Invisible PlaywrightCAUTION
Anti-detect agentic stealth browser: undetected browsing, browser automation, Python AI web browsing agent, computer use, scraping, lead generation. No captchas.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
An anti detect browser and web browsing agent, open source, with an MCP server for coding agents: undetected, no captchas, no blocks. Tell it what you want in plain language.
Two ways to use this browser agent
1. From your assistant, over MCP
Windows, in PowerShell:
powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex" $env:Path = "$env:USERPROFILE\.local\bin;$env:Path"
Linux:
curl -LsSf https://astral.sh/uv/install.sh | sh source $HOME/.local/bin/env
Then install it in your assistant.
Claude Code:
claude plugin marketplace add feder-cr/invisible_playwright_mcp claude plugin install invisible-playwright-mcp@feder-cr
Codex:
codex plugin marketplace add feder-cr/invisible_playwright_mcp codex plugin add invisible-playwright-mcp@feder-cr
Gemini CLI:
gemini extensions install https://github.com/feder-cr/invisible_playwright_mcp
2. Standalone: the web UI
We bring the interface, you bring an OpenRouter key. Chat on the left, the live browser on the right.
Windows, in PowerShell:
powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex" $env:Path = "$env:USERPROFILE\.local\bin;$env:Path" uvx invisible-playwright-mcp ui --openrouter-key sk-or-...
Linux:
curl -LsSf https://astral.sh/uv/install.sh | sh source $HOME/.local/bin/env uvx invisible-playwright-mcp ui --openrouter-key sk-or-...
Then open http://127.0.0.1:8765 and type the same thing.
What to ask a web browsing agent
Anything that
aea0a2e44500OBSERVED · 2026-09-23Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add invisible-playwright-mcp -- uvx invisible-playwright-mcp==0.69.2
Trust audit
CAUTIONgrade B · trust 87/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | WARN |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (1 observation(s))
- Network
- declared (7 observation(s))
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (16)
it through innerHTML is the documented road to exfiltration by injected
Images are absent on purpose - they are the exfiltration vector itself, and
curl -LsSf https://astral.sh/uv/install.sh | sh
.mcpbignore
Then open **http://127.0.0.1:8765** and type the same thing.
base = "http://127.0.0.1:%d/" % port
return srv, "http://127.0.0.1:%d/" % port
return srv, "http://127.0.0.1:%d/" % port
("call_a", "browser_navigate", '{"url": "http://127.0.0.1:8000/form"}'),return base64.b64decode(data), mime
jpeg = base64.b64decode(images[0].data)
any automated access: an agent typing credentials it was not handed is not
curl -LsSf https://astral.sh/uv/install.sh | sh
curl -LsSf https://astral.sh/uv/install.sh | sh
- The refusal message is quoted from this project's own MCP server, read from its source on 2026-09-17 and reproduced in full. It was also triggered live on three expressions during the same session:
Gates applied: no_behavioural_pass.
aea0a2e44500full audit observations/trust-audit/mcp-server/feder-cr__invisible-playwright-1.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-09-23 | aea0a2e44500 | CAUTION | B | 87 | first audit |
Questions
What is the Invisible Playwright MCP server?
Anti-detect agentic stealth browser: undetected browsing, browser automation, Python AI web browsing agent, computer use, scraping, lead generation. No captchas.
Is Invisible Playwright safe to connect to an agent?
With care. The audit graded it B (87/100) and found 16 things worth knowing before you trust this server, listed below with the exact line each was found on.
What credentials does Invisible Playwright need?
It reads GH_TOKEN, GITHUB_TOKEN and OPENROUTER_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does Invisible Playwright run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on PyPI as invisible-playwright-mcp.
How current is this page?
The grade is for one exact copy of the source (aea0a2e44500), read on 2026-09-23. The repository is watched and re-audited when it changes.