feat(package): add mcpName field for MCP Registry ownership verification (#1432 )

docs: not a security boundary section (#1435 )
Revert "docs: fix PLAYWRIGHT_MCP_ALLOWED_HOSTS env var name (#1414 )" (#1440 )
2026-03-18 23:13:09 +00:00 · 2026-03-09 15:37:44 -07:00 · 2026-03-04 18:38:40 -08:00 · 2026-03-04 17:13:40 -08:00 · 2026-03-04 17:05:26 -08:00 · 2026-03-04 17:05:05 -08:00
7 changed files with 63 additions and 34 deletions
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -6,6 +6,10 @@ on:
  pull_request:
    branches: [ main ]

+env:
+  PWMCP_DEBUG: '1'
+  PWDEBUGIMPL: '1'
+
 jobs:
  lint:
    runs-on: ubuntu-latest
--- a/README.md
+++ b/README.md
@@ -72,6 +72,26 @@ amp mcp add playwright -- npx @playwright/mcp@latest

 </details>

+<details>
+<summary>Antigravity</summary>
+
+Add via the Antigravity settings or by updating your configuration file:
+
+```json
+{
+  "mcpServers": {
+    "playwright": {
+      "command": "npx",
+      "args": [
+        "@playwright/mcp@latest"
+      ]
+    }
+  }
+}
+```
+
+</details>
+
 <details>
 <summary>Claude Code</summary>

@@ -344,8 +364,6 @@ Playwright MCP server supports following arguments. They can be provided in the
 | --cdp-endpoint <endpoint> | CDP endpoint to connect to.<br>*env* `PLAYWRIGHT_MCP_CDP_ENDPOINT` |
 | --cdp-header <headers...> | CDP headers to send with the connect request, multiple can be specified.<br>*env* `PLAYWRIGHT_MCP_CDP_HEADER` |
 | --cdp-timeout <timeout> | timeout in milliseconds for connecting to CDP endpoint, defaults to 30000ms<br>*env* `PLAYWRIGHT_MCP_CDP_TIMEOUT` |
-| --chromium-sandbox | enable the chromium sandbox. disable with --no-chromium-sandbox.<br>*env* `PLAYWRIGHT_MCP_CHROMIUM_SANDBOX` |
-| --no-chromium-sandbox | disable the chromium sandbox.<br>*env* `PLAYWRIGHT_MCP_NO_CHROMIUM_SANDBOX` |
 | --codegen <lang> | specify the language to use for code generation, possible values: "typescript", "none". Default is "typescript".<br>*env* `PLAYWRIGHT_MCP_CODEGEN` |
 | --config <path> | path to the configuration file.<br>*env* `PLAYWRIGHT_MCP_CONFIG` |
 | --console-level <level> | level of console messages to return: "error", "warning", "info", "debug". Each level includes the messages of more severe levels.<br>*env* `PLAYWRIGHT_MCP_CONSOLE_LEVEL` |
@@ -360,11 +378,13 @@ Playwright MCP server supports following arguments. They can be provided in the
 | --init-script <path...> | path to JavaScript file to add as an initialization script. The script will be evaluated in every page before any of the page's scripts. Can be specified multiple times.<br>*env* `PLAYWRIGHT_MCP_INIT_SCRIPT` |
 | --isolated | keep the browser profile in memory, do not save it to disk.<br>*env* `PLAYWRIGHT_MCP_ISOLATED` |
 | --image-responses <mode> | whether to send image responses to the client. Can be "allow" or "omit", Defaults to "allow".<br>*env* `PLAYWRIGHT_MCP_IMAGE_RESPONSES` |
+| --no-sandbox | disable the sandbox for all process types that are normally sandboxed.<br>*env* `PLAYWRIGHT_MCP_NO_SANDBOX` |
 | --output-dir <path> | path to the directory for output files.<br>*env* `PLAYWRIGHT_MCP_OUTPUT_DIR` |
 | --output-mode <mode> | whether to save snapshots, console messages, network logs to a file or to the standard output. Can be "file" or "stdout". Default is "stdout".<br>*env* `PLAYWRIGHT_MCP_OUTPUT_MODE` |
