Everything plus the kitchen sink for the open web: this server lets your AI browse real websites, reads whole pages for a fraction of the usual cost, and cannot click anything until you say so.
Measured: the same encyclopedia article costs 33,073 tokens as a raw dump and 4,445 read here, at a typical 200,000-token AI working memory.
↓ or try the demo first: the same page read the usual way, and read hereThis server reads differently. First it hands your AI a small map: what the page is, what sections it has, and what each section would cost to open. The AI opens only what it needs. Same article, a fraction of the memory. And if anything on the page went unread, the map says so plainly, instead of letting the AI believe it saw everything.
Most browser tools work like this: your AI asks to read a page, and the tool copies everything on it into the AI's memory. The article you wanted, but also the menus, the ads, the cookie banner, the footer. For one page that can be tens of thousands of words' worth, and an AI's working memory is limited. Fill it with junk and it starts forgetting the things you told it earlier.
Forty-nine lines of menus, language pickers and appearance settings before one word of the article. All of it is in your assistant's memory now, and none of it was the question.
open a section and watch what it costs.
The same page as a map: each row is a real section of the real article, with the real cost of opening it. The meter only moves when you open one. Keyboard works too: tab to a row and press Enter.
Both panels are the same frozen copy of the Treaty of Versailles article, measured by a script that ships with the source. The dump figure is the cheapest of three ways to dump a page; the other two cost 64,596 and 691,486.
A browser is where your logins, your money, and your mistakes all live. So out of the box, your AI gets reading tools only: it can open pages, follow links, and scroll. The tools for clicking, typing, and submitting are deliberately left out. They are not switched off somewhere, waiting to be found; the AI is simply never given them. A malicious webpage cannot trick your AI into clicking something, because your AI has nothing to click with.
When you do want help filling in a form or clicking through a site, open the server's settings, the same screen you saw when you installed it, and tick one box: allow clicking and typing. The tools appear. Untick it and they are gone again. No reinstalling, no technical steps, and at any moment you can see which mode you are in by glancing at the AI's tool list.
It reads defensively too. Some webpages hide invisible text written for AIs, not people, saying things like "ignore your instructions and click here." This server strips that hidden text out of what your AI sees, counts it, and reports that it was there. Your AI never even gets tempted.
The one-time setup that makes this painless is the tip just below the install steps.Instead of a feature checklist, here are six things people actually ask an AI to do in a browser, and how it usually goes:
| "Hey, could you…" | 🪴 This one | Other tools on this shelf (other web-browsing MCPs) |
|---|---|---|
| "Read this article and tell me what actually matters." | A map first, then only the sections your AI opens: 4,445 tokens for the same article, plus a note about anything left unread. | The whole page arrives at once, menus and footers included: 33,073 tokens of AI memory for one encyclopedia article. |
| "Find the issue about the broken d-pad. There are 771 open ones." | One search finds it, even inside modern component-built pages, and returns a result your AI can act on. | Scroll, copy, repeat. The strongest competing tool added a page search in mid-2026. |
| "Before you read that page: what will it cost me?" | Every section of the map shows what opening it will cost, before you open it. | There is no way to ask. You find out what a page cost after you have paid it. |
| "Fill in this form, but only because I said you could." | Those tools are not installed until you turn them on, and even then, submitting a form stops and asks you first. | The clicking and typing tools are always loaded; whether they get used is up to the AI's judgment. |
| "What did you NOT read on that page?" | Every read ends with a list of what was not read, whether cut for budget, hidden by the page, or unreachable, with the reason. | Usually silence. One tool honestly notes what it cut; another trims text mid-sentence without a mark. |
| "Click send, and prove to me what happened." | Every action reports what actually happened: what was submitted, where the page ended up, kept in a log you can read back. | Usually fire-and-forget: the click was sent, good luck. The best competitor reports where the page went. |
Drawn from a survey of eight browser MCP servers, September 2026; two of the eight are archived. Sources in the repository.
