Chrome DevTools

Name: Chrome DevTools
Author: chromedevtools

SAFEgrade B · trust 84/100

Chrome DevTools for coding agents

browserchromechrome devtoolsdebuggingdevtoolsmcpmcp serverpuppeteer

Overview

From the repository's own README, as read at the audited commit.

# Chrome DevTools for agents[![npm chrome-devtools-mcp package](https://img.shields.io/npm/v/chrome-devtools-mcp.svg)](https://npmjs.org/package/chrome-devtools-mcp)Chrome DevTools for agents (`chrome-devtools-mcp`) lets your coding agent (such as Antigravity, Claude, Cursor or Copilot)control and inspect a live Chrome browser. It acts as a Model-Context-Protocol(MCP) server, giving your AI coding assistant access to the full power ofChrome DevTools for reliable automation, in-depth debugging, and performance analysis.A [CLI][cli] is also provided for use without MCP.[Tool reference][tool-reference] | [Changelog][changelog] | [Contributing][contributing] | [Troubleshooting][troubleshooting] | [Design Principles][design-principles]## Key features- **Get performance insights**: Uses [Chrome  DevTools](https://github.com/ChromeDevTools/devtools-frontend) to record  traces and extract actionable performance insights.- **Advanced browser debugging**: Analyze network requests, take screenshots and  check browser console messages (with source-mapped stack traces).- **Reliable automation**. Uses  [puppeteer](https://github.com/puppeteer/puppeteer) to automate actions in  Chrome and automatically wait for action results.## Disclaimers`chrome-devtools-mcp` exposes content of the browser instance to the MCP clientsallowing them to inspect, debug, and modify any data in the browser or DevTools.Avoid sharing sensitive or personal information that you don't want to share withMCP clients.`chrome-devtools-mcp` officially supports Google Chrome and [Chrome for Testing](https://developer.chrome.com/blog/chrome-for-testing/) only.Other Chromium-based browsers may work, but this is not guaranteed, and you may encounter unexpected behavior. Use at your own discretion.We are committed to providing fixes and support for the latest version of [Extended Stable Chrome](https://chromiumdash.appspot.com/schedule).Performance tools may send trace URLs to the Google CrUX API to fetch real-userex

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code (npm)

claude mcp add chrome-devtools-mcp -- npx -y [email protected]

