Kirusshenkin/leash-firefox-extension

**Let Claude drive Firefox — on a short leash.**
Claude Code and Claude Desktop read pages, click, type and navigate in your Firefox
through an MCP bridge. A security policy written in Rust and compiled to WebAssembly
decides what is allowed — not the model.
**English** · Русский
---
Why Leash
Browser agents read untrusted pages, and prompt injection has no complete fix. Leash
assumes the worst: **Claude is treated as compromised the moment it reads a page**.
Every action is checked by code against rules the page cannot change, so a successful
injection still can't do serious harm.
- 🔒 **Allowlist only.** Claude works only on sites you allowed — exact origin, no wildcards.
Banking, payments, mail, password managers, cloud consoles, sign-in pages, messengers and
marketplaces are blocked out of the box.
- ✋ **You confirm what matters.** Form submits, purchases, deletions, downloads and moving data
between sites wait for your click in a separate Leash window that pages cannot fake.
- 🕵️ **Injection signs are surfaced.** Fake delimiters, SYSTEM: roles, chat markup and
"ignore previous instructions" are flagged; after that, every non-read action needs approval.
- 🔑 **No API key.** Leash plugs into the Claude you already use — Claude Code or Claude Desktop.
- 📴 **The extension never goes online.** No default host permissions, connect-src 'self';
its only channel out is native messaging to the local bridge.
How it works
Claude gets these tools:
| Tool | What it does |
|---|---|
| read_page | Structured snapshot of the active tab: numbered elements, roles, names, visible text |
| click · type_text · select_option | Act on an element from the snapshot |
| scroll · navigate · go_back | Move around allowed sites |
| list_tabs · switch_tab | Work across tabs (closed sites stay hidden) |
Quick start
> Use a separate Firefox profile without important logged-in services
> (about:profiles → *Create a New Profile*).
**1. Bridge** (macOS arm64/x86_64, Linux x86_64) — prebuilt binary from GitHub Releases:
The script checks SHA-256 against the release's SHA256SUMS, installs leash-host into
~/.local/bin (override with LEASH_BIN_DIR=…, pin a release with LEASH_VERSION=v…) and
registers it with Firefox. Verify where the binary came from:
**2. Connect Claude:**
For Claude Desktop, the installer prints a snippet for claude_desktop_config.json.
**3. Extension.** Until the add-on is on addons.mozilla.org: make build, then
about:debugging#/runtime/this-firefox → *Load Temporary Add-on…* → extension/manifest.json.
**4. Go.** Restart Firefox — the Leash sidebar (*View → Sidebar → Leash*) shows the bridge as
connected. Allow a site in Leash settings (Firefox asks for access when you save), then ask
Claude to do something there. It works in the active tab; steps show up in the sidebar.
Uninstall: ~/.local/bin/leash-host uninstall and claude mcp remove leash.
Build the bridge from source instead
A binary downloaded by hand through a browser is blocked by macOS Gatekeeper (it isn't
notarized); get.sh and source builds are not affected.
Security model
What is enforced
- **Site access** = an allowlist entry **and** a host permission granted by your click in
Firefox. Exact match on https, host and port. The built-in deny list (payments, mail,
password managers, cloud consoles, sign-in, government services, messengers and social
networks, marketplaces with saved cards) cannot be lifted. Banks come pre-filled in your own
deny list — add yours there. Access is checked before every action, and the content script
re-checks the document origin right before acting.
- **Confirmation** happens in a separate Leash window; buttons unlock after 0.8 s. Asked for: