Tether-MCP-server

*The problem.* Testing and QA is the highest-effort, least-automated step in the web development workflow. Manual testing is slow and unrepeatable. Script-based automation (Playwright, cloud browsers) runs in a clean browser profile, so it cannot reach the state that matters — the developer's real, logged-in session with SSO, cookies, and staging tokens. Meanwhile AI coding partners can write the fix but cannot verify it: there is no safe way for an agent to click through the app the developer is already logged into. The few agentic browsers that exist are locked to one vendor's model, and Black Hat USA 2026 research (Zenity's "PleaseFix") demonstrated zero-click takeover chains across five shipping agentic browsers. Developers are asked to hand their authenticated sessions to agents with no approval step, no redaction, no audit trail, and no off switch. *The solution.* Tether is a governed control plane between any MCP-capable AI and the developer's real Chrome. A Manifest V3 extension plus a local daemon expose 40 frozen MCP tools (browser_snapshot, browser_find, browser_click, browser_fill_form, browser_submit, …) addressed by stable element refs, not brittle selectors. The developer runs one command, loads the extension, and points any MCP client — IBM Bob 2.0, Claude Code, Cursor, ChatGPT — at the loopback endpoint. The agent then performs real QA in the real session: log in, add to cart, fill the form, stop before submit. *How it improves the workflow.* Every tool call is decided in exactly one place — the extension's policy engine: default-deny per domain, risk tiers (T0 read, T1 write, T2 destructive), and any irreversible action raises an approval card showing a diff of exactly what will happen. Page content is tagged untrusted, so prompt injection cannot trigger tools; secrets are redacted before any output; every action lands in a hash-chained audit log; a kill switch quiesces everything in under 200 ms. No evaluate_script exists at all — the exact primitive PleaseFix exploited. *Target users:* developers and QA engineers who already use AI coding tools. Interaction is conversational: "Run checkout and stop before paying" → snapshot → ref → click → approval → verified result with evidence. *What's original:* neutrality plus governance — the same session, same tools, from any MCP client, with policy enforced locally so nothing leaves the machine in the default mode. No vendor-locked agent can claim that; no local automation MCP server ships a policy engine. *Proof:* 438 unit tests across 69 files, 13 Playwright E2E scenarios, 50/50 live eval tasks, 40 tools in ~4.3k tokens, kill switch < 200 ms — built and released (v0.1.0) in a 48-hour build with IBM Bob 2.0.