mcp.betterchess.co

This tool's sole function is to hand back JavaScript source code with an explicit instruction that the agent run it in the chess.com page using the browser's javascript tool. This chains into code execution in a live web session (with window.__coach* hooks to read game state and even 'play' moves) without any indication that the returned code is reviewed or sandboxed. An agent following this description verbatim would eval remotely-supplied code in the user's browser session on a third-party site, which is a broad capability relative to what a 'chess coaching' tool needs and could be abused to inject unwanted DOM/script behavior, automate actions on the user's account, or exfiltrate page data. Should be treated with the same caution as any 'run this code for me' pattern — the actual JS source should be inspected before execution, and ideally the tool should not implicitly direct the agent to invoke a separate execution tool.