// SCAN REPORT

MCP Playwright Server

58 tools. 47 can modify or destroy data without limits.

4 destructive tools with no built-in limits. Policy required.

Last updated:

47 can modify or destroy data
11 read-only
58 tools total

Community server · catalogue entry verified 04/07/2026

How to control MCP Playwright Server ↓

TOOL MAP

What MCP Playwright Server exposes to your agents

Read (11) Write / Execute (43) Destructive / Financial (4)

Running more than one server? Check your whole stack →

MOST DANGEROUS TOOLS
Critical Risk

The most dangerous MCP Playwright Server tools

Destructive · Medium cookies_clear Clearing cookies is a destructive operation because it irreversibly removes browser state including session cookies, authentication tokens, and preferences. Destructive · Medium session_reset_state This tool permanently clears authentication cookies, localStorage, and sessionStorage data. Destructive · High test_artifact_delete This tool deletes test plans or test files, which is an irreversible destructive operation. Destructive · High element_clear Clear the contents of an input or textarea element

47 of MCP Playwright Server's 58 tools can modify, destroy, or commit something on every call — and an agent calls them with no built-in limits.

POLICY

How to control MCP Playwright Server

PolicyLayer is an MCP gateway — it sits between your AI agents and MCP Playwright Server, and nothing reaches the server without passing your rules. These are the rules we recommend:

Deny destructive operations
{
  "cookies_clear": {
    "deny_if": [
      {
        "conditions": [],
        "on_deny": "Blocked by default. Requires approval."
      }
    ]
  }
}

Destructive tools should never be available to autonomous agents without human approval.

Rate limit write operations
{
  "assert_attribute": {
    "limits": [
      {
        "counter": "assert_attribute_per_hour",
        "window": "hour",
        "max": 30,
        "scope": "grant"
      }
    ]
  }
}

Prevents bulk unintended modifications from agents caught in loops.

Cap read operations
{
  "accessibility_scan": {
    "limits": [
      {
        "counter": "accessibility_scan_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

  1. Create a free account and register MCP Playwright Server — nothing to install.
  2. Add these rules — paste them, or build them visually. Tune the limits to your setup.
  3. Point your MCP client (Claude, Cursor, anything) at your gateway URL.
ENFORCE POLICY ON MCP PLAYWRIGHT →

Instant setup, no code required.

