{
  "markdown": "# Kernel MCP Server\n\n[![MIT License](https://img.shields.io/badge/License-MIT-blue.svg)](https://opensource.org/licenses/MIT)\n[![Node.js](https://img.shields.io/badge/Node.js-18%2B-green.svg)](https://nodejs.org/)\n[![Next.js](https://img.shields.io/badge/Next.js-15.3%2B-black.svg)](https://nextjs.org/)\n[![smithery badge](https://smithery.ai/badge/kernel)](https://smithery.ai/server/kernel)\n\nA [Model Context Protocol (MCP)](https://modelcontextprotocol.io/) server that provides AI assistants with secure access to [Kernel platform](https://onkernel.com) tools and browser automation capabilities.\n\n![Architecture Overview](public/architecture_overview.png)\n\n🌐 **Use instantly** at `https://mcp.onkernel.com/mcp` — no installation required!\n\n## What is this?\n\nThe Kernel MCP Server bridges AI assistants (like Claude, Cursor, fx, or other MCP-compatible tools) with the Kernel platform, enabling them to:\n\n- 🚀 Deploy and manage Kernel apps in the cloud\n- 🌐 Launch and control headless Chromium sessions for web automation\n- 📊 Monitor deployments and track invocations\n- 🔍 Search Kernel documentation and inject context\n- 💻 Execute arbitrary Playwright code against live browsers\n- 🎥 Record MP4 video replays of browser automation\n\n**Open-source & fully-managed** — the complete codebase is available here, and we run the production instance so you don't need to deploy anything.\n\nThe server uses OAuth 2.0 authentication via [Clerk](https://clerk.com) to ensure secure access to your Kernel resources. During authorization, users can grant organization-wide access or restrict the resulting access and refresh tokens to one Kernel project. Project-scoped tokens cannot switch projects; organization-wide authorization remains available for existing workflows.\n\nFor a deeper dive into why and how we built this server, see our blog post: [Introducing Kernel MCP Server](https://blog.onkernel.com/p/introducing-kernel-mcp-server).\n\n## Setup Instructions\n\n### General (Transports)\n\n- Streamable HTTP (recommended): `https://mcp.onkernel.com/mcp`\n- stdio via `mcp-remote` (for clients without remote MCP support): `npx -y mcp-remote https://mcp.onkernel.com/mcp`\n\nUse the streamable HTTP endpoint where supported for increased reliability. If your client does not support remote MCP, use `mcp-remote` over stdio.\n\nKernel's server is a centrally hosted, authenticated remote MCP using OAuth 2.1 with dynamic client registration.\n\n## Quick Setup with Kernel CLI\n\nThe fastest way to configure the MCP server is using the [Kernel CLI](https://github.com/onkernel/cli):\n\n```bash\n# Install the CLI\nbrew install onkernel/tap/kernel\n# or: npm install -g @onkernel/cli\n\n# Install MCP for your tool\nkernel mcp install --target <target>\n```\n\n### Supported Targets\n\n| Target         | Command                                   |\n| -------------- | ----------------------------------------- |\n| Cursor         | `kernel mcp install --target cursor`      |\n| Claude Desktop | `kernel mcp install --target claude`      |\n| Claude Code    | `kernel mcp install --target claude-code` |\n| VS Code        | `kernel mcp install --target vscode`      |\n| Windsurf       | `kernel mcp install --target windsurf`    |\n| Zed            | `kernel mcp install --target zed`         |\n| Goose          | `kernel mcp install --target goose`       |\n| fx             | `kernel mcp install --target fx`          |\n\nThe CLI automatically locates your tool's config file and adds the Kernel MCP server configuration.\n\n## Connect in your client\n\n### Claude\n\n> Our remote MCP server is not compatible with the method Free users of Claude use to add MCP servers.\n\n#### Pro, Max, Team & Enterprise (Claude.ai and Claude Desktop)\n\n1. Go to **Settings → Connectors → Add custom connector**.\n2. Enter: **Integration name:** `Kernel`, **Integration URL:** `https://mcp.onkernel.com/mcp`, then click **Add**.\n3. In **Settings → Connectors**, click **Connect** next to `Kernel` to launch OAuth and approve.\n4. In chat, click **Search and tools** and enable the Kernel tools if needed.