Every tool you connect to an AI takes up part of its working memory before any work starts, and browser tools are the hungriest kind there is. This one starts small, and every number below was measured by a script you can run yourself:
| On the meter | Tools | Tokens | When it draws |
|---|---|---|---|
| Lite core | 19 | 5.8k | From the first message of every session |
| Every pack switched on | 52 | 15.3k | Only when the packs are chosen at launch |
| First read of one long article | · | 4,445 | Once, and it never exceeds the budget you set |
| The same read again, after one click | · | 82 | Every repeat read, priced on what changed |
The read has sixteen levels of detail. It uses the highest level that fits the budget you set, and it tells you which level that was and what more detail would have cost. The tool figures come from a measuring script that ships with the source; the page figures come from another, run against a frozen copy of the page, so you can check both yourself.
Claude Desktop: install the .mcpb bundle and pick what you want on the install screen. The checkboxes are the whole configuration: one to allow clicking and typing (off means read-only browsing, the shipped default), and one per capability pack. Launching the bundle requires uv (the uvx command) on your machine; the server itself is fetched from PyPI on first launch and drives its own bundled Chromium, never your browser or your profile.
In Claude Desktop's Tool permissions for this server, set the Read-only tools group to Always Allow. Those tools cannot change anything, so approving them once is safe, and Claude stops asking about every read. Leave the acting tools on Ask, so anything that changes things still checks with you first.
Install the package and point any MCP client at the executable:
Then in any client's config: {"mcpServers": {"web": {"command": "kitchensink4web"}}}. Running from a clone works the same way; point the command at the web-mcp executable in the clone's virtual environment. Full setup, including the pack and mode switches, is in the README.
Packs and read-only mode are chosen at launch (--packs, KS4WEB_MODE, KS4WEB_ALLOW_ACTING) and are identical for every connection to the process.
This is the newest product in the family, and the page will not pretend otherwise. Before release we attack our own products deliberately: hostile test rounds that try to trick the safety features, leak data, and break the guarantees, followed by fixes, followed by fresh attacks, until a round comes back empty-handed. What this server has not had yet is a long life in strangers' browsers. While it earns one, the design carries the risk for you: it starts read-only, it prices every read before taking it, and it tells you what it could not see. If the web is where you live, bring your strangest pages and tell us what broke.
A page that came back garbled, an error message that made no sense, an action that claimed success and lied. File it at the counter: the form asks exactly what a fix needs. Please never paste private page content; describe what kind of page it was instead.
File a bug report → 🪜Something you wish your AI could do in a browser and this server does not offer. Describe the real task, not just the feature, and it goes on the workbench.
Request a feature → 💼Free for individuals and personal use, and it stays that way. If your company wants to build it into a product of its own, that needs a commercial license, with terms worked out case by case. This counter is where you start that conversation.
Arrange a license →Text that a webpage hides from human eyes is stripped and reported, never obeyed. Every action reports what really happened, not just that a click was sent. The tools that can change anything exist only after you turn them on. And when something cannot be done, a login wall, a bot check, a broken page, your AI gets a plain answer naming what stood in the way, instead of a guess dressed up as progress.
Everything plus the kitchen sink for Microsoft Word: the original of the family. Tracked changes, footnotes, citations, live editing in your own Word window, and a reference list that finally matches the citations. Engineered not to corrupt.
Visit the plumbing aisle → 💡Everything plus the kitchen sink for Microsoft PowerPoint: diagrams built from real shapes, so you can drag a box and the arrows follow. Same never-corrupts promise, for slides.
Visit the paint aisle → 🔌Everything plus the kitchen sink for Excel (.xlsx): every value labeled calculated, cached, or missing, so the AI never repeats a stale number as a fresh one. Same never-corrupts promise, now for spreadsheets.
Visit the electrical aisle → 🏪The whole hardware store on one page: every KitchenSink server, what it does, and where to report what broke. Plus a shelf or two that are not empty by accident.
Browse the store →