playwright-mcp MCP server “The rare tool that's safe by default. Filesystem access is restricted to your workspace roots, and navigation to file:// URLs is blocked unless you explicitly pass --allow-unrestricted-file-access. That's the opposite of the usual "wide open until you lock it down." No telemetry, and the only dependencies are Microsoft's own playwright packages. Two honest caveats, both about what the tool is rather than a flaw. It drives a real browser, so the agent can reach any site it navigates to, and the --allowed-origins and --blocked-origins flags say plainly in their own help text that they are not a security boundary. And by default it persists a browser profile to a temp dir (cookies, logins); pass --isolated to keep the session in memory only. Treat it like handing your agent a real browser with access to your project files, because that's what it is.”