browser_run_code

What browser_run_code does on Playwright MCP

AI agents invoke browser_run_code to trigger actions in Playwright MCP. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call: builds kicked off, notifications sent, workflows started.

Why browser_run_code is rated High

A tool that runs code ('browser_run_code') in a browser context can execute arbitrary JavaScript, access DOM, trigger network requests, steal cookies/credentials, inject malware, or perform any action the browser permits. This is Execute rather than Write because its effects are not limited to data modification—they depend entirely on the code argument and can trigger arbitrary side effects.

From the tool's definition Tool name 'browser_run_code' indicates execution of arbitrary code in browser context. Description is empty, but the name combined with sibling tools like 'browser_evaluate' and the server's stated capability to 'interact with web pages' and 'execute'…

The rule that runs browser_run_code safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Playwright MCP, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For browser_run_code, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "browser_run_code": {
      "limits": [
        {
          "counter": "browser_run_code_rate",
          "window": "minute",
          "max": 10,
          "scope": "grant"
        }
      ]
    }
  }
}

Questions about browser_run_code