FULL CATALOGUE

All 58 MCP Playwright Server tools

DESTRUCTIVE 4 tools
Destructive cookies_clear Clear all cookies from the browser context, or clear specific cookies by name, domain, or path. Destructive element_clear Clear the contents of an input or textarea element Destructive session_reset_state Clear cookies, localStorage, and sessionStorage for a browser session (useful for test isolation) Destructive test_artifact_delete Delete a test plan or test file
EXECUTE 27 tools
Execute browser_history Navigate back or forward in browser history Execute browser_launch Launch a new browser instance (Chromium, Firefox, or WebKit) with optional authentication state and video reco Execute browser_navigate Navigate to a URL in the browser Execute browser_reload Reload the current page Execute browser_tabs List, create, close, or select browser tabs Execute checkbox_set Check or uncheck a checkbox element. Works with both <input type= Execute drag_and_drop Drag an element and drop it on another element. Supports automatic retries for flaky elements. Execute element_click Click an element using various locator strategies. Locator types (in recommended priority order): - Execute element_fill Fill text into an input field using various locator strategies. Locator types (in recommended priority order): Execute element_focus Focus an element (e.g., to trigger focus events or enable keyboard input) Execute element_hover Hover over an element using various locator strategies. Locator types (in recommended priority order): - Execute frame_action Perform an action (click, fill, getText, waitForSelector) inside an iframe. Execute har_playback Use a HAR file to mock network responses. Requests matching the HAR will return recorded responses. Execute har_record_start Start recording HTTP Archive (HAR) for network analysis. Records all network requests during the session. Execute keyboard_press Press a keyboard key or key combination. Examples: Execute keyboard_type Type text character by character (simulates real typing). Use element_fill for faster input, use this for char Execute network_route Intercept and modify network requests matching a URL pattern. Actions: - Execute network_unroute Remove previously set network routes. If no pattern specified, removes all routes. Execute page_prepare Configure page settings for testing (viewport, geolocation, permissions, color scheme, etc.) Execute page_wait_for_load_state Wait for the page to reach a specific load state. Recommended: use domcontentloaded for SPAs, networkidle for Execute select_option Select an option from a dropdown/select element. Supports automatic retries for flaky elements. Execute tracing_group Start a named group in the trace to organize related actions. Call tracing_group_end to close. Execute tracing_group_end End the current trace group started with tracing_group Execute tracing_start Start recording a trace for debugging. Captures screenshots, DOM snapshots, and action logs. View traces at tr Execute tracing_stop Stop recording and save the trace to a file. Open the trace file at https://trace.playwright.dev Execute wait_for_download Wait for a file download to complete after triggering an action Execute wait_for_selector Wait for an element matching the selector to appear or reach a specific state
WRITE 16 tools
Write assert_attribute Assert that an element has a specific attribute value Write assert_checked Assert that a checkbox or radio button is checked or unchecked Write assert_css Assert that an element has a specific CSS property value Write assert_element Assert that an element is in a specific state (web-first assertion with auto-waiting). States: - Write assert_text Assert that an element has or contains specific text (web-first assertion). Supports regex patterns. Write assert_title Assert that the page has a specific title. Supports regex patterns. Write assert_url Assert that the page has a specific URL. Supports regex patterns. Write assert_value Assert that an input element has a specific value Write browser_close Close a browser session Write cookies_set Add one or more cookies to the browser context. Useful for setting authentication tokens or session data. Write file_upload Upload one or more files to a file input element. The selector should target an <input type= Write page_pdf Generate a PDF of the current page (Chromium only). Useful for reports, invoices, or archiving pages. Write save_storage_state Save browser storage state (cookies, localStorage) for authentication reuse Write test_file_create Create a Playwright test specification file generated by the Playwright Test Generator agent Write test_file_update Update an existing Playwright test file. Used by the Healer agent to fix failing tests. Write test_plan_create Create a structured test plan in Markdown format. Used by the Playwright Test Planner agent.
READ 11 tools
Read accessibility_scan Scan the page for accessibility violations using axe-core. Returns WCAG violations with remediation guidance. Read assert_count Assert that the number of elements matching the selector equals expected count Read console_capture Capture browser console messages for debugging. Start capturing, then get logs, then stop when done. Read cookies_get Retrieve all cookies from the browser context, optionally filtered by URLs. Read frame_locator Get information about an iframe. Use this before performing actions inside frames. Read page_content Retrieve the HTML and text content of the page Read page_screenshot Capture a screenshot of the page, a specific element, or a region. Returns base64-encoded image. Read sessions_list List all active browser sessions Read test_artifacts_list List all test plans and test files in the project. Returns specs/ and tests/ directories. Read test_file_read Read the content of a test specification file. Used by agents to understand existing tests. Read video_path Get the file path of the video recording for a page. Only available if video recording was enabled during brow
EXPLORE

Related servers

Other MCP servers with similar tools — same risk classification, starter policies for each.

Yaver 1060 tools
adminautomation
Nodebench 824 tools
adminautomation
UnClick 813 tools
adminautomation
Binance MCP Server 734 tools
adminautomation
Fortimanager 584 tools
adminautomation
Crow 573 tools
adminautomation
Mcp 571 tools
adminautomation
GoHighLevel MCP Server 566 tools
adminautomation
FAQ

Questions about MCP Playwright Server

Can an AI agent delete data through the MCP Playwright Server MCP server? +

Yes. The MCP Playwright Server server exposes 4 destructive tools including cookies_clear, element_clear, session_reset_state. These permanently remove resources with no undo. PolicyLayer blocks destructive tools by default so they never reach the upstream server.

How do I prevent bulk modifications through MCP Playwright Server? +

The MCP Playwright Server server has 16 write tools including assert_attribute, assert_checked, assert_css. Set a rate limit in your policy -- for example, 10 calls per hour prevents an agent from making more than 10 modifications per hour. PolicyLayer enforces this at the gateway, before calls reach MCP Playwright Server.

How many tools does the MCP Playwright Server MCP server expose? +

58 tools across 4 categories: Destructive, Execute, Read, Write. 11 are read-only. 47 can modify, create, or delete data.

How do I enforce a policy on MCP Playwright Server? +

Register the MCP Playwright Server MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.

Enforce policy on every MCP Playwright Server tool call.

Deterministic rules across all 58 MCP Playwright Server tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.

ENFORCE POLICY ON MCP PLAYWRIGHT →

Instant setup, no code required.

58 MCP Playwright Server tools catalogued and risk-classified — across an index of 43,000+ MCP servers.

// GET IN TOUCH

Have a question or want to learn more? Send us a message.

Message sent.

We'll get back to you soon.