
Security News
Open VSX Unblocks Extension IDs Used in Malware Campaign
Open VSX has removed three extension IDs from its malicious-extension list as the legitimate publishers they impersonated move to claim the names for themselves.
@shiplightai/mcp
Advanced tools
UI automation MCP for agentic development workflows. Lets AI coding agents (Claude Code, Cursor, Windsurf, etc.) verify the UI changes they make — closing the build-verify loop automatically. Every interaction is captured as a human-readable step, producing rerunnable regression tests.
claude mcp add shiplight -e PWDEBUG=console -- npx -y @shiplightai/mcp@latest
Add to your MCP config (e.g., .cursor/mcp.json):
{
"mcpServers": {
"shiplight": {
"command": "npx",
"args": ["-y", "@shiplightai/mcp@latest"]
}
}
}
| Variable | Required | Description |
|---|---|---|
PWDEBUG | Yes | Must be set to console. Enables Playwright semantic locator generation (e.g., getByRole, getByTestId) for action entities. Without this, only XPath locators are available. |
No AI API key is required. Every tool this server exposes is deterministic:
actions are driven by the element indices returned from inspect_page, not by a
model. Your coding agent supplies the intelligence; this server supplies the
browser.
Pass environment variables through your MCP config:
{
"mcpServers": {
"shiplight": {
"command": "npx",
"args": ["-y", "@shiplightai/mcp@latest"],
"env": {
"PWDEBUG": "console"
}
}
}
}
The server resolves environment variables in this order:
.env file in the current working directory where the MCP server startsExisting environment variables are never overridden by .env, so project-local .env values act as a fallback.
Once connected, your AI coding agent can:
locator/xpath/frame_path) you embed into .test.yaml files authored with the shiplightai CLI, for fast, deterministic replay.test.yaml files locallyFAQs
Shiplight MCP server for AI-powered test automation
The npm package @shiplightai/mcp receives a total of 1,358 weekly downloads. As such, @shiplightai/mcp popularity was classified as popular.
We found that @shiplightai/mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Open VSX has removed three extension IDs from its malicious-extension list as the legitimate publishers they impersonated move to claim the names for themselves.

Product
Socket’s PHP and Composer support is now in Beta for all customers, with PHP reachability analysis generally available.

Product
Socket is bringing experimental protection to Firefox, scanning 97,000+ extensions in Mozilla's official directory for malware and risky updates.