 | --port <port> | port to listen on for SSE transport.<br>*env* `PLAYWRIGHT_MCP_PORT` |
 | --proxy-bypass <bypass> | comma-separated domains to bypass proxy, for example ".com,chromium.org,.domain.com"<br>*env* `PLAYWRIGHT_MCP_PROXY_BYPASS` |
 | --proxy-server <proxy> | specify proxy server, for example "http://myproxy:3128" or "socks5://myproxy:8080"<br>*env* `PLAYWRIGHT_MCP_PROXY_SERVER` |
+| --sandbox | enable the sandbox for all process types that are normally not sandboxed.<br>*env* `PLAYWRIGHT_MCP_SANDBOX` |
 | --save-session | Whether to save the Playwright MCP session into the output directory.<br>*env* `PLAYWRIGHT_MCP_SAVE_SESSION` |
 | --save-trace | Whether to save the Playwright Trace of the session into the output directory.<br>*env* `PLAYWRIGHT_MCP_SAVE_TRACE` |
 | --save-video <size> | Whether to save the video of the session into the output directory. For example "--save-video=800x600"<br>*env* `PLAYWRIGHT_MCP_SAVE_VIDEO` |
@@ -707,6 +727,10 @@ And then in MCP client config, set the `url` to the HTTP endpoint:
 }
 ```

+## Security
+
+Playwright MCP is **not** a security boundary. See [MCP Security Best Practices](https://modelcontextprotocol.io/docs/tutorials/security/security_best_practices) for guidance on securing your deployment.
+
 <details>
 <summary><b>Docker</b></summary>

@@ -731,7 +755,7 @@ docker run -d -i --rm --init --pull=always \
  --name playwright \
  -p 8931:8931 \
  mcr.microsoft.com/playwright/mcp \
-  cli.js --headless --browser chromium --no-sandbox --port 8931
+  cli.js --headless --browser chromium --no-sandbox --port 8931 --host 0.0.0.0
 ```

 The server will listen on host port **8931** and can be reached by any MCP client.  
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,19 +1,19 @@
 {
  "name": "playwright-mcp-internal",
-  "version": "0.0.67",
+  "version": "0.0.68",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "playwright-mcp-internal",
-      "version": "0.0.67",
+      "version": "0.0.68",
      "license": "Apache-2.0",
      "workspaces": [
        "packages/*"
      ],
      "devDependencies": {
        "@modelcontextprotocol/sdk": "^1.25.2",
-        "@playwright/test": "1.59.0-alpha-1771028105000",
+        "@playwright/test": "1.59.0-alpha-1771104257000",
        "@types/node": "^24.3.0"
      }
    },
@@ -742,9 +742,9 @@
      }
    },
    "node_modules/@hono/node-server": {
-      "version": "1.19.9",
-      "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-1.19.9.tgz",
-      "integrity": "sha512-vHL6w3ecZsky+8P5MD+eFfaGTyCeOHUIFYMGpQGbrBTSmNNoxv0if69rEZ5giu36weC5saFuznL411gRX7bJDw==",
+      "version": "1.19.10",
+      "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-1.19.10.tgz",
+      "integrity": "sha512-hZ7nOssGqRgyV3FVVQdfi+U4q02uB23bpnYpdvNXkYTRRyWx84b7yf1ans+dnJ/7h41sGL3CeQTfO+ZGxuO+Iw==",
      "dev": true,
      "license": "MIT",
      "engines": {
@@ -854,13 +854,13 @@
      "link": true
    },
    "node_modules/@playwright/test": {
-      "version": "1.59.0-alpha-1771028105000",
-      "resolved": "https://registry.npmjs.org/@playwright/test/-/test-1.59.0-alpha-1771028105000.tgz",
-      "integrity": "sha512-chMidCR7qg6ExeTrYP3isJ5fzIgD0bXldX4aQo1vVWPb0su5xJL0UcA5hD1qsmuP1dkUlkI4Qf2wfuxuCfxdyg==",
