MCP server · Org-owned · Audited from source

Chrome DevTools MCP server

by chromedevtools/chrome-devtools-mcpApache-2.0 licenceAudited 19 Sep 2026 · source ad24a9ae5758

npm chrome-devtools-mcp 1.9.0stdio★ 52,293

✓SAFEGrade B · 84/100 · 19 Sep 2026 · ad24a9a

52,293GitHub stars

Is it safe? Yes — SAFE, grade B (84/100). It exposes 84 tools: 70 read, 12 write and 2 destructive. The audit recorded 26 findings (0 critical, 0 high, 1 medium, 20 low). Maintainer's description: Chrome DevTools for coding agents

Ask an AI about this pageGChatGPT CClaude PPerplexity GeGemini XGrok

CoCopilot AIGoogle AI Mode

Cite

Cite this page

ModelsAtlas. “Chrome DevTools MCP server (chromedevtools/chrome-devtools-mcp)”. Retrieved 19 Sep 2026. https://modelsatlas.com/mcp/chromedevtools/chrome-devtools-1

2 MCP servers are called Chrome DevTools. This is the one we pick. Compare all 2 →

chromedevtools/chrome-devtools-mcp Org-owned★ 52,293✓SAFE
benjaminr/chrome-devtools-mcp★ 309✓SAFE

Trust audit

Audit 0.4.1 · full source read 19 Sep 2026

Trust score84/100✓SAFE B

0 critical0 high1 medium20 low5 info

26 findings, listed below with the file and line each was found on. Grade A needs a sandboxed behavioural run too; this audit read the source only.

What the source does

FilesystemDeclared8 observations
NetworkDeclared4 observations
ShellDeclared5 observations
DependenciesNot pinnedSome ranges float
SecretsNone foundNo keys in source

“Declared” means the server says it does this and the source agrees. Browser, file and shell access are expected of some kinds of server.

Five audit layers

Layer	What we check	Result
`L0` Provenance	Repo owner, licence, archive status, activity	PASS 8 findings
`L1` Static source	Secrets, path traversal, supply chain	PASS 16 findings
`L2` Instructions	Prompt injection and authority framing in docs and tool descriptions	PASS
`L3` Inventory	Declared tools match the source	WARN 1 finding
`L4` Sandbox	Run in isolation and watch behaviour	SKIPPED

Provenance & runtime

Who published it, and what the audit could and could not run

Provenance

Repository owner chromedevtoolsOrganizationAccount type recorded when we read the repository.
PackagePublished on npmchrome-devtools-mcp at version 1.9.0
LicenceApache-2.0From the repository, as read at the audited commit.
Last pushTodayActivity of the repository when we read it.
Source commit readad24a9ae5758The audit covers exactly this commit, read on 19 Sep 2026.

Runtime

Sandbox runNot run yetThis audit read the source only; it did not execute the server.
Tool inventory84 declaredRead from the source and classed read, write or destructive.

Every value here is read from the record's own repository and audit.Suggest a correction

Findings (26)

Sorted by severity · the 25 most severe of 26 are listed

MEDIUMFilesystem / pathmcp.destructive_tools

F-05 Filesystem / pathCWE-22 · CWE-59Layer L3

uninstall_extension, uninstall_pwa

Why: 2 tool(s) can delete or overwrite
Fix: prefer a read-only mode or scoped tokens; the page states the blast radius

LOWInventory / provenanceinv.binary · tests/trace-processing/fixtures/basic-trace.json.gz

F-13 Inventory / provenanceCWE-1104Layer L0

basic-trace.json.gz

Why: a compiled or binary member cannot be reviewed from source
Fix: ship source, or explain the binary in the README

