browser_cookie_set

What browser_cookie_set does on Playwright MCP

AI agents use browser_cookie_set to create or update resources in Playwright MCP, usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Playwright MCP environment.

Why browser_cookie_set is rated Medium

Setting cookies is a reversible modification operation that affects browser state and can influence web application behavior, session management, and authentication. While not destructive (cookies can be cleared), it modifies data and could be exploited to hijack sessions, manipulate authentication state, or inject malicious session data. Severity is high due to potential for session/authentication abuse.

From the tool's definition Tool name 'browser_cookie_set' indicates it sets/modifies browser cookies. Sibling tools 'browser_cookie_delete', 'browser_cookie_get', 'browser_cookie_list' confirm a cookie management suite. The naming pattern shows this is a Write operation (create/modify).

The rule that runs browser_cookie_set safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Playwright MCP, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For browser_cookie_set, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "browser_cookie_set": {
      "limits": [
        {
          "counter": "browser_cookie_set_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}

Questions about browser_cookie_set