\n\n> On Claude for Work (Team/Enterprise), only Primary Owners or Owners can enable custom connectors for the org. After it's configured, each user still needs to go to **Settings → Connectors** and click **Connect** to authorize it for their account.\n\n#### Claude Code CLI\n\n```bash\nclaude mcp add --transport http kernel https://mcp.onkernel.com/mcp\n# Then in the REPL run once to authenticate:\n/mcp\n```\n\n### Cursor\n\n### Automatic setup\n\n[![Install MCP Server](https://cursor.com/deeplink/mcp-install-dark.svg)](https://cursor.com/en/install-mcp?name=Kernel&config=eyJ1cmwiOiAiaHR0cHM6Ly9tY3Aub25rZXJuZWwuY29tL21jcCJ9)\n\n#### Manual setup\n\n1. Press **⌘/Ctrl Shift J**.\n2. Go to **MCP & Integrations → New MCP server**.\n3. Add this configuration:\n\n```json\n{\n  \"mcpServers\": {\n    \"kernel\": {\n      \"url\": \"https://mcp.onkernel.com/mcp\"\n    }\n  }\n}\n```\n\n4. Save. The server will appear in Tools.\n\n### OpenCode\n\nAdd the following to your `~/.config/opencode/opencode.jsonc`:\n\n```jsonc\n{\n  \"mcp\": {\n    \"kernel\": {\n      \"type\": \"remote\",\n      \"url\": \"https://mcp.onkernel.com/mcp\",\n    },\n  },\n}\n```\n\nThen authenticate using the OpenCode CLI:\n\n```bash\n# Authenticate with Kernel\nopencode mcp auth kernel\n\n# If you need to re-authenticate, first logout then auth again\nopencode mcp logout kernel\nopencode mcp auth kernel\n```\n\n### fx\n\nConfigure Kernel with the Kernel CLI:\n\n```bash\nkernel mcp install --target fx\n```\n\nOr add Kernel to the `mcp` map in `~/.fx/mcp.json` manually:\n\n```json\n{\n  \"mcp\": {\n    \"kernel\": {\n      \"type\": \"http\",\n      \"url\": \"https://mcp.onkernel.com/mcp\",\n      \"oauth\": {}\n    }\n  }\n}\n```\n\nStart fx, or reload the configuration in an existing session:\n\n```text\n/mcp reload\n```\n\nThen authenticate with Kernel:\n\n```text\n/mcp auth kernel --open\n```\n\nAuthorize access in the browser window that opens. Run `/mcp list` to verify that Kernel is connected.\n\n### Goose\n\nClick [here](goose://extension?cmd=npx&arg=-y&arg=mcp-remote&arg=https%3A%2F%2Fmcp.onkernel.com%2Fmcp&timeout=300&id=kernel&name=Kernel&description=Access%20Kernel%27s%20cloud-based%20browsers%20via%20MCP) to install Kernel on Goose in one click.\n\n#### Goose Desktop\n\n1. Click `Extensions` in the sidebar of the Goose Desktop.\n2. Click `Add custom extension`.\n3. On the `Add custom extension` modal, enter:\n   - **Extension Name**: `Kernel`\n   - **Type**: `STDIO`\n   - **Description**: `Access Kernel's cloud-based browsers via MCP`\n   - **Command**: `npx -y mcp-remote https://mcp.onkernel.com/mcp`\n   - **Timeout**: `300`\n4. Click `Save Changes` button.\n\n#### Goose CLI\n\n1. Run the following command:\n   ```bash\n   goose configure\n   ```\n2. Select `Add Extension` from the menu.\n3. Choose `Command-line Extension`.\n4. Follow the prompts:\n   - **Extension name**: `Kernel`\n   - **Command**: `npx -y mcp-remote https://mcp.onkernel.com/mcp`\n   - **Timeout**: `300`\n   - **Description**: `Access Kernel's cloud-based browsers via MCP`\n\n### Visual Studio Code\n\n```json\n{\n  \"mcpServers\": {\n    \"kernel\": {\n      \"url\": \"https://mcp.onkernel.com/mcp\",\n      \"type\": \"http\"\n    }\n  }\n}\n```\n\n1. Press **⌘/Ctrl P** → search **MCP: Add Server**.\n2. Select **HTTP (HTTP or Server-Sent Events)**.\n3. Enter: `https://mcp.onkernel.com/mcp`\n4. Name the server **Kernel** → Enter.\n\n### Windsurf\n\n1. Press **⌘/Ctrl ,** to open settings.\n2. Navigate **Cascade → MCP servers → View raw config**.\n3. Paste:\n\n```json\n{\n  \"mcpServers\": {\n    \"kernel\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"mcp-remote\", \"https://mcp.onkernel.com/mcp\"]\n    }\n  }\n}\n```\n\n4. On **Manage MCPs**, click **Refresh** to load Kernel MCP.\n\n### Zed\n\n1. Press **⌘/Ctrl ,** to open settings.\n2. Paste:\n\n```json\n{\n  \"context_servers\": {\n    \"kernel\": {\n      \"source\": \"custom\",\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"mcp-remote\", \"https://mcp.onkernel.com/mcp\"]\n    }\n  }\n}\n```\n\n### Smithery\n\nYou can connect directly to `https://mcp.onkernel.com/mcp`, or use Smithery as a proxy using its provided URL.