Our grade: 4 checks
Based on public data, not a full audit. See how we grade. Something changed? Request a re-grade.
Community rating
- 5 0
- 4 5
- 3 5
- 2 4
- 1 0
Trust in production
- Trust it - 0%
- With caveats - 57%
- Wouldn't - 43%
43% would recommend this server
How reviewers scored it
- Setup & docs 3.0
- Auth experience 2.5
- Reliability 2.9
- Maintainer responsiveness 3.8
Why it got a C
First-party and actively maintained. A 2025 DNS-rebinding flaw (CVE-2025-9611) was fixed before it was even reported. Biggest deduction: by default it gives the model a tool that runs arbitrary code on your machine (its README calls it "RCE-equivalent"), and HTTP mode has no authentication or TLS, so a prompt injection from any page it visits can become code execution. The README itself says it is not a security boundary: run it in a container with no credentials.
How to connect
npx -y @playwright/mcp@latestIs Playwright MCP safe?
Is Playwright MCP safe to use?
Playwright MCP grades C (usable with care). There is no login: anything that can start or reach it gets its full access. It can run model-controlled code or uses a plaintext remote connection, so run it isolated with no credentials.
Does Playwright MCP have known vulnerabilities?
Not in our current data: it has no open CVEs or advisories. We re-check as new ones are published.
Does Playwright MCP support authentication?
No. It has no login of its own, so limit who and what can start it.
Alternatives in Browser & Web Automation
- A Apify MCP ServerOfficial Apify server to find and run thousands of ready-made scrapers and automation Actors, then read their results.
- C BrowserTools MCPGive your coding agent the console logs, network requests, screenshots and Lighthouse audits from the Chrome tab you already have open.
- C Chrome DevTools MCPLet an agent drive and debug a live Chrome with DevTools, including performance traces, network, console, screenshots, and scripts.
- C browser-use MCPLLM-oriented browser automation with a high-level action API.
Embed this badge
[](https://trustedmcp.io/servers/playwright-mcp)<a href="https://trustedmcp.io/servers/playwright-mcp"><img src="https://trustedmcp.io/badge/playwright-mcp.svg" alt="TrustedMCP grade C" height="80"></a>Community reviews
Quietly reliable
Started with it as an experiment, now it is a fixture. Nice that it supports both stdio and HTTP, I use stdio locally and HTTP for the shared agent. No access control at all, it runs with my permissions. Fine on my laptop, not on a shared box. Keep permissions tight and it is a good tool.
Used for Visual regression checks
- Setup & docs 3/5
- Auth experience 3/5
- Reliability 4/5
- Maintainer responsiveness 4/5
Would not run this unattended
It works in a demo, but things got shaky under real use. Anything it pulls in I treat as untrusted, prompt injection through content is a real risk here. There is no auth layer, so whatever can reach it can use it. I keep it local only. Updates land regularly, and nothing broke when I upgraded.
Used for Filling repetitive web forms
- Setup & docs 2/5
- Auth experience 2/5
- Reliability 2/5
- Maintainer responsiveness 2/5
Not ready for anything that matters
Gave it a fair shot over two weeks. Releases come often and the changelog is clear. Not something I would put in production yet.
Used for Collecting screenshots for bug reports
- Setup & docs 1/5
- Auth experience 1/5
- Reliability 1/5
- Maintainer responsiveness 3/5
Too much access for my comfort
Ran into problems pretty quickly. There is no auth layer, so whatever can reach it can use it. I keep it local only.
Used for End-to-end test runs against staging
- Setup & docs 2/5
- Auth experience 2/5
- Reliability 2/5
- Maintainer responsiveness 3/5
Great tool, needs a sandbox
First-party and well maintained. But it runs a real browser with your network access — an injected instruction in page content can navigate anywhere. We run it containerised against an origin allowlist. With that in place it is excellent.
