chore(deps-dev): bump qs from 6.14.0 to 6.14.1 (#1292)

Requires https://github.com/microsoft/playwright/pull/38626

.github/workflows/publish.yml

@@ -147,49 +147,3 @@ jobs:
            GITHUB_TOKEN: ${{ github.token }}
         run: |
             gh release upload ${{github.event.release.tag_name}} ./extension/playwright-mcp-extension-${{ steps.get-version.outputs.version }}.zip
-
-  publish-release-mcp-registry:
-    if: github.event_name == 'workflow_dispatch'
-    runs-on: ubuntu-latest
-    environment: allow-mcp-registry-publishing
-    permissions:
-      contents: read
-      id-token: write # Needed for GitHub OIDC authentication
-    steps:
-      - uses: actions/checkout@v5
-      - name: Clone MCP Registry and build publisher tool
-        shell: pwsh
-        run: |
-          cd ${{ runner.temp }}
-
-          # Install Microsoft Go
-          go run github.com/microsoft/go-infra/goinstallscript@v1.1.0
-          ./go-install.ps1 -GitHubActionsPath
-
-          # Enable compliant crypto
-          $env:GOEXPERIMENT = "systemcrypto"
-
-          # Clone and build the publisher tool
-          git clone --branch "v1.3.7" https://github.com/modelcontextprotocol/registry
-          cd registry
-          go build -o ${{ runner.temp }}/mcp-publisher ./cmd/publisher
-
-          # show help for the tool to ensure it's working
-          ${{ runner.temp }}/mcp-publisher --help
-      - name: Azure Login via OIDC
-        uses: azure/login@v2
-        with:
-          client-id: ${{ secrets.AZURE_MCP_REGISTRY_CLIENT_ID }}
-          tenant-id: ${{ secrets.AZURE_MCP_REGISTRY_TENANT_ID }}
-          subscription-id: ${{ secrets.AZURE_MCP_REGISTRY_SUBSCRIPTION_ID }}
-      - name: Publish to the MCP Registry
-        shell: pwsh
-        run: |
-          # log in using Key Vault
-          ${{ runner.temp }}/mcp-publisher `
-              login dns azure-key-vault `
-              -vault "${{ secrets.KV_NAME }}" -key "${{ secrets.KV_KEY_NAME }}" `
-              -domain microsoft.com
-
-          # publish the server.json
-          ${{ runner.temp }}/mcp-publisher publish ./.mcp/server.json

.mcp/server.json

@@ -1,22 +0,0 @@
-{
-  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-10-17/server.schema.json",
-  "name": "com.microsoft/playwright-mcp",
-  "title": "Playwright",
-  "description": "Automate web browsers using accessibility trees for testing and data extraction.",
-  "repository": {
-    "url": "https://github.com/microsoft/playwright-mcp",
-    "source": "github"
-  },
-  "websiteUrl": "https://github.com/microsoft/playwright-mcp",
-  "version": "0.0.53",
-  "packages": [
-    {
-      "registryType": "npm",
-      "identifier": "@playwright/mcp",
-      "version": "0.0.53",
-      "transport": {
-        "type": "stdio"
-      }
-    }
-  ]
-}

README.md

@@ -81,6 +81,34 @@ Follow the MCP install [guide](https://modelcontextprotocol.io/quickstart/user),
 
 </details>
 
+<details>
+<summary>Cline</summary>
+
+Follow the instruction in the section [Configuring MCP Servers](https://docs.cline.bot/mcp/configuring-mcp-servers)
+
+**Example: Local Setup**
+
+Add the following to your [`cline_mcp_settings.json`](https://docs.cline.bot/mcp/configuring-mcp-servers#editing-mcp-settings-files) file:
+
+```json
+{
+  "mcpServers": {
+    "playwright": {
+      "type": "stdio",
+      "command": "npx",
+      "timeout": 30,
+      "args": [
+        "-y",
+        "@playwright/mcp@latest"
+      ],
+      "disabled": false
+    }
+  }
+}
+```
+
+</details>
+
 <details>
 <summary>Codex</summary>
 