\n\n- Use Smithery URL in any MCP client:\n  1. Open [Smithery: Kernel](https://smithery.ai/server/kernel).\n  2. Copy the URL from \"Get connection URL\".\n  3. Paste it into your MCP client's \"Add server\" flow.\n\n- Use Kernel in Smithery's Playground MCP client:\n  1. Open [Smithery Playground](https://smithery.ai/playground).\n  2. Click \"Add servers\", search for \"Kernel\", and add it.\n  3. Sign in and authorize Kernel when prompted.\n\n### Others\n\nMany other MCP-capable tools accept:\n\n- **Command:** `npx`\n- **Arguments:** `-y mcp-remote https://mcp.onkernel.com/mcp`\n\n```json\n{\n  \"kernel\": {\n    \"command\": \"npx\",\n    \"args\": [\"-y\", \"mcp-remote\", \"https://mcp.onkernel.com/mcp\"]\n  }\n}\n```\n\nConfigure these values wherever the tool expects MCP server settings.\n\n## Tools (19 model-facing, plus 1 app-only helper)\n\nEach Kernel feature has a single `manage_*` tool with an `action` parameter, keeping the tool set small and consistent. Standalone tools handle high-frequency and interactive workflows.\n\nOne additional Managed Auth helper (`begin_auth_login`) is marked app-only (`_meta.ui.visibility: [\"app\"]`); it refuses to execute on hosts that do not declare MCP Apps support. The App forwards the server-issued signed flow checkpoint to the shared `manage_auth_connections` `wait` action, so flow identity and terminal-state decisions stay on the server.\n\nSelf-hosted deployments can select tool families with `KERNEL_MCP_ENABLED_TOOLSETS` or hide them with `KERNEL_MCP_DISABLED_TOOLSETS`. Both accept comma- or space-separated toolset names and standalone aliases. For example, `KERNEL_MCP_ENABLED_TOOLSETS=\"playwright computer\"` exposes browser-control tools without browser lifecycle or managed-auth tools, while `KERNEL_MCP_DISABLED_TOOLSETS=api_keys` only removes `manage_api_keys`. `get_connection_context` remains available in either mode.\n\nCall `get_connection_context` before deciding whether to create or select a project. Its canonical `connection_scope` reports whether the connection is organization-wide or fixed to a project. Project-scoped tools advertise an optional `project` (name or ID) and a deprecated `project_id`: organization-wide connections may omit them to preserve organization-wide reads and API default-project behavior, while fixed-project connections may omit them or pass the matching project. Project resources use project-qualified `kernel://orgs/{organizationId}/projects/{projectId}/...` URIs. Authorization remains enforced by the Kernel API; selecting a project never grants access to it.\n\n### manage\\_\\* tools\n\n- `manage_browsers` - Create, update, list, get, and delete browser sessions, and read archived telemetry for active or deleted sessions. Supports headless/stealth modes, profiles, proxies, viewports, extensions, and SSH tunneling.\n- `manage_profiles` - Setup (with guided live browser session), search/list with pagination, get, and delete browser profiles for persisting cookies and logins.\n- `manage_projects` - Create, list, get, update, and delete organization projects. Inspect and update per-project resource limits.\n- `manage_api_keys` - Create, list, get, update, and delete org-wide or project-scoped API keys. Create returns the plaintext key once.\n- `manage_browser_pools` - Create, list, get, delete, and flush pools of pre-warmed browsers. Acquire and release browsers from pools.\n- `manage_proxies` - Create, list, get, check, and delete proxy configurations (datacenter, ISP, residential, mobile, custom).\n- `manage_replays` - Start, stop, and list MP4 video replay recordings for a browser session. Session-scoped: start once, run your automation, then stop. Requires a paid Kernel plan.\n- `manage_extensions` - List and delete uploaded browser extensions.\n- `manage_apps` - List/search apps, invoke actions, get/list/delete deployments, and get invocation results.\n- `manage_auth_connections` - Create, list, get, delete, login, submit, and wait for managed-auth connections in every client. Use domain-filtered `list` for discovery. App-capable clients additionally receive `open_auth_login`; the programmatic actions remain available there too.