Diwall MCP

English
Download v0.0.1

Guides

From a clone of the repository to a model working in your browser: five steps, each with the check that says it worked.

Five steps, in this order

  1. Install and check: the server, from a package or a clone, tested. On a clone, the check is scripts/smoke_test.py, which prints result: conforming; the package does not ship that script.
  2. The browser: your browser on a profile of its own, its debugging port on the loopback interface, started by mcp-server-diwall-browser-setup browser or by you. Check: ss -ltn "sport = :9222" shows 127.0.0.1:9222 or [::1]:9222 only.
  3. The encrypted directory and credentials: where the server writes, and where it reads passwords; mcp-server-diwall-browser-setup creates and opens it. Check, once step 5 is done: status reads mounted.
  4. The operator profile: the sites the server may read and act on. Check, once step 5 is done: status reads configured: true.
  5. Connect an MCP client: the fourteen tools, in the agent you choose. Check: status, called by the model, reads attached: true and confirmation_channel: native.

Steps 2 and 3 depend on each other: the browser keeps its profile inside the encrypted directory, so it starts only once the directory is open; the setup assistant takes them in that order. Each guide gives the commands of its step and sends you to the section of the operator guide that holds every option. The layout of every file the server reads and writes is at the top of that guide: the final layout.

Step 2: The browser on a profile of its own

The server attaches only to a browser started on a dedicated profile, never on your usual one, and never starts or closes it. The browser is started by you or, on your command, by the setup assistant: with the encrypted directory open, mcp-server-diwall-browser-setup browser starts it on the profile of the volume, detached from your terminal. By hand, the profile directory is in the open encrypted directory and the debugging port is the one of your operator profile:

google-chrome \
  --user-data-dir="$HOME/Vaults/Main/mcp-server-diwall-browser/browser-profile/chrome" \
  --remote-debugging-port=9222

chromium and brave-browser take the same two options. Replace ~/Vaults/Main with the place where you open your encrypted directory; --user-data-dir must be the browser.profile_dir of your operator profile, and the port its browser.debug_port.

Never add --remote-debugging-address: the port would be reachable from the network, and whoever reaches it controls the browser. Check that it listens on the loopback interface only:

ss -ltn "sport = :9222"

The local address must be 127.0.0.1:9222 or [::1]:9222, nothing else. The server makes the same check, on /proc/net/tcp and /proc/net/tcp6, every time it attaches, and refuses a port reachable from outside (debug_endpoint_not_loopback) or a browser running on its default profile (profile_dir_is_default).

Then sign in once to each of your sites in this browser, as you would in your usual one. The server works in those sessions.

In detail