Agents could always drive the preview browser, with no way to say no. Adds
Settings → Integrations → Browser → Agent browser access, on by default.

Turning it off withholds the MCP credential in `prepareMcpSession`. That is
the only place a credential is minted and the `/mcp` endpoint accepts nothing
else, so one branch covers all five providers and any external MCP client —
every adapter already treats a missing session as "no MCP server".

The Codex developer instructions describing `preview_*` drop out with the
tools. That is derived from the session's actual MCP configuration via the
existing `hasConfiguredMcpServer`, not from a second read of the setting, so
the prompt cannot describe tools the turn doesn't have. Leaving the text in
would be worse than saying nothing: it steers the model away from Playwright
and agent-browser, so it would talk the agent out of its only remaining
browser automation.

An unreadable settings file denies rather than propagating the error, which
would mean adding ServerSettingsError to a union every caller handles. Denying
is the safe direction: an explicit "off" silently becoming "on" would violate
the user's choice, while the reverse costs one toolset and is visible at once.

The toggle applies to sessions started from then on; a running agent keeps the
tools it was given, which the UI states rather than implying otherwise.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>