GhostKey
GhostKey v0.2.0 delegates narrowly scoped browser actions into a browser the user authenticated themselves, under short-lived origin-scoped sessions. Per ScriptMasterLabs' product identity record (ghostkey-scoped-browser-delegation-v0.2.0), it never exports cookies, passwords, or session tokens, never automates CAPTCHA, and never spends autonomously. The live catalog exposes eight session and status tools over the MCP endpoint at ghostkey-mcp.onrender.com/mcp.
What can GhostKey v0.2.0 do?
GhostKey v0.2.0 creates short-lived, origin-scoped browser delegation sessions, checks session and bridge status, relays authorized navigate/inspect/click/input/select/read/wait actions, and revokes sessions.
- Create short-lived, origin-scoped browser delegation sessions.
- Check session/bridge status and heartbeat.
- Relay authorized navigate, inspect, click, input, select, read and wait actions.
- Revoke sessions and cancel queued work.
- Inspect GhostKey status, catalog, quote guidance and operating policy.
What is GhostKey's security boundary?
How do agents connect to GhostKey?
Agents connect through the MCP endpoint at ghostkey-mcp.onrender.com/mcp over streamable-http transport, version 0.2.0.
Health: https://ghostkey-mcp.onrender.com/healthz
Session Bridge docs: https://ghostkey-mcp.onrender.com/session-bridge/README.txt
Transport: streamable-http
Version: 0.2.0
Current live tools: ghostkey_status, ghostkey_catalog, ghostkey_quote, ghostkey_policy, ghostkey_session_create, ghostkey_session_status, ghostkey_session_action, and ghostkey_session_revoke.
What is the difference between GhostKey and x402 Gateway?
GhostKey does not perform general x402 paid-API discovery. For discovery of x402 paid APIs and fresh payment-requirement inspection, use x402 Gateway. The caller controls spending policy. GhostKey's distinct live product identity is scoped user-authenticated browser delegation with explicit access and session policy.