Exposed tools (84) 70 read · 12 write · 2 destructive

Blast radius: 2 tools can delete or overwrite. An agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`3pDeveloperTool`	read	A test tool
`click`	read	Clicks on the provided element
`click_at`	read	Clicks at the provided coordinates
`close_heapsnapshot`	read	Closes a previously loaded memory heapsnapshot, freeing its memory.
`close_page`	read	Closes the page by its index. The last open page cannot be closed.
`compare_heapsnapshots`	read	Loads two memory heapsnapshots and returns the comparison. If classIndex is provided, returns detailed diff for that class, otherwise returns summary diff.
`disabled_tool`	read	A disabled tool
`drag`	read	Drag an element onto another element
`emulate`	read	Emulates various features on the target page.
`enum_tool`	read	test description
`evaluate`	read	Evaluates a JavaScript script
`evaluate_script`	read	Evaluate a JavaScript function inside the target page${cliArgs?.categoryExtensions ?
`execute_3p_developer_tool`	write	Executes a tool exposed by the page.
`execute_webmcp_tool`	write	Executes a WebMCP tool exposed by the page.
`file_tool`	read	A tool requiring file validation
`fill`	read	Type text into an input, text area or select an option from a <select> element.
`fill_form`	read	Fill out multiple form elements (inputs, selects, checkboxes, radios) at once. ALWAYS prefer this tool over multiple individual
`get_console_message`	read	Gets a console message by its ID. You can get all messages by calling ${LIST_CONSOLE_MESSAGES_TOOL_NAME}.
`get_devtools_comments`	read	Retrieve user comments from the DevTools window for the page.
`get_heapsnapshot_class_nodes`	read	Loads a memory heapsnapshot and returns instances of a specific class with their IDs.
`get_heapsnapshot_details`	read	Loads a memory heapsnapshot and returns all available information including statistics, static data, and aggregated node information. Supports pagination for aggregates.
`get_heapsnapshot_dominators`	read	Loads a memory heapsnapshot and returns the dominator chain for a specific node ID. This helps to identify which objects are keeping the target node alive.
`get_heapsnapshot_duplicate_strings`	read	Loads a memory heapsnapshot and returns duplicate strings grouped by their value.
`get_heapsnapshot_edges`	read	Loads a memory heapsnapshot and returns outgoing edges (references) for a specific node ID.
`get_heapsnapshot_object_details`	read	Loads a memory heapsnapshot and returns detailed information about a specific object by its node ID, including size, type, distance, and DOM detachedness.
`get_heapsnapshot_retainers`	read	Loads a memory heapsnapshot and returns retainers for a specific node ID.
`get_heapsnapshot_retaining_paths`	read	Loads a memory heapsnapshot and returns retaining paths for a specific node ID. This helps to understand why a node is not being garbage collected.
`get_heapsnapshot_summary`	read	Loads a memory heapsnapshot and returns snapshot summary stats, including native contexts and their sizes, and retained by context summary.
`get_network_request`	read	Gets a network request by an optional reqid, if omitted returns the currently selected request in the DevTools Network panel. Useful for inspecting request headers (including
`get_os_app_state`	read	Returns the OS integration state (badge count and registered file
`get_tab_id`	read	Get the tab ID of the page
`global_tool`	read	A global tool
`group-1`	read	desc-1
`group-2`	read	desc-2
`handle_dialog`	read	If a browser dialog was opened, use this command to handle it
`hover`	read	Hover over the provided element
`hybrid_tool`	read	A tool with both schema file verifications
`install_extension`	write	Installs a Chrome extension from the given path.
`install_pwa`	write	Installs a Progressive Web App (PWA) identified by its manifest ID.
`install_pwa_tool`	write	PWA tool with local-only file verification
`launch_pwa`	read	Launches an installed Progressive Web App using its saved display mode.
`lenient_tool`	read	A tool with a required argument
`lighthouse_audit`	read	Get Lighthouse score and reports for accessibility, SEO, best practices, and agentic browsing. This excludes performance. For performance audits, run ${startTrace.name}
`list_3p_developer_tools`	read	Lists all third-party developer tools the page exposes for providing runtime information.Third-party developer tools can be called via the
`list_extensions`	read	Lists all the Chrome extensions installed in the browser. This includes their name, ID, version, and enabled status.
`list_network_requests`	read	Lists the most recent requests for the target page since the last navigation.
`list_pages`	read	Get a list of pages${args?.categoryExtensions ?
`list_webmcp_tools`	read	Lists all WebMCP tools the page exposes.
`myTool`	read	Does something
`navigate`	read	Loads a URL
`navigate_page`	read	Go to a URL, or back, forward, or reload. Use project URL if not specified otherwise.
`new_page`	read	Open a new tab and load a URL. Use project URL if not specified otherwise.
`open_devtools`	read	Open a DevTools window for the selected page.
`page_file_tool`	read	A page scoped tool with file verification
`page_tool`	read	A page scoped tool
`performance_analyze_insight`	read	Provides more detailed information on a specific Performance Insight of an insight set that was highlighted in the results of a trace recording.
`performance_start_trace`	write	Start a performance trace on the target webpage. Use to find frontend performance issues, Core Web Vitals (LCP, INP, CLS), and improve page load speed.
`performance_stop_trace`	write	Stop the active performance trace recording on the target webpage.
`press_key`	read	Press a key or key combination. Use this when other input methods like fill() cannot be used (e.g., keyboard shortcuts, navigation keys, or special key combinations).
`query_heapsnapshot_objects`	read	Loads a memory heapsnapshot and queries objects matching specific filters (className, propertyName, nodeType, retainedSize, selfSize, isDetached, sortBy).
`reload_extension`	read	Reloads an unpacked Chrome extension by its ID.
`remote_file_tool`	read	A tool with remote-only file verification
`resize_page`	read	Resizes the page
`resolve_devtools_comment`	read	Append an agent reply to a DevTools comment thread and mark it as resolved.
`reveal_in_devtools`	read	Navigate DevTools to a specified panel and highlight a target DOM node or network request. The parameters uid and reqid are mutually exclusive.
`screencast_start`	write	Starts recording a screencast (video) of the target page in specified format.
`screencast_stop`	write	Stops the active screencast recording on the target page.
`screenshot`	read	Takes a screenshot
`select_page`	read	Select a page as a context for future tool calls.
`take_heapsnapshot`	read	Capture a heap snapshot of the target page. Use to analyze the memory distribution of JavaScript objects and debug memory leaks.
`take_screenshot`	read	Take a screenshot of the page or element.
`test-group`	read	test description
`test-tool`	read	test tool description
`test_tool`	read	A test tool
`tool-1`	read	tool-1-desc
`tool-2`	read	tool-2-desc
`trigger_extension_action`	write	Triggers the default action of an extension by its ID.
`type_text`	read	Type text using keyboard into a previously focused input
`uninstall_extension`	destructive	Uninstalls a Chrome extension by its ID.
`uninstall_pwa`	destructive	Uninstalls a Progressive Web App identified by its manifest ID and
`upload_file`	write	Upload a file through a provided element.
`upload_tool`	write	A tool with local-only file verification
`wait_for`	read	Wait for the specified text to appear on the selected page.
`wrapped_enum_tool`	read	test description

Details

Source: chromedevtools/chrome-devtools-mcp
npm: chrome-devtools-mcp@1.9.0
Transports: stdio
Credentials it reads: GEMINI_API_KEY
License: Apache-2.0
Stars: 52,222 · pushed 0d ago

Trust audit

Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	PASS
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (8 observation(s))
Network: declared (4 observation(s))
Shell: declared (5 observation(s))
Dependencies: not all pinned
Secrets in source: none-found

Findings (25)

MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59

uninstall_extension, uninstall_pwa

Why it matters. 2 tool(s) can delete or overwrite

Fix. prefer a read-only mode or scoped tokens; the page states the blast radius

LOWInventory / provenance · inv.binary · CWE-1104

tests/trace-processing/fixtures/basic-trace.json.gz

basic-trace.json.gz

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

LOWInventory / provenance · inv.hidden_file · CWE-1104

.gitmodules

.gitmodules

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWInventory / provenance · inv.hidden_file · CWE-1104

.prettierignore

.prettierignore

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWInventory / provenance · inv.hidden_file · CWE-1104

.release-please-manifest.json

.release-please-manifest.json

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose