Connecting a client. For running the server itself, see Deployment.

Everything below needs two things: the server's URL and, if auth is on, its token. Where that token comes from is in Administration.

https://selenium.example.com/mcp

Three query parameters change how the server treats you. Each has a header form that wins over it, so an administrator can pin a setting inside a credential and a caller cannot override it — except the workspace, where sending both is refused rather than one winning.

Prefer the query parameter when one credential is shared between callers: each names itself in its own URL. Use the header when one credential should mean one browser no matter who holds it.

Add it to .mcp.json in the project, or use claude mcp add:

{
  "mcpServers": {
    "selenium-flow": {
      "type": "http",
      "url": "https://selenium.example.com/mcp",
      "headers": {
        "Authorization": "Bearer ${SELENIUM_FLOW_TOKEN}"
      }
    }
  }
}

Claude Code reads MCP resources, so workspace://current, workspace://files and the embedded skill all arrive without a tool call, and read_resource stays hidden. It also renders images returned by a tool, so screenshot is directly useful there.

It does not implement MCP Apps, so files arrive as the workspace://files listing rather than a thumbnail grid. Use the signed URLs in it, or the admin UI.

Same shape, in claude_desktop_config.json. Claude Desktop does implement MCP Apps, so show(uri) draws any resource the server serves: your workspace, its files and any one of them (a screenshot, a recording you can play), the saved site data, the flows as cards, one flow, the secrets, the skill's pages and the flow schema, though inside a collapsed tool-result panel you may need to expand it.

.vscode/mcp.json, with the token as a prompted input so it never lands in the file:

{
  "inputs": [
    {
      "type": "promptString",
      "id": "selenium_flow_token",
      "description": "Bearer token for selenium-flow",
      "password": true
    }
  ],
  "servers": {
    "selenium-flow": {
      "type": "http",
      "url": "https://selenium.example.com/mcp",
      "headers": { "Authorization": "Bearer ${input:selenium_flow_token}" }
    }
  }
}

VS Code's model cannot read MCP resources, so the server recognises it and gives it list_resources and read_resource(uri) — no ?resources=off needed. Resources are also browsable by you, with MCP: Browse Resources, and flow and file names complete in the picker.

VS Code 1.109 and later implement MCP Apps, so the components render inline. For that to work the server needs PUBLIC_BASE_URL set — an app's iframe gets a deny-by-default CSP, and that variable is what admits the server's own images to it.

Use an MCP Client Tool node attached to an AI Agent, with an httpBearerAuth credential. Two things about n8n specifically:

• It has no notion of MCP resources. The intended shape is to leave resources on here and read them through mcp-kb, which proxies them into one catalogue with one read_resource. Until that is wired up, add ?resources=off so this server gives the agent read_resource itself.
• It opens a new MCP transport for every tool call. The negotiated MCP session id is therefore never the same twice, so anything keyed on it could never be found again. Name the workspace in the URL: ?workspace=my-agent.

http://selenium-flow.flow.svc.cluster.local:8000/mcp?resources=off&workspace=my-agent

Put the name in the URL, not the credential, when that credential is shared with anything else — an X-Workspace in the credential silently binds every consumer of it to one browser.

n8n cannot display an image returned by a tool, and its agent cannot see one either. Use screenshot(save=true) and put the returned link in the reply: n8n's chat renders markdown images, so ![shot](url) works.

Anything speaking MCP Streamable HTTP works with the URL and a bearer token. If a client cannot read resources, add ?resources=off.

Every action is also a plain endpoint. See Actions for each one, and GET /openapi.yaml on a running server for the machine-readable contract — both are unauthenticated, so a client can read the contract before presenting a token.

curl -X POST https://selenium.example.com/browser/extract \
  -H "Authorization: Bearer $TOKEN" \
  -H 'Content-Type: application/json' \
  -H "X-Workspace: my-workspace" \\
  -d '{"selector": {"xpath": "//h1"}}'

The HTTP surface also accepts the bare token as the whole Authorization value, for clients that cannot express a scheme.

curl https://selenium.example.com/ready

/ready needs no credentials and reports the Grid as well as the process — a server that cannot see a Grid is not actually ready, and says so with a 503. /health only says the process is up.