LOWInventory / provenanceinv.hidden_file · .gitmodules

F-13 Inventory / provenanceCWE-1104Layer L0

.gitmodules

Why: hidden member outside the usual dotfiles
Fix: review its purpose

LOWInventory / provenanceinv.hidden_file · .prettierignore

F-13 Inventory / provenanceCWE-1104Layer L0

.prettierignore

Why: hidden member outside the usual dotfiles
Fix: review its purpose

LOWInventory / provenanceinv.hidden_file · .release-please-manifest.json

F-13 Inventory / provenanceCWE-1104Layer L0

.release-please-manifest.json

Why: hidden member outside the usual dotfiles
Fix: review its purpose

LOWCode injectioncode.eval_exec · tests/tools/input.test.ts:895

F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1

let isChecked = await page.$eval(

Why: evaluates text as code
Fix: remove; use a parser or a dispatch table

LOWCode injectioncode.eval_exec · tests/tools/input.test.ts:914

F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1

isChecked = await page.$eval(

Why: evaluates text as code
Fix: remove; use a parser or a dispatch table

LOWCode injectioncode.eval_exec · tests/tools/input.test.ts:953

F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1

let swChecked = await page.$eval(

Why: evaluates text as code
Fix: remove; use a parser or a dispatch table

LOWCode injectioncode.eval_exec · tests/tools/input.test.ts:972

F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1

swChecked = await page.$eval(

Why: evaluates text as code
Fix: remove; use a parser or a dispatch table

LOWCode injectioncode.eval_exec · tests/tools/input.test.ts:1001

F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1

let r1Checked = await page.$eval(

Why: evaluates text as code
Fix: remove; use a parser or a dispatch table

LOWFilesystem / pathfs.traversal · src/telemetry/watchdog/ClearcutSender.ts:9

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

import {logger} from '../../utils/logger.js';

Why: No further detail recorded for this rule.
Fix: —

LOWFilesystem / pathfs.traversal · src/telemetry/watchdog/main.ts:12

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

import {logger, flushLogs, saveLogsToFile} from '../../utils/logger.js';

Why: No further detail recorded for this rule.
Fix: —

LOWFilesystem / pathfs.traversal · src/third_party/devtools-formatter-worker.ts:8

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

import '../../third_party/devtools-frontend/front_end/entrypoints/formatter_worker/formatter_worker-entrypoint.js';

Why: No further detail recorded for this rule.
Fix: —

LOWFilesystem / pathfs.traversal · src/third_party/devtools-heap-snapshot-worker.ts:8

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

import '../../third_party/devtools-frontend/front_end/entrypoints/heap_snapshot_worker/heap_snapshot_worker-entrypoint.js';

Why: No further detail recorded for this rule.
Fix: —

LOWFilesystem / pathfs.traversal · src/third_party/index.ts:99

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

export * as DevTools from '../../third_party/devtools-frontend/mcp/mcp.js';

Why: No further detail recorded for this rule.
Fix: —

LOWNetwork egressnet.raw_ip · docs/advanced-usage.md:109

F-04 Network egressCWE-200 · CWE-319Layer L1

Add the `--browser-url` option to your MCP client configuration. The value of this option should be the URL of the running Chrome instance. `http://127.0.0.1:9222` is a common default.

Why: No further detail recorded for this rule.
Fix: —

LOWNetwork egressnet.raw_ip · docs/advanced-usage.md:118

F-04 Network egressCWE-200 · CWE-319Layer L1

"--browser-url=http://127.0.0.1:9222"

Why: No further detail recorded for this rule.
Fix: —

LOWNetwork egressnet.raw_ip · docs/client-configurations.md:30

F-04 Network egressCWE-200 · CWE-319Layer L1

"--browser-url=http://127.0.0.1:9222"

Why: No further detail recorded for this rule.
Fix: —

LOWNetwork egressnet.raw_ip · docs/client-configurations.md:317

F-04 Network egressCWE-200 · CWE-319Layer L1

- **Connection URL:** `http://127.0.0.1:8080/mcp`

Why: No further detail recorded for this rule.
Fix: —

LOWNetwork egressnet.raw_ip · docs/configuration.md:43

F-04 Network egressCWE-200 · CWE-319Layer L1

Connect to a running, debuggable Chrome instance (e.g. `http://127.0.0.1:9222`). For more details see: https://github.com/ChromeDevTools/chrome-devtools-mcp/blob/main/docs/advanced-usage.md#connecting

