AI Agent - Aug 12, 2026

Cloudflare Kitesurf MCP Client Guide and Safety Boundaries

Quick answer

Cloudflare says an AI agent that speaks MCP and CDP can use Kitesurf through Browser Run. Its documentation shows a chrome-devtools-mcp connection to the DevTools WebSocket endpoint with browser=kitesurf.

The connection gives the agent a browser transport. It does not authorize a target, neutralize prompt injection, approve data access, or grant permission to click, submit, message, purchase, change an account, or export data. Review browser-agent authority boundaries before enabling actions.

Secure connection checklist

  1. Create a least-privilege Browser Run token for the approved account and environment.
  2. Store the token outside source and prompts; inject it through an approved secret path.
  3. Pin or review the MCP bridge package and client configuration.
  4. Add browser=kitesurf only to the intended endpoint.
  5. Allowlist target domains, navigation, extraction, downloads, uploads, and actions.
  6. Separate read-only browsing from consequential tools and require approval for the latter.
  7. Log policy decisions, tool proposals, approvals, denials, engine, endpoint, target, and outcome.

Do not paste a live token into a shared configuration example. Rotate it if it reaches page content, model context, source control, or an unapproved log.

Treat page content as untrusted

A rendered page can contain instructions designed to redirect the agent, expose secrets, or trigger unsafe tools. Keep page text in the data channel, not the instruction channel. Validate tool arguments against the approved task, ignore in-page requests for credentials or policy changes, and pause ambiguous actions for human review.

Kitesurf’s isolate design helps separate browser components, but application-level permission remains the operator’s responsibility.

Test the full MCP path

Test client startup, secret injection, connection, navigation, DOM and network inspection, tool proposals, denial, approval, timeout, disconnect, cancellation, token expiry, log completeness, and Chromium fallback. A connection test alone is insufficient.

Use the CDP Playwright and Puppeteer guide for protocol checks and the compatibility guide for workload acceptance.

Frequently asked questions

Can an MCP client use Cloudflare Kitesurf?

Yes, when the agent and MCP client use a CDP bridge supported by Browser Run. Cloudflare documents chrome-devtools-mcp as one configuration path.

Does an MCP connection authorize browsing or actions?

No. Transport access is separate from target authorization, data permission, credential scope, tool approval, and permission to take consequential actions.

Where should the Browser Run token be stored?

Use an approved secret or environment store with least-privilege scope. Do not place a live token in prompts, page content, source control, screenshots, or ordinary logs.

Official sources

Source check: August 12, 2026. Recheck MCP bridge, package, endpoint, authentication, beta limits, and security guidance before use.