Atlas / MCP servers / snowfort-ai / Circuit

CircuitBLOCK

Name: Circuit
Author: snowfort-ai

mcp/snowfort-ai/circuit-1

MCP server by snowfort-ai · Audited 2026-10-08

⚑ Report / re-scan Source ↗

Computer use-like MCP for webapps and electron apps, to enable AI agents to test their changes

Verdict

BLOCK

Grade

Trust score

28 /100

Exposed tools

48 41r · 7w · 0d

Transport

sse · stdio · streamable-http

License

NOASSERTION

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

[](https://opensource.org/licenses/Apache-2.0)

Circuit MCP is a comprehensive Model Context Protocol (MCP) server suite that enables AI coding agents to automate both web browsers and Electron desktop applications with unparalleled precision and flexibility.

🚀 Quick Start for AI Agents

MCP Configuration

Add to your AI agent's MCP configuration file:

Web Automation Only

{
"mcpServers": {
"circuit-web": {
"command": "npx",
"args": ["@snowfort/circuit-web@latest"]
}
}
}

Desktop Automation Only

{
"mcpServers": {
"circuit-electron": {
"command": "npx",
"args": ["@snowfort/circuit-electron@latest"]
}
}
}

Complete Dual-Engine Setup (Recommended)

{
"mcpServers": {
"circuit-web": {
"command": "npx",
"args": ["@snowfort/circuit-web@latest"]
},
"circuit-electron": {
"command": "npx",
"args": ["@snowfort/circuit-electron@latest"]
}
}
}

First Commands

Once configured, your AI agent can immediately start automating:

// Launch browser with optimized AI settings
browser_launch({
"compressScreenshots": true,
"screenshotQuality": 50
})
browser_navigate({"sessionId": "...", "url": "https://github.com"})
// Auto-snapshot included in response!

// Launch and control any Electron app
app_launch({"app": "/Applications/Visual Studio Code.app"})
click({"sessionId": "...", "selector": "button[title='New File']"})

✨ Features

🌐 Web Automation (29 Tools)

Cross-Browser Support: Chromium, Firefox, WebKit
🎯 AI-Optimized Snapshots: Auto-snapshots with element references after every action
📸 Smart Screenshot Compression: JPEG compression for faster AI workflows (configurable)
Complete Interaction Set: Click, type, hover, drag, scroll with au

Read from source at commit a11e352a2a3fOBSERVED · 2026-10-08

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add circuit-web --env DOTENV_KEY=${DOTENV_KEY} --env LOG_TOKENS=${LOG_TOKENS} -- npx -y @snowfort/[email protected]

claude-desktop

{
  "mcpServers": {
    "circuit-web": {
      "command": "npx",
      "args": [
        "-y",
        "@snowfort/[email protected]"
      ],
      "env": {
        "DOTENV_KEY": "${DOTENV_KEY}",
        "LOG_TOKENS": "${LOG_TOKENS}"
      }
    }
  }
}

Exposed tools (48)

41 read · 7 write · 0 destructive.

Tool	Risk	Description
`add_locator_handler`	write	Add automatic handler for modals/overlays
`app_launch`	read	Launch new Electron app instance. For Electron Forge projects, use startScript to auto-start webpack dev server
`back`	read	Navigate back in window history
`browser_console_messages`	read	Get all console messages from the session
`browser_generate_playwright_test`	read	Generate Playwright test code from recorded actions
`browser_handle_dialog`	read	Handle browser dialogs (alert, confirm, prompt)
`browser_launch`	read	Launch a new browser session
`browser_navigate`	read	Navigate to a URL in an existing browser session
`browser_network_requests`	read	Get all network requests from the session
`browser_resize`	read	Resize browser window viewport
`browser_tab_close`	read	Close a tab by ID
`browser_tab_list`	read	List all open tabs
`browser_tab_new`	read	Open a new tab
`browser_tab_select`	read	Select a tab by ID
`click`	read	Click on an element identified by a CSS selector
`click_by_role`	read	Click on an element by its accessibility role
`click_by_text`	read	Click on an element containing specific text
`click_nth`	read	Click on the nth element matching a selector
`close`	read	Close a session
`collect-user-info`	read	A tool that collects user information through elicitation
`content`	read	Get the HTML content of the current window
`drag`	read	Drag an element to a target location
`evaluate`	write	Execute JavaScript in the page or application context
`forward`	read	Navigate forward in window history
`fs_read_file`	read	Read content from a file
`fs_write_file`	write	Write content to a file
`get_weather`	read
`get_windows`	read	List windows with type identification (main/devtools/other) and titles
`greet`	read	A simple greeting tool
`hover`	read	Hover over an element identified by a CSS selector
`ipc_invoke`	write	Invoke an IPC method in the Electron application
`key`	read	Press a keyboard key
`keyboard_press`	read	Press a key or key combination
`keyboard_type`	read	Type text using keyboard events with optional delay
`list-files`	read
`multi-greet`	read	A tool that sends different greetings with delays between them
`pdf`	write	Save the current page as a PDF
`refresh`	read	Refresh the current window
`screenshot`	read	Take a screenshot of the current page or window
`select`	read	Select an option from a dropdown
`smart_click`	read	Smart click that automatically handles refs (e1, e2...), text, or CSS selectors
`snapshot`	read	Get accessibility tree snapshot with element references for AI targeting
`start-notification-stream`	write	Starts sending periodic notifications
`text_content`	read	Get the visible text content of the current window
`type`	read	Type text into an element identified by a CSS selector
`upload`	write	Upload a file to an input element
`wait_for_load_state`	read	Wait for the page to reach a specific load state
`wait_for_selector`	read	Wait for an element to appear on the page

