MCP Playwright
Playwright Model Context Protocol Server - Tool to automate Browsers and APIs in Claude Desktop, Cline, Cursor IDE and More 🔌
MCP Playwright is an open-source mcp server by executeautomation, written mainly in TypeScript, with 5,676 GitHub stars and the MIT license. Its code was last updated Dec 13, 2025.
Scan summary: scanned Nov 5, 2026 at commit 2349c28. Seen able to run shell commands, run dynamic code, control a web browser, connect to the internet. Scan policy
2349c28 · Nov 5, 2026Findings (85)
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
run-tests.cjs:5 - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
run-tests.js:5 - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.@babel/plugin-transform-modules-systemjs@7.25.9: 1 known vulnerabilityGHSA-fv7c-fp4j-7gwp
docs/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.body-parser@1.20.3: 2 known vulnerabilitiesGHSA-27r3-jxmh-p828, GHSA-v422-hmwv-36x6
docs/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.brace-expansion@1.1.11: 8 known vulnerabilitiesGHSA-3jxr-9vmj-r5cp, GHSA-6j4f-fj2g-mc7p, GHSA-f886-m6hf-6m8v, GHSA-mh99-v99m-4gvg, GHSA-q2hr-2g5m-vwhr +3 more
docs/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.browserslist@4.24.3: 2 known vulnerabilitiesGHSA-73wf-gq98-2v4g, GHSA-c83g-rgw3-j3cx
docs/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.compression@1.7.5: 1 known vulnerabilityGHSA-vc2v-76pw-4v95
docs/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.fast-uri@3.0.3: 12 known vulnerabilitiesGHSA-333x-w4r6-6crp, GHSA-4c8g-83qw-93j6, GHSA-7p8r-x3mc-p8w7, GHSA-f65p-4m7j-42xc, GHSA-hrr3-gc8f-f4qj +7 more
docs/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.image-size@1.1.1: 2 known vulnerabilitiesGHSA-m5qc-5hw7-8vg7, GHSA-w3rx-r6r6-pgpr
docs/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.joi@17.13.3: 12 known vulnerabilitiesGHSA-4528-x5fx-h6hg, GHSA-6h2x-m376-mqjq, GHSA-6w3j-5fw6-r9vr, GHSA-gg4h-3hg2-grpc, GHSA-q7cg-457f-vx79 +7 more
docs/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.js-yaml@3.14.1: 5 known vulnerabilitiesGHSA-2883-xcg3-v3hh, GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj, GHSA-h67p-54hq-rp68, GHSA-mh29-5h37-fv8m
docs/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.js-yaml@4.1.0: 5 known vulnerabilitiesGHSA-2883-xcg3-v3hh, GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj, GHSA-h67p-54hq-rp68, GHSA-mh29-5h37-fv8m
docs/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.launch-editor@2.9.1: 4 known vulnerabilitiesGHSA-587h-7wmj-h5pm, GHSA-698v-4r3x-3vcv, GHSA-r825-w8mm-5pxw, GHSA-v6wh-96g9-6wx3
docs/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.lodash@4.17.21: 4 known vulnerabilitiesGHSA-r5fr-rjxr-66jc, GHSA-xxjr-mmjv-4gpg, GHSA-r5fr-rjxr-66jc, GHSA-xxjr-mmjv-4gpg
docs/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.minimatch@3.1.2: 6 known vulnerabilitiesGHSA-23c5-xmqv-rm74, GHSA-3ppc-4f35-3m26, GHSA-7r86-cg39-jmmj, GHSA-23c5-xmqv-rm74, GHSA-3ppc-4f35-3m26 +1 more
docs/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.nanoid@3.3.8: 3 known vulnerabilitiesGHSA-28wg-ghj8-5hjv, GHSA-2v37-7h3g-55p8, GHSA-xwg4-73v4-xw9w
docs/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.node-forge@1.3.1: 18 known vulnerabilitiesGHSA-2328-f5f3-gj25, GHSA-4487-j8r4-4g2f, GHSA-4642-5mcj-2rqw, GHSA-525v-9gp9-w22h, GHSA-554w-wpv2-vw27 +13 more
docs/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.path-to-regexp@0.1.12: 2 known vulnerabilitiesGHSA-37ch-88jc-xwx2, GHSA-37ch-88jc-xwx2
docs/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.picomatch@2.3.1: 4 known vulnerabilitiesGHSA-3v7f-55p6-f55p, GHSA-c2c7-rcm5-vvqj, GHSA-3v7f-55p6-f55p, GHSA-c2c7-rcm5-vvqj
docs/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.postcss@8.4.49: 4 known vulnerabilitiesGHSA-6g55-p6wh-862q, GHSA-fxqj-rqcc-2cmp, GHSA-qx2v-qp2m-jg93, GHSA-r28c-9q8g-f849
docs/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.serialize-javascript@6.0.2: 3 known vulnerabilitiesGHSA-5c6j-r48x-rmvq, GHSA-m5mm-p8h7-m29v, GHSA-qj8w-gfj5-8c6v