Why: No further detail recorded for this rule.
Fix: —

LOWSupply chainsupply.unpinned · package.json

F-08 Supply chainCWE-829 · CWE-1357Layer L1

@blackwell-systems/gcf, @eslint/js, @google/genai, @rollup/plugin-commonjs, @rollup/plugin-json, @rollup/plugin-node-resolve, @stylistic/eslint-plugin, @toon-format/toon

Why: 26 dependency range(s) float
Fix: pin exact versions or ship a lockfile

INFOInventory / provenanceinv.oversize · src/third_party/lighthouse-devtools-mcp-bundle.js

F-13 Inventory / provenanceCWE-1104Layer L0

src/third_party/lighthouse-devtools-mcp-bundle.js

Why: 3572855 bytes not read
Fix: —

INFOInventory / provenanceinv.oversize · tests/fixtures/example.heapsnapshot

F-13 Inventory / provenanceCWE-1104Layer L0

tests/fixtures/example.heapsnapshot

Why: 2369369 bytes not read
Fix: —

INFOInventory / provenanceinv.oversize · tests/fixtures/heap-1.heapsnapshot

F-13 Inventory / provenanceCWE-1104Layer L0

tests/fixtures/heap-1.heapsnapshot

Why: 1214756 bytes not read
Fix: —

INFOInventory / provenanceinv.oversize · tests/fixtures/heap-2.heapsnapshot

F-13 Inventory / provenanceCWE-1104Layer L0

tests/fixtures/heap-2.heapsnapshot

Why: 1216999 bytes not read
Fix: —

Tools it exposes

84 declared in source · 2 destructive

70 read12 write2 destructive

2 tools can delete or overwrite. An agent that can be talked into calling a tool can be talked into calling this one, so give it a token scoped to what you need.

