Mastra explains Firecrawl browser provider, flags password exposure in traces
Mastra published a walkthrough of @mastra/browser-firecrawl, a browser provider built by Firecrawl's team that it says gives an agent a hosted browser for pages behind a login without running Chromium locally, with a demo that logs into Sauce Labs' test store and checks out a backpack. Mastra says FirecrawlBrowser extends its AgentBrowser and exposes the same 16 browser tools by default, with the difference being that AgentBrowser launches Chromium locally with Playwright while FirecrawlBrowser connects to a Firecrawl session over CDP; sessions are tied to an agent thread, but the thread-to-session map lives in the server process, so restarts or another instance get a fresh browser with no cookies, and Firecrawl ends sessions after five minutes idle or ten minutes total by default. Mastra also warns that a password typed through the browser_type tool is recorded in memory and traces as plain text because the browser tool's field is called text rather than password; named profiles with saveChanges set to false let an agent start signed in without the model seeing the password.
The walkthrough shows how thread-scoped hosted browser sessions can keep an agent signed in across turns, and flags that passwords typed through browser tools can land in traces unless named profiles are used.
Firecrawl just published a walkthrough for @mastra/browser-firecrawl, the browser provider their team built for Mastra. It gives your agent a hosted browser for pages behind a login, with no Chromium running on your machine. Their demo logs into Sauce Labs' test store and checks out a backpack.
Their post covers setup. We'll walk through what happens inside Mastra when the agent logs in. One detail matters once you move from the demo to a real login: where the password ends up.
Same tools, different browser
FirecrawlBrowser extends our AgentBrowser, so the model drives the page the same way with either one. Both give the agent the same 16 browser tools by default. The only difference is where Chromium runs. AgentBrowser launches it on your machine with Playwright. FirecrawlBrowser gets a session from Firecrawl and connects to it over CDP.
Each browser session belongs to a thread. Inside @mastra/agent-browser, every page tool pulls threadId from the agent's execution context before running:
browser/agent-browser/src/tools/type.ts
#Mastra#Firecrawl#@mastra/browser-firecrawl#AgentBrowser#Playwright#Sauce Labs#Chromium