Browserbase MCP server and Dome

1. 01

   Add the Browserbase MCP server

   Dome keeps the Browserbase API key and sends it as a Bearer token. Sessions run on your Browserbase account.

   $ dome tools add --name browserbase \
     --url https://mcp.browserbase.com/mcp \
     --auth-method api-key \
     --credential-type shared \
     --authorization "Bearer $BROWSERBASE_API_KEY" \
     --gateway prod-gateway

2. 02

   Sync the catalog

   Browserbase lists its six tools without a session. The key is spent only when an agent calls one.

   $ dome tools catalog sync browserbase

3. 03

   Apply the rules

   The portal list is scoped to shipment-tracker. Simulate a lookalike domain, then deploy.

   $ dome rules apply browserbase-permit.cedar browserbase-sites.cedar \
     --agent shipment-tracker --name browserbase-sites

Commands and rules tested against a Dome workspace on October 1, 2026. For anything about Browserbase itself, see Browserbase's documentation.

permit (principal, action == Dome::Action::"mcp:call", resource is Dome::MCPTool)
when {
  resource.connection_name == "browserbase" &&
  ["start", "navigate", "observe", "extract", "act", "end"].contains(resource.tool_name)
};
 
forbid (principal, action == Dome::Action::"mcp:call", resource is Dome::MCPTool)
when {
  resource.connection_name == "browserbase" &&
  resource.tool_name == "navigate" &&
  !(resource has arguments &&
    resource.arguments has url &&
    (resource.arguments.url like "https://carrier.meridian-freight.com/*" ||
     resource.arguments.url like "https://track.atlas-logistics.com/*"))
};