Playwright
SAFEgrade B · trust 89/100Playwright MCP server
mcpplaywrightOverview
From the repository's own README, as read at the audited commit.
## Playwright MCPA Model Context Protocol (MCP) server that provides browser automation capabilities using [Playwright](https://playwright.dev). This server enables LLMs to interact with web pages through structured accessibility snapshots, bypassing the need for screenshots or visually-tuned models.### Playwright MCP vs Playwright CLIThis package provides MCP interface into Playwright. If you are using a **coding agent**, you might benefit from using the [CLI+SKILLS](https://github.com/microsoft/playwright-cli) instead.- **CLI**: Modern **coding agents** increasingly favor CLI–based workflows exposed as SKILLs over MCP because CLI invocations are more token-efficient: they avoid loading large tool schemas and verbose accessibility trees into the model context, allowing agents to act through concise, purpose-built commands. This makes CLI + SKILLs better suited for high-throughput coding agents that must balance browser automation with large codebases, tests, and reasoning within limited context windows.<br>**Learn more about [Playwright CLI with SKILLS](https://github.com/microsoft/playwright-cli)**.- **MCP**: MCP remains relevant for specialized agentic loops that benefit from persistent state, rich introspection, and iterative reasoning over page structure, such as exploratory automation, self-healing tests, or long-running autonomous workflows where maintaining continuous browser context outweighs token cost concerns.### Key Features- **Fast and lightweight**. Uses Playwright's accessibility tree, not pixel-based input.- **LLM-friendly**. No vision models needed, operates purely on structured data.- **Deterministic tool application**. Avoids ambiguity common with screenshot-based approaches.### Requirements- Node.js 18 or newer- VS Code, Cursor, Windsurf, Claude Desktop, Goose, Grok, Junie or any other MCP client<!--// Generate using:node utils/generate-links.js-->### Getting startedFirst, install the Playwright MCP server with your client.**Standard config** wo
Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add mcp -- npx -y @playwright/[email protected]
Details
- Source
- microsoft/playwright-mcp
- npm
@playwright/mcp@0.0.81- Transports
- stdio
- Tools
- Registered at runtime; the list could not be read from source.
- License
- Apache-2.0
- Stars
- 37,226 · pushed 0d ago
Trust audit
Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (2 observation(s))
- Network
- declared (1 observation(s))
- Shell
- declared (3 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (6)
-----BEGIN PRIVATE KEY-----
import type * as playwright from '../../..';
MCP_VERSION=$(node -p "require('../../package.json').version")@modelcontextprotocol/sdk, @types/node
| --allow-unrestricted-file-access | allow access to files outside of the workspace roots. Also allows unrestricted access to file:// URLs. By default access to file system is restricted to workspace
Gates applied: no_behavioural_pass.
Audited 2026-09-18 · audit v0.4.0 · source sha 146dc5a010d0 · full audit: observations/trust-audit/mcp-server/microsoft__playwright-5.json · Report an issue or request a re-scan
Audit history
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-09-18 | 146dc5a010d0 | SAFE | B | 89 | first audit |
Alternatives
Other servers in the same categories, safer ones first.
Questions
What is the Playwright MCP server?
Playwright MCP server
Is Playwright safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does Playwright need?
No credential environment variables were found in its source, so it appears to need none.
How does Playwright run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as @playwright/mcp at 0.0.81.
How current is this page?
The grade is for one exact copy of the source (146dc5a010d0), read on 2026-09-18. The repository is watched and re-audited when it changes.
Provenance: OBSERVED · read 2026-09-18 · job trust-audit-2026-09-18