Steel MCP Server

Give Claude, Cursor, VS Code, or another MCP client a Steel-managed Chromium browser. Use
Steel to read pages that block a plain fetch, take screenshots, or work
through interactive sites by clicking, typing, and filling forms.

Unlike v1's screenshot-and-numbered-box loop, v2 reads pages as markdown or accessibility trees,
shows small screenshots through MCP image blocks without using pixels for interaction, and makes browser sessions explicit.

> Status: 2.0.0-rc.8. Run the server locally over stdio, or run the hosted endpoint
> yourself — it is in the package and documented below. mcp.steel.dev is not live yet.

<a href="https://glama.ai/mcp/servers/steel-dev/steel-mcp-server"></a>

Example prompts

| Ask | What happens |
|---|---|
| "Read this page and summarize the pricing table." | One steel_scrape. No browser session, nothing to release |
| "Find and compare prices for this product across these three shops." | Three stateless reads, or a session where a shop needs JavaScript to render |
| "Sign in to my account and check the total on last month's invoice." | A session, a snapshot, and a handoff to you at the login wall — the server never guesses at a password |
| "Fill out this application form with the details from my CV." | The agent fills ordinary fields, then steel_session_handoff lets you choose the CV locally in the same browser |
| "Screenshot the top of this article for a slide." | One steel_screenshot, shown inline when small enough and always linked for download |
| "Show me what happened in my last browser session." | steel_session_diagnostics reads the latest released session. No new browser is started |
| "Replay my last finished browser session." | steel_session_replay returns the latest finished session's Steel dashboard link. No browser is started |

What it exposes

The default browse profile is sixteen tools:

| Tool | What it does |
|---|---|
| steel_scrape | Read a budgeted page plus bounded links/metadata. Starts no browser session |
| steel_screenshot | Capture a URL for a person or a live session for model-visible visual verification; URL captures support proxies |
| steel_pdf | Render a page to PDF and return a link; supports proxies |
| steel_session_create | Start a browser session you can interact with |
| steel_session_release | Shut it down and stop the meter |
| steel_navigate | Point a session at a URL |
| steel_snapshot | Read the page as an accessibility tree with @eN references |
| steel_find | Locate elements by text, safe regex, or role without reading the whole page |
| steel_act | Click, type, fill a form, select, hover, scroll, press a key, go back, dismiss overlays |
| steel_wait_for | Wait for named text, a selector, or a URL |
| steel_session_diagnostics | Read activity or rediscover this credential's live handles without starting a browser |
| steel_session_handoff | Pause while you take exclusive control of the same browser, then return it to the agent |
| steel_session_replay | On an explicit watch/replay request, return a finished session's safe dashboard link |
| steel_batch | Run known reversible steps in one call; hand off before login, payment or final confirmation |
| steel_session_options | Plan non-default setup and safely discover saved profile IDs or managed-login namespaces |
| steel_session_live_view | Feeds the inline viewer its connection details. Hosts hide it from the model |

Set STEEL_PROFILE=scrape to expose only the three stateless read tools. They never start a browser
session. The default browse profile adds the thirteen session tools above.

Saved identity and non-default sessions

Call steel_session_options with an absolute target URL, a read, interact, or account goal,
and only the needs the task explicitly requires. Plain reads still recommend steel_scrape.
Non-default plans return a short-lived signed configuration for steel_session_create; the token
is bound to this Steel credential and expires after ten minutes.
When a request says "my profile", "saved login", or "Steel credentials", discover the account
options first; never guess a profile UUID or credential namespace.

{
  "url": "https://example.com/account",
  "goal": "account",
  "needs": ["persist_profile", "location"],
  "country": "DE"
}

The account catalog exposes only profile UUID/status/timestamps and exact-origin credential
namespace/timestamps. Stored values, cookies, fingerprints, proxy configuration, usernames,
passwords, and TOTP secrets never enter model context. Select a READY profile by UUID; names are
not guessed. Loading a profile is read-only unless persist_profile was explicitly planned. With
persistence, Steel creates or updates the profile on release; it may be UPLOADING before it
becomes READY. One existing profile cannot have two persistent writers through this MCP at once.
Managed login uses the returned exact-origin namespace and may auto-submit a matching form.

STEEL_PROFILE=browse|scrape selects this server's tool preset and is unrelated to saved browser
profiles. Profile discovery, persistence, credentials, proxies, and CAPTCHA assistance are Steel
Cloud features; self-hosted deployments return a named unsupported-capability result.