+      "version": "1.59.0-alpha-1771104257000",
+      "resolved": "https://registry.npmjs.org/@playwright/test/-/test-1.59.0-alpha-1771104257000.tgz",
+      "integrity": "sha512-0zUPgLuSbyO2xtA+FdEWejFpA5tYU1dINMj2D6KGbB7dgxW8V/4bOrpYS38hizSrzpdSiuRcIK7UgiNFxEeK3A==",
      "dev": true,
      "license": "Apache-2.0",
      "dependencies": {
-        "playwright": "1.59.0-alpha-1771028105000"
+        "playwright": "1.59.0-alpha-1771104257000"
      },
      "bin": {
        "playwright": "cli.js"
@@ -2168,9 +2168,9 @@
      }
    },
    "node_modules/hono": {
-      "version": "4.11.8",
-      "resolved": "https://registry.npmjs.org/hono/-/hono-4.11.8.tgz",
-      "integrity": "sha512-eVkB/CYCCei7K2WElZW9yYQFWssG0DhaDhVvr7wy5jJ22K+ck8fWW0EsLpB0sITUTvPnc97+rrbQqIr5iqiy9Q==",
+      "version": "4.12.5",
+      "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.5.tgz",
+      "integrity": "sha512-3qq+FUBtlTHhtYxbxheZgY8NIFnkkC/MR8u5TTsr7YZ3wixryQ3cCwn3iZbg8p8B88iDBBAYSfZDS75t8MN7Vg==",
      "dev": true,
      "license": "MIT",
      "engines": {
@@ -2626,12 +2626,12 @@
      }
    },
    "node_modules/playwright": {
-      "version": "1.59.0-alpha-1771028105000",
-      "resolved": "https://registry.npmjs.org/playwright/-/playwright-1.59.0-alpha-1771028105000.tgz",
-      "integrity": "sha512-tSRYmBZlJt32Q0CKNlVyavvobXt+P7kFUJN+ak9wkcUo+hRSHqyAUcp6G9pRG/vilraanrS6gmAIs3cjUwwxhA==",
+      "version": "1.59.0-alpha-1771104257000",
+      "resolved": "https://registry.npmjs.org/playwright/-/playwright-1.59.0-alpha-1771104257000.tgz",
+      "integrity": "sha512-6SCMMMJaDRsSqiKVLmb2nhtLES7iTYawTWWrQK6UdIGNzXi8lka4sLKRec3L4DnTWwddAvCuRn8035dhNiHzbg==",
      "license": "Apache-2.0",
      "dependencies": {
-        "playwright-core": "1.59.0-alpha-1771028105000"
+        "playwright-core": "1.59.0-alpha-1771104257000"
      },
      "bin": {
        "playwright": "cli.js"
@@ -2648,9 +2648,9 @@
      "link": true
    },
    "node_modules/playwright-core": {
-      "version": "1.59.0-alpha-1771028105000",
-      "resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.59.0-alpha-1771028105000.tgz",
-      "integrity": "sha512-yEIjYyIGSWw8cuaw1hSkAQ+1EBQSdYW2RaHOgHLVAKW8iw7gs8tpY9Wr/75oGazhohRyZNNDom41SO7ktuTUcA==",
+      "version": "1.59.0-alpha-1771104257000",
+      "resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.59.0-alpha-1771104257000.tgz",
+      "integrity": "sha512-YiXup3pnpQUCBMSIW5zx8CErwRx4K6O5Kojkw2BzJui8MazoMUDU6E3xGsb1kzFviEAE09LFQ+y1a0RhIJQ5SA==",
      "license": "Apache-2.0",
      "bin": {
        "playwright-core": "cli.js"
@@ -3420,7 +3420,7 @@
    },
    "packages/extension": {
      "name": "@playwright/mcp-extension",
-      "version": "0.0.67",
+      "version": "0.0.68",
      "license": "Apache-2.0",
      "devDependencies": {
        "@types/chrome": "^0.0.315",
@@ -3445,11 +3445,11 @@
    },
    "packages/playwright-mcp": {
      "name": "@playwright/mcp",
-      "version": "0.0.67",
+      "version": "0.0.68",
      "license": "Apache-2.0",
      "dependencies": {
-        "playwright": "1.59.0-alpha-1771028105000",
-        "playwright-core": "1.59.0-alpha-1771028105000"
+        "playwright": "1.59.0-alpha-1771104257000",
