Point an app at two logged-in users and it finds the broken access control (IDOR). Deterministic browser perception + cross-identity authz testing for AI agents — drives your real Chrome over MCP or runs headless. Open-core, local, no account.
Setup
Choose your client, copy the config, then fill in any required environment variables.
claude mcp add zerodom -- uvx zerodom~/.codex/config.toml
[mcp_servers.zerodom]
command = "uvx"
args = ["zerodom"]
# codex mcp add zerodom -- uvx zerodom~/.cursor/mcp.json
{
"mcpServers": {
"zerodom": {
"command": "uvx",
"args": [
"zerodom"
]
}
}
}.vscode/mcp.json
{
"servers": {
"zerodom": {
"type": "stdio",
"command": "uvx",
"args": [
"zerodom"
]
}
}
}~/.gemini/settings.json
{
"mcpServers": {
"zerodom": {
"command": "uvx",
"args": [
"zerodom"
]
}
}
}claude_desktop_config.json
{
"mcpServers": {
"zerodom": {
"command": "uvx",
"args": [
"zerodom"
]
}
}
}.trae/mcp.json
{
"mcpServers": {
"zerodom": {
"command": "uvx",
"args": [
"zerodom"
]
}
}
}