MCP server · Audited from source

Playwright MCP server

by executeautomation/mcp-playwrightMIT licenceAudited 21 Sep 2026 · source 61fd8a85d50a

npm @executeautomation/playwright-mcp-server 1.0.12ssestdio★ 5,650

!CAUTIONGrade C · 77/100 · 21 Sep 2026 · 61fd8a8

5,650GitHub stars

Is it safe? With care — CAUTION, grade C (77/100). It exposes 33 tools: 22 read, 9 write and 2 destructive. The audit recorded 21 findings (0 critical, 0 high, 5 medium, 11 low). Maintainer's description: Playwright Model Context Protocol Server - Tool to automate Browsers and APIs in Claude Desktop, Cline, Cursor IDE and More 🔌

Ask an AI about this pageGChatGPT CClaude PPerplexity GeGemini XGrok

CoCopilot AIGoogle AI Mode

Cite

Cite this page

ModelsAtlas. “Playwright MCP server (executeautomation/mcp-playwright)”. Retrieved 21 Sep 2026. https://modelsatlas.com/mcp/executeautomation/playwright-2

4 MCP servers are called Playwright. You are viewing executeautomation/mcp-playwright. Compare all 4 →

microsoft/playwright-mcp Org-owned★ 37,315✓SAFE
ashish-bansal/playwright-mcp Org-owned★ 32✓SAFE
qabyai/playwright-mcp Org-owned★ 32✓SAFE
executeautomation/mcp-playwright★ 5,650!CAUTION

Trust audit

Audit 0.4.1 · full source read 21 Sep 2026

Trust score77/100!CAUTION C

0 critical0 high5 medium11 low5 info

21 findings, listed below with the file and line each was found on. Grade A needs a sandboxed behavioural run too; this audit read the source only.

What the source does

FilesystemDeclared1 observation
NetworkDeclared1 observation
ShellDeclared2 observations
DependenciesNot pinnedSome ranges float
SecretsFoundSee the findings

“Declared” means the server says it does this and the source agrees. Browser, file and shell access are expected of some kinds of server.

Five audit layers

Layer	What we check	Result
`L0` Provenance	Repo owner, licence, archive status, activity	PASS 6 findings
`L1` Static source	Secrets, path traversal, supply chain	WARN 12 findings
`L2` Instructions	Prompt injection and authority framing in docs and tool descriptions	PASS 2 findings
`L3` Inventory	Declared tools match the source	WARN 1 finding
`L4` Sandbox	Run in isolation and watch behaviour	SKIPPED

Provenance & runtime

Who published it, and what the audit could and could not run

Provenance

Repository owner executeautomationUser accountAccount type recorded when we read the repository.
PackagePublished on npm@executeautomation/playwright-mcp-server at version 1.0.12
LicenceMITFrom the repository, as read at the audited commit.
Last push9 months agoActivity of the repository when we read it.
Source commit read61fd8a85d50aThe audit covers exactly this commit, read on 21 Sep 2026.

Runtime

Sandbox runNot run yetThis audit read the source only; it did not execute the server.
Tool inventory33 declaredRead from the source and classed read, write or destructive.

Every value here is read from the record's own repository and audit.Suggest a correction

Findings (21)

Sorted by severity

MEDIUMHard-coded secretssecret.generic · docs/docs/playwright-api/Examples.md:19

F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why: No further detail recorded for this rule.
Fix: —

MEDIUMHard-coded secretssecret.generic · docs/docs/playwright-api/Examples.md:26

F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why: No further detail recorded for this rule.
Fix: —

MEDIUMHard-coded secretssecret.generic · docs/docs/playwright-api/Examples.md:32

F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why: No further detail recorded for this rule.
Fix: —

MEDIUMHard-coded secretssecret.generic · docs/docs/playwright-api/Examples.md:88

F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why: No further detail recorded for this rule.
Fix: —

MEDIUMFilesystem / pathmcp.destructive_tools

F-05 Filesystem / pathCWE-22 · CWE-59Layer L3

clear_codegen_session, playwright_delete

Why: 2 tool(s) can delete or overwrite
Fix: prefer a read-only mode or scoped tokens; the page states the blast radius

LOWInventory / provenanceinv.hidden_file · docs/static/.nojekyll

F-13 Inventory / provenanceCWE-1104Layer L0

.nojekyll

Why: hidden member outside the usual dotfiles
Fix: review its purpose

LOWFilesystem / pathfs.traversal · src/__tests__/codegen.test.ts:12

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

OUTPUT_DIR: path.join(__dirname, '../../tests/generated'),

Why: No further detail recorded for this rule.
Fix: —

LOWFilesystem / pathfs.traversal · src/__tests__/tools/api/requests.test.ts:1

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

import { GetRequestTool, PostRequestTool, PutRequestTool, PatchRequestTool, DeleteRequestTool } from '../../../tools/api/requests.js';

