Add token-based auth (#1)

* Add token-based auth

* Update mcp-server/browser-api.ts

Co-authored-by: Copilot <[email protected]>

* Fix socket readystate check

---------

Co-authored-by: Copilot <[email protected]>

Author: eyalzh

.gitignore

@@ -7,44 +7,10 @@ yarn-error.log*
 lerna-debug.log*
 .pnpm-debug.log*
 
-# Diagnostic reports (https://nodejs.org/api/report.html)
-report.[0-9]*.[0-9]*.[0-9]*.[0-9]*.json
-
-# Runtime data
-pids
-*.pid
-*.seed
-*.pid.lock
-
-# Directory for instrumented libs generated by jscoverage/JSCover
-lib-cov
-
-# Coverage directory used by tools like istanbul
-coverage
-*.lcov
-
-# nyc test coverage
-.nyc_output
-
-# Grunt intermediate storage (https://gruntjs.com/creating-plugins#storing-task-files)
-.grunt
-
-# Bower dependency directory (https://bower.io/)
-bower_components
-
-# node-waf configuration
-.lock-wscript
-
-# Compiled binary addons (https://nodejs.org/api/addons.html)
-build/Release
-
 # Dependency directories
 node_modules/
 jspm_packages/
 
-# Snowpack dependency directory (https://snowpack.dev/)
-web_modules/
-
 # TypeScript cache
 *.tsbuildinfo
 
@@ -57,74 +23,18 @@ web_modules/
 # Optional stylelint cache
 .stylelintcache
 
-# Microbundle cache
-.rpt2_cache/
-.rts2_cache_cjs/
-.rts2_cache_es/
-.rts2_cache_umd/
-
-# Optional REPL history
-.node_repl_history
-
-# Output of 'npm pack'
-*.tgz
-
-# Yarn Integrity file
-.yarn-integrity
-
-# dotenv environment variable files
+# dotenv environment variable files and config files
 .env
 .env.development.local
 .env.test.local
 .env.production.local
 .env.local
 
-# parcel-bundler cache (https://parceljs.org/)
-.cache
-.parcel-cache
-
-# Next.js build output
-.next
-out
-
-# Nuxt.js build / generate output
-.nuxt
 dist
 
-# Gatsby files
-.cache/
-# Comment in the public line in if your project uses Gatsby and not Next.js
-# https://nextjs.org/blog/next-9-1#public-directory-support
-# public
-
-# vuepress build output
-.vuepress/dist
-
-# vuepress v2.x temp and cache directory
 .temp
 .cache
 
-# vitepress build output
-**/.vitepress/dist
-
-# vitepress cache directory
-**/.vitepress/cache
-
-# Docusaurus cache and generated files
-.docusaurus
-
-# Serverless directories
-.serverless/
-
-# FuseBox cache
-.fusebox/
-
-# DynamoDB Local files
-.dynamodb/
-
-# TernJS port file
-.tern-port
-
 # Stores VSCode versions used for testing VSCode extensions
 .vscode-test
 
@@ -137,4 +47,4 @@ dist
 
 .nx
 
-.DS_Store
+.DS_Store

README.md

@@ -27,6 +27,9 @@ npm install --prefix firefox-extension
 npm run build
 ```
 
+The final `npm run build` command should be executed in the main repository directory, as it also generates a shared `config.json` file used by both the server and the extension.
+
+
 ### Usage with Claude Desktop:
 
 Add the following configuration to `claude_desktop_config.json` (use the Edit Config button in Claude Desktop Developer settings):
@@ -51,9 +54,11 @@ Make sure to restart Claude Desktop.
 
 The browser-control-mcp extension was developed for Firefox.
 
-To install the extension, simply go to `about:debugging` in Firefox, click on "This Firefox", click on "Load Temporary Add-on...", and select the `manifest.json` file under the `firefox-extension` folder in this project.
-
-If you are already using Firefox, then *it is recommended you download a separate instance of Firefox* (e.g. Firefox Developer's edition - https://www.mozilla.org/en-US/firefox/developer/) and install the browser-control extension on it, not on your personal browser.
+To install the extension:
 
-While you can install the extension on your personal browser, this will expose your browsing history to the MCP client (e.g. Claude), as well as allow the client to access pages or to invoke requests with your existing browser sessions. 
+1. Type `about:debugging` in the Firefox URL bar
+2. Click on "This Firefox"
+3. click on "Load Temporary Add-on..."
+4. Select the `manifest.json` file under the `firefox-extension` folder in this project
 
+If you prefer not to run the extension on your personal Firefox browser, an alternative is to download a separate Firefox instance (such as Firefox Developer Edition, available at https://www.mozilla.org/en-US/firefox/developer/).

common/resources.ts

@@ -11,9 +11,9 @@ export interface TabContentResourceMessage extends ResourceMessageBase {
 }
 
 export interface BrowserTab {
-  id: string;
-  url: string;
-  title: string;
+  id?: number;
+  url?: string;
+  title?: string;
 }
 
 export interface TabsResourceMessage extends ResourceMessageBase {
@@ -23,13 +23,13 @@ export interface TabsResourceMessage extends ResourceMessageBase {
 
 export interface OpenedTabIdResourceMessage extends ResourceMessageBase {
   resource: "opened-tab-id";
-  tabId: number;
+  tabId: number | undefined;
 }
 
 export interface BrowserHistoryItem {
-  url: string;
-  title: string;
-  lastVisitTime: number;
+  url?: string;
+  title?: string;
+  lastVisitTime?: number;
 }
 
 export interface BrowserHistoryResourceMessage extends ResourceMessageBase {

firefox-extension/auth.ts

@@ -0,0 +1,34 @@
+function buf2hex(buffer: ArrayBuffer) {
+  return Array.from(new Uint8Array(buffer))
+    .map((x) => x.toString(16).padStart(2, "0"))
+    .join("");
+}
+
+export async function getMessageSignature(
+  message: string,
+  secretKey: string
+): Promise<string> {
+  if (secretKey.length === 0) {
+    throw new Error("Secret key is empty");
+  }
+
+  const encoder = new TextEncoder();
+  const keyData = encoder.encode(secretKey);
+  const messageData = encoder.encode(message);
+
+  const key = await crypto.subtle.importKey(
+    "raw",
+    keyData,
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+
+  const rawSignature = await crypto.subtle.sign(
+    { name: "HMAC" },
+    key,
+    messageData
+  );
+
+  return buf2hex(rawSignature);
+}