# set_cookie

A write tool on the Chrome Devtools MCP server.

Agent View of the PolicyLayer registry record for `set_cookie`. HTML page: https://policylayer.com/tools/benjaminr-chrome-devtools-mcp/set-cookie

## Facts

- Tool: `set_cookie`
- Server: Chrome Devtools (`benjaminr/chrome-devtools-mcp`) — https://policylayer.com/tools/benjaminr-chrome-devtools-mcp.md
- Homepage: https://github.com/benjaminr/chrome-devtools-mcp
- Risk category: Write (Medium risk)
- Registry record: grade F, identity unverified
- Server rate-limited: no
- Parameters: 0
- Recommended policy verdict: Rate-limited

## Example call (MCP tools/call, JSON-RPC 2.0)

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "set_cookie",
    "arguments": {}
  }
}
```

## Why set_cookie is rated Medium

Setting cookies is a reversible Write operation—it creates or modifies browser storage. While not destructive (cookies can be cleared), it has high severity because malicious cookie injection could enable session hijacking, credential theft, or tracking. The context of Chrome DevTools and presence of cookie-clearing functions confirms this is cookie manipulation.

From the tool's own definition: "Tool name 'set_cookie' and sibling tool 'clear_all_cookies' in a Chrome DevTools context indicate cookie manipulation. The function sets cookies, which modifies browser state and stored data."

## Use case

AI agents use set_cookie to create or update resources in Chrome Devtools, usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Chrome Devtools environment.

## Recommended policy (PolicyLayer)

Verdict: **Rate-limited**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Chrome Devtools:

```json
{
  "version": "1",
  "default": "deny",
  "tools": {
    "set_cookie": {
      "limits": [
        {
          "counter": "set_cookie_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}
```

## Other tools on Chrome Devtools (46)

- `clear_all_cookies` — Destructive — https://policylayer.com/tools/benjaminr-chrome-devtools-mcp/clear-all-cookies.md
- `clear_storage_for_origin` — Destructive — https://policylayer.com/tools/benjaminr-chrome-devtools-mcp/clear-storage-for-origin.md
- `clear_console` — Execute — https://policylayer.com/tools/benjaminr-chrome-devtools-mcp/clear-console.md
- `connect_to_browser` — Execute — https://policylayer.com/tools/benjaminr-chrome-devtools-mcp/connect-to-browser.md
- `evaluate_in_all_frames` — Execute — https://policylayer.com/tools/benjaminr-chrome-devtools-mcp/evaluate-in-all-frames.md
- `execute_javascript` — Execute — https://policylayer.com/tools/benjaminr-chrome-devtools-mcp/execute-javascript.md
- `focus_element` — Execute — https://policylayer.com/tools/benjaminr-chrome-devtools-mcp/focus-element.md
- `inspect_console_object` — Execute — https://policylayer.com/tools/benjaminr-chrome-devtools-mcp/inspect-console-object.md
- `navigate_to_url` — Execute — https://policylayer.com/tools/benjaminr-chrome-devtools-mcp/navigate-to-url.md
- `override_storage_quota` — Execute — https://policylayer.com/tools/benjaminr-chrome-devtools-mcp/override-storage-quota.md
- `start_chrome` — Execute — https://policylayer.com/tools/benjaminr-chrome-devtools-mcp/start-chrome.md
- `start_chrome_and_connect` — Execute — https://policylayer.com/tools/benjaminr-chrome-devtools-mcp/start-chrome-and-connect.md
- `start_css_coverage_tracking` — Execute — https://policylayer.com/tools/benjaminr-chrome-devtools-mcp/start-css-coverage-tracking.md
- `track_indexeddb` — Execute — https://policylayer.com/tools/benjaminr-chrome-devtools-mcp/track-indexeddb.md
- `disconnect_from_browser` — Other — https://policylayer.com/tools/benjaminr-chrome-devtools-mcp/disconnect-from-browser.md
- `collect_css_class_names` — Read — https://policylayer.com/tools/benjaminr-chrome-devtools-mcp/collect-css-class-names.md
- `describe_element` — Read — https://policylayer.com/tools/benjaminr-chrome-devtools-mcp/describe-element.md
- `get_all_cookies` — Read — https://policylayer.com/tools/benjaminr-chrome-devtools-mcp/get-all-cookies.md
- `get_background_colors` — Read — https://policylayer.com/tools/benjaminr-chrome-devtools-mcp/get-background-colors.md
- `get_computed_styles` — Read — https://policylayer.com/tools/benjaminr-chrome-devtools-mcp/get-computed-styles.md
- `get_connection_status` — Read — https://policylayer.com/tools/benjaminr-chrome-devtools-mcp/get-connection-status.md
- `get_console_error_summary` — Read — https://policylayer.com/tools/benjaminr-chrome-devtools-mcp/get-console-error-summary.md
- `get_console_logs` — Read — https://policylayer.com/tools/benjaminr-chrome-devtools-mcp/get-console-logs.md
- `get_cookies` — Read — https://policylayer.com/tools/benjaminr-chrome-devtools-mcp/get-cookies.md
- `get_document` — Read — https://policylayer.com/tools/benjaminr-chrome-devtools-mcp/get-document.md
- `get_element_at_position` — Read — https://policylayer.com/tools/benjaminr-chrome-devtools-mcp/get-element-at-position.md
- `get_element_attributes` — Read — https://policylayer.com/tools/benjaminr-chrome-devtools-mcp/get-element-attributes.md
- `get_element_box_model` — Read — https://policylayer.com/tools/benjaminr-chrome-devtools-mcp/get-element-box-model.md
- `get_element_outer_html` — Read — https://policylayer.com/tools/benjaminr-chrome-devtools-mcp/get-element-outer-html.md
- `get_inline_styles` — Read — https://policylayer.com/tools/benjaminr-chrome-devtools-mcp/get-inline-styles.md
- …and 16 more: https://policylayer.com/tools/benjaminr-chrome-devtools-mcp.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=benjaminr-chrome-devtools-mcp · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/benjaminr-chrome-devtools-mcp