{act:{action:"click",text:"Post",role:"button"}}]}). Each step is an object with exactly ONE key: page, act, fill, read, wait, or if. Cached for replay. Manage cached workflows: run({manage:"list"}) or run({manage:"delete", workflow:"id"}).
status
List all pending tool calls with their callId, toolName, and elapsed time.
tabs
List all open browser tabs with their URLs and titles.
translate
Translate page content or specific text to another language.
webmcp_call
Call a WebMCP tool registered by the current page. Use webmcp_list first to discover available tools.
webmcp_list
Discover WebMCP tools registered by the current page via navigator.modelContext.registerTool() or <form toolname="..."> elements. Returns list of available page-declared tools.
Versions
1- 0.4.1Scanned Oct 22, 2026, 11:54 AMHigh