playwright-mcp

Name: playwright-mcp
Author: Microsoft

✓ Vetted

Microsoft's official Playwright MCP server. Drives a real browser through the accessibility tree (navigate, click, type, screenshot) with no vision model required.

Installed, run, and audited by hand on Jul 12, 2026.

by Microsoft MCP server Browser automationTesting

Last shipped 4 days ago passing liveness · checked Jul 28, 2026

Commit activity · last 52 weeks

Stars36k

LanguageTypeScript

LicenseApache-2.0

Open issues10

Pricingfree

ListedJul 11, 2026

Facts pulled from the source repo and refreshed nightly. Stars are a data point, not our ranking. We don't order by popularity.

Install claude mcp add playwright -- npx @playwright/mcp@latest

Runs in

Harness	Support	Notes
Claude Code	full	—
Any MCP client	full	—

Support levels reflect what we actually ran, not what the README claims. untested means exactly that.

The verdict

The rare tool that's safe by default. Filesystem access is restricted to your workspace roots, and navigation to file:// URLs is blocked unless you explicitly pass --allow-unrestricted-file-access. That's the opposite of the usual "wide open until you lock it down." No telemetry, and the only dependencies are Microsoft's own playwright packages. Two honest caveats, both about what the tool is rather than a flaw. It drives a real browser, so the agent can reach any site it navigates to, and the --allowed-origins and --blocked-origins flags say plainly in their own help text that they are not a security boundary. And by default it persists a browser profile to a temp dir (cookies, logins); pass --isolated to keep the session in memory only. Treat it like handing your agent a real browser with access to your project files, because that's what it is.

What it is

The reference browser-automation MCP: it drives Chrome, Firefox, WebKit, or Edge through the accessibility tree, so it clicks and types against real element roles rather than screenshots, and needs no vision model. Screenshot, PDF, and devtools capabilities are opt-in via --caps.

How it was vetted

Booted the published package (@playwright/mcp 0.0.78) and read the repo at commit 5f8fc00 (2026-07-09). A browser driver can reach a lot by definition, so the audit looked at the defaults and the escape hatches.

Safe-by-default filesystem. Access is confined to the workspace roots (or cwd) and file:// navigation is blocked. Opening that up is an explicit, named flag (--allow-unrestricted-file-access). Good hygiene, and the reason this one earns a clean pass where a write-capable tool would need its guardrails pinned.
Candid about its non-boundaries. The origin allow and block lists carry their own warning that they do not serve as a security boundary and don’t affect redirects. Documentation that tells you where the edges aren’t is a good sign.
No telemetry, first-party deps only. The dependency tree is Microsoft’s own playwright and playwright-core. No analytics SDKs anywhere.
Profile persistence. By default a browser profile (including any logins you perform) is saved to a temp --user-data-dir. Use --isolated for an in-memory session that leaves nothing behind.

Runs in

What it is

How it was vetted

More in Browser automation