Why: No further detail recorded for this rule.
Fix: —

LOWFilesystem / pathfs.traversal · src/__tests__/tools/api/requests.test.ts:2

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

import { ToolContext } from '../../../tools/common/types.js';

Why: No further detail recorded for this rule.
Fix: —

LOWFilesystem / pathfs.traversal · src/__tests__/tools/browser/advancedInteraction.test.ts:1

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

import { DragTool, PressKeyTool } from '../../../tools/browser/interaction.js';

Why: No further detail recorded for this rule.
Fix: —

LOWFilesystem / pathfs.traversal · src/__tests__/tools/browser/advancedInteraction.test.ts:2

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

import { ToolContext } from '../../../tools/common/types.js';

Why: No further detail recorded for this rule.
Fix: —

LOWNetwork egressnet.raw_ip · docs/docs/playwright-web/HTTP-SSE-Transport.mdx:646

F-04 Network egressCWE-200 · CWE-319Layer L1

proxy_pass http://127.0.0.1:8931;

Why: No further detail recorded for this rule.
Fix: —

LOWSupply chainsupply.unpinned · docs/package.json

F-08 Supply chainCWE-829 · CWE-1357Layer L1

@mdx-js/react, clsx, gh-pages, prism-react-renderer, react, react-dom, typescript

Why: 7 dependency range(s) float
Fix: pin exact versions or ship a lockfile

LOWSupply chainsupply.unpinned · package.json

F-08 Supply chainCWE-829 · CWE-1357Layer L1

@playwright/test, cors, express, mcp-evals, @types/cors, @types/express, @types/jest, @types/node

Why: 12 dependency range(s) float
Fix: pin exact versions or ship a lockfile

LOWPrompt injectionprompt.credential_read · README.md:299

F-01 Prompt injectionCWE-94 · CWE-1427Layer L2

The evals package loads an mcp client that then runs the index.ts file, so there is no need to rebuild between tests. You can load environment variables by prefixing the npx command. Full documentatio

Why: asks the agent to read credentials
Fix: —

LOWPrompt injectionprompt.transfer_instruction · docs/docs/playwright-api/Examples.md:115

F-01 Prompt injectionCWE-94 · CWE-1427Layer L2

Perform POST operation for the URL https://api.restful-api.dev/objects with Bearer token "your-token-here" set in the headers

Why: an instruction to move sensitive data to an outside destination
Fix: remove; a skill never needs the user's secrets off the machine

INFOInventory / provenanceinv.oversize · docs/docs/playwright-api/img/api-response.png

F-13 Inventory / provenanceCWE-1104Layer L0

docs/docs/playwright-api/img/api-response.png

Why: 1144445 bytes not read
Fix: —

INFOInventory / provenanceinv.oversize · docs/docs/playwright-api/img/playwright-api.png

F-13 Inventory / provenanceCWE-1104Layer L0

docs/docs/playwright-api/img/playwright-api.png

Why: 1516139 bytes not read
Fix: —

INFOInventory / provenanceinv.oversize · docs/docs/playwright-web/img/console-log.gif

F-13 Inventory / provenanceCWE-1104Layer L0

docs/docs/playwright-web/img/console-log.gif

Why: 18032689 bytes not read
Fix: —

INFOInventory / provenanceinv.oversize · docs/docs/playwright-web/img/mcp-result.png

F-13 Inventory / provenanceCWE-1104Layer L0

docs/docs/playwright-web/img/mcp-result.png

Why: 1472061 bytes not read
Fix: —

INFOInventory / provenanceinv.oversize · docs/docs/playwright-web/img/standalone.png

F-13 Inventory / provenanceCWE-1104Layer L0

docs/docs/playwright-web/img/standalone.png

Why: 3498859 bytes not read
Fix: —

Tools it exposes

33 declared in source · 2 destructive

22 read9 write2 destructive

2 tools can delete or overwrite. An agent that can be talked into calling a tool can be talked into calling this one, so give it a token scoped to what you need.

