Mosaic has an anti-detect browser MCP server built into the app. Turn it on in Settings › MCP, give your assistant an API key, and Claude (or any client that speaks the Model Context Protocol) can create profiles, start them, read the page in front of them and click through it. As of 2 November 2026 the server registers 156 tools, and the settings panel lists every one of them by name, read off the running server.
The server is not a separate project bolted on beside the app. It runs in the same process as the window, and its tools call the code the interface calls, so an assistant can do whatever you can do from the profile list, and nothing more.
What an assistant can do with it
The tools cover the whole product, in the same groups the window has.
- Profiles and projects:
create_profile,update_profile,start_profile,stop_profile,move_profiles, and their bulk versions. - Proxies and providers:
add_proxies,check_proxy,mint_proxy,rotate_proxy,parse_proxy_list. - Fingerprints:
preview_fingerprint,audit_fingerprint,repair_hardware,match_profile_to_exit. - Sessions: cookies, bookmarks, saved logins and
get_totp_codefor a profile's two-factor secret. - The live page:
page_snapshot,page_click,page_type,page_fill,page_scroll,page_network. - Checks:
run_leak_test,open_detection_test,library_health.
A request like "make three profiles on my German provider, start them and open the shop's login page in each" is four or five tool calls. Each profile mints its own session from the provider, so the three come out on three exits, the same as when you do it by hand (provider accounts covers the minting).
An AI assistant can make, start and drive your profilesIn Mosaic: MCP server. Let an AI assistant create, launch and drive profiles. Free holds 3 profiles. Pro is $49 a month for any number.
Mosaic is a desktop app
Email yourself the link and open it on your computer.
How it reads and drives a page
page_snapshot returns the page as a tree of roles, names and states, with a ref on everything that can be pressed or typed into. That is a few hundred lines where the HTML is tens of thousands, which is what a model can actually read. Every other page tool takes those refs. A ref belongs to the snapshot that made it, so after a navigation an old ref is refused by name instead of landing on whatever element now sits in that spot.
The page tools never enable the DevTools Runtime domain, because we measured that one call flipping a bot detector to its bot verdict. The snapshot and the queries run in an isolated world the page cannot see. Clicks and keystrokes go through the same human-input code the window uses: a cursor that travels to the element, keys typed with human timing, and scrolling with a real wheel. Nothing calls element.click() or sets .value.
One tool is visible to the page, and its description says so. Capturing a page's own console.log calls and uncaught errors means wrapping console in the page's world, so page_console_mode is off by default and should be turned off again when the assistant is done.
Connecting a client
The server speaks JSON-RPC over HTTP on 127.0.0.1, port 39218 by default. Most MCP clients still launch a local command over stdio, so Mosaic writes a small bridge script next to its data and an example config beside it. Settings › MCP prints the block to paste:
{
"mcpServers": {
"mosaic": {
"command": "node",
"args": ["<path shown in Settings › MCP>/mosaic-mcp.mjs"],
"env": { "MOSAIC_API_KEY": "<key from the API tab>" }
}
}
}
The bridge forwards each line to the local server with your key. If the key is wrong, or the plan does not include MCP, the client gets that sentence back as an error instead of a reply it cannot parse.
Why the anti-detect browser MCP server is off by default
These tools start browsers that hold live, logged-in sessions. So the server does not run until you switch it on, it answers only on 127.0.0.1, and every request needs an API key, sent as Authorization: Bearer <key>. Calls show up on the API activity screen under the key that made them, so you can see afterwards what an assistant did.
The tools do not ask you to confirm each action. An assistant that is told to empty the trash can call the tool that does it. What we did instead is refuse a destructive call that has no scope: emptying the trash or a profile's downloads without naming what to empty is an error, never "all of it".
Who it is for
People who already work with an assistant and want it to do the repetitive half of running their own accounts: setting up a batch of profiles, checking their proxies, opening the same page in each. Every tool argument is validated, and an unknown field or a value the tool cannot use is refused with the field named, because a model cannot ask what was meant.
Limits
The MCP server is part of Pro, along with the REST API it mirrors. Pro is $49 a month, with a 14-day free trial; the Free plan has neither automation surface. Everything runs on your own computer: there is no hosted endpoint and no headless server mode, and the browsers an assistant opens are the same headed Tesseract Chrome windows you would open yourself. The profiles stay on your machine, as local first describes, and what a platform allows is still up to the platform.