browser_set_storage_state

What browser_set_storage_state does on Playwright

AI agents use browser_set_storage_state to create or update resources in Playwright, usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Playwright environment.

Why browser_set_storage_state is rated Medium

Setting storage state modifies browser data that persists and affects subsequent page behavior. While reversible (storage can be cleared/overwritten), this is a write operation that could be misused to inject malicious data, forge authentication tokens, or manipulate session state. Not destructive (data is not irreversibly deleted), not financial, and not execute (though effects depend on what data is stored).

From the tool's definition Tool name 'browser_set_storage_state' indicates modification of browser storage state (localStorage, sessionStorage, etc.). Empty description limits evidence, but naming pattern aligns with sibling cookie/storage management tools like browser_cookie_set.

The rule that runs browser_set_storage_state safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Playwright, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For browser_set_storage_state, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "browser_set_storage_state": {
      "limits": [
        {
          "counter": "browser_set_storage_state_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}

Questions about browser_set_storage_state