Tool	Risk	What it does
`clear_codegen_session`	destructive	Clear a code generation session without generating a test
`playwright_delete`	destructive	Perform an HTTP DELETE request
`playwright_custom_user_agent`	write	Set a custom User Agent for the browser
`playwright_evaluate`	write	Execute JavaScript in the browser console
`playwright_expect_response`	write	Ask Playwright to start waiting for a HTTP response. This tool initiates the wait operation but does not wait for its completion.
`playwright_patch`	write	Perform an HTTP PATCH request
`playwright_post`	write	Perform an HTTP POST request
`playwright_put`	write	Perform an HTTP PUT request
`playwright_save_as_pdf`	write	Save the current page as a PDF file
`playwright_upload_file`	write	Upload a file to an input[type=
`start_codegen_session`	write	Start a new code generation session to record Playwright actions
`end_codegen_session`	read	End a code generation session and generate the test file
`get_codegen_session`	read	Get information about a code generation session
`playwright_assert_response`	read	Wait for and validate a previously initiated HTTP response wait operation.
`playwright_click`	read	Click an element on the page
`playwright_click_and_switch_tab`	read	Click a link and switch to the newly opened tab
`playwright_close`	read	Close the browser and release all resources
`playwright_console_logs`	read	Retrieve console logs from the browser with filtering options
`playwright_drag`	read	Drag an element to a target location
`playwright_fill`	read	fill out an input field
`playwright_get`	read	Perform an HTTP GET request
`playwright_get_visible_html`	read	Get the HTML content of the current page. By default, all <script> tags are removed from the output unless removeScripts is explicitly set to false.
`playwright_get_visible_text`	read	Get the visible text content of the current page
`playwright_go_back`	read	Navigate back in browser history
`playwright_go_forward`	read	Navigate forward in browser history
`playwright_hover`	read	Hover an element on the page
`playwright_iframe_click`	read	Click an element in an iframe on the page
`playwright_iframe_fill`	read	Fill an element in an iframe on the page
`playwright_navigate`	read	Navigate to a URL
`playwright_press_key`	read	Press a keyboard key
`playwright_resize`	read	Resize the browser viewport using manual dimensions or device presets. Supports 143+ device presets including iPhone, iPad, Android devices, and desktop browsers with proper user-agent and touch emulation.
`playwright_screenshot`	read	Take a screenshot of the current page or a specific element
`playwright_select`	read	Select an element on the page with Select tag

Install

Package version 1.0.12 · audited commit 61fd8a8

Read the findings first. The most severe is Hard-coded secrets (medium) at docs/docs/playwright-api/Examples.md.

Add to Cursor Add to VS Code

One-click links open your editor with the config below filled in, exactly as the snippets show it, pinned to version 1.0.12. The audit covers commit 61fd8a8 only.

claude mcp add playwright-mcp-server -- npx -y @executeautomation/[email protected]

{
  "mcpServers": {
    "playwright-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "@executeautomation/[email protected]"
      ]
    }
  }
}

The command pins the package version recorded in the source (1.0.12); the audit covers commit 61fd8a85d50a. Transport: sse · stdio. No environment variables required.

Audit history

2026-09-21
!CAUTION C 77 / 100
Source changed, verdict held · 61fd8a85d50a

README badge

For maintainers · updates on every re-audit

[![ModelsAtlas: CAUTION C](https://modelsatlas.com/mcp/executeautomation/playwright-2/badge.svg)](https://modelsatlas.com/mcp/executeautomation/playwright-2/)

The badge always shows the latest audit; a maintainer cannot pin an old verdict.

Other ratings

Cited, never blended into our score

No third-party security ratings are recorded for this server yet. When they exist they appear here with their source and date, beside, not inside, our grade.

Questions about Playwright MCP server

What is the Playwright MCP server?

Playwright Model Context Protocol Server - Tool to automate Browsers and APIs in Claude Desktop, Cline, Cursor IDE and More 🔌

What tools does Playwright expose?

33 in total: 22 read-only, 9 that write, and 2 that can delete or overwrite (clear_codegen_session, playwright_delete). Every one is listed on this page with its risk.

Is Playwright safe to connect to an agent?

With care. The audit graded it C (77/100) and found 21 things worth knowing before you trust this server, listed below with the exact line each was found on. Separately from the audit: 2 of its tools can destroy data, so scope the token you give it to what you actually need.

What credentials does Playwright need?

No credential environment variables were found in its source, so it appears to need none.

How does Playwright run?

It speaks sse and stdio, so it runs as a local process your client starts. It is published on npm as @executeautomation/playwright-mcp-server at 1.0.12.

How current is this page?

The grade is for one exact copy of the source (61fd8a85d50a), read on 2026-09-21. The repository is watched and re-audited when it changes.

Which Playwright MCP server is the right one?

microsoft/playwright-mcp. 4 servers share the name; see the side-by-side comparison.

Sources

executeautomation/mcp-playwright on GitHub — the source we read, its licence, stars and activityObserved · 21 Sep 2026
ModelsAtlas trust audit — CAUTION verdict for commit 61fd8a85d50aObserved · 21 Sep 2026

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.

What is the Playwright MCP server?
GChatGPT CClaude PPerplexity
What tools does Playwright expose?
GChatGPT CClaude PPerplexity
Is Playwright safe to connect to an agent?
GChatGPT CClaude PPerplexity