docs/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.source-map-js@1.2.1: 1 known vulnerabilityGHSA-68fv-2mgg-jv7q
docs/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.svgo@3.3.2: 4 known vulnerabilitiesGHSA-2p49-hgcm-8545, GHSA-4vpr-x523-8j87, GHSA-w27v-7q3p-w38r, GHSA-xpqw-6gx7-v673
docs/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.uuid@8.3.2: 2 known vulnerabilitiesGHSA-w5hq-g745-h8pq, GHSA-w5hq-g745-h8pq
docs/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.webpack-dev-middleware@5.3.4: 1 known vulnerabilityGHSA-g84c-rxfj-3j2c
docs/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.ws@7.5.10: 1 known vulnerabilityGHSA-96hv-2xvq-fx4p
docs/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.ws@8.18.0: 2 known vulnerabilitiesGHSA-58qx-3vcg-4xpx, GHSA-96hv-2xvq-fx4p
docs/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.@fastify/busboy@2.1.1: 2 known vulnerabilitiesGHSA-gxm5-99cw-xjw9, GHSA-x8mw-p69m-v3mx
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.@grpc/grpc-js@1.14.3: 4 known vulnerabilitiesGHSA-5375-pq7m-f5r2, GHSA-99f4-grh7-6pcq, GHSA-f596-whhp-79r4, GHSA-m9gg-hp2v-232j
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.@modelcontextprotocol/sdk@1.24.3: 8 known vulnerabilitiesGHSA-22jm-h49p-29qw, GHSA-345p-7cg4-v4c7, GHSA-46jr-4wx8-v453, GHSA-6prh-2h8m-c8cw, GHSA-6qxp-vccf-f47h +3 more
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.@opentelemetry/exporter-prometheus@0.200.0: 1 known vulnerabilityGHSA-q7rr-3cgh-j5r3
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.@opentelemetry/propagator-jaeger@2.0.0: 1 known vulnerabilityGHSA-45rx-2jwx-cxfr
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.@opentelemetry/sdk-node@0.200.0: 1 known vulnerabilityGHSA-q7rr-3cgh-j5r3
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.axios@1.13.2: 35 known vulnerabilitiesGHSA-35jp-ww65-95wh, GHSA-3g43-6gmg-66jw, GHSA-3p68-rc4w-qgx5, GHSA-3pq3-5fj3-cg6v, GHSA-3w6x-2g7m-8v23 +30 more
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.body-parser@1.20.4: 2 known vulnerabilitiesGHSA-27r3-jxmh-p828, GHSA-v422-hmwv-36x6
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.body-parser@2.2.1: 2 known vulnerabilitiesGHSA-27r3-jxmh-p828, GHSA-v422-hmwv-36x6
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.brace-expansion@1.1.12: 7 known vulnerabilitiesGHSA-3jxr-9vmj-r5cp, GHSA-6j4f-fj2g-mc7p, GHSA-f886-m6hf-6m8v, GHSA-mh99-v99m-4gvg, GHSA-q2hr-2g5m-vwhr +2 more
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.browserslist@4.28.1: 2 known vulnerabilitiesGHSA-73wf-gq98-2v4g, GHSA-c83g-rgw3-j3cx
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.fast-uri@3.1.0: 12 known vulnerabilitiesGHSA-333x-w4r6-6crp, GHSA-4c8g-83qw-93j6, GHSA-7p8r-x3mc-p8w7, GHSA-f65p-4m7j-42xc, GHSA-hrr3-gc8f-f4qj +7 more
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.form-data@4.0.5: 1 known vulnerabilityGHSA-hmw2-7cc7-3qxx
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.js-yaml@3.14.2: 4 known vulnerabilitiesGHSA-2883-xcg3-v3hh, GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj, GHSA-h67p-54hq-rp68
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.js-yaml@4.1.1: 4 known vulnerabilitiesGHSA-2883-xcg3-v3hh, GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj, GHSA-h67p-54hq-rp68
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.jsondiffpatch@0.6.0: 2 known vulnerabilitiesGHSA-33vc-wfww-vjfv, GHSA-j4fx-xxwh-2485
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.nanoid@3.3.11: 3 known vulnerabilitiesGHSA-28wg-ghj8-5hjv, GHSA-2v37-7h3g-55p8, GHSA-xwg4-73v4-xw9w
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.path-to-regexp@8.3.0: 2 known vulnerabilitiesGHSA-27v5-c462-wpq7, GHSA-j3q9-mxjg-w52f
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.undici@5.29.0: 16 known vulnerabilitiesGHSA-2m5v-pch6-74hx, GHSA-2mjp-6q6p-2qxm, GHSA-35p6-xmwp-9g52, GHSA-4992-7rv2-5pvq, GHSA-8xcm-r25x-g524 +11 more
