Browser Auth: browsing what needs a login

For public pages, use the browser MCP tool in the dashboard's Browser panel. This skill handles login walls through playwright-cli: attach and saved state have no native-tool equivalent. Loopback, private and link-local targets also need the CLI's approval path. A policy denial has no fallback.

There is no bundled SSO. Use the user's existing browser context or saved state; never navigate a borrowed tab away from the user's work.

Pick a path

Path	When	Setup cost
Attach (attach --extension)	The user is at their machine with the site already logged in, in a Chromium-family browser	None. Their live sessions are the session
Saved state (state-save / state-load)	You will come back to this site across sessions or restarts, or the host has no interactive browser to attach	One human login, once
Individual cookies (cookie-*)	You hold a specific cookie value, or you are repairing one entry rather than a whole context	Per-cookie

Attach is the strongest of the three, and worth naming as such: it drives the user's own running browser with every session they are logged into, not a scoped copy. When the user has Chrome on this machine, attach is the default: asking for "my Chrome", or for a site they are signed in to (their mail, their files), means attach. Saved state fits a site you return to often. Fall back to the headless playwright-cli open only when no Chrome is installed, the user asks for headless, or the gateway runs on another machine. The browser tool's fallback text tells you which of these this host is.

Attach

Attach mode has one prerequisite the install flow cannot satisfy: the Playwright extension must be installed in the browser being attached to. A browser extension is granted inside the browser by the person using it, so nobody but the user can add it: