Atlas / MCP servers / chromedevtools / chrome-devtools-mcp

chrome-devtools-mcpSAFE

Name: chrome-devtools-mcp
Author: chromedevtools

mcp/chromedevtools/chrome-devtools-mcp

MCP server by chromedevtools · browser · chrome · chrome devtools · Audited 2026-10-20

⚑ Report / re-scan Source ↗

Chrome DevTools for coding agents

Verdict

SAFE

Grade

Trust score

84 /100

Exposed tools

93 79r · 12w · 2d

Transport

stdio

License

Apache-2.0

Stars

53,894

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

[](https://npmjs.org/package/chrome-devtools-mcp)

Chrome DevTools for agents (chrome-devtools-mcp) lets your coding agent (such as Antigravity, Claude, Cursor or Copilot) control and inspect a live Chrome browser. It acts as a Model-Context-Protocol (MCP) server, giving your AI coding assistant access to the full power of Chrome DevTools for reliable automation, in-depth debugging, and performance analysis. A [CLI][cli] is also provided for use without MCP.

[Tool reference][tool-reference] | [Changelog][changelog] | [Contributing][contributing] | [Troubleshooting][troubleshooting] | [Design Principles][design-principles]

Key features

Get performance insights: Uses [Chrome

DevTools](https://github.com/ChromeDevTools/devtools-frontend) to record traces and extract actionable performance insights.

Advanced browser debugging: Analyze network requests, take screenshots and

check browser console messages (with source-mapped stack traces).

Reliable automation. Uses

puppeteer to automate actions in Chrome and automatically wait for action results.

Disclaimers

chrome-devtools-mcp exposes content of the browser instance to the MCP clients allowing them to inspect, debug, and modify any data in the browser or DevTools. Avoid sharing sensitive or personal information that you don't want to share with MCP clients.

chrome-devtools-mcp officially supports Google Chrome and Chrome for Testing only. Other Chromium-based browsers may work, but this is not guaranteed, and you may encounter unexpected behavior. Use at your own discretion. We are committed to providing fixes and support for the latest version of Extended Stable Chrome.

Performance tools may send trace URLs to the Go

Read from source at commit 122de45ea344OBSERVED · 2026-10-20

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code (npm)

claude mcp add chrome-devtools-mcp -- npx -y [email protected]

Exposed tools (93)

