Build my server

Guides

Playwright MCP Server: Setup, Safe Flags and Security (Oct 2026)

By Team TrustedMCP

On this page
Playwright MCP Server: Setup, Safe Flags and Security (Oct 2026)

Playwright MCP is Microsoft's official MCP server that lets an agent drive a real browser. TrustedMCP grades it C. The main reason: one of its default tools runs any code the model writes on your machine. With the right flags and a container, you can run it much more safely.

It is open source at microsoft/playwright-mcp and very actively maintained. The latest release when we checked was v0.0.83.

What it connects

  • A real browser. Chromium by default. Firefox, WebKit and Edge are options via --browser.
  • Page structure, not pixels. The agent reads the page as an accessibility snapshot, so it does not need a vision model.
  • 25 default tools. Navigate, click, type, fill forms, upload files, take screenshots, read console and network logs, and manage tabs. More tool groups (vision, pdf, devtools, network, storage, testing) are opt-in with --caps.
  • One risky default. browser_run_code_unsafe is in the core group. The README says it "executes arbitrary JavaScript in the Playwright server process and is RCE-equivalent."

Setup

All snippets come from the official README. You need Node.js 18 or newer.

Claude Code:

claude mcp add playwright npx @playwright/mcp@latest

Cursor: go to Cursor Settings > MCP > Add new MCP Server, pick the command type and enter npx @playwright/mcp@latest. Or use the standard config below in your Cursor MCP file.

VS Code, from the command line:

code --add-mcp '{"name":"playwright","command":"npx","args":["@playwright/mcp@latest"]}'

Claude Desktop and most other clients use the standard config:

{ "mcpServers": { "playwright": { "command": "npx", "args": ["@playwright/mcp@latest"] } } }

To add a flag, put it in the args list after the package name.

Run it safely

This is the part most guides skip. Do these in order of impact.

1. Know that you cannot switch off the unsafe tool with a flag. --caps only adds tool groups. The core group, which includes browser_run_code_unsafe, is always loaded. We checked the source: the tool filter keeps every core tool no matter what you pass. So block it in your client instead. In Claude Code, add a deny rule to your settings:

{ "permissions": { "deny": ["mcp__playwright__browser_run_code_unsafe"] } }

In VS Code and Cursor, untick that tool in the client's tool list for the server. Either way, keep approval prompts on for this server.

2. Use a throwaway browser profile. By default the server keeps a persistent profile on disk, so logins carry over between sessions. Add --isolated to keep the profile in memory only. If you need a login, load a test account with --storage-state, as the README shows:

{ "mcpServers": { "playwright": { "command": "npx",
  "args": ["@playwright/mcp@latest", "--isolated", "--storage-state={path/to/storage.json}"] } } }

Or point --user-data-dir at a folder used only for this. Add --headless if you do not need to watch.

3. Do not log it into real accounts. Any page the agent visits can carry hidden instructions. If the browser is signed in to your email or bank, a prompt injection can use those sessions.

4. Keep HTTP mode on localhost. --port turns on HTTP transport. It has no authentication and no TLS. --host defaults to localhost. Never set it to 0.0.0.0 on a machine others can reach. The README's long-running Docker example does bind 0.0.0.0 and publishes port 8931, so do not copy it onto a shared or public host. Leave --allowed-hosts at its default; it is the DNS rebinding guard.

5. Run it in a container with no credentials. The README's Docker config runs headless Chromium only:

{ "mcpServers": { "playwright": { "command": "docker",
  "args": ["run", "-i", "--rm", "--init", "--pull=always", "mcr.microsoft.com/playwright/mcp"] } } }

Do not mount your home folder or pass API keys into it.

6. Treat origin lists as a convenience. --allowed-origins and --blocked-origins limit where the browser goes. The README says they do not serve as a security boundary and do not affect redirects. File access is limited to workspace roots by default. Do not add --allow-unrestricted-file-access.

Security notes

The README states it plainly: "Playwright MCP is not a security boundary." The browser reads untrusted web pages. A page can tell the model to call a tool. If that tool is browser_run_code_unsafe, the result is code running on your machine with your user's rights. That chain is why the safe-run steps above matter. More in is it safe to install an MCP server and MCP security best practices.

Why it grades C

Here is how it does on each check:

  • Maintenance, 25 of 25. First-party from Microsoft, frequent releases.
  • Known CVEs, 25 of 25. CVE-2025-9611, a DNS rebinding flaw, affected versions before 0.0.40. The fix shipped before the advisory was published. Nothing is open.
  • Authentication, 0 of 30. HTTP mode has no authentication at all.
  • Transport, 0 of 20. HTTP mode has no TLS, and an RCE-equivalent tool is on by default.

None of this means the project is careless. It means the defaults trust the model and the pages it reads. Full breakdown on the Playwright MCP listing. The method is in how TrustedMCP scores servers. Similar servers are in browser automation, and our MCP browser comparison sets Playwright beside browser-use and Chrome DevTools.

FAQs

What is Playwright MCP? It is an MCP server from Microsoft that gives an AI agent a real browser. The agent sees the page as structured text and acts with tools like click, type and navigate. It works with Claude, Cursor, VS Code and many other clients.

How do I install it in Claude Code? Run claude mcp add playwright npx @playwright/mcp@latest. Then add the deny rule from step 1 above. Run claude mcp list to check it connected.

How do I connect it to my existing browser? Install the "Playwright Extension" from the Chrome Web Store (Chrome or Edge) and add --extension to args. On first use you pick which tab the agent may control, and you approve each connection. The extension's own docs offer a PLAYWRIGHT_MCP_EXTENSION_TOKEN to skip that approval. We suggest you keep the approval. This mode uses your real logged-in sessions, which is the riskiest way to run it.

Why does it show "0 tools enabled" or no tools? Usually the server did not start, so the client got no tool list. Check these:

  • Run npx @playwright/mcp@latest in a terminal and read any error.
  • Check node --version. The README needs Node.js 18 or newer.
  • Restart the client after editing the config, and check the JSON is valid.
  • If two clients share one workspace, the persistent profile can only be used by one browser at a time. Add --isolated or a separate --user-data-dir.
  • Check whether your client caps or hides tools per server, and that the tools are ticked on.

Playwright MCP or Playwright CLI? The README now points coding agents to microsoft/playwright-cli. The CLI is more token-efficient because it does not load large tool schemas and accessibility trees into context. Microsoft says MCP still fits long-running agent loops that need a persistent browser and rich page inspection. If context is tight, see why MCP servers eat your context window.

Playwright MCP or Chrome DevTools MCP? Chrome DevTools MCP is from the Chrome DevTools team. It uses Puppeteer and officially supports Google Chrome and Chrome for Testing only. Its focus is debugging and performance traces, with tools for network, memory and performance, plus a --slim mode with fewer tools. Its README notes that performance tools may send trace URLs to Google's CrUX API, and that Google collects usage statistics unless you opt out. Playwright MCP supports Chromium, Firefox and WebKit and is aimed at general automation. Pick Chrome DevTools MCP to debug a Chrome page. Pick Playwright MCP for cross-browser tasks and test-style flows.