Trust audit

BLOCKgrade F · trust 28/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	WARN
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	FAIL
L3	Class-specific surface	PASS
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (10 observation(s))
Network: declared (13 observation(s))
Shell: declared (11 observation(s))
Dependencies: not all pinned
Secrets in source: none-found

Findings (25)

CRITICALObfuscation / stealth · obf.decode_then_exec · CWE-506, CWE-94

node_modules/.pnpm/[email protected]/node_modules/playwright-core/lib/generated/injectedScriptSource.js:24

atob( ...  eval(

Why it matters. decodes a payload and executes it

CRITICALObfuscation / stealth · obf.decode_then_exec · CWE-506, CWE-94

node_modules/.pnpm/[email protected]/node_modules/playwright-core/lib/vite/traceViewer/assets/defaultSettingsView-Cjl_e5YM.js:105

atob( ... }eval(

Why it matters. decodes a payload and executes it

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

node_modules/.pnpm/[email protected]/node_modules/ajv/dist/ajv.bundle.js:421

var makeValidate = new Function(

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

node_modules/.pnpm/[email protected]/node_modules/ajv/lib/compile/index.js:120

var makeValidate = new Function(

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

node_modules/.pnpm/[email protected]/node_modules/depd/index.js:425

var deprecatedfn = new Function('fn', 'log', 'deprecate', 'message', 'site',

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

node_modules/.pnpm/[email protected]/node_modules/depd/index.js:427

'return function (' + args + ') {' +

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHNetwork egress · net.tls_off · CWE-200, CWE-319

node_modules/.pnpm/[email protected]/node_modules/playwright-core/bin/reinstall_chrome_beta_mac.sh:7

curl -o ./googlechromebeta.dmg -k https://dl.google.com/chrome/mac/universal/beta/googlechromebeta.dmg

Why it matters. certificate verification is disabled

Fix. leave verification on

HIGHNetwork egress · net.tls_off · CWE-200, CWE-319

node_modules/.pnpm/[email protected]/node_modules/playwright-core/bin/reinstall_chrome_stable_mac.sh:7

curl -o ./googlechrome.dmg -k https://dl.google.com/chrome/mac/universal/stable/GGRO/googlechrome.dmg

Why it matters. certificate verification is disabled

Fix. leave verification on

HIGHNetwork egress · net.tls_off · CWE-200, CWE-319

node_modules/.pnpm/[email protected]/node_modules/playwright-core/lib/server/socksClientCertificatesInterceptor.js:75

rejectUnauthorized: false

Why it matters. certificate verification is disabled

Fix. leave verification on

HIGHSupply chain · supply.typosquat · CWE-829, CWE-1357

node_modules/.pnpm/[email protected]/node_modules/iconv-lite/package.json

request ~ requests

Why it matters. dependency name one edit from a popular package

Fix. verify the package; likely typosquat

HIGHPrompt injection · prompt.zero_width · CWE-94, CWE-1427

node_modules/.pnpm/[email protected][email protected]/node_modules/express-rate-limit/license.md:1

# MIT License

Why it matters. invisible characters in instruction text

Fix. strip non-printing characters

MEDIUMInventory / provenance · inv.binary · CWE-1104

node_modules/.pnpm/[email protected]/node_modules/fsevents/fsevents.node

fsevents.node

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

MEDIUMInventory / provenance · inv.binary · CWE-1104

node_modules/.pnpm/[email protected]/node_modules/fsevents/fsevents.node

fsevents.node

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

MEDIUMInventory / provenance · inv.binary · CWE-1104

snowfort-circuit-electron-0.0.6.tgz

snowfort-circuit-electron-0.0.6.tgz

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

MEDIUMInventory / provenance · inv.symlink · CWE-1104

node_modules/.pnpm/@[email protected]/node_modules/content-type

node_modules/.pnpm/@[email protected]/node_modules/content-type