Authentication disabled
Minimal local configuration
{
"mcpServers": {
"hronaut": {
"type": "streamable-http",
"url": "http://127.0.0.1:47812/mcp",
"alwaysAllow": [],
"disabled": false
}
}
}Zoo Code browser MCP
Give Zoo Code a browser that survives the editor task.
Hronaut runs a separate visible Chromium application. Zoo Code connects over Streamable HTTP while named workspaces, sign-ins, tabs, and debugging state remain available after the editor task ends.
Hronaut is an independent project and is not affiliated with or endorsed by Zoo Code.
Local MCP endpoint
http://127.0.0.1:47812/mcp
Run Zoo Code and Hronaut on the same computer. A hosted or remote agent cannot reach this loopback endpoint without a separately designed secure transport.
Global Streamable HTTP setup
Add Hronaut through Edit Global MCP.
Open the Zoo Code pane, choose MCP Servers, then Edit Global MCP. Use the first configuration only while Hronaut authentication is disabled.
Authentication enabled
Read the owner token from the editor process environment
{
"mcpServers": {
"hronaut": {
"type": "streamable-http",
"url": "http://127.0.0.1:47812/mcp",
"headers": {
"Authorization": "Bearer ${env:HRONAUT_MCP_TOKEN}"
},
"alwaysAllow": [],
"disabled": false
}
}
}Set HRONAUT_MCP_TOKEN in the trusted environment that launches the editor, then restart the editor so Zoo Code can resolve it. Copy the token setup command from Hronaut Home. Never paste the token itself into this JSON, chat, source control, screenshots, or shell history.
Observable verification
Verify both the MCP connection and browser result.
1 · Connection
Check MCP Servers
Confirm hronaut is connected in Zoo Code. Hronaut Home should show the new client under Connections.
2 · Approval
Review tools before automation
Keep alwaysAllow empty initially. Add only actions you have reviewed, and keep Hronaut's pause and tab-lock controls available for human takeover.
3 · Browser task
Prove workspace persistence
Ask: “Using Hronaut, create a workspace named first-check, open https://example.com inside it, and tell me the page title and workspace ID. Do not use my Default workspace.”
Expect a visible first-check workspace showing Example Domain. Start another Zoo Code task and reuse that same workspace to prove the browser outlived the first task.
Local authority
Treat persistent browser access as durable authority.
Any local client that can reach an unprotected Hronaut endpoint can control its agent workspaces. Enable MCP authentication before using valuable signed-in sessions, keep the owner token outside configuration files, and pause MCP before entering passwords, security keys, payment details, or recovery material.
Zoo Code is the active community continuation of the discontinued Roo Code project. Verify the current package and repository before installation; the Hronaut setup above depends only on Zoo Code's standard MCP configuration and does not install a Zoo Code package.
Primary sources
Configuration and interpolation evidence.
- Official Zoo Code MCP guide — global MCP editing, Streamable HTTP configuration, headers, and approval settings.
- Zoo Code configuration source — recursive
${env:VARIABLE}expansion across configuration objects. - Zoo Code repository — active project status and Apache-2.0 license.
- Hronaut reference — loopback transport, authentication, isolation, persistence, and human controls.
Keep the browser; change the task
Use named workspaces for durable Zoo Code jobs.
Named workspaces isolate site state from the human Default workspace and remain available to later local Zoo Code tasks or another compatible MCP client.