LMCP (a free MCP server for Mac, I work on it) has 14 browser tools for exactly this. Here's how they work and where the edges are.

The model: a separate window, logged in once

The browser tools don't touch your Safari or Chrome. LMCP runs its own browser window (WebKit), and that window starts signed out on purpose, so your real browser's cookies are never used.

Sessions are named. The first time, your agent calls web_login with a name like analytics and the URL. A window opens on your Mac and you log in yourself, password and 2FA included. The password never goes through the tool or the AI. From then on, that session is saved to disk and survives restarts, and every other tool can reuse it by name.

A real flow from Claude Code

First run:

Use LMCP to log me into analytics.example.com in a session called "analytics".

You log in in the window that pops up. After that, the actual work:

In the "analytics" session, go to the weekly report page, extract the table with date, visits and signups, and save it as a CSV on my Desktop.

Under the hood that's roughly:

• web_navigate to the page, reusing the saved login

• web_read with mode: "a11y" to get a compact map of links, buttons and fields, which is much cheaper than raw HTML

• web_extract with a field-to-CSS-selector map to pull the rows as structured data

• Claude Code writes the CSV itself

Next week you just ask again. No login, no copy-paste.

The other tools fill in the gaps: web_find locates elements by selector or visible text, web_click and web_type interact, web_wait_for polls until something appears instead of sleeping blindly, web_screenshot gives the model a look, and web_session_list shows what's saved.

Guardrails worth knowing

• Submitting is gated. If web_click hits a button that submits a form, it returns a preview and asks the agent to call again with confirm: true. web_type never submits on its own.

• Read-only mode. Set LMCP_READ_ONLY=1 (or read_only in the config) and every tool that can change something is blocked, web_eval included. Nice for unattended jobs that should only read.

• Deleting a session wipes its cookies and site data, and also asks for confirmation first.

The honest limitations

• "Sign in with Google" doesn't work in this window. Google blocks its sign-in flow in embedded browsers. LMCP detects it and suggests the email + one-time code option instead, if the site has one.

• Captchas and 2FA are yours. The agent calls web_show, the window comes to the front, you solve it, and the agent carries on with the session intact.

• One tab per session. Pop-ups and new tabs load in the same view.

• The LMCP menu bar app has to be running, since that's where the browser lives.

• Terms of service. Automating some sites (LinkedIn, Instagram) can break their rules. That risk is on you, and the tool says so.

Try it

It's free:

curl -fsSL 'https://local-mcp.com/install?ref=hashnode-t2' | bash

Or npx -y local-mcp@latest setup. Restart Claude Code afterwards. One tip from testing: if you also have other browser tools connected, say "use LMCP" in the prompt, otherwise the model may quietly pick a different one.

What's the site you'd automate first?

Why we built it

If you've wired MCP servers by hand, you know the drill. One server per app, an API key here, an OAuth app registration there, and for anything Microsoft, a trip to your IT admin for consent. Meanwhile all that data is already sitting on your machine, inside apps you're logged into.

So we built one install that reaches what's already there.

How it works, briefly

The MCP server runs on your Mac and the tools execute there. Where it can, LMCP uses what the apps already keep locally instead of going through cloud APIs. Teams is the fun example: instead of Microsoft Graph, we read the local cache the Teams app keeps on disk, so there's no Azure app to register and no admin consent to chase.

The installer finds the AI apps you have and configures them for you. If you use Claude Code, it's just there the next time you start a session.

What people actually do with it

A few things that work well from Claude Code or Codex:

• "Open our analytics dashboard, grab this week's numbers and put them in a spreadsheet." The browser tools use your existing logged-in sessions, so no credentials to hand over.
• "Summarize what happened in the #launch Slack channel since Monday."
• "Find last week's invoice PDF in my Downloads and pull the totals into an Excel file."
• "What's on my calendar tomorrow, and is there anything in my inbox I should read before those meetings?"

The fun part is chaining. Once your agent can read mail, check your calendar and drive the browser, small workflows you'd never bother scripting become one prompt.

Turning it into automations

Where it gets interesting is when you stop typing the prompt every time.

LMCP has recipes: you save a multi-step workflow once ("every morning, pull new orders from the dashboard, add them to the sheet, flag anything unusual") and run it again whenever you want. And since Claude Code and Codex can run without you sitting there, you can hook those workflows into a script or a scheduled job. Your Mac does the clicking, the agent does the thinking.

Some of the heaviest setups we've seen look less like "a person chatting with Claude" and more like small pipelines running on their own: scraping a few sites, checking a couple of inboxes, writing the results somewhere useful.

What it doesn't do

Worth being upfront about this:

• Tools run on your Mac, but your AI provider still sees whatever you ask it to read. LMCP doesn't make Claude or ChatGPT local.
• It doesn't bypass app permissions or company policies.
• Web AIs like claude.ai or ChatGPT can use it through an optional cloud connector, which is off by default. Desktop and CLI clients don't need it.

Try it

It's free. If you're comfortable with a shell:

curl -fsSL 'https://local-mcp.com/install?ref=hashnode-g1' | bash

Or npx -y local-mcp@latest setup, or the signed installer at local-mcp.com. Restart your AI client afterwards, since MCP tools load at startup.

What would you want your agent to do on your Mac that it can't do today? That's genuinely how we decide what to build next.