First tagged release of sncro-relay. Pre-1.0 — active development, breaking changes possible on minor bumps.
What's in the box
- MCP relay at `relay/` — FastAPI app exposing 9 MCP tools for browser inspection (DOM, console, network, errors)
- Framework plugins at `middleware/` — FastAPI and Flask drop-ins. Each is a single file with tests.
- Demo app at `trysncro/` — SportsCrash, a deliberately-broken page for end-to-end testing.
- MIT license — everything in this repo is free to self-host, fork, or reuse.
MCP tools
`create_session`, `check_session`, `end_session`, `get_page_snapshot`, `get_console_logs`, `get_network_log`, `query_element`, `query_all`, `report_issue`.
Security
This codebase has been through an adversarial static review (the `blackhat/2` engagement, Phases A–I). Every Critical and High finding is line-verified closed. See SECURITY.md for the threat model and reporting path.
Key defences:
- Three-secret auth (session_key + session_secret + browser_secret)
- CSRF gate on the enable flow (Sec-Fetch-Site / Origin)
- Clickjacking headers (X-Frame-Options + CSP frame-ancestors)
- SSRF guard on domain probes
- Rate limiting on all public endpoints (slowapi)
- Stored XSS defences in admin/public rendering paths
Plugins welcome
If you want sncro on Django, Rails, Express, Next.js, ASP.NET, Go, Laravel, or anything else — CONTRIBUTING.md has the full plugin spec and the test template. We will merge well-tested plugins fast.
Runtime
Python 3.11, 3.12, 3.13 supported. CI runs pytest across all three on every push / PR.
Next
Roadmap toward v1.0.0: community-contributed plugins, billing wired up, a month without a security phase.