\n- `manage_credentials` - Create, list, get, update, and delete stored credentials; fetch a current TOTP code for credentials with a configured totp_secret.\n- `manage_credential_providers` - Create, list, get, update, and delete external credential providers (e.g. 1Password); list available items and test the provider connection.\n\n### Standalone tools\n\n- `get_connection_context` - Inspect the authenticated principal, organization, credential scope, and effective project scope.\n- `computer_action` - Mouse, keyboard, clipboard, and screenshot controls for browser sessions (click, type, press_key, scroll, move, get_position, read_clipboard, write_clipboard, screenshot).\n- `browser_curl` - Send HTTP requests through an existing browser session's Chrome network stack.\n- `execute_playwright_code` - Execute Playwright/TypeScript code against an existing browser session. Does not create or delete browsers - use `manage_browsers` for session lifecycle.\n- `exec_command` - Run shell commands inside a browser VM. Returns decoded stdout/stderr.\n- `search_docs` - Search Kernel platform documentation and guides.\n- `submit_feedback` - send product, mcp, or documentation feedback directly to the KERNEL team without interrupting the current task.\n- `open_auth_login` - Open a secure interactive Managed Auth MCP App after user consent. Registered only for clients that declare MCP Apps support; credentials and MFA never enter MCP/model traffic.\n\n## Resources\n\nProject resources use the prefix `kernel://orgs/{organization_id}/projects/{project_id}`.\n\n- `/browsers` and `/browsers/{session_id}` - List or access browser sessions\n- `/browser-pools` and `/browser-pools/{id_or_name}` - List or access browser pools\n- `/profiles` and `/profiles/{profile_name}` - List or access browser profiles\n- `/apps` and `/apps/{app_name}` - List or access deployed apps\n\n## Prompts\n\n- `kernel-concepts` - Get explanations of Kernel's core concepts (browsers, apps, overview)\n- `debug-browser-session` - Get a comprehensive debugging guide for troubleshooting browser sessions (VM issues, network problems, Chrome errors)\n\n## Troubleshooting\n\n- Cursor clean reset: ⌘/Ctrl Shift P → run `Cursor: Clear All MCP Tokens` (resets all MCP servers and auth; re-enable Kernel and re-authenticate).\n- Clear saved auth and retry: `rm -rf ~/.mcp-auth`\n- Ensure a recent Node.js version when using `npx mcp-remote`\n- If behind strict networks, try stdio via `mcp-remote`, or explicitly set the transport your client supports\n\n## Examples\n\n### Invoke apps from anywhere\n\n```\nHuman: Run my web-scraper app to get data from reddit.com\nAssistant: I'll execute your web-scraper action with reddit.com as the target.\n[Uses manage_apps tool with action: \"invoke\" to run your deployed app in the cloud]\n```\n\n### Execute Playwright code dynamically\n\n```\nHuman: Go to example.com and get me the page title\nAssistant: I'll create a browser session, then execute Playwright code against it to navigate to the site and retrieve the title.\n[Uses manage_browsers tool with action: \"create\" to get a session_id]\n[Uses execute_playwright_code tool with session_id and code: \"await page.goto('https://example.com'); return await page.title();\"]\nReturns: { success: true, result: \"Example Domain\" }\n```\n\n### Use managed authentication for a protected site\n\n1. Call `manage_auth_connections` with `action: \"list\"` and the exact `domain_filter`.\n2. Fetch all pages. Reuse an authenticated connection; ask only when multiple relevant accounts match.\n3. A direct request to log in is consent. If authentication is discovered incidentally, ask before opening the App.\n4. For a new connection, choose a concise service-derived profile name unless the user supplied one; do not ask solely for a profile name.\n5. Call `open_auth_login`, then immediately follow its `next_action` and repeat the read-only wait while it reports `pending`.\n6. The user enters credentials/MFA only in the secure App. Once the wait reports `authenticated`, resume the original task with the verified `profile_name`.