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.uuid@11.1.0: 1 known vulnerabilityGHSA-w5hq-g745-h8pq
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.zod@3.25.76: 1 known vulnerabilityGHSA-mrhx-c7xc-m3w5
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.Install contacted hosts other than package registriescdn.playwright.dev, playwright.download.prss.microsoft.com, storage.googleapis.com
- lowLow. Minor, or common in normal tools. Shown for information.@babel/core@7.26.0: 1 known vulnerabilityGHSA-4x5r-pxfx-6jf8
docs/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.@babel/helpers@7.26.0: 1 known vulnerabilityGHSA-968p-4wvh-cqc8
docs/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.@babel/runtime@7.26.0: 1 known vulnerabilityGHSA-968p-4wvh-cqc8
docs/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.@babel/runtime-corejs3@7.26.0: 1 known vulnerabilityGHSA-968p-4wvh-cqc8
docs/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.ajv@6.12.6: 1 known vulnerabilityGHSA-2g4f-4pwh-qvx6
docs/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.ajv@8.17.1: 2 known vulnerabilitiesGHSA-2g4f-4pwh-qvx6, GHSA-2g4f-4pwh-qvx6
docs/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.colord@2.9.3: 1 known vulnerabilityGHSA-2wm5-q62r-hmrv
docs/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.deepmerge@4.3.1: 2 known vulnerabilitiesGHSA-gcqx-w48m-w2h4, GHSA-gcqx-w48m-w2h4
docs/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.estree-util-value-to-estree@3.2.1: 1 known vulnerabilityGHSA-f7f6-9jq7-3rqj
docs/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.follow-redirects@1.15.9: 1 known vulnerabilityGHSA-r4q5-vmmm-2653
docs/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.http-proxy-middleware@2.0.7: 3 known vulnerabilitiesGHSA-4www-5p9h-95mh, GHSA-64mm-vxmg-q3vj, GHSA-9gqv-wp59-fq42
docs/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.mdast-util-to-hast@13.2.0: 1 known vulnerabilityGHSA-4fh9-h7wg-q85m
docs/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.on-headers@1.0.2: 1 known vulnerabilityGHSA-76c9-3jph-rj3q
docs/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.postcss-selector-parser@6.1.2: 2 known vulnerabilitiesGHSA-rj75-hqrm-r3gf, GHSA-w9m9-85wc-3x92
docs/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.postcss-selector-parser@7.0.0: 1 known vulnerabilityGHSA-rj75-hqrm-r3gf
docs/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.prismjs@1.29.0: 1 known vulnerabilityGHSA-x7hr-w5r2-h6wg
docs/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.qs@6.13.0: 5 known vulnerabilitiesGHSA-4mjr-xmp4-gh2g, GHSA-6pq8-jhm2-2vcw, GHSA-6rw7-vpxm-498p, GHSA-q8mj-m7cp-5q26, GHSA-w7fw-mjwx-w883
docs/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.webpack@5.97.1: 2 known vulnerabilitiesGHSA-38r7-794h-5758, GHSA-8fgc-7cc6-rx7x
docs/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.webpack-dev-server@4.15.2: 6 known vulnerabilitiesGHSA-4v9v-hfq4-rm2v, GHSA-79cf-xcqc-c78w, GHSA-9jgg-88mc-972h, GHSA-f5vj-f2hx-8m93, GHSA-m28w-2pqf-7qgj +1 more
docs/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.yaml@1.10.2: 1 known vulnerabilityGHSA-48c2-rrv3-qjmp
docs/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.@ai-sdk/provider-utils@2.2.8: 1 known vulnerabilityGHSA-866g-f22w-33x8
package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.@babel/core@7.28.5: 1 known vulnerabilityGHSA-4x5r-pxfx-6jf8
package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.@opentelemetry/core@2.0.0: 1 known vulnerabilityGHSA-8988-4f7v-96qf
package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.@opentelemetry/core@2.2.0: 1 known vulnerabilityGHSA-8988-4f7v-96qf
package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.@protobufjs/utf8@1.1.0: 1 known vulnerabilityGHSA-q6x5-8v7m-xcrf
package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.ai@4.3.19: 1 known vulnerabilityGHSA-rwvc-j5jr-mgvh
package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.baseline-browser-mapping@2.9.5: 1 known vulnerabilityGHSA-w5vr-8v7q-w6rv
