AI agents

Drive your desktop from anywhere.

Remote MCP lets an agent that is not on your computer drive your Donut Browser. The desktop app keeps an outgoing connection to the Donut API, and the API relays each MCP message to it. Your desktop answers every call itself, with the tools listed on the MCP page.

Remote MCP is included in the Solo, Pro, Team and Enterprise plans. Free does not include it. It is the only way to use MCP with Donut: the local MCP server has been removed.

• Solo: MCP without browser automation. An agent can manage profiles, groups, proxies, VPNs and extensions, and use the human-in-the-loop tools.
• Pro, Team and Enterprise: also the browser automation tools (launch, navigate, click, type, read pages) and recipes.

Set it up

1. In the desktop app, sign in and open Integrations → Remote MCP (Cmd/Ctrl+I). Turn on Remote control.
2. Open your account page. The remote control card shows Desktop connected when the app is online.
3. Under Credentials, click New credential. Copy it at once: it starts with dmk_ and is shown one time only. The desktop app also creates one when you click Add next to a client, and Rotate replaces it in every client the app set up.
4. Point your MCP client at the endpoint and send the credential as a bearer token.

{
  "mcpServers": {
    "donut-browser-remote": {
      "url": "https://api.donutbrowser.com/api/mcp",
      "headers": { "Authorization": "Bearer dmk_…" }
    }
  }
}

The exact config format depends on your client. What matters is the URL and the Authorization header.

Check the connection

Two calls tell you if the whole chain works, without launching a browser:

# Is a desktop connected, and does your plan include remote control?
curl -s https://api.donutbrowser.com/api/mcp/status \
  -H "Authorization: Bearer $DONUT_MCP_KEY"

# A round trip to your desktop that changes nothing on it.
curl -s -X POST https://api.donutbrowser.com/api/mcp/test \
  -H "Authorization: Bearer $DONUT_MCP_KEY"

status answers with connected and entitled. test answers with ok: true and round_trip_ms when your desktop replies.

Transport

The endpoint speaks streamable HTTP. A client that used the old local server only changes the URL and adds the credential:

• POST /api/mcp sends a JSON-RPC message (initialize, tools/list, tools/call, ping).
• The initialize response carries an mcp-session-id header. Send it back on every later request.
• DELETE /api/mcp with that header ends the session.
• GET /api/mcp answers 405: the server does not open streams on its own.

Toolsets

Every tool schema an agent loads costs it context. Name toolsets on the URL to load fewer:

https://api.donutbrowser.com/api/mcp?toolsets=network,cookies

The x-mcp-toolsets header does the same, for clients that cannot change the URL. The 48 core tools are always included: profiles, browser control and the tools that keep you in the loop. Add any of these:

In the app, Tools agents see on the Remote MCP tab picks toolsets for the clients it set up.

No toolsets, an empty value or all lists every tool. A toolset only changes what tools/list shows: a call to a tool you did not list still works.

Credentials

• Each credential acts as you. You can hold up to 10 live credentials at once.
• Revoke a credential on your account page. It stops working within about 10 seconds.
• A credential can call the MCP endpoint only. It cannot create, list or revoke credentials, so a leaked one cannot make itself permanent.
• One desktop holds the connection at a time: the first app to connect keeps it until it disconnects.

What the relay sees

Remote MCP is not end-to-end encrypted. Every message passes through Donut’s relay at api.donutbrowser.com as readable JSON. Cloudflare proxies that host. Remote control is off by default; while it is off, your desktop opens no connection to the relay.

What passes through

• Every message from your agent: tool names and their arguments, such as URLs, text to type and JavaScript to evaluate.
• Every answer from your desktop: page text, screenshots, profile and proxy lists, and your answers to ask_human.

What the relay holds in memory

• A call stays in memory only until your desktop answers it, for at most 90 seconds.
• While your desktop is connected: its instance ID, app version, operating system, connection time and last-seen time. GET /api/mcp/status shows them, and your account page shows all but the last-seen time.
• The account token your desktop connected with. Every 30 seconds the relay checks that the token is still valid and that your paid plan is still active. Each call also checks that your plan includes remote control.
• Short-lived caches: your plan and the account of each credential for 10 seconds, and request counts per IP address for rate limits.

What the relay stores

• No content of the messages it forwards. The relay does not write tool calls, arguments, answers or screenshots to the database or to its logs.
• Server logs: your account email with the desktop’s instance ID, operating system and app version when the desktop connects, and the email and instance ID when it reconnects, disconnects or is dropped. Each credential event below is also logged with your email, user ID and IP address. A refused credential is logged with the IP address, user agent and a prefix of the credential’s hash.
• Credentials: a SHA-256 hash of each dmk_ credential, never the credential itself, with dmk_ and the next 8 characters, its label, your email, creation time, revocation time, and the time and IP address of its last use. The last-use fields are written at most once an hour.
• Sign-in events: a record when you create or revoke a credential, when a new one is refused because you already hold 10, once per hour of use with the IP address, and each time a revoked or expired credential is refused. These records have no automatic expiry, deleting your account does not delete them, and Donut admins can read them.
• A presence entry in Redis with your desktop’s instance ID. The relay renews it every 30 seconds and deletes it when the desktop disconnects. If the relay stops renewing it, it expires after 120 seconds.
• Outside the relay: on a Team or Enterprise plan, your desktop reports profile, proxy and group actions, an agent’s included, to your team’s activity log. Team keeps the log for 90 days, Enterprise for 365.

Two tool groups store data in Donut’s cloud by design. The recipe tools are answered by the Donut API itself. It stores your recipes, and a run_recipe run stores its steps with any variables filled in, a transcript with a short summary of each answer from your desktop, and the extracted values. run_recipe saves no screenshots. Replays and schedules that run on your desktop also pass through the relay and store the same records, with screenshots when you ask for them. If the database refuses a recipe, the error log can contain its name and steps.

send_feedback stores the agent’s message with your email, app version, operating system, the agent client, recent tool names and error codes. When the agent includes logs, recent app log lines go with it, which name each tool call and its profile ID; they are deleted after 90 days (see MCP).

What your desktop removes or refuses

• list_proxies and get_proxy answer with [redacted] in place of proxy passwords, VLESS URIs, dynamic proxy list URLs and change-IP links.
• Tools that read local paths or export secrets answer TOOL_IS_LOCAL_ONLY: add_extension, update_extension, detect_browser_profiles, import_browser_profiles and export_proxies.
• Tools that open a URL accept only http, https and about:blank. file:, data:, javascript: and every other scheme are refused.

What never reaches the relay

• Profile data that no tool call asks for. Cookies, history and pages stay on your disk until a tool returns them.
• The browsing traffic of your profiles. It goes from the browser through each profile’s own proxy or VPN.
• Calls to the local REST API and CDP connections. Both stay on 127.0.0.1.

Keep agent traffic on your machine

To keep page content off Donut’s servers, drive the profile from your own machine: the local REST API launches it and your script attaches over CDP on 127.0.0.1. Run AI agents in private browser profiles shows the setup, with an example that uses a local model.

Errors

Tool errors, such as a profile that is already running, come back inside the JSON-RPC response. Two of them depend on your plan; their code is in error.data.code:

Checked against the app on October 15, 2026.