Playwright MCP server

Install

What it lets the assistant do

• Open any URL and manage tabs Network browser_navigate, browser_navigate_back and browser_tabs list, open, close and switch tabs, and a page can load anything it links to. --allowed-origins and --blocked-origins filter requests, but the README states that neither is a security boundary and neither affects redirects.
• Read the page as an accessibility snapshot Read browser_snapshot returns the accessibility tree and browser_find searches it. Everything on the page, including text other people wrote, goes into the assistant’s context.
• Click, type, hover, drag and fill forms Write browser_click, browser_type, browser_hover, browser_drag, browser_fill_form, browser_select_option and browser_press_key act inside whatever sessions the browser profile is signed in to, exactly as a person at the keyboard would.
• Run JavaScript on the page Write browser_evaluate evaluates a JavaScript expression on the page or on one element. The README marks it as not read-only.
• Run Playwright code in the server process Write browser_run_code_unsafe is part of the core tool set. The README says it executes arbitrary JavaScript in the Playwright server process and is equivalent to remote code execution.
• Upload local files Read browser_file_upload sends files from paths it is given. By default file access is limited to the workspace roots (or the working directory) and file:// URLs are blocked; --allow-unrestricted-file-access lifts both limits.
• Take screenshots and save output Write browser_take_screenshot and the filename options on snapshot, console and network tools write files, with relative names resolved against the workspace root.
• Read console messages and network requests Read browser_console_messages and browser_network_requests list what the page logged and which URLs it requested since it loaded.
• Handle dialogs, wait and resize Write browser_handle_dialog accepts or dismisses alerts and prompts, browser_wait_for waits up to 30 seconds for text to appear or disappear, and browser_resize sets the window size.
• Close the browser Write browser_close closes the page. In isolated mode, closing the browser ends the session and discards its storage state.
• Serve over HTTP instead of stdio Network npx @playwright/mcp@latest --port 8931 starts a standalone server that clients reach by URL. --allowed-hosts sets which hosts it will serve from.
• Opt-in capability groups Write The --caps flag adds tool groups that are off by default, including storage (list and set cookies, localStorage and sessionStorage), network (route and mock requests), devtools (tracing and video), vision, pdf and testing.

Tools checked one by one against the repository README on 2026-10-15.

Before you connect it

1. 1Choose the browser profile on purpose. By default the server keeps a persistent profile per workspace (under ~/Library/Caches/ms-playwright on macOS), so sign-ins survive between sessions. Use --isolated to keep the profile in memory, or --user-data-dir for a profile with no personal accounts.
2. 2Treat every page as untrusted input. The README says Playwright MCP is not a security boundary and points to the MCP security best practices. Keep tool confirmations on, above all for form submissions.
3. 3Watch the two code tools. browser_run_code_unsafe and browser_evaluate both run code you did not write; if your client can switch off single tools, switch these off until a task needs them.
4. 4Leave file access at the default. --allow-unrestricted-file-access opens file:// URLs and paths outside the workspace roots to the browser and to uploads.
5. 5Pin the version. The README installs @playwright/mcp@latest; npm listed 0.0.83 as the latest version on 2026-10-15. Replace @latest with the version you tested.
6. 6Consider the CLI for coding agents. The README itself suggests Playwright CLI with skills for coding agents, because it avoids loading large tool schemas and accessibility trees into the model context.
7. 7Do not rely on the secrets option. The configuration schema says secrets replace matching plain text in tool responses so the model does not see it by accident, and adds that this is a convenience, not a security feature.
8. 8Give each client its own profile. The README warns that a persistent profile can be used by one browser instance at a time; start any extra client with --isolated or its own --user-data-dir.
9. 9Know where files land. A screenshot taken without a file name goes to the output directory as page-{timestamp}; named files resolve against the workspace root, so keep that root a project folder you are happy to have written to.
10. 10Keep the sandbox on at your desk. --no-sandbox disables the browser sandbox for every process type that is normally sandboxed. The README’s Docker example uses it inside a container; a desktop setup has no reason to copy it.