Claude in Chrome vs Playwright MCP Extension vs Browsentic: who gets to touch your logged-in browser?

Headless browsers were never the point. The point was always the tab you are already logged into: the admin dashboard with no API, the vendor portal from 2011, the Google Doc your manager keeps asking you to update. Three tools now let an AI agent drive that tab instead of a fresh Chromium in a sandbox.

I built one of them. Browsentic is mine. Discount accordingly. I have tried to hold it to the same bar as the other two, because a comparison that flatters the author is worth exactly what you paid for it.

The 30-second version

Every row has a catch. Let's go through them.

Claude in Chrome: the polished one with a cloud in the loop

Anthropic's extension went generally available on August 26, 2026 for every paid Claude plan. You install it from the Web Store, sign in, and a Claude side panel appears beside your tab. It reads pages, clicks, fills forms, records GIFs of what it did. If you use Claude Code, claude --chrome wires the same extension to your terminal and shares your browser's login state.

It is the smoothest of the three by a wide margin. Zero setup. A real design team. Two prompt-injection classifiers, one on incoming content and one on actions before they execute, plus a blocklist for financial, adult and piracy sites and a hard "no" on stock trades, CAPTCHAs and facial images. Nobody else on this list ships a classifier.

Now the catches.

You rent it. Pro, Max, Team or Enterprise, or nothing. If your Claude Code authenticates with an API key, a long-lived token, Bedrock, Vertex or Foundry, Chrome integration stays off. One model family, one vendor, one bill.

The cloud is between you and your tab. Page content goes up to Anthropic. The extension holds a connection to bridge.claudeusercontent.com. That is fine for many people and a non-starter for anyone whose logged-in tabs contain customer data they are not allowed to ship to a third party.

It has already been popped once. In December 2025, Koi Security disclosed ShadowPrompt: an over-broad *.claude.ai allowlist chained with a DOM XSS in a CAPTCHA component meant any website could inject prompts into the extension as if you had typed them. No click, no permission dialog. Fixed in 1.0.41. Every extension that holds the debugger permission and talks to a cloud origin carries this class of risk, but this one has a CVE-shaped story attached to it.

A long list of Chrome permissions at install, debugger and nativeMessaging among them, per Anthropic's own getting-started guide. That is not unusual for this category, but you should know what you are handing over.

"Automatically approve" is a default mode. Claude screens its own actions and pauses only when a classifier flags something. Anthropic's safety page says the risk "is not zero" and that you remain responsible for every action. A 2.8-star Web Store rating at GA suggests the beta did things people did not ask for.

Pick it if: you already pay for Claude, you are fine with pages going to Anthropic, and you want the thing that works today with no terminal.

Playwright MCP Extension: the best page model, wearing no clothes

Microsoft's Playwright MCP is the gold standard for how an agent should see a page. It hands the model an accessibility-tree snapshot with stable element references, not pixels, so clicks land on ref=e42 rather than "the blue button near the top." Its --extension flag plus the Playwright MCP Bridge extension points that machinery at a tab in your real, logged-in Chrome or Edge. Free, Apache 2.0, works with Claude Code, Cursor, VS Code, Codex, anything that speaks MCP.

If you are a QA engineer who wants to generate tests against an authenticated app, stop reading. This is your tool.

For everyone else, the catches.

It is a bridge, not a product. There is no UI. You type in a terminal, the browser moves, you alt-tab to see what happened. Every session begins with a tab-picker page. There is no timeline of what the agent did, no way to say "approve this once but not on that site."

Safety is somebody else's problem. browser_evaluate runs arbitrary JavaScript in your logged-in tab, and the only thing standing in front of it is whatever generic "allow tool?" prompt your MCP client shows for every tool. There is no notion of scope, no "this run is about github.com, so navigating to evil.example should ask." The model reads raw page content with nothing telling it that content is data rather than instructions. Playwright was built for test runners, where the page is yours and hostile content is not the threat model. Pointed at the open web with your cookies, that assumption stops holding.

