Playwright MCP
Expose Playwright browser tools to MCP clients using accessibility snapshots.
Sources and review
Checked against public documentation on . Suitability guidance is our editorial judgment; this is not a performance benchmark or an endorsement.
Developers whose MCP-compatible agent needs persistent browser state and structured page inspection.
You need a hosted browser fleet, a complete agent, or a browser tool that operates only from pixels.
About Playwright MCP
Microsoft Playwright MCP connects an MCP client to browser automation tools. Its primary page representation is a structured accessibility snapshot, allowing an agent to inspect and interact with a page without relying on screenshot interpretation. This entry covers the MCP server, not a standalone coding agent or hosted browser service.
Playwright MCP is listed in this index written primarily in TypeScript, with 39k stars on GitHub. Its latest recorded repository push was in October 2026; that is not an ASE editorial review date.
Before connecting: access and data
Playwright MCP operates a browser and can act through logged-in sessions. Its publisher explicitly says it is not a security boundary.
Publisher documentation checked ; recheck due . These are documented capabilities, not a tested connection or security assessment.
- Can read
- Page content, browser output and data exposed by the selected browser session.
- Can change
- Clicks, form fills and uploads can change the visited service. Tools may also save snapshots or browser state to files.
- Code and process execution
- The documented browser_run_code_unsafe tool runs arbitrary JavaScript in the server process. Browser actions are not necessarily read-only.
- Credentials and account state
- Persistent profiles, imported storage state or an existing-browser connection may contain authenticated sessions. No separate MCP API key is described for the standard local setup.
- Data destinations
- The browser contacts visited sites. Page/tool output reaches your client; any forwarding to a model provider depends on that client.
- Limits of this check
- Origin allow/block lists do not cover redirects and are not security boundaries. Workspace file restrictions are guardrails, not sandbox guarantees.
- Limit access before connecting
- Start with --isolated and no imported login state or existing-browser connection. Avoid --allow-unrestricted-file-access; keep client approvals for consequential actions.
- Disconnect and revoke access
- Operational advice: disconnect and stop the server; separately log out or revoke the site's sessions and remove retained profiles/state as needed. Closing an isolated session does not revoke an imported account session.
- List the accounts, files and services the enabled tools can read, change or execute. Check your actual credentials and discovered tools.
- Use narrowly scoped credentials and read-only mode where supported. Review proposed writes before approving them; a generated configuration does not apply these limits for you.
- Local launch is not local-only data processing. External services receive requests, and your client may pass tool results to its model provider. Check both destinations before sharing private data.
- Keep keys and browser session files out of shared config, repositories and screenshots. Know how to disconnect the server and separately revoke its credentials or account sessions.
Add Playwright MCP to your MCP client
Generated from the launch command in the project's README. Your client starts the server on demand.
Claude Code
claude mcp add playwright-mcp -- npx @playwright/mcp@latestCursor
{
"mcpServers": {
"playwright-mcp": {
"command": "npx",
"args": ["@playwright/mcp@latest"]
}
}
}VS Code
{
"servers": {
"playwright-mcp": {
"type": "stdio",
"command": "npx",
"args": ["@playwright/mcp@latest"]
}
}
}Claude Desktop
{
"mcpServers": {
"playwright-mcp": {
"command": "npx",
"args": ["@playwright/mcp@latest"]
}
}
}Codex
[mcp_servers.playwright-mcp]
command = "npx"
args = ["@playwright/mcp@latest"]