@@ -308,6 +336,14 @@ Playwright MCP server supports following arguments. They can be provided in the
                                         Important: *does not* serve as a
                                         security boundary and *does not* affect
                                         redirects.
+  --allow-unrestricted-file-access      allow access to files outside of the
+                                        workspace roots. Also allows
+                                        unrestricted access to file:// URLs. By
+                                        default access to file system is
+                                        restricted to workspace root directories
+                                        (or cwd if no roots are configured)
+                                        only, and navigation to file:// URLs is
+                                        blocked.
   --blocked-origins <origins>           semicolon-separated list of origins to
                                         block the browser from requesting.
                                         Blocklist is evaluated before allowlist.
@@ -540,6 +576,11 @@ npx @playwright/mcp@latest --config path/to/config.json
      */
     cdpHeaders?: Record<string, string>;
 
+    /**
+     * Timeout in milliseconds for connecting to CDP endpoint. Defaults to 30000 (30 seconds). Pass 0 to disable timeout.
+     */
+    cdpTimeout?: number;
+
     /**
      * Remote endpoint to connect to an existing Playwright server.
      */
@@ -665,6 +706,12 @@ npx @playwright/mcp@latest --config path/to/config.json
      */
     mode?: 'incremental' | 'full' | 'none';
   }
+
+  /**
+   * Whether to allow file uploads from anywhere on the file system.
+   * By default (false), file uploads are restricted to paths within the MCP roots only.
+   */
+  allowUnrestrictedFileAccess?: boolean;
 }
 ```
 

config.d.ts

@@ -64,6 +64,11 @@ export type Config = {
      */
     cdpHeaders?: Record<string, string>;
 
+    /**
+     * Timeout in milliseconds for connecting to CDP endpoint. Defaults to 30000 (30 seconds). Pass 0 to disable timeout.
+     */
+    cdpTimeout?: number;
+
     /**
      * Remote endpoint to connect to an existing Playwright server.
      */
@@ -189,4 +194,10 @@ export type Config = {
      */
     mode?: 'incremental' | 'full' | 'none';
   }
+
+  /**
+   * Whether to allow file uploads from anywhere on the file system.
+   * By default (false), file uploads are restricted to paths within the MCP roots only.
+   */
+  allowUnrestrictedFileAccess?: boolean;
 };

extension/manifest.json

@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "Playwright MCP Bridge",
-  "version": "0.0.53",
+  "version": "0.0.56",
   "description": "Share browser tabs with Playwright MCP server",
   "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA9nMS2b0WCohjVHPGb8D9qAdkbIngDqoAjTeSccHJijgcONejge+OJxOQOMLu7b0ovt1c9BiEJa5JcpM+EHFVGL1vluBxK71zmBy1m2f9vZF3HG0LSCp7YRkum9rAIEthDwbkxx6XTvpmAY5rjFa/NON6b9Hlbo+8peUSkoOK7HTwYnnI36asZ9eUTiveIf+DMPLojW2UX33vDWG2UKvMVDewzclb4+uLxAYshY7Mx8we/b44xu+Anb/EBLKjOPk9Yh541xJ5Ozc8EiP/5yxOp9c/lRiYUHaRW+4r0HKZyFt0eZ52ti2iM4Nfk7jRXR7an3JPsUIf5deC/1cVM/+1ZQIDAQAB",
   "permissions": [