Watching, and taking over

On a host that supports MCP Apps — Claude among them — steel_session_create renders the running
browser inline in the conversation. Frames are painted to a canvas from the session's own CDP
screencast. Take control acquires a renewable exclusive lease before clicks, typing or scrolling
go back to the page, so the agent and a person cannot drive at the same time. Hand back returns
ownership. During a steel_session_handoff, accept the pending handoff prompt afterward; the agent
then re-reads the page before continuing.
Chat hosts size an inline view for a card rather than a browser, so the view asks for the height its
page needs and offers Full screen — on a host that grants it; the control removes itself on one
that does not.

steel_session_handoff invokes that flow for sensitive information, review, manual writing, local
files, or whenever you ask to take over. Login walls and CAPTCHAs can invoke it automatically. The
tool answers input_required, waits for hand-back, and verifies the current page before the agent
continues. Clients with URL elicitation open Steel's external player when no inline app is available.

When a remote file input opens while you control the inline viewer, Choose local file opens a
trusted local picker. After confirmation, up to 5 MB travels over the session-scoped browser socket
directly into that page. The model and MCP server receive neither the local path nor the file bytes,
and the file is not staged in Steel's persistent Files API. A client that cannot render the inline
viewer reports local upload as unavailable instead of pretending it can read your machine.

For a browser that has already finished, explicitly ask to watch or replay it and pass its Steel
dashboard UUID to steel_session_replay, or omit the UUID to select the latest released session.
This release returns a sanitized Steel dashboard link. Inline finished-session playback is disabled
until its browser asset can be hosted immutably without inflating the MCP Apps payload.

Quick start

Claude for macOS or Windows

Build the desktop extension and open it — Claude installs it and prompts for your
Steel API key. Nothing else to configure, and no Node
install of your own is needed at runtime.

git clone https://github.com/steel-dev/steel-mcp-server.git
cd steel-mcp-server
npm install
npm run pack:mcpb
open "build/steel-mcp-$(node -p 'require("./package.json").version').mcpb"    # Windows: double-click it

When replacing an installed bundle, fully quit and reopen Claude after the installer finishes, then
start a new conversation so Claude reads the new tool catalog instead of reusing an older one.

Steel Cloud

You need Node.js 20 or newer and a
Steel API key. It is not published to npm yet, so install
it from source:

git clone https://github.com/steel-dev/steel-mcp-server.git
cd steel-mcp-server
npm install

npm install also builds the server. To use it with Claude Desktop on macOS, add this to
~/Library/Application Support/Claude/claude_desktop_config.json:

{
  "mcpServers": {
    "steel": {
      "command": "node",
      "args": ["/absolute/path/to/steel-mcp-server/dist/stdio.js"],
      "env": {
        "STEEL_API_KEY": "<your-steel-api-key>"
      }
    }
  }
}

Or with Claude Code:

claude mcp add steel -e STEEL_API_KEY=your-steel-api-key -- node "$PWD/dist/stdio.js"

Self-hosted steel-browser

Run the steel-browser image, then point the server at
it. No API key is needed or sent:

{
  "mcpServers": {
    "steel": {
      "command": "node",
      "args": ["/absolute/path/to/steel-mcp-server/dist/stdio.js"],
      "env": {
        "STEEL_LOCAL": "true"
      }
    }
  }
}

For Claude Code, run this from the cloned steel-mcp-server directory:

claude mcp add steel -e STEEL_LOCAL=true -- node "$PWD/dist/stdio.js"

Self-hosted Steel runs one browser session at a time. It does not support Steel-managed proxies,
browser profiles, managed credentials, or CAPTCHA solving. The server returns a specific explanation if a tool
requests one of those cloud-only features.

Configuration

| Variable | Default | Meaning |
|---|---|---|
| STEEL_API_KEY | — | Required for Steel Cloud. Never sent to a self-hosted deployment |
| STEEL_LOCAL | false | true drives a local steel-browser and waives the API key |
| STEEL_BASE_URL | https://api.steel.dev | Steel REST base URL. A trailing /v1 is fine either way |
| STEEL_PROFILE | browse | scrape or browse |
| STEEL_SESSION_TIMEOUT_MS | 900000 | Default immutable lifetime. A create request may choose another value up to 24 hours and the account maximum |
| STEEL_INACTIVITY_TIMEOUT_MS | 600000 | Idle release. Supports a normal handoff/continuation window but may retain an abandoned browser for about 10 minutes |
| STEEL_MAX_SESSIONS | 10 | Concurrent sessions this server will hold |
| STEEL_CONNECT_URL | wss://connect.steel.dev | CDP endpoint, derived from the base URL when self-hosted |

Logs are structured JSON on stderr; stdout carries nothing but JSON-RPC.

Session continuity is bounded by both inactivity and immutable expires_at. A visible viewer alone
does not reserve a session. Explicit handoff suspends local idle reclamation only until hard expiry,
and real human browser input resets Steel's inactivity clock. Release finished sessions promptly.

Running the hosted endpoint

The hosted entrypoint needs two packages a default install deliberately leaves out, so that a desktop
or npx user never carries the hosted stack:

```bash
npm install ioredis @modelcontextprotocol/node