Security

Deputy lets an agent act in your real, logged-in browser. That is the point of it, and the reason for the limits below.

Only your computer reaches it

• deputy-mcp listens on 127.0.0.1:7331 only. Nothing on your network or the internet can connect to it.
• Only the extension speaks for the browser. Web pages can reach 127.0.0.1 too, and they always send an Origin. So the extension's address (/ext) accepts only a chrome-extension:// origin, the address other deputy-mcp processes use (/peer) accepts only local programs with no origin, and the MCP endpoint (/mcp) refuses any origin that isn't localhost, which defends it against DNS rebinding.
• There's no password on the local endpoint, as with other local MCP servers. Any program that already runs on your computer can reach 127.0.0.1:7331.

It acts as you, in the page

• No cookies leave the browser. Deputy runs in the page's own security context. deputy-mcp holds no cookies and copies no session state.
• No chrome.debugger. Deputy works from content scripts and extension APIs, so there's no "started debugging this browser" banner and no debugger permission.
• No remote code. All of the extension's logic ships in the package. It exchanges typed JSON messages with deputy-mcp, and never fetches or evaluates code itself.

It asks before changing things

• State-changing forms ask first. Any form other than a GET form is marked as needing approval. If your client can show approval prompts, Deputy asks you before it submits. If no one can answer, it fills the form and names the submit button, and your agent presses it only if your instruction was to submit. See Before it submits.
• The browser enforces it. Deputy never sets WebMCP's auto-submit attribute on such a form, so Chromium fills the fields, focuses the submit button and waits for a person.
• Asking is bounded. If an approval doesn't come back, Deputy treats it as a no; it never asks in a loop.
• The state carried between those calls is signed, because it names a tab, and Deputy rejects any that doesn't match its signature.

You choose what your agent may do

• Reading, filling, clicking and opening pages are always on.
• Screenshots, console and network, uploads, and reading downloads can each be switched off on the setup page. The extension refuses a switched-off operation, which no agent can route around. See Settings.
• Your agent's own JavaScript (browser_eval) runs only through Chrome's User Scripts API, and only after you turn on Chrome's Allow User Scripts switch for Deputy.
• Uploads take absolute paths to files on your computer, 25 MB in total, and only when your agent asks.
• Pro screenshots leave your computer only after you switch that on. See Privacy.

Pro is checked on Deputy's server

Pro's hosted models and usage caps are enforced on Deputy's server against your license key, not in the extension or in deputy-mcp, whose code you can read. Your key travels over HTTPS to Deputy's server a few times a day, to check your plan.