extension/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@playwright/mcp-extension",
-  "version": "0.0.53",
+  "version": "0.0.56",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@playwright/mcp-extension",
-      "version": "0.0.53",
+      "version": "0.0.56",
       "license": "Apache-2.0",
       "devDependencies": {
         "@types/chrome": "^0.0.315",

extension/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@playwright/mcp-extension",
-  "version": "0.0.53",
+  "version": "0.0.56",
   "description": "Playwright MCP Browser Extension",
   "private": true,
   "repository": {

extension/src/ui/connect.tsx

@@ -44,8 +44,18 @@ const ConnectApp: React.FC = () => {
       const relayUrl = params.get('mcpRelayUrl');
 
       if (!relayUrl) {
-        setShowButtons(false);
-        setStatus({ type: 'error', message: 'Missing mcpRelayUrl parameter in URL.' });
+        handleReject('Missing mcpRelayUrl parameter in URL.');
+        return;
+      }
+
+      try {
+        const host = new URL(relayUrl).hostname;
+        if (host !== '127.0.0.1' && host !== '[::1]') {
+          handleReject(`MCP extension only allows loopback connections (127.0.0.1 or [::1]). Received host: ${host}`);
+          return;
+        }
+      } catch (e) {
+        handleReject(`Invalid mcpRelayUrl parameter in URL: ${relayUrl}. ${e}`);
         return;
       }
 

package-lock.json

@@ -1,23 +1,23 @@
 {
   "name": "@playwright/mcp",
-  "version": "0.0.53",
+  "version": "0.0.56",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@playwright/mcp",
-      "version": "0.0.53",
+      "version": "0.0.56",
       "license": "Apache-2.0",
       "dependencies": {
-        "playwright": "1.58.0-alpha-1766189059000",
-        "playwright-core": "1.58.0-alpha-1766189059000"
+        "playwright": "1.58.0-alpha-2026-01-16",
+        "playwright-core": "1.58.0-alpha-2026-01-16"
       },
       "bin": {
         "mcp-server-playwright": "cli.js"
       },
       "devDependencies": {
         "@modelcontextprotocol/sdk": "^1.24.0",
-        "@playwright/test": "1.58.0-alpha-1766189059000",
+        "@playwright/test": "1.58.0-alpha-2026-01-16",
         "@types/node": "^24.3.0"
       },
       "engines": {
@@ -63,13 +63,13 @@
       }
     },
     "node_modules/@playwright/test": {
-      "version": "1.58.0-alpha-1766189059000",
-      "resolved": "https://registry.npmjs.org/@playwright/test/-/test-1.58.0-alpha-1766189059000.tgz",
-      "integrity": "sha512-op1/OXuSTm7H0v0vpGtWjLylW3fchuX9TZAPvR+m2QrVKMrqfu17Bzu/l5eMCvIGyJfNqe7JTZuB2Jou9v1EDg==",
+      "version": "1.58.0-alpha-2026-01-16",
+      "resolved": "https://registry.npmjs.org/@playwright/test/-/test-1.58.0-alpha-2026-01-16.tgz",
+      "integrity": "sha512-zhOc7QhE1FcIFUa1GNzs30phACtSLOgObjiz1GJSAcfp1OetskyjvspJPgHxrHggWphkQaj8IYoDe4y03rd6eg==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
-        "playwright": "1.58.0-alpha-1766189059000"
+        "playwright": "1.58.0-alpha-2026-01-16"
       },
       "bin": {
         "playwright": "cli.js"
@@ -884,12 +884,12 @@
       }
     },
     "node_modules/playwright": {
-      "version": "1.58.0-alpha-1766189059000",
