← MCP servers · microsoft

Playwright

SAFEgrade B · trust 89/100

Playwright MCP server

mcpplaywright

Overview

From the repository's own README, as read at the audited commit.

## Playwright MCPA Model Context Protocol (MCP) server that provides browser automation capabilities using [Playwright](https://playwright.dev). This server enables LLMs to interact with web pages through structured accessibility snapshots, bypassing the need for screenshots or visually-tuned models.### Playwright MCP vs Playwright CLIThis package provides MCP interface into Playwright. If you are using a **coding agent**, you might benefit from using the [CLI+SKILLS](https://github.com/microsoft/playwright-cli) instead.- **CLI**: Modern **coding agents** increasingly favor CLI–based workflows exposed as SKILLs over MCP because CLI invocations are more token-efficient: they avoid loading large tool schemas and verbose accessibility trees into the model context, allowing agents to act through concise, purpose-built commands. This makes CLI + SKILLs better suited for high-throughput coding agents that must balance browser automation with large codebases, tests, and reasoning within limited context windows.<br>**Learn more about [Playwright CLI with SKILLS](https://github.com/microsoft/playwright-cli)**.- **MCP**: MCP remains relevant for specialized agentic loops that benefit from persistent state, rich introspection, and iterative reasoning over page structure, such as exploratory automation, self-healing tests, or long-running autonomous workflows where maintaining continuous browser context outweighs token cost concerns.### Key Features- **Fast and lightweight**. Uses Playwright's accessibility tree, not pixel-based input.- **LLM-friendly**. No vision models needed, operates purely on structured data.- **Deterministic tool application**. Avoids ambiguity common with screenshot-based approaches.### Requirements- Node.js 18 or newer- VS Code, Cursor, Windsurf, Claude Desktop, Goose, Grok, Junie or any other MCP client<!--// Generate using:node utils/generate-links.js-->### Getting startedFirst, install the Playwright MCP server with your client.**Standard config** wo

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude-code (npm)
claude mcp add mcp -- npx -y @playwright/[email protected]

Details

Source
microsoft/playwright-mcp
npm
@playwright/mcp@0.0.81
Transports
stdio
Tools
Registered at runtime; the list could not be read from source.
License
Apache-2.0
Stars
37,226 · pushed 0d ago

Trust audit

Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codeWARN
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (2 observation(s))
Network
declared (1 observation(s))
Shell
declared (3 observation(s))
Dependencies
not all pinned
Secrets in source
found

Findings (6)

MEDIUMHard-coded secrets · secret.private_key · CWE-798, CWE-321
tests/testserver/key.pem:1
-----BEGIN PRIVATE KEY-----
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
config.d.ts:17
import type * as playwright from '../../..';
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
utils/docker/publish_docker.sh:18
MCP_VERSION=$(node -p "require('../../package.json').version")
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
package.json
@modelcontextprotocol/sdk, @types/node
Why it matters. 2 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWPrompt injection · prompt.authority_framing · CWE-94, CWE-1427
README.md:411
| --allow-unrestricted-file-access | allow access to files outside of the workspace roots. Also allows unrestricted access to file:// URLs. By default access to file system is restricted to workspace 
LOWInventory / provenance · mcp.no_tools_extracted · CWE-1104
server.json
Why it matters. the tool list is enumerated at runtime by tools/list, not declared in source
Fix. the page says so rather than showing an empty table

Gates applied: no_behavioural_pass.

Audited 2026-09-18 · audit v0.4.0 · source sha 146dc5a010d0 · full audit: observations/trust-audit/mcp-server/microsoft__playwright-5.json · Report an issue or request a re-scan

Audit history

DateSourceVerdictGradeScoreChange
2026-09-18146dc5a010d0SAFEB89first audit

Alternatives

Other servers in the same categories, safer ones first.

Questions

What is the Playwright MCP server?

Playwright MCP server

Is Playwright safe to connect to an agent?

The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.

What credentials does Playwright need?

No credential environment variables were found in its source, so it appears to need none.

How does Playwright run?

It speaks stdio, so it runs as a local process your client starts. It is published on npm as @playwright/mcp at 0.0.81.

How current is this page?

The grade is for one exact copy of the source (146dc5a010d0), read on 2026-09-18. The repository is watched and re-audited when it changes.

Provenance: OBSERVED · read 2026-09-18 · job trust-audit-2026-09-18