AI ASSISTANTS · LOCAL MCP SERVER
Let your AI assistant
capture web pages.
lillabr-mcp is a small local MCP server. Your AI app starts it, the LilLabr extension in your own Chrome connects to it over a private local connection, and the assistant can capture pages, including ones you are signed in to, and read what it captured as files on your computer.
What it is, in one picture.
MCP, the Model Context Protocol, is how AI apps such as Claude Desktop, Claude Code, Cursor and the ChatGPT desktop app or Codex talk to local tools. lillabr-mcp is one of those tools. It runs on your computer, listens only on 127.0.0.1, and makes no outbound connections of its own. The LilLabr Chrome extension finds it on one of five local ports and connects to it. From then on the assistant can ask Chrome to capture a page, and Chrome, with your logins and your approval, makes the capture and hands it to the server, which saves it as a .labr file in ~/Lillabr/captures/ and reads it for the assistant.
Nothing is uploaded by the server. Captures made for an assistant are never put on your clipboard, never uploaded by LilLabr even with Save captures on, and never replace your own latest capture in the panel. It needs Node 20 or newer, Chrome with LilLabr enabled, and an AI app that can run a local stdio MCP server. The package is on npm, so there is nothing to install: npx -y lillabr-mcp --print-config claude-desktop prints the exact text for Claude Desktop (or claude-code, cursor or generic for other apps), and claude mcp add lillabr -- npx -y lillabr-mcp adds it to Claude Code.
Apps that only accept remote servers, such as claude.ai in the browser or ChatGPT on the web, cannot use it. For those, LilLabr 1.0.6 offers a separate hosted connector link: in the panel, sign in with Google (only this link needs it; capturing never does), press Set up next to Claude or ChatGPT under Finish setup (or Connect MCP tools under “You’re all set” once Figma is connected), read the short disclosure, then Copy link and paste the link into the app. A capture the app asks for passes through LilLabr’s cloud, encrypted with a key from the link but not end to end, so the developer could read it while it exists. Anyone who has the link can ask for captures, and each website still needs your Allow in a window of LilLabr’s own. If you want nothing in the cloud, use the local link this page describes.
Pairing: you approve both ends.
- Open Chrome with LilLabr on any normal web page and ask your assistant to capture something or to check LilLabr’s status. The toolbar icon shows AI while a request is waiting.
- Open the LilLabr panel with the toolbar icon if it is not open already. It shows a six-digit code under “An AI assistant wants to connect.” The assistant does not have it.
- Tell the assistant the code. It hands the code to the server, which answers within a few seconds whether it matches.
- When the assistant says the code matches, click Allow in the panel. Pairing completes only when both have happened. If the code does not match, read it again; if it still does not match or you did not expect the request, click Don’t allow.
- On a fresh install, the assistant cannot capture until you have ticked I agree to the Privacy Policy and Terms on the panel’s capture step (the Privacy Policy and the Terms of Use) and made your first capture. After Allow the panel says “One more step before it can capture”, and the assistant is told to ask you. LilLabr never agrees on your behalf.
Three wrong codes make the assistant wait a minute. After you decline, LilLabr leaves that assistant alone for about ten minutes, and a request expires after ten minutes. Once paired, the connection is automatic; the panel says “AI assistant connected” and every capture it starts shows a notice. Disconnect assistant, under AI assistant in the panel’s Settings, deletes the secret on both sides and forgets the websites you allowed.
Which websites it may capture.
Pairing lets the assistant ask; it does not let it capture everything. The first time the assistant wants a website, including the tab you are on, LilLabr opens a small window of its own and asks you. The window names the site, says when it is on your own computer or network, and reminds you that a capture includes anything you are signed in to there. Allow is remembered until you disconnect or choose Forget allowed websites in Settings; Don’t allow is remembered for ten minutes; closing the window counts as no for that one request. Websites are matched by origin, so a dev server on two different ports is asked about twice. Until you have allowed a site, the assistant is not even told which page you are on.