-      "resolved": "https://registry.npmjs.org/playwright/-/playwright-1.58.0-alpha-1766189059000.tgz",
-      "integrity": "sha512-h6yaIbcmyla/fh9jvvRBgVRMgwSmloKnCR4NDnVV18vqi1i5F4xqe3tGtgwHmkah9CJdQhhbZlTBIkY73q6+Xw==",
+      "version": "1.58.0-alpha-2026-01-16",
+      "resolved": "https://registry.npmjs.org/playwright/-/playwright-1.58.0-alpha-2026-01-16.tgz",
+      "integrity": "sha512-Ix0VALX+fNrXICSNnrfsvTMch0LA3WdVY8q71ReQzQ+UF0lCK9YbtRwBz65BJLBsWE1j38vBLR+YYE93MezYZA==",
       "license": "Apache-2.0",
       "dependencies": {
-        "playwright-core": "1.58.0-alpha-1766189059000"
+        "playwright-core": "1.58.0-alpha-2026-01-16"
       },
       "bin": {
         "playwright": "cli.js"
@@ -902,9 +902,9 @@
       }
     },
     "node_modules/playwright-core": {
-      "version": "1.58.0-alpha-1766189059000",
-      "resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.58.0-alpha-1766189059000.tgz",
-      "integrity": "sha512-TzOav4UONfbqB0U1I75RrcvOGdJ1icVam2/lje1Lok/D9lX9iJjBLGB4FqNgFqaIgeOqI1hpHY8nMfA82JqJtg==",
+      "version": "1.58.0-alpha-2026-01-16",
+      "resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.58.0-alpha-2026-01-16.tgz",
+      "integrity": "sha512-r3XM/xwmyoKLgHI8+ooCoKaRv8mch39UoHyLfWSols6GB2H9Lx3JhvhzRep+rYBYk+GDj0222GKuwg1PnVF8zA==",
       "license": "Apache-2.0",
       "bin": {
         "playwright-core": "cli.js"
@@ -928,9 +928,9 @@
       }
     },
     "node_modules/qs": {
-      "version": "6.14.0",
-      "resolved": "https://registry.npmjs.org/qs/-/qs-6.14.0.tgz",
-      "integrity": "sha512-YWWTjgABSKcvs/nWBi9PycY/JiPJqOD4JA6o9Sej2AtvSGarXxKC3OQSk4pAarbdQlKAh5D4FCQkJNkW+GAn3w==",
+      "version": "6.14.1",
+      "resolved": "https://registry.npmjs.org/qs/-/qs-6.14.1.tgz",
+      "integrity": "sha512-4EK3+xJl8Ts67nLYNwqw/dsFVnCf+qR7RgXSK9jEEm9unao3njwMDdmsdvoKBKHzxd7tCYz5e5M+SnMjdtXGQQ==",
       "dev": true,
       "license": "BSD-3-Clause",
       "dependencies": {

package.json

@@ -1,8 +1,7 @@
 {
   "name": "@playwright/mcp",
-  "version": "0.0.53",
+  "version": "0.0.56",
   "description": "Playwright Tools for MCP",
-  "mcpName": "com.microsoft/playwright-mcp",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/microsoft/playwright-mcp.git"
@@ -38,15 +37,15 @@
     }
   },
   "dependencies": {
-    "playwright": "1.58.0-alpha-1766189059000",
-    "playwright-core": "1.58.0-alpha-1766189059000"
+    "playwright": "1.58.0-alpha-2026-01-16",
+    "playwright-core": "1.58.0-alpha-2026-01-16"
   },
   "bin": {
     "mcp-server-playwright": "cli.js"
   },
   "devDependencies": {
     "@modelcontextprotocol/sdk": "^1.24.0",
-    "@playwright/test": "1.58.0-alpha-1766189059000",
+    "@playwright/test": "1.58.0-alpha-2026-01-16",
     "@types/node": "^24.3.0"
   }
 }

src/README.md

@@ -1,3 +1,3 @@
 # Where is the source?
 
-Playwright MCP source code is located in the Playwright monorepo. Please refer to the contributor's guide in [CONTRIBUTING.md](../CONTRIBUTING.md) for more details.
+Playwright MCP source code is located in the [Playwright monorepo](https://github.com/microsoft/playwright/blob/main/packages/playwright/src/mcp). Please refer to the contributor's guide in [CONTRIBUTING.md](../CONTRIBUTING.md) for more details.