Tool	Risk	What it does
`uninstall_extension`	destructive	Uninstalls a Chrome extension by its ID.
`uninstall_pwa`	destructive	Uninstalls a Progressive Web App identified by its manifest ID and
`execute_3p_developer_tool`	write	Executes a tool exposed by the page.
`execute_webmcp_tool`	write	Executes a WebMCP tool exposed by the page.
`install_extension`	write	Installs a Chrome extension from the given path.
`install_pwa`	write	Installs a Progressive Web App (PWA) identified by its manifest ID.
`install_pwa_tool`	write	PWA tool with local-only file verification
`performance_start_trace`	write	Start a performance trace on the target webpage. Use to find frontend performance issues, Core Web Vitals (LCP, INP, CLS), and improve page load speed.
`performance_stop_trace`	write	Stop the active performance trace recording on the target webpage.
`screencast_start`	write	Starts recording a screencast (video) of the target page in specified format.
`screencast_stop`	write	Stops the active screencast recording on the target page.
`trigger_extension_action`	write	Triggers the default action of an extension by its ID.
`upload_file`	write	Upload a file through a provided element.
`upload_tool`	write	A tool with local-only file verification
`3pDeveloperTool`	read	A test tool
`click`	read	Clicks on the provided element
`click_at`	read	Clicks at the provided coordinates
`close_heapsnapshot`	read	Closes a previously loaded memory heapsnapshot, freeing its memory.
`close_page`	read	Closes the page by its index. The last open page cannot be closed.
`compare_heapsnapshots`	read	Loads two memory heapsnapshots and returns the comparison. If classIndex is provided, returns detailed diff for that class, otherwise returns summary diff.
`disabled_tool`	read	A disabled tool
`drag`	read	Drag an element onto another element
`emulate`	read	Emulates various features on the target page.
`enum_tool`	read	test description
`evaluate`	read	Evaluates a JavaScript script
`evaluate_script`	read	Evaluate a JavaScript function inside the target page${cliArgs.categoryExtensions ?
`file_tool`	read	A tool requiring file validation
`fill`	read	Type text into an input, text area or select an option from a <select> element.
`fill_form`	read	Fill out multiple form elements (inputs, selects, checkboxes, radios) at once. ALWAYS prefer this tool over multiple individual
`get_console_message`	read	Gets a console message by its ID. You can get all messages by calling ${LIST_CONSOLE_MESSAGES_TOOL_NAME}.
`get_devtools_comments`	read	Retrieve user comments from the DevTools window for the page.
`get_heapsnapshot_class_nodes`	read	Loads a memory heapsnapshot and returns instances of a specific class with their IDs.
`get_heapsnapshot_details`	read	Loads a memory heapsnapshot and returns all available information including statistics, static data, and aggregated node information. Supports pagination for aggregates.
`get_heapsnapshot_dominators`	read	Loads a memory heapsnapshot and returns the dominator chain for a specific node ID. This helps to identify which objects are keeping the target node alive.
`get_heapsnapshot_duplicate_strings`	read	Loads a memory heapsnapshot and returns duplicate strings grouped by their value.
`get_heapsnapshot_edges`	read	Loads a memory heapsnapshot and returns outgoing edges (references) for a specific node ID.
`get_heapsnapshot_object_details`	read	Loads a memory heapsnapshot and returns detailed information about a specific object by its node ID, including size, type, distance, and DOM detachedness.
`get_heapsnapshot_retainers`	read	Loads a memory heapsnapshot and returns retainers for a specific node ID.
`get_heapsnapshot_retaining_paths`	read	Loads a memory heapsnapshot and returns retaining paths for a specific node ID. This helps to understand why a node is not being garbage collected.
`get_heapsnapshot_summary`	read	Loads a memory heapsnapshot and returns snapshot summary stats, including native contexts and their sizes, and retained by context summary.
`get_network_request`	read	Gets a network request by an optional reqid, if omitted returns the currently selected request in the DevTools Network panel. Useful for inspecting request headers (including
`get_os_app_state`	read	Returns the OS integration state (badge count and registered file
`get_tab_id`	read	Get the tab ID of the page
`global_tool`	read	A global tool
`group-1`	read	desc-1
`group-2`	read	desc-2
`handle_dialog`	read	If a browser dialog was opened, use this command to handle it
`hover`	read	Hover over the provided element
`hybrid_tool`	read	A tool with both schema file verifications
`launch_pwa`	read	Launches an installed Progressive Web App using its saved display mode.
`lenient_tool`	read	A tool with a required argument
`lighthouse_audit`	read	Get Lighthouse score and reports for accessibility, SEO, best practices, and agentic browsing. This excludes performance. For performance audits, run ${startTrace(args).name}
`list_3p_developer_tools`	read	Lists all third-party developer tools the page exposes for providing runtime information. Third-party developer tools can be called via the
`list_extensions`	read	Lists all the Chrome extensions installed in the browser. This includes their name, ID, version, and enabled status.
`list_network_requests`	read	Lists the most recent requests for the target page since the last navigation.
`list_pages`	read	Get a list of pages${args?.categoryExtensions ?
`list_webmcp_tools`	read	Lists all WebMCP tools the page exposes.
`myTool`	read	Does something
`navigate`	read	Loads a URL
`navigate_page`	read	Go to a URL, or back, forward, or reload. Use project URL if not specified otherwise.
`new_page`	read	Open a new tab and load a URL. Use project URL if not specified otherwise.
`open_devtools`	read	Open a DevTools window for the selected page.
`page_file_tool`	read	A page scoped tool with file verification
`page_tool`	read	A page scoped tool
`performance_analyze_insight`	read	Provides more detailed information on a specific Performance Insight of an insight set that was highlighted in the results of a trace recording.
`press_key`	read	Press a key or key combination. Use this when other input methods like fill() cannot be used (e.g., keyboard shortcuts, navigation keys, or special key combinations).
`query_heapsnapshot_objects`	read	Loads a memory heapsnapshot and queries objects matching specific filters (className, propertyName, nodeType, retainedSize, selfSize, isDetached, sortBy).
`reload_extension`	read	Reloads an unpacked Chrome extension by its ID.
`remote_file_tool`	read	A tool with remote-only file verification
`resize_page`	read	Resizes the page
`resolve_devtools_comment`	read	Append an agent reply to a DevTools comment thread and mark it as resolved.
`reveal_in_devtools`	read	Navigate DevTools to a specified panel and highlight a target DOM node or network request. The parameters uid and reqid are mutually exclusive.
`screenshot`	read	Takes a screenshot
`select_page`	read	Select a page as a context for future tool calls.
`take_heapsnapshot`	read	Capture a heap snapshot of the target page. Use to analyze the memory distribution of JavaScript objects and debug memory leaks.
`take_screenshot`	read	Take a screenshot of the page or element.
`test-group`	read	test description
`test-tool`	read	test tool description
`test_tool`	read	A test tool
`tool-1`	read	tool-1-desc
`tool-2`	read	tool-2-desc
`type_text`	read	Type text using keyboard into a previously focused input
`wait_for`	read	Wait for the specified text to appear on the selected page.
`wrapped_enum_tool`	read	test description