Used for Agent driving end-to-end checkout tests against staging
- Setup & docs 4/5
- Auth experience 3/5
- Reliability 4/5
- Maintainer responsiveness 4/5
Recommended it to two teams already
Set this up for our team after comparing a few options. Filed an issue and got a reply within two days. It drives a real browser, so I give it a separate profile with no saved logins. No access control at all, it runs with my permissions. Fine on my laptop, not on a shared box. I would use it in prod, but only with a human approving writes.
Used for QA smoke tests after deploys
- Setup & docs 3/5
- Auth experience 2/5
- Reliability 4/5
- Maintainer responsiveness 4/5
Fine once configured properly
It does the job, but it took some tweaking. Watch out for instructions hidden in the data it reads. I review actions before approving them.
Used for Monitoring a competitor changelog
- Setup & docs 2/5
- Auth experience 4/5
- Reliability 3/5
- Maintainer responsiveness 4/5
Powerful enough to scare me off unattended use
Works fine interactively. I would not put this on an unattended agent that touches anything authenticated — the blast radius of full browser control plus page-driven navigation is too big for my comfort.
Used for Tried it for scraping competitor pricing
- Setup & docs 4/5
- Auth experience 2/5
- Reliability 3/5
- Maintainer responsiveness 4/5
Earned a permanent spot in my config
Tried it on a side project first, then rolled it out at work. You can tell it is actively maintained, the rough edges keep getting fixed. Nothing stops a misbehaving agent from using every tool it exposes, so I trimmed the tool list. Worth it, just do not skip the hardening steps.
Used for Visual regression checks
- Setup & docs 5/5
- Auth experience 3/5
- Reliability 3/5
- Maintainer responsiveness 4/5
Mixed feelings after two weeks
Useful tool, though I would not hand it to a junior unsupervised. Nice that it supports both stdio and HTTP, I use stdio locally and HTTP for the shared agent. There is no auth layer, so whatever can reach it can use it. I keep it local only.
Used for End-to-end test runs against staging
- Setup & docs 3/5
- Auth experience 3/5
- Reliability 3/5
- Maintainer responsiveness 4/5
Our team uses it every day
Replaced a homegrown script with Playwright MCP and have not looked back. No access control at all, it runs with my permissions. Fine on my laptop, not on a shared box. Anything it pulls in I treat as untrusted, prompt injection through content is a real risk here. Worth it, just do not skip the hardening steps.
Used for Filling repetitive web forms
- Setup & docs 4/5
- Auth experience 3/5
- Reliability 4/5
- Maintainer responsiveness 5/5
Needs more maintenance love
Setup was rough and the result was flaky. No access control at all, it runs with my permissions. Fine on my laptop, not on a shared box. Updates land regularly, and nothing broke when I upgraded.
Used for Research agent browsing documentation
- Setup & docs 3/5
- Auth experience 2/5
- Reliability 2/5
- Maintainer responsiveness 3/5
Solid core, fiddly setup
Works well enough for what I need. It drives a real browser, so I give it a separate profile with no saved logins. Nothing stops a misbehaving agent from using every tool it exposes, so I trimmed the tool list. Fine in production if you sandbox it.
Used for Scraping public pricing pages
- Setup & docs 3/5
- Auth experience 3/5
- Reliability 3/5
- Maintainer responsiveness 5/5
Useful, with a few rough edges
Some tools are great, a couple feel half finished. There is no auth layer, so whatever can reach it can use it. I keep it local only. Nice that it supports both stdio and HTTP, I use stdio locally and HTTP for the shared agent. Filed an issue and got a reply within two days. Recommended, with sensible guardrails.
Used for Scraping public pricing pages
- Setup & docs 3/5
- Auth experience 2/5
- Reliability 2/5
- Maintainer responsiveness 4/5
Write a review
Ran this server? Tell other teams how it went. You get one review per server. We email you a link to confirm it, then an editor checks it before it goes up. We never show your email.