browser_start_session

What browser_start_session does on Kali Security MCP

AI agents invoke browser_start_session to trigger actions in Kali Security MCP. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call: builds kicked off, notifications sent, workflows started.

Why browser_start_session is rated High

Starting a browser session is an Execute action—it initiates external operations whose effects depend on how the session is subsequently controlled. While not Destructive by itself, it enables downstream actions that could modify systems or exfiltrate data. The empty description lowers confidence slightly, but server purpose and naming pattern strongly suggest execution capability.

From the tool's definition Tool name 'browser_start_session' indicates it initiates automated browser interactions. Server context shows tools for 'penetration testing' and 'automated workflows.' Sibling tools like 'adaptive_web_penetration' and 'adaptive_execute_strategy' confirm this…

The rule that runs browser_start_session safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Kali Security MCP, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For browser_start_session, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "browser_start_session": {
      "limits": [
        {
          "counter": "browser_start_session_rate",
          "window": "minute",
          "max": 10,
          "scope": "grant"
        }
      ]
    }
  }
}

Questions about browser_start_session