Is Playwright MCP server safe?
What Playwright MCP server does
Playwright MCP provides browser automation with Playwright, letting a model work with web pages through structured accessibility snapshots instead of screenshots. The npm author field lists Microsoft Corporation, with source in microsoft/playwright-mcp. It launches and controls a browser, which by default uses a persistent profile, and limits file access to workspace roots unless --allow-unrestricted-file-access is set. Before installing, consider --isolated to keep the browser profile in memory, and note the README's statement that --allowed-origins does not serve as a security boundary.
What to do: Nothing here argues against installing it. Grant the capabilities it lists only if you expect the tool to need them.
Playwright MCP server is an MCP server analyzed by SkillTotal's deterministic static scanner. The scan found no malicious indicators. It can: no notable capabilities — capabilities are what the code can do, not a verdict on intent. Risk score 0/100 (low).
@playwright/
Get notified when this component changes
Change alerts aren't live yet. Leave your email and we'll let you know when they launch. We use it only for this and delete it on request.
Automated static-analysis result. It can contain false positives and false negatives, and is not a claim about the intent of Playwright MCP server's authors. Report a false positive.
Maintain Playwright MCP server?
The free Claude Code plugin scans each npm, PyPI or MCP package with this report's open-source engine before the install command runs. It runs on your machine and needs no account.
Check your own component
Run the same evidence-backed scan on any MCP server, agent skill, or package.
Scan your own componentHow we determine this: deterministic static analysis (regex + AST), evidence-anchored, no code execution. Methodology →