Charlotte MCP Server

Findings (14)

• highHigh. Something risky that needs a close look before you install.
  dependencies issue

  Details are available to the maintainer after claiming this listing.
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  @modelcontextprotocol/node@2.0.0: 1 known vulnerability

  GHSA-f897-62hf-6gxq

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  body-parser@2.3.0: 1 known vulnerability

  GHSA-27r3-jxmh-p828

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  extract-zip@2.0.1: 2 known vulnerabilities

  GHSA-7pqw-9j4j-h8q3, GHSA-jmr9-qjv8-65gv

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  zod@3.25.76: 1 known vulnerability

  GHSA-mrhx-c7xc-m3w5

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  zod@4.4.3: 2 known vulnerabilities

  GHSA-mrhx-c7xc-m3w5, GHSA-mrhx-c7xc-m3w5

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  Install contacted hosts other than package registries

  storage.googleapis.com
• lowLow. Minor, or common in normal tools. Shown for information.
  @hono/node-server@1.19.17: 1 known vulnerability

  GHSA-rmxm-3fg6-px4f

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  @vitest/mocker@4.1.11: 2 known vulnerabilities

  GHSA-qxg6-89mg-rqv8, GHSA-xp26-3454-mjgp

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  ip-address@10.7.3: 1 known vulnerability

  GHSA-rxp7-6hxx-x8q5

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  minimatch@10.2.5: 2 known vulnerabilities

  GHSA-g3hv-75wg-m249, GHSA-g3hv-75wg-m249

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  qs@6.16.0: 1 known vulnerability

  GHSA-6pq8-jhm2-2vcw

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  minimatch@9.0.9: 1 known vulnerability

  GHSA-g3hv-75wg-m249

  site/package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  Reads environment variables not listed in the manifest

  DRIFT_PROGRESS_NOTE, DRIFT_RUN_DATE

Network activity

Tools exposed (23)

• charlotte_navigate

  Load a URL in the active page. Returns page representation after navigation. Default minimal detail includes landmarks, headings, and interactive element counts — use charlotte_find to locate specific elements, or pass detail: 'summary' to get the full element list.

• charlotte_back

  Navigate back in browser history. Returns page representation after navigation.

• charlotte_forward

  Navigate forward in browser history. Returns page representation after navigation.

• charlotte_reload

  Reload the current page. Returns page representation after reload.

• charlotte_observe

  Get current page state without performing any action. Use detail levels to control verbosity: "minimal" for landmarks, headings, and interactive element counts by landmark (use charlotte_find to get specific elements with actionable IDs, or observe({ detail: "summary" }) to see all elements), "summa

• charlotte_find

  Search for elements matching criteria. Filters interactive elements by text, role, type, or spatial proximity. Use the selector parameter to find DOM elements by CSS selector — this reaches elements not in the accessibility tree (custom widgets, non-semantic divs). Selector results return Charlotte

• charlotte_screenshot

  Capture a visual screenshot. Fallback for when structured representation isn't sufficient (complex visualizations, canvas elements, images). Use save: true to persist as a file artifact that can be referenced later.

• charlotte_screenshots

  List all saved screenshot artifacts. Returns metadata for each saved screenshot including ID, filename, page URL, and timestamp.

• charlotte_screenshot_get

  Retrieve a previously saved screenshot artifact by its ID. Returns the image data and metadata.

• charlotte_screenshot_delete

  Delete a saved screenshot artifact by its ID. Removes the file from disk.

• charlotte_diff

  Compare current page state to a previous snapshot. Returns structural diff showing added, removed, moved, and changed elements.

• charlotte_click

  Click an interactive element on the page. Returns full page representation after the click.

• charlotte_click_at

  Click at specific page coordinates. Use when target elements are not in the accessibility tree (custom widgets, canvas, non-semantic interactive divs). Dispatches real CDP-level mouse events. Returns full page representation after the click.

• charlotte_type

  Type text into an input element. Returns full page representation after typing.

• charlotte_select

  Select an option in a select/dropdown element. Returns full page representation after selection.

• charlotte_toggle

  Toggle a checkbox or switch element. Returns full page representation after toggle.

• charlotte_submit

  Submit a form. Can submit by form ID or by clicking its submit button. Returns full page representation after submission.

• charlotte_scroll

  Scroll the page or a specific container. Returns full page representation after scrolling.

• charlotte_tabs

  List all open browser tabs with their URLs, titles, and active status.

• charlotte_tab_open

  Open a new browser tab. Optionally navigate to a URL. The new tab becomes the active tab.

• charlotte_tab_switch

  Switch to a different browser tab by its tab ID. Returns the page representation of the activated tab.

• charlotte_tab_close

  Close a browser tab by its ID. If the closed tab was active, switches to the first remaining tab.

• charlotte_tools

  Manage Charlotte tool visibility. Lists available tool groups and their status. Use 'enable' or 'disable' to control which tools are loaded. Disabled tools don't appear in the tool list — enable a group to access its tools. Groups: 'interaction' for form filling, clicking, and drag-and-drop. 'sessio