+        "playwright-core": "1.59.0-alpha-1771104257000"
      },
      "bin": {
        "playwright-mcp": "cli.js"
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
  "name": "playwright-mcp-internal",
-  "version": "0.0.67",
+  "version": "0.0.68",
  "private": true,
  "repository": {
    "type": "git",
@@ -26,7 +26,7 @@
  ],
  "devDependencies": {
    "@modelcontextprotocol/sdk": "^1.25.2",
-    "@playwright/test": "1.59.0-alpha-1771028105000",
+    "@playwright/test": "1.59.0-alpha-1771104257000",
    "@types/node": "^24.3.0"
  }
 }
--- a/packages/extension/manifest.json
+++ b/packages/extension/manifest.json
@@ -1,7 +1,7 @@
 {
  "manifest_version": 3,
  "name": "Playwright MCP Bridge",
-  "version": "0.0.67",
+  "version": "0.0.68",
  "description": "Share browser tabs with Playwright MCP server",
  "permissions": [
    "debugger",
--- a/packages/extension/package.json
+++ b/packages/extension/package.json
@@ -1,6 +1,6 @@
 {
  "name": "@playwright/mcp-extension",
-  "version": "0.0.67",
+  "version": "0.0.68",
  "description": "Playwright MCP Browser Extension",
  "private": true,
  "repository": {
--- a/packages/playwright-mcp/package.json
+++ b/packages/playwright-mcp/package.json
@@ -1,6 +1,6 @@
 {
  "name": "@playwright/mcp",
-  "version": "0.0.67",
+  "version": "0.0.68",
  "description": "Playwright Tools for MCP",
  "repository": {
    "type": "git",
@@ -14,6 +14,7 @@
    "name": "Microsoft Corporation"
  },
  "license": "Apache-2.0",
+  "mcpName": "io.github.microsoft/playwright-mcp",
  "scripts": {
    "lint": "node update-readme.js",
    "test": "playwright test",
@@ -32,8 +33,8 @@
    }
  },
  "dependencies": {
-    "playwright": "1.59.0-alpha-1771028105000",
-    "playwright-core": "1.59.0-alpha-1771028105000"
+    "playwright": "1.59.0-alpha-1771104257000",
+    "playwright-core": "1.59.0-alpha-1771104257000"
  },
  "bin": {
    "playwright-mcp": "cli.js"
Author	SHA1	Message	Date
Willian Tolotti	55622bf5f1	feat(package): add `mcpName` field for MCP Registry ownership verification (#1432 )	2026-03-09 15:37:44 -07:00
Yury Semikhatsky	a9d95f8d83	docs: not a security boundary section (#1435 )	2026-03-04 18:38:40 -08:00
Yury Semikhatsky	d8f8b7b52d	Revert "docs: fix PLAYWRIGHT_MCP_ALLOWED_HOSTS env var name (#1414 )" (#1440 ) This reverts commit `f1f42f8616`. It broke lint. See https://github.com/microsoft/playwright-mcp/pull/1414/checks in the original PR.	2026-03-04 17:13:40 -08:00
dependabot[bot]	0d8753294d	chore(deps-dev): bump hono from 4.11.8 to 4.12.5 (#1437 )	2026-03-04 17:05:26 -08:00
dependabot[bot]	1e0b51325e	chore(deps-dev): bump @hono/node-server from 1.19.9 to 1.19.10 (#1438 )	2026-03-04 17:05:05 -08:00
Promode	43e31e8361	doc: Add Antigravity to MCP client list in README (#1419 )	2026-02-25 11:10:43 -08:00
Luca Moretti	f1f42f8616	docs: fix PLAYWRIGHT_MCP_ALLOWED_HOSTS env var name (#1414 )	2026-02-21 15:07:56 -08:00
Luca Moretti	c60d7bd7a6	docs: add --host 0.0.0.0 to Docker service example (#1415 )	2026-02-21 15:06:51 -08:00
Yury Semikhatsky	066e54b6ea	chore: mark 0.0.68 (#1406 )	2026-02-14 15:17:41 -08:00
Yury Semikhatsky	d6c2e7ce5e	chore: roll to Feb 14 (#1405 )	2026-02-14 14:33:34 -08:00
Yury Semikhatsky	8c4b1aaa25	chore: fix tests on linux (#1404 )	2026-02-14 13:11:47 -08:00