Install

Package version 1.9.0 · audited commit ad24a9a

claude mcp add chrome-devtools-mcp -- npx -y [email protected]

The command pins the package version recorded in the source (1.9.0); the audit covers commit ad24a9ae5758. Transport: stdio. Reads this environment variable: GEMINI_API_KEY. Give it the narrowest token it needs.

Audit history

2026-09-19
✓SAFE B 84 / 100
Source changed, verdict held · ad24a9ae5758
2026-09-18
✓SAFE B 84 / 100
First audit · ffd7af791934

README badge

For maintainers · updates on every re-audit

[![ModelsAtlas: SAFE B](https://modelsatlas.com/mcp/chromedevtools/chrome-devtools-1/badge.svg)](https://modelsatlas.com/mcp/chromedevtools/chrome-devtools-1/)

The badge always shows the latest audit; a maintainer cannot pin an old verdict.

Other ratings

Cited, never blended into our score

No third-party security ratings are recorded for this server yet. When they exist they appear here with their source and date, beside, not inside, our grade.

Questions about Chrome DevTools MCP server

What is the Chrome DevTools MCP server?

Chrome DevTools for coding agents

What tools does Chrome DevTools expose?

84 in total: 70 read-only, 12 that write, and 2 that can delete or overwrite (uninstall_extension, uninstall_pwa). Every one is listed on this page with its risk.

Is Chrome DevTools safe to connect to an agent?

The audit found nothing in the source that contradicts what it says it does, and graded it B (84/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B. Separately from the audit: 2 of its tools can destroy data, so scope the token you give it to what you actually need.

What credentials does Chrome DevTools need?

It reads GEMINI_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does Chrome DevTools run?

It speaks stdio, so it runs as a local process your client starts. It is published on npm as chrome-devtools-mcp at 1.9.0.

How current is this page?

The grade is for one exact copy of the source (ad24a9ae5758), read on 2026-09-19. The repository is watched and re-audited when it changes.

Which Chrome DevTools MCP server is the right one?

chromedevtools/chrome-devtools-mcp (this page). 2 servers share the name; see the side-by-side comparison.

Sources

chromedevtools/chrome-devtools-mcp on GitHub — the source we read, its licence, stars and activityObserved · 19 Sep 2026
ModelsAtlas trust audit — SAFE verdict for commit ad24a9ae5758Observed · 19 Sep 2026

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.

What is the Chrome DevTools MCP server?
GChatGPT CClaude PPerplexity
What tools does Chrome DevTools expose?
GChatGPT CClaude PPerplexity
Is Chrome DevTools safe to connect to an agent?
GChatGPT CClaude PPerplexity