package chrome-devtools-mcp
No known issues
Grade A (Few risk signals). Use --ignore-scripts and pin exact version.
Earlier reports: Versions 0.20.0 up to, but not including, 1.1.0 were affected (Chrome DevTools for agents: daemon.pid write follows symlinks in /tmp fallback runtime directory, Jun 17, 2026, GHSA-3pvj-jv98-qhjq, link). Versions 0.24.0 up to, but not including, 1.1.0 were affected (chrome-devtools-mcp: validatePath() does not canonicalize symlinks before enforcing roots, Aug 17, 2026, GHSA-8qf9-62x2-82pp, link). The current version, 1.12.0, is not named.
- Latest version
- 1.12.0
- First published
- 18 months ago
- Maintainers
- 3
- Catalog grade
- A — Few risk signals
- Est. context load
- ~3.8k tokens / turn (~22 tool schemas, 1.9% of 200k context)
Threat reports
Install it pinned and without install scripts:
npm install --ignore-scripts --save-exact "chrome-devtools-mcp"Based on public adoption and transparency signals as of Oct 16, 2026. Our opinion, not a code audit or security guarantee. Answers change through the day.