Most Agent Browsers Trust the Web. This One Doesn't

All the substantive claims check out. Here's the breakdown:

Confirmed accurate

• Real project, real security model. PinchTab is a real open-source browser automation tool (Go binary + HTTP API + MCP server, github.com/pinchtab/pinchtab). It's designed first for local, single-user control on a machine you manage.
• "Drives real Chrome behind an HTTP API and MCP server" — accurate. PinchTab is a standalone HTTP server that gives AI agents direct control over Chrome, and it ships an MCP server as documented.
• "Defaults to local-only allowlist, agent can't reach the public internet until you widen it" — accurate and actually understated if anything. The repo confirms IDPI restricts navigation to an allowlist of approved domains, and the default local-only config sets allowedDomains to just 127.0.0.1, localhost, and ::1. By default, IDPI restricts browsing to locally hosted websites only, preventing agents from navigating the public internet until you explicitly allow it.
• "Extracted page text is framed as untrusted content" — accurate and specifically named. IDPI stands for Indirect Prompt Injection defense, and it scans extracted content for suspicious prompt-injection patterns and wraps text output so downstream systems can treat it as untrusted content.
• MIT license — confirmed, repo shows MIT license.

One small discrepancy

• "9.5k stars" — at the time I checked, the repo showed 9.2k–9.3k stars (it ticked up slightly between two fetches, suggesting it's actively growing). 9.5k isn't wildly off, but it's a small overstatement — likely just stale by a few days/weeks, which is normal for a fast-growing repo. Worth updating to the current number before posting if you want precision.

Worth knowing but not stated in the post (not wrong, just context)

• The security boundary is deeper than the post implies: it's not just an IP allowlist — there's also a token-based auth layer, a set of high-risk endpoints (JS eval, cookie access, file uploads, downloads, file:// scheme) that are disabled by default independently of the domain allowlist, and content-scanning for injection patterns on top of the "wrap as untrusted" framing. If you want a beefier post, "security boundary" could fairly be pluralized — it's a layered default-deny posture, not a single gate.
• Good faith caveat also in their own docs: widening navigation to non-local or non-trusted sites is still a security-reducing choice; IDPI lowers risk, but it does not make hostile pages safe or remove browser attack surface — so it's a mitigation, not a full prompt-injection solution, which is worth keeping in mind if you're pitching it as "the" answer to the problem.

Bottom line: the post is factually solid — just nudge the star count down to ~9.2–9.3k (or check live before publishing) and you're good.