[FEATURE] Allow cross-origin XHR/fetch in the sandboxed Browser pane for local dev TLDs (localhost, .test, .local)
Preflight Checklist
- [x] I have searched existing requests and this feature hasn't been requested yet
- [x] This is a single feature request (not multiple features)
Problem Statement
The sandboxed Browser pane (mcp__Claude_Browser__*) blocks cross-origin XHR/fetch requests made by page JavaScript (ERR_BLOCKED_BY_CLIENT), even when both origins are local development domains under my own control. This breaks any full-stack local dev setup where frontend and backend run on separate origins — a very common pattern (e.g. app.test calling api.test, or localhost:3000 calling localhost:8000).
Concretely: I run a Next.js frontend on website.test (proxied via Caddy) that calls a Laravel API on api.website.test. Login, CSRF cookie fetches, and any authenticated flow that spans both origins fail in the Browser pane, even though:
Both domains resolve to 127.0.0.1
Both are served by infrastructure I control
The same request succeeds instantly via curl/Bash, or in a real browser through the Claude in Chrome extension
This makes the Browser pane unusable for testing any split front/back architecture locally, which is one of the most common web project layouts.
Proposed Solution
Allow cross-origin requests within the Browser pane sandbox when both the requesting and target origins match a recognized local-dev pattern:
localhost (any port)
127.0.0.1 / ::1 (any port)
any hostname ending in .test
any hostname ending in .local
These TLDs are reserved for local/private use (RFC 6761 for .test, mDNS convention for .local) and are never publicly routable, so allowing cross-origin traffic between them doesn't reopen the exfiltration risk the sandbox is meant to prevent — a page under one of these TLDs can't reach a real external target through this allowlist.
Alternative Solutions
_No response_
Priority
Critical - Blocking my work
Feature Category
CLI commands and flags
Use Case Example
_No response_
Additional Context
_No response_