Give your LLM access to your accounts. One click in Chrome, and your MCP servers can shop, browse, and manage services on your behalf.
Most useful sites don't have APIs. They have login sessions. MCP Auth Bridge is a Chrome extension that captures your session credentials (cookies, bearer tokens) and writes them to disk so MCP servers can pick them up. Log into a site in Chrome, click Save, and your AI can use that session to search products, manage wishlists, place grocery orders, and more.
MCP servers are great at automating tasks, but they hit a wall the moment a site requires authentication. You can't just paste a session cookie into a config file; most auth cookies are httpOnly (invisible to JavaScript) and bearer tokens rotate constantly.
This started with a specific problem: getting Amazon's httpOnly auth cookies into an MCP server so Claude could search and shop. A Chrome extension can read those cookies where bookmarklets and scripts can't. That approach worked well enough that it made sense to generalize it. Now adding a new site is just a JSON entry.
| Site | What the MCP server does | Auth method |
|---|---|---|
| Deku Deals | Nintendo eShop deal tracking. Search games, check prices, manage wishlists, find sales. | Session cookie |
| Amazon | Product search, order history, wishlist management on Amazon.ca. | httpOnly auth cookies |
| PC Express | Grocery shopping at Real Canadian Superstore. Search products, add to cart, reorder past purchases. Originally built by FireBall1725. | Bearer token + cart ID from API calls |
| Roll20 | Read a D&D character sheet and campaign data (handouts, chat) directly from Roll20's Firebase Realtime Database. | Firebase ID token (minted on-demand) |
| front-rich | Pull per-message repeat-open history from Front's undocumented /seens endpoint (the documented /seen only gives first-seen per recipient). Multi-workspace via user-typed labels. |
Session cookies + page-context (cell, company) |
| bird (X / Twitter) | Read X lists, home timeline, mentions, and search from the terminal via X's internal GraphQL — no paid API. Powers a nightly list digest. Consumer wrapper: consumers/bird-x. |
httpOnly session cookies (auth_token + ct0) |
The pattern works for any site where you log in through a browser. If the site uses cookies, bearer tokens, or a Firebase-style ID token (which covers nearly all of them), you can add it.
You define sites in sites.json. Each entry specifies the domain, what kind of credentials to capture, and where to write them. Three capture methods:
Cookies grab session cookies via Chrome's cookies API, which can read httpOnly cookies that regular JavaScript can't touch. This is the simpler path and works for most sites.
Bearer intercept patches fetch() and XMLHttpRequest on the page to capture OAuth tokens from API calls as they happen. More involved, but necessary for sites like PC Express where the token isn't in a cookie.
Firebase ID token runs an on-demand script in the page to call firebase.auth().currentUser.getIdToken() and read relevant window globals. Useful for Firebase-backed sites (e.g. Roll20) where data flows over WebSocket and there's no Authorization header to intercept.
Front session captures Front's httpOnly session cookies (front.id, front.id.sig, front.csrf) AND derives the workspace's cell, company, and workspace_subdomain by URL parsing + a same-origin /api/1/me probe. The save prompts for a label (jumbo, xe, etc.) so multiple Front workspaces coexist in one file as a dict of labeled sessions. The native host's front_session_jar format upserts a single label per save — other labels are untouched. Consumer: front-rich-mcp reads ~/.mcp-credentials/front-sessions.json[label] for the pull_repeat_opens tool.
When you click Save, the extension sends credentials to a native messaging host (a small Python script) that writes them to ~/.mcp-credentials/ in the right format. MCP servers read that file fresh on each call. No restarts, no config file juggling.
Open chrome://extensions, enable Developer mode, click Load unpacked, and select this folder. Note the Extension ID.
chmod +x install.sh
./install.sh <your-extension-id>Close and reopen Chrome so it picks up the native messaging registration.
- Browse to a configured site and log in
- Click the MCP Auth Bridge extension icon
- Click Save for the site you want
- Your MCP server picks up the fresh credentials on its next call
That's it. No terminal commands, no manual token copying, no restarting Claude Desktop.
For cookie-based sites, add an entry to sites.json and reload the extension. No code changes.
{
"mysite": {
"label": "My Site",
"domains": ["mysite.com"],
"capture_method": "cookies",
"cookies": ["session_id"],
"output_path": "~/.mcp-credentials/mysite.json",
"output_format": "cookie_jar"
}
}For bearer intercept sites, you'll also need to add content script matches in manifest.json and URL patterns in content-scripts/token-interceptor.js.
The config is just JSON, so you can paste a prompt into Claude, ChatGPT, or whatever you use and have it write the entry for you. Here are some examples:
Cookie-based site (simplest case):
I use MCP Auth Bridge to capture browser credentials for my MCP servers. Add a new cookie site to my sites.json for Best Buy Canada (bestbuy.ca). I need the session cookies so my MCP server can check order status and track prices. Use cookie_jar format and save to ~/.mcp-credentials/bestbuy.json. Use a blue color.
Cookie site where you need all cookie metadata:
Add an entry to my MCP Auth Bridge sites.json for eBay (ebay.com, ebay.ca). I need the full cookie array including httpOnly flags and expiration dates because the MCP server replays the entire cookie jar. Use cookie_editor format, save to ~/mcp-server-ebay/cookies.json, and use an orange-red color.
Bearer token site with .env output:
I'm adding Instacart to my MCP Auth Bridge setup. Instacart uses bearer tokens in its API calls (instacart.com, instacart.ca). I need bearer intercept with dotenv output to ~/instacart-mcp-server/.env. Map access_token to INSTACART_TOKEN. Also write a credential JSON file to ~/.mcp-credentials/instacart.json so my server can live-reload without parsing dotenv. Use a green color. Remind me what I need to change in manifest.json and token-interceptor.js too.
Your AI will generate the JSON entry and, for bearer sites, walk you through the manifest and content script changes. The popup picks up new sites automatically when you reload the extension.
cookie_jar is a simple JSON object with cookie names and values, a domain, and a timestamp. Good for most MCP servers.
cookie_editor writes the full cookie array in the format the Cookie-Editor browser extension uses. Useful when the MCP server needs all cookie metadata (expiration, httpOnly flags, etc.).
dotenv writes a .env file with configurable variable mapping, plus an optional JSON credential file for servers that want live-reload without parsing dotenv.
bearer_json writes a flat JSON file with {type, access_token, <extra_fields…>, captured_at}. Generic — extra fields from the site config flow through verbatim, so the MCP server just reads one file on startup. Used by Roll20.
mcp-auth-bridge/
sites.json Site config (the only file you edit to add sites)
manifest.json Chrome extension manifest (Manifest V3)
background.js Service worker that routes by site config
popup.html + popup.js One-click UI with a card per configured site
content-scripts/
token-interceptor.js Patches fetch/XHR to capture bearer tokens
bridge.js Relays tokens from page context to extension
native-host/
credential_host.py Writes credentials to disk in the right format
com.mcp.credentials.json Native host manifest template
install.sh One-time setup for the native messaging host