Bind a Browser

A browser asset is a browser you already use — on your own desktop, with your own logins. The WingGate browser extension is the piece that makes it manageable: it connects your browser to WingGate, exposes scoped browser tools to authorized AI agents, and keeps sensitive actions under your control.

The extension runs in your browser, on your machine. Page data goes to whoever you granted access — it does not pass through a third-party relay you did not set up.

What you get

Once a browser is bound and a member has access through a Project:

• AI agents with an MCP credential can use browser tools: page snapshot, screenshot, click, fill, wait, drag, wheel and context menu, and discovery/calling of page-level WebMCP tools.
• Destructive or sensitive actions (submitting forms, clicking through flows) require local confirmation in the extension — the extension asks you before it acts.
• The access chain is the same as for any other asset: Organization role, Project grant, asset readiness, and the audit trail.

Install the extension

Install from the Chrome Web Store

An official build that updates automatically, with nothing to keep on disk:

1. Open the WingGate listing in the Chrome Web Store and choose Add to Chrome.
2. Pin the WingGate icon in the browser toolbar, then start binding.

When the store is unreachable: load unpacked

Offline or on an isolated network, install the package your WingGate deployment serves:

1. Download the extension package from your WingGate deployment's own domain. The zip root is the extension root.
2. Unzip it to a folder you will keep (the browser loads the extension from this folder).
3. Open chrome://extensions (or your Chromium browser's equivalent page), enable Developer mode, choose Load unpacked, then select the unzipped folder.

Both paths work with Chromium-based browsers (Chrome, Chromium, and derivatives) and share one extension ID: the store build and the download package can replace each other without losing a binding. An unpacked install is yours to maintain and upgrade by hand — replace the folder contents with a newer package and reload it from chrome://extensions.

Bind it to your Organization

Binding uses a device-code flow, so the browser itself never needs console credentials:

1. In the web console, open your Organization's asset pool and choose Add asset → Bind browser. This opens the binding guide and a button to the binding approval page.
2. Open the WingGate extension in your browser and start binding. It shows a short device code.
3. In the console, approve the code on the binding page.
4. When binding succeeds, the browser appears in the Organization asset pool with an auto-generated name.

One bound browser is one asset, identified by the extension's public key. Unbinding from the extension revokes that identity on the server, removes the matching browser asset from the Organization asset pool, and deletes the local keys. After unbinding, binding again creates a new asset; binding again without unbinding reconnects to the existing asset instead of duplicating it. A rebuilt machine does not inherit stale access.

Use it

After binding, grant members access through a Project as you would for any asset. An agent with an MCP credential for that Project lists the browser tools alongside file and command tools. When the extension is closed or the browser is not running, the asset shows as offline — that is a live-session state, not a setup failure; reopen the browser to restore it.

Troubleshooting

• Binding does not complete — confirm the extension is open and showing the same device code you are approving, and that you approve on the page for the right Organization.
• Asset is offline — start the browser; the extension reconnects on its own.
• Agent cannot use the browser tools — check the member's Project grant and that the MCP credential was created for that Project; see the MCP setup guide.
• Unbinding fails — unbinding needs the hub to be reachable: the extension revokes the server-side identity before clearing local keys, so a network failure keeps the binding and reports an error; retry later. If the hub is permanently unreachable, an Organization admin can revoke the extension from the Executors list in the console instead.
• Binding lost after upgrading from an older download package — the download package and the store build share one extension ID. If you loaded an earlier package (an older ID), that folder is a different extension in Chrome and the new package does not upgrade it in place: unbind in the extension first (revokes the server-side identity and removes the browser asset), then remove the old entry in chrome://extensions, load or install the new package, and bind again. Skipping the unbind leaves an orphan agent and browser asset in the Organization.