
Security News
OWASP 2025 Top 10 Adds Software Supply Chain Failures, Ranked Top Community Concern
OWASP’s 2025 Top 10 introduces Software Supply Chain Failures as a new category, reflecting rising concern over dependency and build system risks.
simple-playwright-mcp
Advanced tools

A powerful Model Context Protocol (MCP) server that provides browser automation capabilities using Playwright. This server enables AI assistants like Claude/Cursor/ChatGPT to interact with web pages, extract content, take screenshots, and execute custom browser automation scripts.
This package minimizes the amount of tools to help AI Agents pick the right tool for a given prompt.
For detailed information about available tools, see tools.md.
Configure the server behavior using environment variables:
| Variable | Description | Default | Options |
|---|---|---|---|
PLAYWRIGHT_HEADLESS | Run browser in headless mode | true | true, false |
BROWSER_TYPE | Browser engine to use | chromium | chromium, firefox, webkit |
SCREENSHOT_DIR | Directory for saving screenshots | ./screenshots | Any valid path |
PORT | HTTP server port | 4201 | Any valid port number |
MCP_AUTH_TOKEN | Authentication token for HTTP server (optional) | None | Any string |
RETURN_SCREENSHOTS | Return base64 screenshot data to agent | false | true, false |
To use this server with Cursor/Claude Code/Claude Desktop, add it to your MCP settings file.
Configuration:
{
"mcpServers": {
"playwright": {
"command": "npx",
"args": [
"simple-playwright-mcp"
],
"env": {
"PLAYWRIGHT_HEADLESS": "false",
"BROWSER_TYPE": "chromium",
"SCREENSHOT_DIR": "/Users/yourname/projects/playwright-mcp/screenshots",
"RETURN_SCREENSHOTS": "false"
}
}
}
}
Note: After updating the configuration, restart Claude Code/Desktop for changes to take effect.
Start the HTTP server:
npm install
npm start
# or with custom port
PORT=4201 npm start
# With authentication (recommended)
MCP_AUTH_TOKEN=your-secret-token npm start
The server will listen on http://localhost:4201/mcp (or your custom port).
Authentication (Optional):
You can secure the HTTP server with token-based authentication by setting the MCP_AUTH_TOKEN environment variable. If set, all requests must include the token in the Authorization header.
Example HTTP Request (with authentication):
curl -X POST http://localhost:4201/mcp \
-H "Content-Type: application/json" \
-H "Authorization: Bearer your-secret-token" \
-d '{
"jsonrpc": "2.0",
"id": 1,
"method": "tools/call",
"params": {
"name": "navigate",
"arguments": {
"url": "https://example.com"
}
}
}'
npm install
# Start HTTP server with auto-reload
npm run dev
# Start stdio server with auto-reload
npm run dev:stdio
# Build TypeScript to JavaScript
npm run build
# Install Playwright browsers
npm run install-browsers
1. Node.js version too old
Error: Playwright requires Node.js 18 or higher
Solution: Update Node.js to version 18 or higher.
2. Browser not installed
Error: Executable doesn't exist at /path/to/browser
Solution: Run npm run install-browsers
3. Permission denied (Claude Code)
Error: EACCES: permission denied
Solution: Ensure the script has execute permissions and use absolute paths in configuration.
4. Port already in use (HTTP mode)
Error: listen EADDRINUSE: address already in use :::4201
Solution: Change the port with PORT=4201 npm start
For stdio mode, logs are written to stderr and appear in Claude Code logs:
~/Library/Logs/Claude/mcp-server-playwright.log~/.config/Claude/logs/mcp-server-playwright.logFor HTTP mode, logs appear in the terminal where you started the server.
Contributions are welcome! Please:
npm run build to ensure it compilesMIT
Built with:
FAQs
n8n MCP server with Playwright browser automation capabilities
We found that simple-playwright-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OWASP’s 2025 Top 10 introduces Software Supply Chain Failures as a new category, reflecting rising concern over dependency and build system risks.

Research
/Security News
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.

Security News
Socket CTO Ahmad Nassri discusses why supply chain attacks now target developer machines and what AI means for the future of enterprise security.