Voyager Browser

Voyager's web-page sense: safe read-only observation of one live URL (structure, security, a11y).

Quick Install

Automated & IDE Setup

Copy the AI prompt to install this server into Claude Code, Cursor, or another agent — or use 1-click editor setup below.

Add to Cursor Add to VS Code

Manual Client & Custom JSON ConfigExpand JSON ▾

Client Config & Setup

Remote HTTP

Choose your client or environment

Target File:~/Library/Application Support/Claude/claude_desktop_config.json

claude_desktop_config.json

{
  "mcpServers": {
    "voyager-browser": {
      "url": "https://example.com"
    }
  }
}

💡 Paste the JSON block into your client's configuration file under mcpServers, then restart the application.

Documentation Overview

@dir-ai/voyager-browser

Voyager's web-page sense. A safe, read-only observation of one live URL: its structure, forms, links, script origins, security posture (HTTPS / HSTS / CSP / mixed-content / cookies) and accessibility signals (lang, image alt coverage, heading order) — each with a described, never applied fix.

It parses static HTML — no JavaScript execution, no headless browser — so it's honest about what it can and cannot see (it will not render a client-side SPA's runtime state). Every piece of page text is returned framed as untrusted. It is SSRF-gated: it refuses non-http(s) URLs and anything resolving to private, loopback, or cloud-metadata addresses.

One sense in the Voyager family. Read-only, like all the senses — it never submits a form, clicks, or mutates anything.

Install

Terminal

npm i -g @dir-ai/voyager-browser

Use

bash

voyager-browser observe https://example.com
voyager-browser observe https://example.com --json

Code

https://example.com/
https://example.com — 200; 3 finding(s), worst: medium. 0 form(s), 1 link(s).

  title: Example Domain
  security: https  ·  a11y lang:yes alt:n/a

  med   HTTPS without HSTS
        ↳ add Strict-Transport-Security: max-age=63072000; includeSubDomains
  med   no Content-Security-Policy
        ↳ add a Content-Security-Policy to constrain scripts/resources
  low   no X-Content-Type-Options: nosniff
        ↳ add X-Content-Type-Options: nosniff

As an MCP server

One tool, observe_page.

config.json

{ "command": "voyager-browser", "args": ["mcp"] }

As a library

server.ts

import { observe } from '@dir-ai/voyager-browser'

const brief = await observe('https://example.com')
console.log(brief.summary)
console.log(brief.security)   // { https, hsts, csp, mixedContent, thirdPartyScripts, … }
console.log(brief.forms)      // insecure / cross-origin / sensitive flags
console.log(brief.findings)   // severity + described fix

What it looks for

Security posture (quality, not just presence) — plain HTTP; missing/weak HSTS; missing CSP or a CSP graded weak (unsafe-inline/unsafe-eval/wildcard/no object-src/no base-uri); missing clickjacking protection (X-Frame-Options / frame-ancestors); missing nosniff, Referrer-Policy, Permissions-Policy; version-leaking Server/X-Powered-By; mixed content on an HTTPS page (origin-compared, not prefix); per-cookie Secure/HttpOnly; third-party scripts without Subresource Integrity.
Forms — a form on HTTPS posting to plain HTTP (critical); a sensitive form (password/payment) posting cross-origin or over HTTP; a sensitive POST with no anti-CSRF token; sensitive data on GET.
Links — external target="_blank" without rel="noopener" (reverse-tabnabbing).
Body-content leaks — directory listings (Apache/nginx autoindex), language-specific stack traces (Python/Java/PHP/Node/Oracle/SQLSTATE/MySQL) and verbose framework debug pages (Werkzeug/Flask, Rails, Symfony/Whoops, ASP.NET YSOD) disclosed in the response body — each with the matched signature (framed).
Exposed JWTs — JWT-shaped tokens found in the HTML, response headers, Set-Cookie, and same-origin bundles are decoded (header+payload, base64url, no signature verification, no secret cracking) and flagged for alg:none (critical), expired (exp in the past), or missing exp. Claim values are framed as untrusted.
Passive discovery of well-known sensitive paths — bounded, same-origin, read-only GETs to a short fixed list (/.git/config, /.env, /.svn/entries, /.DS_Store, /config.json, /wp-config.php~, /backup/, /uploads/), flagging only a confirmed body signature — never a bare 200. Pinned to the vetted IP; honours --authorized. Disable with --no-discovery.
Accessibility — missing <html lang>, images without alt, skipped heading levels, unlabeled form fields.
Render honesty — a render: static | hybrid | client-heavy field: if a page's content is JavaScript-rendered, the brief says so and marks itself PARTIAL rather than reporting a shell as clean.
Composition hints — third-party script origins to vet with @dir-ai/voyager / @dir-ai/voyager-net.

