Pascal Playwright Mcp

Browser automation via Playwright MCP server. Navigate websites, click elements, fill forms, extract data, take screenshots, and perform full browser automat...

Security Scan

The skill is internally consistent with a Playwright MCP-based browser automation tool: required binaries and instructions match the described purpose, it requests no credentials, and there are no suspicious install URLs or hidden behaviors in the included files.

Purpose & Capability

Name/description (Playwright MCP browser automation) match the declared requirements (playwright-mcp, npx) and the SKILL.md content. The included examples and tools (navigate, click, evaluate, snapshot) are expected for Playwright MCP usage.

Instruction Scope

SKILL.md instructs running the Playwright MCP CLI via npx and describes using tools that run arbitrary page JavaScript (browser_evaluate). That's expected for browser automation, but browser_evaluate can be used to read page content or run scripts that exfiltrate data from pages or interact with authenticated sessions — so operators should limit which sites are allowed and where outputs are sent. The doc's security claims (restricted FS, host validation, sandboxing) are configuration-level and should be verified at runtime; the instructions themselves do not enforce them.

Install Mechanism

No embedded or remote binary downloads in the skill bundle; SKILL.md recommends installing @playwright/mcp from the public npm registry via npm or npx, which is a standard, traceable distribution method. The registry metadata contained no unexpected URLs or shorteners.

Credentials

The skill declares no required environment variables or credentials, which is appropriate for a local browser automation helper. No config paths or secrets are requested.

Persistence & Privilege

The skill does not request persistent/always-on inclusion and uses normal autonomous-invocation defaults. It does not attempt to modify other skills or system-wide configurations in the provided files.

Assessment

This skill appears to be what it claims — a Playwright MCP helper — but a few practical safety checks are recommended before you run it: 1) Install @playwright/mcp from the official npm registry and pin a specific version. 2) Run the MCP server in a restricted environment (container or sandboxed VM) if you will point it at untrusted sites. 3) Configure --allowed-hosts and --blocked-origins to prevent navigation to arbitrary domains, and avoid using --no-sandbox unless you understand the risks. 4) Be cautious with browser_evaluate (arbitrary JS): it can read page data and interact with authenticated sessions; do not evaluate untrusted scripts or send outputs to untrusted endpoints. 5) Verify the runtime configuration actually restricts filesystem access and service capabilities as the SKILL.md claims. If you need higher assurance, ask the publisher for the exact MCP server launch flags and the source/package checksum before installing.

Playwright MCP Skill

Browser automation powered by Playwright MCP server. Control Chrome, Firefox, or WebKit programmatically.

Installation

npm install -g @playwright/mcp
# Or
npx @playwright/mcp

Install browsers (first time):

npx playwright install chromium

Quick Start

Start MCP Server (STDIO mode)

npx @playwright/mcp

Start with Options

# Headless mode
npx @playwright/mcp --headless

# Specific browser
npx @playwright/mcp --browser firefox

# With viewport
npx @playwright/mcp --viewport-size 1280x720

# Ignore HTTPS errors
npx @playwright/mcp --ignore-https-errors

Common Use Cases

1. Navigate and Extract Data

# MCP tools available:
# - browser_navigate: Open URL
# - browser_click: Click element
# - browser_type: Type text
# - browser_select_option: Select dropdown
# - browser_get_text: Extract text content
# - browser_evaluate: Run JavaScript
# - browser_snapshot: Get page structure
# - browser_close: Close browser

2. Form Interaction

1. browser_navigate to form URL
2. browser_type into input fields
3. browser_click to submit
4. browser_get_text to verify result

3. Data Extraction

1. browser_navigate to page
2. browser_evaluate to run extraction script
3. Parse returned JSON data

MCP Tools Reference

Tool	Description
browser_navigate	Navigate to URL
browser_click	Click element by selector
browser_type	Type text into input
browser_select_option	Select dropdown option
browser_get_text	Get text content
browser_evaluate	Execute JavaScript
browser_snapshot	Get accessible page snapshot
browser_close	Close browser context
browser_choose_file	Upload file
browser_press	Press keyboard key

Configuration Options

# Security
--allowed-hosts example.com,api.example.com
--blocked-origins malicious.com
--ignore-https-errors

# Browser settings
--browser chromium|firefox|webkit
--headless
--viewport-size 1920x1080
--user-agent "Custom Agent"

# Timeouts
--timeout-action 10000      # Action timeout (ms)
--timeout-navigation 30000  # Navigation timeout (ms)

# Output
--output-dir ./playwright-output
--save-trace
--save-video 1280x720

Examples

Login to Website

browser_navigate: { url: "https://example.com/login" }
browser_type: { selector: "#username", text: "user" }
browser_type: { selector: "#password", text: "pass" }
browser_click: { selector: "#submit" }
browser_get_text: { selector: ".welcome-message" }

Extract Table Data

browser_navigate: { url: "https://example.com/data" }
browser_evaluate: { 
  script: "() => { return Array.from(document.querySelectorAll('table tr')).map(r => r.textContent); }" 
}

Screenshot

browser_navigate: { url: "https://example.com" }
browser_evaluate: { script: "() => { document.body.style.zoom = 1; return true; }" }
# Screenshot saved via --output-dir or returned in response

Security Notes

• By default restricts file system access to workspace root
• Host validation prevents navigation to untrusted domains
• Sandboxing enabled by default (use --no-sandbox with caution)
• Service workers blocked by default

Troubleshooting

# Update browsers
npx playwright install chromium

# Debug mode
npx @playwright/mcp --headless=false --output-mode=stdout

# Check installation
playwright-mcp --version

Links

• Playwright Docs
• MCP Protocol
• NPM Package