mcp-playwright

Security Findings (63)

• CriticalAS-006

  💻Arbitrary Code Execution

  heuristic signal

  playwright_evaluate:tool name or description implies arbitrary script/code execution (evaluate_script, execute javascript, etc.)

  Fix: This tool can execute arbitrary code or shell commands on the host system. Remove it unless strictly required. If kept: (1) restrict access to trusted users/agents only, (2) require human approval before each invocation (Claude Desktop: set approval_required: true; other clients: enable equivalent confirmation), (3) use the most restrictive sandbox or read-only mode available, and (4) never expose this tool to untrusted input sources.

• HighAS-012

  🔄Tool Drift

  Tool set changed silently at v1.0.12: 33 tool(s) added, 8 tool(s) removed without a version bump.

  + 33 added

  clear_codegen_sessionend_codegen_sessionget_codegen_sessionplaywright_assert_responseplaywright_clickplaywright_click_and_switch_tabplaywright_closeplaywright_console_logsplaywright_custom_user_agentplaywright_deleteplaywright_dragplaywright_evaluateplaywright_expect_responseplaywright_fillplaywright_getplaywright_get_visible_htmlplaywright_get_visible_textplaywright_go_backplaywright_go_forwardplaywright_hoverplaywright_iframe_clickplaywright_iframe_fillplaywright_navigateplaywright_patchplaywright_postplaywright_press_keyplaywright_putplaywright_resizeplaywright_save_as_pdfplaywright_screenshotplaywright_selectplaywright_upload_filestart_codegen_session

  − 8 removed

  compare-visual-statediagnose-flakygenerate-e2e-testget-failureinspect-pagelist-testsrun-testvalidate-selector

  Fix: The set of tools exposed by this server changed between scans of the same version — a sign the package was silently updated without a version bump. Audit the changelog and all tool definitions before trusting this server. Pin to a specific commit hash rather than a floating version tag.

• LowAS-011

  ℹ️Missing Rate-Limit / Timeout ×9

  tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration

  playwright_evaluateplaywright_getplaywright_postplaywright_putplaywright_patchplaywright_deleteplaywright_expect_responseplaywright_assert_responseplaywright_get_visible_html

  Fix: Declare explicit rate-limit, timeout, and retry configuration for all network and execution tools. Implement exponential back-off and surface resource state to the calling agent.

• InfoAS-014

  ℹ️Dependency Inventory Unavailable ×33

  No metadata.dependencies or repo_url were exposed by this MCP server, and no local project manifest could be inferred from the launch command.

  start_codegen_sessionend_codegen_sessionget_codegen_sessionclear_codegen_sessionplaywright_navigateplaywright_screenshotplaywright_clickplaywright_iframe_clickplaywright_iframe_fillplaywright_fillplaywright_selectplaywright_hoverplaywright_upload_fileplaywright_evaluateplaywright_console_logsplaywright_resizeplaywright_closeplaywright_getplaywright_postplaywright_putplaywright_patchplaywright_deleteplaywright_expect_responseplaywright_assert_responseplaywright_custom_user_agentplaywright_get_visible_textplaywright_get_visible_htmlplaywright_go_backplaywright_go_forwardplaywright_dragplaywright_press_keyplaywright_save_as_pdfplaywright_click_and_switch_tab

  Fix: Review and remediate the identified issue.

• InfoAS-002

  ⚠️Excessive Permissions ×14

  declared capabilities: filesystem access

  end_codegen_sessionplaywright_screenshotplaywright_upload_fileplaywright_save_as_pdf

  declared capabilities: network access

  playwright_navigateplaywright_expect_responseplaywright_assert_response

  declared capabilities: code/command execution

  playwright_evaluateplaywright_get_visible_html

  declared capabilities: network access, HTTP requests

  playwright_getplaywright_postplaywright_putplaywright_patch

  declared capabilities: network access, filesystem access, HTTP requests

  playwright_delete

  Fix: Tool requests broad permissions (exec/fs/network). Validate input parameters using Enums where possible, and restrict file system operations to explicit allowed directories.

• InfoAS-010

  🔑Insecure Secret Handling ×5

  input parameter "token" accepts a credential (informational; not evidence of insecure handling)

  playwright_getplaywright_postplaywright_putplaywright_patchplaywright_delete

  Fix: Avoid accepting raw credentials as input parameters. Use secret managers (e.g. 1Password CLI, AWS Secrets Manager) and ensure credentials are never logged or stored in agent traces.