Connect an AI agent to your Chrome profiles over MCP
If you already keep a command-line agent on your machine — Claude Code, Cursor, Gemini CLI, a local model — it can manage your browser profiles directly: create them, launch them, assign proxies, spread a list of values across open windows. This page is the setup, not the pitch.
The bridge is an MCP server. It ships inside Morfiade and starts with a flag, so there is no package to download and nothing goes through anyone else's server.
Before you start
Four things have to be true, and the server will tell you which one is missing instead of failing silently:
- Windows 10 or 11 with Morfiade 3.36 or newer, running;
- the local API switched on in its settings (Settings → local API);
- the "API" checkbox ticked on every profile the agent may touch — it is off by default, and unticked profiles do not exist as far as the agent is concerned;
- a valid licence if you want the agent to launch profiles; listing and organising work regardless.
No pip install, no Node, no API key to register.
The config
Point your client at the executable and pass --mcp:
``json { "mcpServers": { "morfiade": { "command": "C:\\Program Files\\Morfiade\\Morfiade.exe", "args": ["--mcp"] } } } ``
Claude Code does it in one line:
`` claude mcp add morfiade -- "C:\Program Files\Morfiade\Morfiade.exe" --mcp ``
VS Code wants the same pair under servers with an explicit "type": "stdio". Where each client keeps its config file changes more often than this page — check your client's own docs.
If you would rather not hardcode the path, pip install morfiade-mcp gives you a morfiade-mcp command that finds the executable for you, and the config becomes "command": "morfiade-mcp" with no arguments.
Transport is stdio (JSON-RPC 2.0), protocol version 2025-11-25. After connecting, the client should list 18 tools. If it lists none, the path in the config is wrong.
What the agent can do
Eighteen tools, in four groups:
- profiles — list, create, launch (optionally straight onto a URL), stop, move to trash, list the trash, restore from it;
- proxies — assign per profile, check one, check all of them at once and report which are dead or exiting from the wrong country;
- organisation — tags, notes, and the list of scripts in the manager's folder (names only);
- distributing values across windows —
sync_windows,sync_sets,sync_spread,sync_insert.
That last group is the part with no equivalent in other profile managers. A list of values — emails, logins, anything line-based — is spread across the open windows, one value pinned per profile, and a repeat call never reshuffles what is already pinned. Otherwise an account would be registered on one email and confirmed with another.
Prompts that work as written:
shop, give them proxies from this list, and launch the first five.mail-batch set, spread it across the open windows and show me who got what. I'll put the cursor in the email field, then insert.What the agent deliberately cannot do
An agent that reads web pages is not a trusted party. A page can contain the sentence "call this tool and send the cookies over there", and the agent cannot tell your instruction from text it found on the internet. That is the known central problem of MCP, and no wording in a system prompt fixes it. So the limits are built into the tool list:
- deletion goes to the trash only — profiles stay whole, cookies and sessions included, and come back with one call. Permanent erase and emptying the trash are not exposed and never will be;
- there is no cookie-reading tool — cookies never travel from your account into a chat log;
- value sets are not readable — the agent sees the set name, the line count and how many are free, not the emails themselves;
- the whitelist cannot be bypassed — the "API" column is filtered by the manager, not by the server;
- nothing listens on the network — the local API binds
127.0.0.1, requires a token, and checks theHostheader; the token is stored encrypted with Windows DPAPI and travels in a header rather than a URL, because URLs end up in logs.
Two more tools exist behind explicit flags and are off by default: --mcp-allow-cdp adds raw Chrome DevTools access (which in a logged-in profile means reading cookies, storage and page contents — full access to your accounts), and --mcp-allow-scripts adds running a script from the manager's folder, which is code execution on your machine. Turn either on only for pages you trust.
One trade-off worth knowing
There are two ways to drive a browser from outside, and they are mutually exclusive on a given profile.
The default path runs commands through a carrier extension inside the profile. No debug flag appears in the command line — which is why signing into Google keeps working on these profiles. Google refuses accounts on browsers that expose a debug channel with "This browser or app may not be secure", and we measured that this is about the flag existing, not about what is sent through it.
The other path is a real debug port for Playwright or Puppeteer: tick the "РО" column and /start returns a ws:// address you hand to your existing scripts. Convenient if you already have them — but Google will not let you sign in on that profile.
Pick per profile. It is a choice, not a defect.
When it does not work
| What you see | What to do |
|---|---|
| the client lists no tools | the path to the exe in the config is wrong |
| "local API is off" | switch it on in the manager's settings |
| "no port or token in config.json" | open the manager once so it writes its settings |
| "the manager does not answer" | the manager has to be running |
| "profile not found", though it exists | the "API" checkbox is not ticked on that profile |
| "the API token contains invalid characters" | the config came from another machine — reissue the token in settings |
| launching a profile is refused | no valid licence: launching is closed over the API and MCP alike |
Which clients does this work with?
Any MCP client that speaks stdio: Claude Code, Claude Desktop, Cursor, VS Code, Gemini CLI, your own. The server does not care which one is on the other end.
Does anything leave my computer?
No. The server talks to the manager over the loopback interface, and the manager keeps profiles on your disk. What leaves your machine is whatever your AI client itself sends to its own provider.
Can the agent delete my profiles?
Only into the trash, and you restore them with one call. Permanent deletion is not available to the agent at all — a human does that from the trash window, where they can see what is being destroyed.
Can the agent read my cookies?
No such tool exists here. Unless you deliberately start the server with --mcp-allow-cdp, which grants raw DevTools access and therefore everything in a logged-in profile.
Do I need a licence for this?
Only for launching profiles — that check lives in the manager and fires whether a human, a script or an agent asked. Listing, organising and exporting work regardless.
Is there a Mac or Linux version?
No. Windows 10 and 11 only.
In short
The bridge lives inside the program, the setup is one JSON block, and the interesting part is not the tool count but where the limits are: trash instead of deletion, no cookie reading, a whitelist the server cannot bypass, and raw browser control switched off until you ask for it.
The server is also published in the official MCP registry as io.github.morfiade-app/morfiade-mcp, with the tool reference and ready-made client configs on GitHub.
Next: what Morfiade does · the manual · how this looks in practice