Steel MCP Server

Give Claude, Cursor, or any MCP client a real Chrome in the cloud. Read pages that block a plain fetch, fill forms, take screenshots, and hand the browser to a person when a login or a CAPTCHA needs one. The browser is run by Steel.

Status: 3.0.0. Download it from Releases. It is not published to npm. mcp.steel.dev is not live yet.

Install

You need a Steel API key. The free tier is enough to try it.

Claude for macOS or Windows

Download steel-mcp-2.0.1.mcpb and open it. Claude installs it and asks for your Steel API key. No Node install is needed.

When you replace an installed bundle, quit and reopen Claude after the installer finishes, then start a new conversation so Claude reads the new tool catalog.

Claude Code

claude mcp add steel -e STEEL_API_KEY=your-steel-api-key -- npx -y github:steel-dev/steel-mcp-server

The first run clones and builds the server, which takes about a minute. Later runs start at once.

Cursor, VS Code, and other MCP clients

Add this to the client's MCP configuration:

{
  "mcpServers": {
    "steel": {
      "command": "npx",
      "args": ["-y", "github:steel-dev/steel-mcp-server"],
      "env": { "STEEL_API_KEY": "<your-steel-api-key>" }
    }
  }
}

To run from a checkout instead, npm install builds the server; point command at node and args at /absolute/path/to/steel-mcp-server/dist/stdio.js.

Self-hosted steel-browser

Run the steel-browser image and set STEEL_LOCAL=true instead of an API key. No key is needed or sent. Self-hosted Steel runs one browser session at a time and has no managed proxies, browser profiles, managed credentials, or CAPTCHA solving; a tool that asks for one of those gets a named explanation instead.

A shared endpoint for a team

dist/hosted.js serves the same tools over Streamable HTTP, with each caller bringing their own Steel key. Claude Code connects to it directly; Claude Desktop needs the mcp-remote bridge. Deployment, Redis, tracing, and the client snippets are in docs/HOSTING.md.

What you can ask

How it works

• Read first, browse when you must. steel_scrape answers most questions about a page and starts no billed session. A session is created only to interact, and released when the task is done.
• Elements, not pixels. steel_snapshot and steel_find read the page as an accessibility tree and give targetable elements @eN references. steel_act clicks, types, and fills by reference. Screenshots are for people and for visual checks, never for aiming.
• Actions report what changed. A click returns whether the page navigated, the DOM changed, or focus moved. If nothing changed, the response says so instead of claiming success. When a reference stops working, the error says why and what to call next.
• People handle the sensitive parts. On a host with MCP Apps, Claude among them, the running browser renders inline in the conversation. Take control gives you the browser for a login, a CAPTCHA, a payment, or a local file; Hand back returns it, and the agent re-reads the page before it continues. Login walls and CAPTCHAs trigger the handoff automatically. Saved browser profiles and managed credentials are discovered through steel_session_options, never guessed. Details in docs/SESSIONS.md.
• Page content is data, not instructions. Everything read from a page arrives inside an <untrusted-page-content> block with hidden text and other prompt-injection carriers stripped. Passwords and credentials are redacted before they reach a response or a log.

Tools

The default browse profile exposes sixteen tools. STEEL_PROFILE=scrape exposes only the first three, which never start a browser.

Configuration

Logs are structured JSON on stderr; stdout carries nothing but JSON-RPC. The hosted endpoint has its own variables, listed in docs/HOSTING.md.

Troubleshooting

A site returns 403 or shows a challenge page. That is bot detection, not a bug. The error names the vendor and one thing to try next; change one thing at a time. steel_session_diagnostics shows what happened.

Managed proxies or CAPTCHA solving fail with a payment error. Those need a $10 verified paid balance on Launch; free credits do not count.

A @eN reference stopped working. The error says why: the page navigated, the frame holding it loaded a new document, the node was removed, or the element changed role or name. It also says what to call to recover.

A click reports that nothing changed. It probably landed on something else. If an overlay covers the target, the error names it: run steel_act with dismiss_overlays, then retry. If the target is inside a frame, the response says the frame is not observed; take a fresh snapshot instead of clicking again.

A session seems to have vanished. Steel releases a session after ten minutes without activity, and at the plan's hard time limit. Create a new one only if you need to interact again; to read the old activity, call steel_session_diagnostics with its dashboard UUID, or with no id for the latest.

"Concurrency limit reached" on steel_session_create. Your Steel plan allows fewer simultaneous browsers than are open. Sessions you forgot to release count; steel_session_release frees one immediately.

The extension fails to start with a message about STEEL_API_KEY. The key never reached the server. Open the extension's settings in Claude and enter it again; the field is write-only, so a blank one looks the same as a filled one.

Tracing was requested but could not start. The desktop bundle ships without the OpenTelemetry exporter stack. The server logs this once and serves normally; a source checkout can install @opentelemetry/sdk-node and @opentelemetry/exporter-trace-otlp-http.

Security and privacy

The server holds no data of its own. It sends the URLs and page interactions a tool call names to Steel, which runs the browser, and returns what the page said. Page content passes through to your MCP client and is not stored, logged, or forwarded anywhere else. Nothing about your conversation is collected, and no telemetry exporter is loaded unless you configure one with a standard OTEL_* variable. Steel's handling of the browser sessions it runs is covered by the Steel privacy policy.

Web pages can contain prompt injections, and filtering cannot remove every one. Review browser actions that submit data, make purchases, or change an account. The threat model and the current mitigations are in RESEARCH.md §7. Report vulnerabilities as described in SECURITY.md, not in a public issue.

Development

npm run build
npm run typecheck
npm run lint
npm test               # unit + integration
npm run budget         # tools/list byte budget per profile
npm run conformance    # MCP conformance suite
npm run test:browser   # runs the inline viewer and the frame snapshot in a real Chrome
npm run test:e2e       # starts, waits for and tears down the real-browser stack

CLAUDE.md has the working rules; this project practises TDD, so a change starts with a failing test. RELEASING.md explains what ships from this one package: the desktop bundle, the container image, and the hosted service. NOTES.md records what was measured against Steel's API and Chrome, and RESEARCH.md the decisions behind the design.

Contributions are welcome: fork, branch, and open a pull request that says what it changes and why. For bugs, open an issue with the tool you called and the error text.