Chrome and Edge only in extension mode, despite Playwright's cross-browser reputation. And the bridge has a reputation of its own: issues about the extension sitting at "No MCP clients are currently connected" while the server is demonstrably running are a recurring genre.

Pick it if: you live in a terminal or IDE, you want the most precise page representation available, and you are comfortable being the entire safety layer yourself.

Browsentic: your agent, your browser, your rules

Browsentic is a side panel plus a small local daemon. Open the panel beside any tab, type or dictate, and it drives the page. The model is whichever agent CLI you already have logged in: Claude Code, Codex or Antigravity, switchable with one click, and you pick the model each one runs. The same daemon doubles as an MCP server, so Cursor, Zed or Claude Desktop can drive the same browser. There is no Browsentic account and no Browsentic server. MIT, and the install path is one command.

It is the only one of the three that does not decide which model you use, and the only one where the safety policy is a file on your disk rather than a promise.

• Policy is data, not vibes. Form submission, file upload, download, navigating off the sites a run is about, and typing a saved secret each pause with a card that names the rule. Allow once, deny, or "always on this host." Denies cannot be clicked past. A run's scope is derived from where it started and what you said, and nothing read from a page can widen it. Every rule is listed in the docs and every default can be changed.
• Live tools are off until you flip them on. When the agent wants to write JavaScript for a page, the panel shows you the source and a Review button before a line of it runs. A script that worked can be kept, named after the site, and rerun by typing /. There is deliberately no "always allow" for code.
• Point instead of describe. Press the lens, hover, click. The element rides along with your next message. When the agent is the one who is unsure, it hands the lens back and asks you to point.
• It keeps working when you walk away. Watch a build or an upload in the background, schedule something for ten minutes from now or every two, and it announces on the page you are looking at when it is done.
• Teach it a site once. It explores, writes reusable notes, and every later session already knows the way around. Record yourself doing a job once and later say "do it like last time."
• Page text is fenced. Every block of page content is wrapped in a per-daemon random marker with a note that it is data, never instructions, and a run is confined to the sites it is about. Not a guarantee. The goal is that a successful injection has nowhere to send what it took.

Two things to know before you install.

It is not on the Chrome Web Store yet. npx browsentic setup installs the extension, starts the daemon and prints a pairing code. You then load the folder it printed through chrome://extensions and paste the code. Two steps in the browser, once. Your browser stays paired through updates because the path never changes.

It runs the agent you bring. You need Node 20 and one of Claude Code, Codex or Antigravity logged in. That is the trade: no second subscription, and no cloud between you and your tab, in exchange for a CLI on your machine. If you have none of the three, Claude in Chrome is the shorter road.

Pick it if: you want the agent you already use, in a side panel, with a policy you can read and change, and nothing about your browser going anywhere your agent was not already sending it.

The security paragraph everyone skips

None of the three is immune to prompt injection, and any vendor who tells you otherwise is selling something. The honest differences are in what each one does about it:

• Claude in Chrome bets on classifiers and a blocklist. Strongest detection, weakest transparency. You do not see the rules and you cannot edit them.
• Playwright MCP bets on you. No detection, no scope, no fencing. Total transparency, because there is nothing to hide.
• Browsentic bets on containment. Fencing, scope, and gates on the actions that would exfiltrate. You can read every rule and change every default. A good enough page can still fool the model, and the design accepts that. The claim is that a fooled agent has nowhere to go.

Pick the failure mode you can live with.

Where this leaves you

• Already pay for Claude, want zero setup, do not mind the cloud: Claude in Chrome. Turn off automatic approval.
• Test engineer, terminal-native, know exactly what browser_evaluate can do: Playwright MCP Extension.
• Want a side panel, want to choose the agent, want the policy on your disk and your data off the cloud: Browsentic.

If you try mine and it does something you did not ask for, open an issue. I read every one.