Playwright MCP Server: Tools, Setup and Security

This profile is part of our MCP server directory, within The MCP Guide. Profiles are checked against each vendor's own documentation. Need a server built? See MCP development.

Playwright MCP lets an AI app drive a real web browser: open pages, click, type, fill forms and read what is on screen. Microsoft publishes it as an open-source local server built on the Playwright testing library.

Checked against: Playwright MCP on GitHub on 28 October 2026. eSEOspace did not install or test this server.

Key Takeaways

Playwright MCP reads pages through structured accessibility snapshots, so it does not need screenshots or a vision model.
You add it with npx @playwright/mcp@latest; it needs Node.js 18 or newer.
Extra tool groups such as network, storage, DevTools, PDF and coordinate-based clicks are opt-in through --caps.
Microsoft states plainly that "Playwright MCP is not a security boundary."
Microsoft says coding agents may do better with the Playwright CLI plus skills, which it calls more token-efficient.

At a glance

Item	Detail
Publisher	Microsoft
Official?	Yes
Hosting	Local package `@playwright/mcp`; Docker image; optional standalone HTTP port
Transport	stdio by default; HTTP when started with `--port`
Sign-in	None
Read or write	Acts in the browser (clicks, typing, uploads, script runs)
Price	Free and open source
Source code	microsoft/playwright-mcp (Apache 2.0)
Status	Not stated

What it can do

The README lists core automation tools that load by default, including:

browser_navigate, browser_navigate_back, browser_tabs, browser_close
browser_snapshot (an accessibility snapshot, which the README says "is better than screenshot") and browser_take_screenshot
browser_click, browser_type, browser_fill_form, browser_select_option, browser_hover, browser_drag, browser_press_key
browser_file_upload, browser_handle_dialog, browser_wait_for
browser_console_messages, browser_network_requests
browser_evaluate and browser_run_code_unsafe for running JavaScript

Opt-in groups use --caps: config, network, storage, devtools, vision (coordinate-based clicks), pdf (browser_pdf_save) and testing (test assertions).

Microsoft positions MCP for "exploratory automation" and long-running autonomous work where an agent keeps browser state. For high-throughput coding agents, it points to the separate Playwright CLI with skills.

How to connect it

The standard config works in most clients:

{
  "mcpServers": {
    "playwright": {
      "command": "npx",
      "args": [
        "@playwright/mcp@latest"
      ]
    }
  }
}

For Claude Code, the README gives:

claude mcp add playwright npx @playwright/mcp@latest

The README has setup sections for many clients, including Cursor, VS Code, Windsurf (now Devin Desktop), Codex, Gemini CLI, Goose, Junie and Kiro. A Docker image is available at mcr.microsoft.com/playwright/mcp, which supports only headless Chromium for now.

Security notes

Microsoft's own wording sets the tone: the server is "not a security boundary," and it links to the MCP project's security best practices.

Things to know before you use it:

Browser profile. By default the server uses a persistent profile like a normal browser. Use --isolated to keep the profile in memory and discard it when the browser closes.
Origin filters are not walls. --allowed-origins and --blocked-origins exist, but the README says they do "not serve as a security boundary" and do not affect redirects.
Code execution. browser_evaluate and browser_run_code_unsafe run JavaScript in the page.
Network exposure. If you run it with --port or in Docker with --host 0.0.0.0, any client that can reach the port can use it.

Web pages are untrusted input. Read prompt injection through tool results and exposed local MCP servers, and see the MCP Security Center.

Alternatives

Chrome DevTools MCP server for performance traces and deep Chrome debugging.
Postman MCP server if you are testing APIs rather than pages.
Sentry MCP server to pair browser tests with production error data.

Next step

Run Playwright MCP in isolated mode against a staging site first, never a logged-in production admin. Our guide to sandboxing local MCP servers explains how, and the MCP server directory lists other developer tools.

Frequently asked questions

Is Playwright MCP free?

Yes. It is open source under the Apache 2.0 license and runs locally with npx.

Does Playwright MCP need a vision model?

No. It works from Playwright's accessibility tree, not pixels. Coordinate-based tools are available if you opt in with --caps=vision.

Should I use Playwright MCP or the Playwright CLI?

Microsoft suggests the CLI with skills for coding agents that need to save tokens. MCP suits exploratory or long-running tasks where the agent benefits from keeping browser state and inspecting pages over time.

Can Playwright MCP use my logged-in browser?

By default it uses a persistent profile, and it can also connect to an existing browser through an extension. For safer testing, use --isolated or a storage state file instead of your everyday profile.

Playwright MCP Server: Tools, Setup and Security