Comet MCP

Findings (15)

• highHigh. Something risky that needs a close look before you install.
  dependencies issue

  Details are available to the maintainer after claiming this listing.
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.

  src/cdp-client.ts:25
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.

  src/cdp-client.ts:144
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.

  src/cdp-client.ts:403
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  @hono/node-server@1.19.7: 3 known vulnerabilities

  GHSA-92pp-h63x-v22m, GHSA-frvp-7c67-39w9, GHSA-wc8c-qw6v-h7f6

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  @modelcontextprotocol/sdk@1.25.1: 8 known vulnerabilities

  GHSA-22jm-h49p-29qw, GHSA-345p-7cg4-v4c7, GHSA-46jr-4wx8-v453, GHSA-6prh-2h8m-c8cw, GHSA-6qxp-vccf-f47h +3 more

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  body-parser@2.2.1: 2 known vulnerabilities

  GHSA-27r3-jxmh-p828, GHSA-v422-hmwv-36x6

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  fast-uri@3.1.0: 12 known vulnerabilities

  GHSA-333x-w4r6-6crp, GHSA-4c8g-83qw-93j6, GHSA-7p8r-x3mc-p8w7, GHSA-f65p-4m7j-42xc, GHSA-hrr3-gc8f-f4qj +7 more

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  hono@4.11.3: 40 known vulnerabilities

  GHSA-26pp-8wgv-hjvm, GHSA-2gcr-mfcq-wcc3, GHSA-3hrh-pfw6-9m5x, GHSA-3vhc-576x-3qv4, GHSA-458j-xx4x-4375 +35 more

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  path-to-regexp@8.3.0: 2 known vulnerabilities

  GHSA-27v5-c462-wpq7, GHSA-j3q9-mxjg-w52f

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  ws@7.5.10: 1 known vulnerability

  GHSA-96hv-2xvq-fx4p

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  zod@3.25.76: 1 known vulnerability

  GHSA-mrhx-c7xc-m3w5

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  ajv@8.17.1: 1 known vulnerability

  GHSA-2g4f-4pwh-qvx6

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  qs@6.14.1: 4 known vulnerabilities

  GHSA-4mjr-xmp4-gh2g, GHSA-6pq8-jhm2-2vcw, GHSA-q8mj-m7cp-5q26, GHSA-w7fw-mjwx-w883

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  No manifest declaring network access and environment variables (agent.json)

Network activity

Tools exposed (6)

• comet_connect

  Connect to Comet browser (auto-starts if needed)

• comet_ask

  Send a prompt to Comet/Perplexity and wait for the complete response (blocking). Ideal for tasks requiring real browser interaction (login walls, dynamic content, filling forms) or deep research with agentic browsing.

• comet_poll

  Check agent status and progress. Call repeatedly to monitor agentic tasks.

• comet_stop

  Stop the current agent task if it's going off track

• comet_screenshot

  Capture a screenshot of current page

• comet_mode

  Switch Perplexity search mode. Modes: 'search' (basic), 'research' (deep research), 'labs' (analytics/visualization), 'learn' (educational). Call without mode to see current mode.