// SCAN REPORT

CDP-MCP Server

36 tools. 23 can modify or destroy data without limits.

3 destructive tools with no built-in limits. Policy required.

Last updated: 30 Jun 2026

23 can modify or destroy data

13 read-only

36 tools total

Community server · catalogue entry verified 30/06/2026

How to control CDP-MCP Server ↓

TOOL MAP

What CDP-MCP Server exposes to your agents

Read (13) Write / Execute (20) Destructive / Financial (3)

Running more than one server? Check your whole stack →

MOST DANGEROUS TOOLS

Critical Risk

The most dangerous CDP-MCP Server tools

Destructive · Low console_clear Clearing the console message buffer is irreversible: once cleared, the previously captured log entries are gone and cannot be recovered. Destructive · Low network_clear Clearing the network request buffer irreversibly destroys the captured network logs stored in memory. Destructive · High debugger_remove_breakpoint Remove a breakpoint by its ID Execute · High cdp_attach_target Attaching to a Chrome target via CDP gives the agent direct debugging control over that browser context — enabling breakpoints, script evaluation, network interception, and other low-level operations.

23 of CDP-MCP Server's 36 tools can modify, destroy, or commit something on every call — and an agent calls them with no built-in limits.

POLICY

How to control CDP-MCP Server

PolicyLayer is an MCP gateway — it sits between your AI agents and CDP-MCP Server, and nothing reaches the server without passing your rules. These are the rules we recommend:

Deny destructive operations

{
  "console_clear": {
    "deny_if": [
      {
        "conditions": [],
        "on_deny": "Blocked by default. Requires approval."
      }
    ]
  }
}

Destructive tools should never be available to autonomous agents without human approval.

Rate limit write operations

{
  "cdp_disconnect": {
    "limits": [
      {
        "counter": "cdp_disconnect_per_hour",
        "window": "hour",
        "max": 30,
        "scope": "grant"
      }
    ]
  }
}

Prevents bulk unintended modifications from agents caught in loops.

Cap read operations

{
  "cdp_list_targets": {
    "limits": [
      {
        "counter": "cdp_list_targets_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

Create a free account and register CDP-MCP Server — nothing to install.
Add these rules — paste them, or build them visually. Tune the limits to your setup.
Point your MCP client (Claude, Cursor, anything) at your gateway URL.

ENFORCE POLICY ON CDP-MCP →

Instant setup, no code required.

FULL CATALOGUE

All 36 CDP-MCP Server tools

DESTRUCTIVE 3 tools

Destructive console_clear Clear the console message buffer Destructive debugger_remove_breakpoint Remove a breakpoint by its ID Destructive network_clear Clear the network request buffer

EXECUTE 19 tools

Execute cdp_attach_target Attach to a specific Chrome target by ID Execute cdp_connect Connect to a Chromium instance (discovers running instance or launches one) Execute cdp_send_command Send a raw CDP command to the browser. Unlocks all CDP domains (Page, DOM, Input, Fetch, etc.) except Accessib Execute debugger_blackbox_script Set URL patterns for scripts to skip during stepping (e.g. vendor libraries) Execute debugger_enable Enable the JavaScript debugger for the current target Execute debugger_evaluate_on_frame Evaluate a JavaScript expression in the context of a paused call frame Execute debugger_pause Force pause JavaScript execution immediately Execute debugger_resume Resume execution from a paused state Execute debugger_set_breakpoint Set a breakpoint at a URL and line number (1-based). Use urlRegex for pattern matching. Execute debugger_set_exception_breakpoints Configure when to pause on exceptions Execute debugger_step_into Step into the function call on the current line Execute debugger_step_out Step out of the current function back to the caller Execute debugger_step_over Step over the current line (stays in the same function) Execute network_continue_request Continue a paused request (optionally modify URL, method, headers, or body) Execute network_disable_interception Disable network interception and continue all paused requests Execute network_enable_interception Enable network request interception (pauses matching requests for inspection/modification). WARNING: paused re Execute network_fail_request Fail a paused request with a specific error reason Execute network_fulfill_request Respond to a paused request with a custom response (mock/intercept the response entirely) Execute runtime_evaluate Evaluate a JavaScript expression in the global page context

WRITE 1 tools

Write cdp_disconnect Disconnect from the current Chrome target (does NOT close Chrome)

READ 13 tools

Read cdp_list_targets List all available Chrome targets (tabs/pages) Read console_get_logs Get captured console messages (log, warn, error, info) Read debugger_get_call_stack Get the current call stack when paused (with function names, URLs, line numbers) Read debugger_get_pause_info Get information about the current pause state (reason, location, breakpoints hit) Read debugger_inspect_scopes Inspect variables in scope when paused (Local, Closure, this) Read debugger_list_breakpoints List all active breakpoints Read network_get_paused_requests List all currently paused/intercepted requests awaiting action Read network_get_requests List captured network requests (with response status, headers, timing) Read network_get_response_body Get the response body for a specific request by its requestId Read runtime_get_properties Get properties of an object by its objectId (for drilling into complex objects) Read source_get_script Get the full source code of a script by scriptId or URL Read source_list_scripts List all loaded JavaScript scripts in the current page Read source_resolve_sourcemap Resolve a generated code position to its original source using source maps

EXPLORE

Related servers

Other MCP servers with similar tools — same risk classification, starter policies for each.

FAQ

Questions about CDP-MCP Server

Can an AI agent delete data through the CDP-MCP Server MCP server? +

Yes. The CDP-MCP Server server exposes 3 destructive tools including console_clear, debugger_remove_breakpoint, network_clear. These permanently remove resources with no undo. PolicyLayer blocks destructive tools by default so they never reach the upstream server.

How do I prevent bulk modifications through CDP-MCP Server? +

The CDP-MCP Server server has 1 write tools including cdp_disconnect. Set a rate limit in your policy -- for example, 10 calls per hour prevents an agent from making more than 10 modifications per hour. PolicyLayer enforces this at the gateway, before calls reach CDP-MCP Server.

How many tools does the CDP-MCP Server MCP server expose? +

36 tools across 3 categories: Destructive, Read, Write. 13 are read-only. 23 can modify, create, or delete data.

How do I enforce a policy on CDP-MCP Server? +

Register the CDP-MCP Server MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.

Enforce policy on every CDP-MCP Server tool call.

Deterministic rules across all 36 CDP-MCP Server tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.

ENFORCE POLICY ON CDP-MCP →

Instant setup, no code required.

36 CDP-MCP Server tools catalogued and risk-classified — across an index of 43,000+ MCP servers.