\n\nExample: “Log me into my Hacker News account and update my profile to add a random emoji at the bottom.” The agent should discover `news.ycombinator.com`, open the App when needed, wait for authentication, then continue the profile edit without asking for credentials or a profile name in chat.\n\nThe secure App defaults `record_session` and `browser_telemetry.enabled` to `true`, recording replay video plus the operational telemetry categories (`control`, `connection`, `system`, and `captcha`) for managed-auth browser sessions. Callers can explicitly disable either setting. The programmatic `manage_auth_connections` create/login actions preserve the API’s opt-in and inheritance behavior when these parameters are omitted.\n\n### Set up browser profiles for authentication\n\n```\nHuman: Set up a profile for my work accounts\nAssistant: I'll create a profile and guide you through the setup process.\n[Uses manage_profiles tool with action: \"setup\"]\n\nHuman: I'm done setting up my accounts\nAssistant: Perfect! I'll close the browser session and save your profile.\n[Uses manage_browsers tool with action: \"delete\" to save profile]\n```\n\n### Debug a browser session\n\n> **Note:** Attach the `debug-browser-session` prompt to your conversation first, then ask for help debugging.\n\n```\nHuman: [Attaches debug-browser-session prompt with session_id and issue_description]\n       Help me debug this browser session.\nAssistant: [Follows the debugging guide from the prompt: uses Kernel CLI to check session status,\n            read VM logs, test network connectivity, and diagnose issues]\n```\n\n### Connect local dev server to cloud browser\n\nThis is perfect for AI coding workflows where you need to preview local changes in a real browser:\n\n```\nHuman: I'm working on a React app running on localhost:3000. I want to test it in a cloud browser.\nAssistant: I'll create a browser session with SSH port forwarding for you.\n[Uses manage_browsers tool with action: \"create\" and remote_forward: \"3000:localhost:3000\"]\nReturns: Session ID, live view URL, and SSH tunnel command.\n```\n\n## 🤝 Contributing\n\nWe welcome contributions! Please see our contributing guidelines:\n\n1. **Fork the repository** and create your feature branch\n2. **Make your changes** and add tests if applicable\n3. **Run the linter and formatter**:\n   ```bash\n   bun run lint\n   bun run format\n   ```\n4. **Test your changes** thoroughly\n5. **Submit a pull request** with a clear description\n\n### Development Guidelines\n\n- Follow the existing code style and formatting\n- Add TypeScript types for new functions and components\n- Update documentation for any API changes\n- Ensure all tests pass before submitting\n- Run the required [OAuth conformance suite](docs/oauth-conformance.md) when changing discovery, registration, authorization, token exchange, refresh, or scope enforcement\n\n## 📄 License\n\nThis project is licensed under the MIT License - see the [LICENSE](LICENSE) file for details.\n\n## 🔗 Related Projects\n\n- [Model Context Protocol](https://modelcontextprotocol.io/) - The protocol specification\n- [Kernel Platform](https://onkernel.com) - The platform this server integrates with\n- [Clerk](https://clerk.com) - Authentication provider\n- [@onkernel/sdk](https://www.npmjs.com/package/@onkernel/sdk) - Kernel JavaScript SDK\n\n## 💬 Support\n\n- **Issues & Bugs**: [GitHub Issues](https://github.com/onkernel/kernel-mcp-server/issues)\n- **MCP Feedback**: [github.com/kernelxyz/mcp-feedback](https://github.com/kernelxyz/mcp-feedback)\n- **Documentation**: [Kernel Docs](https://onkernel.com/docs) • [MCP Setup Guide](https://onkernel.com/docs/mcp-server)\n- **Community**: [Kernel Discord](https://discord.gg/FBrveQRcud)\n\n---\n\nBuilt with ❤️ by the [Kernel Team](https://kernel.so)\n\n# Running this server locally\n\n```bash\ncp .env .env.local # Values for the .env.local file are in 1Password > DevEnvVars > MCP section\nbun install\nbun run dev\n```\n\nThis will start the server on port 3002.\n",
  "bytes": 20105,
  "sha": "359afa89040da9f77160a0ee592f760648bac0b40fb9768c59f7329918785005",
  "repo_slug": "onkernel/kernel-mcp-server",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_com_onkernel_kernel_mcp_server_4ea2ffe9/readme"
}