High-risk tools in Chrome Devtools

High severity Chrome Devtools MCP Server 18 of 32 tools

18 of the 32 tools in Chrome Devtools are classified as high risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.

Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.

Tools at high risk

click Execute

Clicks on the provided element
click_at Execute

Clicks at the provided coordinates
drag Execute

Drag an element onto another element
emulate Execute

Emulates various features on the selected page.
evaluate_script Execute

Evaluate a JavaScript function inside the currently selected page. Returns the response as JSON, so returned values have to be JSON-serializable.
fill Execute

Type text into a input, text area or select an option from a <select> element.
handle_dialog Execute

If a browser dialog was opened, use this command to handle it
hover Execute

Hover over the provided element
install_extension Execute

Installs a Chrome extension from the given path.
navigate_page Execute

Navigates the currently selected page to a URL.
new_page Execute

Creates a new page
performance_start_trace Execute

Starts a performance trace recording on the selected page. This can be used to look for performance problems and insights to improve the performance of the page. It will also re...
performance_stop_trace Execute

Stops the active performance trace recording on the selected page.
press_key Execute

Press a key or key combination. Use this when other input methods like fill() cannot be used (e.g., keyboard shortcuts, navigation keys, or special key combinations).
reload_extension Execute

Reloads an unpacked Chrome extension by its ID.
resize_page Execute

Resizes the selected page
select_page Execute

Select a page as a context for future tool calls.
wait_for Execute

Wait for the specified text to appear on the selected page.

Attacks that target this class

High-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.

High-risk tools in Chrome Devtools

Tools at high risk

Attacks that target this class

More on Chrome Devtools

Enforce policy on every Chrome Devtools tool call.