Pantheon-Security/chrome-mcp-secure

**Enterprise-grade Chrome automation for AI agents with compliance-ready logging**
Enterprise Features • Compliance Logging • Security Features • Quick Start • Docker Deploy
---
Enterprise Ready
**Built for corporate environments** where security, compliance, and auditability are non-negotiable.
| Requirement | Solution |
|-------------|----------|
| **Audit Trails** | Hash-chained audit logs with tamper detection |
| **SIEM Integration** | CEF (Splunk, ArcSight, QRadar) + Syslog (RFC 5424) |
| **Credential Security** | Post-quantum encryption (ML-KEM-768 + ChaCha20-Poly1305) |
| **Data Protection** | Auto-redaction of PII in screenshots and logs |
| **Session Control** | Configurable timeouts, auto-expiry, inactivity lockout |
| **Access Control** | Token-based authentication with brute-force protection |
| **Compliance Logging** | OWASP-compliant event categories, correlation IDs |
Compliance Standards Support
| Standard | Coverage |
|----------|----------|
| **SOC 2 Type II** | Audit logging, access controls, encryption at rest |
| **GDPR** | Data minimization, right to erasure, audit trails |
| **PCI DSS** | Credential protection, access logging, encryption |
| **HIPAA** | Audit controls, access management, encryption |
---
Compliance Logging
**SIEM-ready logging** in industry-standard formats. Every tool execution, credential access, and security event is logged.
Output Formats
| Format | Use Case | Example |
|--------|----------|---------|
| **CEF** | Splunk, ArcSight, QRadar | CEF:0\|Pantheon-Security\|Chrome-MCP-Secure\|2.3.0\|... |
| **Syslog** | Centralized logging (RFC 5424) | 1 2025-12-16T10:30:00Z ... |
| **JSONL** | Elastic, custom pipelines | {"timestamp":"...","category":"audit",...} |
Event Categories (OWASP-Compliant)
- authentication - Login attempts, session creation
- authorization - Access control decisions
- credential - Vault operations (store, retrieve, delete)
- audit - Tool executions with timing
- security - Rate limits, injection attempts, anomalies
- data_access - Sensitive data retrieval
Quick Configuration
Example CEF Output
---
> **Security-hardened fork** of lxe/chrome-mcp
> Maintained by Pantheon Security
---
Real-World Results
> **"We used this MCP for hours building out our security dashboard - the reliability was incredible. The amount of work we produced was huge compared to manual browser interaction."**
> — Pantheon Security team
Production Tested
| Metric | Result |
|--------|--------|
| **Session Duration** | 4+ hours continuous use |
| **Stability** | Zero crashes or disconnects |
| **Credential Security** | All logins encrypted, auto-wiped |
| **Productivity Gain** | 10x faster than manual browser work |
This isn't just a security enhancement - it's a **reliable workhorse** for AI-assisted browser automation. When you need Claude to interact with web apps for extended sessions, this MCP delivers.
---
Security Features
Core Security (v2.1.0)
| Feature | Description |
|---------|-------------|
| **Post-Quantum Encryption** | ML-KEM-768 + ChaCha20-Poly1305 hybrid |
| **Secure Credential Vault** | Encrypted at rest, auto-wiped from memory |
| **Memory Scrubbing** | Zeros sensitive data after use |
| **Audit Logging** | Tamper-evident logs with hash chains |
| **Profile Isolation** | Dedicated Chrome profile for secure sessions |
| **Log Sanitization** | Credentials masked in all output |
| **Rate Limiting** | 100 requests per minute per operation |
| **Input Validation** | CSS selector sanitization, URL validation |
Advanced Security Modules (v2.2.0+)
| Module | Description |
|--------|-------------|
| **Secrets Scanner** | Detects 25+ credential patterns (AWS, GitHub, Slack, OpenAI keys, private keys, JWTs, credit cards, SSNs) |
| **Response Validator** | Prompt injection detection (15 patterns), suspicious URL blocking, encoded payload detection |