79 read · 12 write · 2 destructive. Blast radius: 2 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`3pDeveloperTool`	read	A test tool
`browserless_tool`	read	A tool that does not need a browser
`click`	read	Clicks on the provided element
`click_at`	read	Clicks at the provided coordinates
`close_heapsnapshot`	read	Closes a previously loaded and cached memory heapsnapshot, freeing its memory.
`close_page`	read	Closes the page by its index. The last open page cannot be closed.
`compare_heapsnapshots`	read	Loads and caches two memory heapsnapshots and returns the comparison. If classIndex is provided, returns detailed diff for that class, otherwise returns summary diff.
`custom_tool`	read	A custom tool
`debug_tool`	read	A debugging WebMCP tool
`disabled_tool`	read	A disabled tool
`drag`	read	Drag an element onto another element
`dynamic_debug_tool`	read	Added dynamically
`emulate`	read	Emulates various features on the target page. Each call replaces all emulation settings (except extraHttpHeaders), so pass all desired settings in a single call.
`enum_tool`	read	test description
`evaluate`	read	Evaluates a JavaScript script
`evaluate_script`	read	Evaluate JavaScript inside the target page${cliArgs.categoryExtensions ?
`execute_3p_developer_tool`	write	Executes a third-party developer tool exposed by the page.
`execute_webmcp_tool`	write	Executes a WebMCP tool exposed by the page (for debugging tools, use
`file_tool`	read	A tool requiring file validation
`fill`	read	Type text into an input, text area or select an option from a <select> element.
`fill_form`	read	Fill out multiple form elements (inputs, selects, checkboxes, radios) at once. ALWAYS prefer this tool over multiple individual
`get_console_message`	read	Gets a console message by its ID. You can get all messages by calling ${LIST_CONSOLE_MESSAGES_TOOL_NAME}.
`get_devtools_comments`	read	Retrieve user comments from the DevTools window for the page.
`get_heapsnapshot_class_nodes`	read	Loads and caches a memory heapsnapshot and returns instances of a specific class with their IDs.
`get_heapsnapshot_details`	read	Loads and caches a memory heapsnapshot and returns all available information including statistics, static data, and aggregated node information. Supports pagination for aggregates.
`get_heapsnapshot_dominators`	read	Loads and caches a memory heapsnapshot and returns the dominator chain for a specific node ID. This helps to identify which objects are keeping the target node alive.
`get_heapsnapshot_duplicate_strings`	read	Loads and caches a memory heapsnapshot and returns duplicate strings grouped by their value.
`get_heapsnapshot_edges`	read	Loads and caches a memory heapsnapshot and returns outgoing edges (references) for a specific node ID.
`get_heapsnapshot_object_details`	read	Loads and caches a memory heapsnapshot and returns detailed information about a specific object by its node ID, including size, type, distance, and DOM detachedness.
`get_heapsnapshot_retainers`	read	Loads and caches a memory heapsnapshot and returns retainers for a specific node ID.
`get_heapsnapshot_retaining_paths`	read	Loads and caches a memory heapsnapshot and returns retaining paths for a specific node ID. This helps to understand why a node is not being garbage collected.
`get_heapsnapshot_summary`	read	Loads and caches a memory heapsnapshot and returns snapshot summary stats, including native contexts and their sizes, and retained by context summary.
`get_network_request`	read	Gets a network request by an optional reqid, if omitted returns the currently selected request in the DevTools Network panel. Useful for inspecting request headers (including
`get_os_app_state`	read	Returns the OS integration state (badge count and registered file
`get_tab_id`	read	Get the tab ID of the page
`global_tool`	read	A global tool
`group-1`	read	desc-1
`group-2`	read	desc-2
`handle_dialog`	read	If a browser dialog was opened, use this command to handle it
`hanging_context_tool`	read	A tool whose browser connection never resolves
`hover`	read	Hover over the provided element
`hybrid_tool`	read	A tool with both schema file verifications
`install_extension`	write	Installs a Chrome extension from the given path.
`install_pwa`	write	Installs a Progressive Web App (PWA) identified by its manifest ID.
`install_pwa_tool`	write	PWA tool with local-only file verification
`launch_pwa`	read	Launches an installed Progressive Web App using its saved display mode.
`legacy_webmcp_tool`	read	A WebMCP tool without debugging annotation
`lighthouse_audit`	read	Get Lighthouse scores, failing audits, and the DOM nodes they flag for accessibility, SEO, best practices, and agentic browsing. Full reports are saved to disk. This excludes performance. For performance audits, run ${startTrace(args).name}
`list_3p_developer_tools`	read	Lists all third-party developer tools the page exposes for providing runtime information (including debugging WebMCP tools and tools exposed via the
`list_extensions`	read	Lists all the Chrome extensions installed in the browser. This includes their name, ID, version, and enabled status.
`list_network_requests`	read	Lists the most recent requests for the target page since the last navigation.
`list_pages`	read	Get a list of pages${args?.categoryExtensions ?
`list_webmcp_tools`	read	Lists all WebMCP tools the page exposes (excluding debugging tools, which are exposed via
`myTool`	read	Does something
`navigate`	read	Loads a URL
`navigate_page`	read	Go to a URL, or back, forward, or reload. Use project URL if not specified otherwise.
`new_page`	read	Open a new tab and load a URL. Use project URL if not specified otherwise.
`open_devtools`	read	Open a DevTools window for the selected page.
`page_file_tool`	read	A page scoped tool with file verification
`page_tool`	read	A page scoped tool
`performance_analyze_insight`	read	Provides more detailed information on a specific Performance Insight of an insight set that was highlighted in the results of a trace recording.
`performance_start_trace`	write	Start a performance trace on the target webpage. Use to find frontend performance issues, Core Web Vitals (LCP, INP, CLS), and improve page load speed.
`performance_stop_trace`	write	Stop the active performance trace recording on the target webpage.
`press_key`	read	Press a key or key combination. Use this when other input methods like fill() cannot be used (e.g., keyboard shortcuts, navigation keys, or special key combinations).
`query_heapsnapshot_objects`	read	Loads and caches a memory heapsnapshot and queries objects matching specific filters (className, propertyName, nodeType, retainedSize, selfSize, isDetached, sortBy).
`reload_extension`	read	Reloads an unpacked Chrome extension by its ID.
`remote_file_tool`	read	A tool with remote-only file verification
`resize_page`	read	Resizes the page
`resolve_devtools_comment`	read	Append an agent reply to a DevTools comment thread and mark it as resolved.
`reveal_in_devtools`	read	Navigate DevTools to a specified panel and highlight a target DOM node or network request. The parameters uid and reqid are mutually exclusive.
`screencast_start`	write	Starts recording a screencast (video) of the target page.
`screencast_stop`	write	Stops the active screencast recording on the target page.
`screenshot`	read	Takes a screenshot
`select_page`	read	Select a page as a context for future tool calls.
`slow_tool`	read	A tool whose handler legitimately outlasts the timeout
`strict_tool`	read	A tool with a required argument
`take_heapsnapshot`	read	Capture a heap snapshot of the target page. Use to analyze the memory distribution of JavaScript objects and debug memory leaks.
`take_screenshot`	read	Take a screenshot of the page or element.
`test-group`	read	test description
`test-tool`	read	test tool description
`test_tool`	read	A test tool
`tool-1`	read	tool-1-desc
`tool-2`	read	tool-2-desc
`trigger_extension_action`	write	Triggers the default action of an extension by its ID.
`type_text`	read	Type text using keyboard into a previously focused input
`uninstall_extension`	destructive	Uninstalls a Chrome extension by its ID.
`uninstall_pwa`	destructive	Uninstalls a Progressive Web App identified by its manifest ID and
`upload_file`	write	Upload a file through a provided element.
`upload_tool`	write	A tool with local-only file verification
`user_tool`	read	A non-debugging WebMCP tool
`wait_for`	read	Wait for the specified text to appear on the selected page.
`webmcp_tool`	read	A WebMCP tool
`wrapped_enum_tool`	read	test description

Trust audit

SAFEgrade B · trust 84/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	PASS
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (9 observation(s))
Network: declared (4 observation(s))
Shell: declared (5 observation(s))
Dependencies: not all pinned
Secrets in source: none-found

Findings (25)

MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59

uninstall_extension, uninstall_pwa

Why it matters. 2 tool(s) can delete or overwrite

Fix. prefer a read-only mode or scoped tokens; the page states the blast radius

LOWInventory / provenance · inv.binary · CWE-1104

tests/trace-processing/fixtures/basic-trace.json.gz

basic-trace.json.gz

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

LOWInventory / provenance · inv.hidden_file · CWE-1104

.gitallowed

.gitallowed

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWInventory / provenance · inv.hidden_file · CWE-1104

.gitmodules

.gitmodules

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWInventory / provenance · inv.hidden_file · CWE-1104

.prettierignore

.prettierignore

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWInventory / provenance · inv.hidden_file · CWE-1104

.release-please-manifest.json

.release-please-manifest.json

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose