To test a site with Claude Code, connect Claude in Chrome in a separate test profile, keep manual review enabled, and give the agent one exact URL. Ask it to read or inspect the page and stop before a form submission, a download, or a move to another hostname. Where an organization needs a policy that users cannot grant around, Anthropic documents Team and Enterprise controls for site allowlists and blocklists.
The setup depends on the connection you chose. Claude Code's native --chrome connection uses the Claude in Chrome extension. A separately installed Playwright MCP server has its own browser process, context and request filters. Changing one of these sets of permissions does not update the other.
Three controls to check before the first browser action
| Control | What it controls | Where to check |
|---|---|---|
| Chrome extension site access | Which pages Chrome allows an extension to interact with using its host privileges | Chrome's extension details in the current profile |
| Claude in Chrome approvals | Which site or action the agent may use under the current mode and policy | Claude side panel, the browser prompt and Extension settings |
| Claude Code tool approval | Whether the Claude Code session may invoke a tool | Claude Code permission prompt and session settings |
A browser tab can load a site even when an extension cannot read it. Likewise, a successful page read does not tell you that a subsequent click is acceptable. A button can submit a request while its label says only “Continue.” Review the effect you are authorizing. Claude Code can also expose shell or HTTP-capable tools, which have separate settings. A browser restriction covers the browser path you tested.
Anthropic describes one-time action approvals and persistent site approvals in its Claude in Chrome permissions guide. The visible workflow varies between the classic panel and Cowork. In the classic panel, review the sites and steps listed in the proposed plan. In a mode that asks before an action, use the individual prompt to decide. A persistent approval allows multiple eligible actions, and the guide lists protected actions that can still require explicit approval, including entering potentially sensitive information, downloads and authorizations. Certain actions are prohibited under the product's rules.
Set up a single-site, read-only test
Start Chrome in a test profile without personal tabs, production cookies, or a password manager signed in. Use a test account only if your page requires it.
Connect the intended profile with
claude --chromeor the/chromecommand in Claude Code. Review the connection dialog and the extension state in that same profile. The Claude Code Chrome guide lists supported entry points and prerequisites.Give the agent one explicit URL. Use the full address and name any secondary site that must remain out of scope. Staging, identity and payment hosts can be separate even if the page links to them.
Approve the minimum operation that answers the test. For a smoke check, ask for the page heading and names of visible controls. For a form flow, use test data, request a preview of the values, and stop before sending.
Record both outcomes. Confirm that the intended site was readable. Then try a harmless out-of-scope site and decline the prompt or confirm that the organization policy blocks it. Stop the run if the agent can still take the forbidden action.
An example first request for the public Selenium test form:
Read https://www.selenium.dev/selenium/web/web-form.html only.
Return the heading and the label on the submit button.
Do not type, click, submit, download, or open any other URL.
If the site or an action asks for more permission, pause and tell me.This gives you a result you can check by eye. To test an actual submission, use a new run on a test endpoint with an owner-approved side effect and a way to verify the resulting record.
What a denial looked like in two isolated tests
We used an unpacked test extension in a disposable Chrome for Testing profile and the public Selenium Web form. The fixture declared access to the Selenium host and used the browser's scripting API only to read the page heading. After we changed site access in Chrome’s extension details, the Selenium host appeared with its switch off. The visible browser page still showed the form, but the extension readback timed out, so this part only verifies the visible setting. This was a Chrome platform test with a synthetic extension. The Claude extension's own approval UI is described by Anthropic's documentation.
For the second test, Playwright MCP 0.0.84 ran headless in an isolated context. We sent the same browser_navigate call before and after changing the allowed origin in a fresh process:
| Check | Result |
|---|---|
| Selenium Web form with the Selenium origin allowed | Page loaded and exposed the heading “Web form” |
| example.com in that same session | ERR_BLOCKED_BY_CLIENT |
| Selenium Web form with only the example.com origin allowed | ERR_BLOCKED_BY_CLIENT |
The process used npx -y @playwright/mcp@0.0.84 --headless --isolated --allowed-origins https://www.selenium.dev for the first two checks. For the third, we stopped it and started a fresh process with only https://example.com in the list. No form was submitted. Microsoft's Playwright MCP documentation says that the origin option is not a security boundary and does not affect redirects. Use a network boundary when the requirement is to enforce access across redirects and other tools. The Chrome extension permissions documentation describes the separate host-permission mechanism used by the first test.
Revoke access and verify the next run
Open the Claude extension side panel, choose the three-dot menu, then Extension settings. Under Your approved sites, remove the site. Begin a fresh task with the intended profile, request the same small read, and check whether a prompt or block returns. If your goal is to disconnect the browser altogether, disable the Chrome integration for the Claude Code session and verify that the browser tool is unavailable. If you need to restrict the Chrome extension itself, review its site access in Chrome's extension details as a separate step.
If a prompt keeps repeating, verify the hostname shown in the prompt and the approved sites list before broadening permissions. A Reddit user reported repeated prompts while moving between Facebook Marketplace and Sheets even with broad Chrome extension access. A separate Claude Code issue reported that a persistent approval did not appear in the saved list on a particular version. Treat these as reported symptoms. Confirm the actual behavior in your current profile and product version.
For the separate MCP path, see how to set up Playwright MCP in Claude Code. For controls that apply beyond one host, see browser-agent security risks. If you want to compare this approval workflow with another browser agent, download Tabbit and use the same public read-only task in an isolated profile.
See profiles, workspaces and tab groups to decide which browser state to isolate and connecting to an existing browser if the task needs an existing session. Web search versus browser control explains why a browser permission is a separate decision from a search. How browser agents work covers the action loop, and Playwright browser automation covers an independent test runner.
FAQ
Can I restrict Claude in Chrome to a single test site?
Use a dedicated test profile, review the exact site in the plan, and decline new sites. A Team or Enterprise admin can enforce an organization allowlist where supported.
Does allowing a site approve every form submission?
Site approval grants access to the site under the current permission mode. Anthropic documents extra protections for some sensitive actions. Keep ordinary submissions out of the test plan and review them separately.
Where do I revoke a saved Claude browser site approval?
Open the Claude extension side panel, use the three-dot menu to reach Extension settings, and remove the entry under Your approved sites.
Why does Claude keep asking on a site I previously allowed?
Check which browser profile is connected, which hostname triggered the prompt, whether the saved site appears in Extension settings, and whether the organization restricts the site.
Is Playwright MCP's allowed-origins option a security boundary?
Microsoft describes it as request filtering and excludes redirects from its guarantee. For a hard boundary, pair an isolated browser with network controls.