// SCAN REPORT

Playwright MCP Server

9 tools. 6 can modify or destroy data without limits.

5 write tools that can modify data. Rate limits recommended.

Last updated: 12 Jun 2026

6 can modify or destroy data

3 read-only

9 tools total

Community server · catalogue entry verified 12/06/2026

How to control Playwright MCP Server ↓

TOOL MAP

What Playwright MCP Server exposes to your agents

Read (3) Write / Execute (5) Destructive / Financial (0)

Running more than one server? Check your whole stack →

MOST DANGEROUS TOOLS

High Risk

The most dangerous Playwright MCP Server tools

Execute · High navigate Navigate is an Execute-level tool because it causes the browser to fetch and load arbitrary URLs, which can trigger side effects (network requests, script execution, cookie modifications, third-party interactions). Execute · Medium drag_and_drop This tool performs drag-and-drop browser automation actions, which constitutes executing external browser operations. Execute · Medium mouse_click This tool performs a browser mouse click action at given coordinates. Execute · Low move_mouse This tool performs a browser action (moving the mouse cursor) which is a form of browser automation/execution.

6 of Playwright MCP Server's 9 tools can modify, destroy, or commit something on every call — and an agent calls them with no built-in limits.

POLICY

How to control Playwright MCP Server

PolicyLayer is an MCP gateway — it sits between your AI agents and Playwright MCP Server, and nothing reaches the server without passing your rules. These are the rules we recommend:

Cap read operations

{
  "get_all_content": {
    "limits": [
      {
        "counter": "get_all_content_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

Create a free account and register Playwright MCP Server — nothing to install.
Add these rules — paste them, or build them visually. Tune the limits to your setup.
Point your MCP client (Claude, Cursor, anything) at your gateway URL.

ENFORCE POLICY ON PLAYWRIGHT →

Free to start. No card required.

FULL CATALOGUE

All 9 Playwright MCP Server tools

EXECUTE 5 tools

Execute navigate 指定されたURLにブラウザでアクセスします Execute mouse_wheel マウスホイールのスクロールを実行します Execute drag_and_drop ドラッグアンドドロップ操作を実行します Execute mouse_click 指定された座標でマウスクリックを実行します Execute move_mouse 指定された座標にマウスカーソルを移動します

READ 3 tools

Read get_all_content 現在開いているページのコンテンツを取得し、HTML構造を保持した形式で返します Read get_interactive_elements ページ内のインタラクティブ要素（ボタン、テキストエリア、ラジオボタンなど）の座標と範囲を取得します Read get_visible_content 現在開いているページの表示領域内のコンテンツを取得します

OTHER 1 tools

Other echo 入力されたメッセージをそのまま返します

EXPLORE

Related servers

Other MCP servers with similar tools — same risk classification, starter policies for each.

FAQ

Questions about Playwright MCP Server

Is the Playwright MCP Server MCP server safe to use without restrictions? +

The Playwright MCP Server server is primarily read-only with 3 read tools. While it cannot modify data, an agent in a retry loop can make thousands of API calls per minute, exhausting rate limits and running up costs. Rate limiting is still recommended.

How many tools does the Playwright MCP Server MCP server expose? +

9 tools across 3 categories: Execute, Read, Write. 3 are read-only. 6 can modify, create, or delete data.

How do I enforce a policy on Playwright MCP Server? +

Register the Playwright MCP Server MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.

Enforce policy on every Playwright MCP Server tool call.

Deterministic rules across all 9 Playwright MCP Server tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.

ENFORCE POLICY ON PLAYWRIGHT →

Free to start. No card required.

9 Playwright MCP Server tools catalogued and risk-classified — across an index of 43,000+ MCP servers.