A page the assistant asks for opens in a window of its own that does not take focus, is captured and closed. When you ask for the page you are on, the assistant captures that tab, scrolling through it for a full-page capture and putting it back where it was.
The nine tools.
| Tool | What it does | Notes |
|---|---|---|
lillabr_status | Says whether Chrome is connected or what to do next, and lists captures still running and those finished in the last 30 minutes. | Read-only. |
lillabr_confirm_pairing | Gives the server the code you read from the panel. | The only tool that takes part in pairing. Does nothing without the code. |
lillabr_capture | Captures a URL in its own window, or the tab you are on, once you have allowed that website. Saves the .labr and returns its path, counts, links and a small preview. | Modes: full page (the default) or screen. There is no element mode through this link. |
lillabr_capture_result | Waits for a capture that took longer than one call. | A call never runs longer than 45 seconds because AI apps cut tool calls at about a minute; a long capture returns still_capturing with a job instead of being started twice. |
lillabr_capture_flow | Captures up to 10 URLs in order, 3 seconds apart. | A call that would run too long stops and lists what is left. |
lillabr_list_captures | Lists saved captures, newest first, in pages. | Read-only. |
lillabr_describe_capture | A summary: sizes, background, layer counts, fonts, type scale, headings, colors, sections, images and warnings. | Read-only. |
lillabr_read_layers | The layer tree below a path, paged, or just the text layers. | Layer text is cut at 300 characters per layer. |
lillabr_get_image | One image from a capture, or an SVG as text. | PNG, JPEG, GIF and WebP up to 1 MiB and 8,000 px a side. |
Capturing usually takes 5 to 60 seconds. Chrome allows 30 captures an hour through this link and runs one at a time. Only http and https pages can be captured, never chrome:// or file:// pages and never addresses with a user name or password. A capture with more than 50,000 layers is not read, and a capture file is limited to 256 MiB.
What goes where.
| What | Where | Who can read it |
|---|---|---|
| Captures (.labr) | ~/Lillabr/captures/ | You. Folder mode 700, files 600 on macOS and Linux; in your user profile on Windows. |
| List of captures | ~/Lillabr/index.json | You. |
| Server id and pairing secret | ~/.lillabr/server.json | You. |
| Pairing secret and allowed websites, Chrome’s side | LilLabr’s extension storage in your Chrome profile | The extension only; web pages cannot read it. |
| What the assistant reads from a capture | Sent to the AI app you connected | Whoever runs that AI, as with anything you paste into its chat. |
A capture holds what the page showed you: text, images and form values that were on screen, with passwords masked. Unless the app asks for none, Chrome also hands the app a small JPEG screenshot of the visible part of the page with the capture (for a flow of several pages, only when the app asks, and then for at most four of them); it shows whatever was on screen, including form values the capture masks, and LilLabr does not keep it. In what the assistant is told, link addresses lose credentials and query parameters named like secrets, which is a rule of thumb by name. The server’s logs never contain page content or the secret. The .labr file is a plain ZIP, so you can open any capture yourself.
The security model, in plain words.
- A web page cannot use this. The server accepts only the LilLabr extension’s origin, and only on the exact loopback address.
- Another program cannot pretend to be this server. After pairing, each side proves it knows a shared secret with a challenge made fresh for every connection and tied to the port.
- Pairing needs you at both ends. Chrome shows the code only to you; the assistant must be told it by you; Allow must be clicked in Chrome.
- It can only do what is listed above. It cannot read your clipboard, cookies, passwords or files, run scripts, or upload anything. It can open web addresses in your Chrome with your logins, which is why each website is asked about first, in a window a web page cannot reach, and why captures are capped at 30 an hour.
- Page text is untrusted. A captured page may contain text written to trick an AI. The tools say so in their results, strip invisible characters and cap every string, but no filter is perfect; keep an eye on what your assistant does after reading a page you do not trust.
Out of scope: malware already running as you, and other people’s programs on a shared computer, which can reach the same local port. The complete protocol and its known limits are documented with the server. Related: WebMCP tools for agents that run inside the browser, and the privacy policy’s sections on the AI assistant link and the AI connector link.