Skip to content

Security: agenthand/obo

Security

docs/SECURITY.md

Security

OBO controls the browser where the extension is installed. Treat the local OBO server as a browser-control interface.

Default Mode

By default, OBO listens on:

127.0.0.1:3333

This keeps access on your own machine. This is the recommended mode for almost everyone.

LAN Mode

Advanced users can bind the server to a reachable local-network address:

obo server --host 0.0.0.0 --port 3335

Only use this on a trusted local network. Anyone who can reach that port may be able to send browser-control commands to OBO.

When you are done, switch back to the default:

obo server --host 127.0.0.1 --port 3333

Permissions

The extension requests these Chrome permissions:

Permission Why OBO needs it
debugger Use Chrome DevTools Protocol for snapshots, clicks, typing, scrolling, screenshots, navigation, file upload, and JavaScript evaluation.
tabs List and manage browser tabs.
tabGroups Group controlled tabs under an OBO tab group.
storage Save local connection settings and session state.

OBO does not request broad host permissions in the extension manifest.

Data Handling

OBO does not send browser data to a cloud service. The extension talks to the local OBO server over WebSocket, and the CLI talks to that local server over HTTP.

Agents or tools that call OBO may receive page text, screenshots, tab URLs, and interaction results. Use OBO only with agents you trust.

There aren't any published security advisories