Safety

Read-only. Fetches the page with a single GET; never submits, clicks, or mutates.
No code execution. Static HTML parsing only — the page's JavaScript is never run.
SSRF-gated, with IP pinning. Only http(s); a single URL (no lists/credentials). The host is resolved, every address is classified canonically (IPv4-mapped IPv6, unspecified, CGNAT, NAT64, link-local, private, loopback, metadata all refused), and the connection is pinned to the vetted IP so DNS rebinding cannot swap in an internal address between the check and the fetch. Every redirect hop is re-vetted and re-pinned.
Untrusted by construction. Every owner-controlled string that reaches the brief — title, headings, meta, links, form actions, field names — is injection-stripped and framed; the agent must treat it as data, not instructions.
Bounded. One deadline covers headers and body; the body is byte-capped; a truncated read downgrades confidence and is never reported as "clean".
Honest limits. It reads what the server sends. It does not see client-rendered state — and the render field says exactly how much it saw.

Roadmap

v0.3 — same-origin JS-bundle static scan (exposed secrets/endpoints/source-maps), third-party/tracker/cookie inventory + tech fingerprinting, WCAG-mapped a11y depth, and a CognitiveClaim adapter so a page observation drops into a @dir-ai/voyager-agent mission (page → host → dependency chain).
v1.0 — an opt-in, consent-gated --render sandboxed headless pass (network-isolated, resource-capped) for true SPA/rendered-DOM coverage, always labeled as render-mode output; a stable finding-kind taxonomy and a full posture score.

The line stays fixed: voyager-browser expands by reading more of what's already served, never by doing more to the server. Anything active (submitting, fuzzing, probing) belongs to a separate consent-gated organ.

The Voyager family

Package	Sense
`@dir-ai/voyager`	web — verified-internet retrieval
`@dir-ai/voyager-browser`	web page — observe one live URL
`@dir-ai/voyager-repo`	code — orient in a repository
`@dir-ai/voyager-net`	hosts — authorized host audit
`@dir-ai/voyager-contract`	the cognitive contract the senses speak
`@dir-ai/voyager-agent`	the one agent that composes them

License

MIT © dir-ai

Read the full README →View source on GitHub →

Related MCP Servers

View all in Developer Tools View all alternatives

Reviews

No reviews yet — be the first to share how this listing worked for you.

Frequently Asked Questions about Voyager Browser

Add the following block to your claude_desktop_config.json under mcpServers: "mcpServers": { "voyager-browser": { "command": "npx", "args": ["-y", "voyager-browser"] } }

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:

Live Dynamic SVG Preview

Markdown (GitHub README)

[![AllMCPs](https://allmcps.com/api/badge/voyager-browser?style=directory)](https://allmcps.com/mcp/voyager-browser)

HTML Embed

<a href="https://allmcps.com/mcp/voyager-browser"><img src="https://allmcps.com/api/badge/voyager-browser?style=directory" alt="Voyager Browser on AllMCPs" /></a>

Technical Specs & Signals

CategoryDeveloper Tools

36Quality signal: Fair · 36/100How this signal is calculated ▾

Server availabilityNot measured

Not scored for repo-hosted servers — we can't reach the running server, only its GitHub page. Hosted MCP endpoints are health-checked live.

Verified ownership10/20

Documentation & tools16/30

Adoption & activity1/15

Community engagement0/10

A guidance signal from public completeness & health data — not a user rating. New listings start lower and rise as they add docs, get verified, and grow adoption. Signals we can't observe for a listing are skipped, not counted against it.

★ Featured

Moxie Docs MCP

MCP & Agent Skills for Automated Documentation, and codebase conventions + context

Explore Server →

Own this project?

This directory is pre-filled from public sources. Claim via GitHub README, site badge, or DNS TXT to unlock edit access and the Official badge — proof is checked automatically, then reviewed by our team.

Free dofollow backlink: add your website and place the AllMCPs badge on it — no claim needed. We detect it automatically and keep it verified as long as the badge stays live.

Claim & get free dofollow

Share & Embed

Add our SVG badge (dark/light directory styles) or embeddable widget to your site.

Explore more

More in 💻 Developer Tools →Best MCP servers for Developers →Alternatives to Voyager Browser →Install in Claude Desktop Install in Cursor Install in VS Code