package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.follow-redirects@1.15.11: 1 known vulnerabilityGHSA-r4q5-vmmm-2653
package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.qs@6.14.0: 5 known vulnerabilitiesGHSA-4mjr-xmp4-gh2g, GHSA-6pq8-jhm2-2vcw, GHSA-6rw7-vpxm-498p, GHSA-q8mj-m7cp-5q26, GHSA-w7fw-mjwx-w883
package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.package.json has a prepare scriptnpm run build
package.json - lowLow. Minor, or common in normal tools. Shown for information.No manifest declaring network access and environment variables (agent.json)
Network activity
Tools exposed (33)
start_codegen_sessionStart a new code generation session to record Playwright actions
end_codegen_sessionEnd a code generation session and generate the test file
get_codegen_sessionGet information about a code generation session
clear_codegen_sessionClear a code generation session without generating a test
playwright_navigateNavigate to a URL
playwright_screenshotTake a screenshot of the current page or a specific element
playwright_clickClick an element on the page
playwright_iframe_clickClick an element in an iframe on the page
playwright_iframe_fillFill an element in an iframe on the page
playwright_fillfill out an input field
playwright_selectSelect an element on the page with Select tag
playwright_hoverHover an element on the page
playwright_upload_fileUpload a file to an input[type='file'] element on the page
playwright_evaluateExecute JavaScript in the browser console
playwright_console_logsRetrieve console logs from the browser with filtering options
playwright_resizeResize the browser viewport using manual dimensions or device presets. Supports 143+ device presets including iPhone, iPad, Android devices, and desktop browsers with proper user-agent and touch emulation.
playwright_closeClose the browser and release all resources
playwright_getPerform an HTTP GET request
playwright_postPerform an HTTP POST request
playwright_putPerform an HTTP PUT request
playwright_patchPerform an HTTP PATCH request
playwright_deletePerform an HTTP DELETE request
playwright_expect_responseAsk Playwright to start waiting for a HTTP response. This tool initiates the wait operation but does not wait for its completion.
playwright_assert_responseWait for and validate a previously initiated HTTP response wait operation.
playwright_custom_user_agentSet a custom User Agent for the browser
playwright_get_visible_textGet the visible text content of the current page
playwright_get_visible_htmlGet the HTML content of the current page. By default, all <script> tags are removed from the output unless removeScripts is explicitly set to false.
playwright_go_backNavigate back in browser history
playwright_go_forwardNavigate forward in browser history
playwright_dragDrag an element to a target location
playwright_press_keyPress a keyboard key
playwright_save_as_pdfSave the current page as a PDF file
playwright_click_and_switch_tabClick a link and switch to the newly opened tab
Automated result for the commit shown. See our scan policy. View the scan log
Maintainers can claim the listing to rescan, or dispute a result.
MCP Playwright alternatives
View more →Similar mcp servers in Browser Automation, ranked by GitHub stars. Compare licence, recent activity and scan status before you choose.
| Name | Stars | Licence | Last updated | Scan |
|---|---|---|---|---|
| MCP Playwright (this page) executeautomation | 5.7k | MIT | Dec 13, 2025 | Scanned, no flagged issues |
| Chrome Devtools MCP ChromeDevTools | 55k | Apache-2.0 | Nov 1, 2026 | Scanned, no flagged issues |
| Playwright MCP microsoft | 39k | Apache-2.0 | Oct 31, 2026 | Scanned, no flagged issues |
| MCP Chrome hangwin | 13k | MIT | Jan 6, 2026 | Scanned, no flagged issues |
| Browser Tools MCP AgentDeskAI | 7.3k | MIT | Oct 28, 2026 | Scanned, no flagged issues |
| MCP BrowserMCP | 7.3k | Apache-2.0 | Oct 30, 2026 | Scanned, no flagged issues |