How to allow or block URLs in chrome-devtools-mcp (allowed origins equivalent)?

4 answers

• Best answerAgentArmorHQ teamTeam4d ago

  As of June 16, 2026, the feature was implemented and merged. You can restrict network access in browser sessions using URL patterns with the CLI options --blocked-url-pattern (block traffic) and --allowed-url-pattern (allow specific endpoints).

  Example configuration from the thread for blocking endpoints:

  jsonCopy to clipboard

  {
    "mcpServers": {
      "chrome-devtools": {
        "command": "npx",
        "args": [
          "chrome-devtools-mcp@latest",
          "--blocked-url-pattern",
          "*://example.com/*",
          "*://*.another-blocked-example.com/*"
        ]
      }
    }
  }
  

  A maintainer explained that URLs are matched using DevTools Protocol's Network.setBlockedURLs URL patterns, which also covers origins and other patterns. Full option details are in the project’s Configuration Documentation.

  Known limitations stated in the thread:

  • Network throttling/emulation is disabled when a blocklist or allowlist is configured. Using the emulate tool to modify networkConditions (e.g., setting Offline) throws: Network throttling is not supported when network blocking (allowlist/blocklist) is configured. Other emulation settings (cpuThrottlingRate, geolocation, viewport) still work.
  • Service worker-initiated fetches bypass these restrictions and are not blocked.
  Did this work for you?WorkedDidn't work
  UpvoteStarReport
• AgentArmorHQ teamTeam4d ago

  What @OrKoN tried on GitHub (Worked)

  A maintainer suggested expressing allowed and blocked URLs via CDP's Network.setBlockedURLs with URL patterns, implemented in Puppeteer and then consumed by the MCP server. This approach shipped.

  Source: https://github.com/ChromeDevTools/chrome-devtools-mcp/issues/239#issuecomment-3965585093 (opens external site) ↗

  Did this work for you?WorkedDidn't work
  UpvoteStarReport
• AgentArmorHQ teamTeam4d ago

  What a GitHub user tried on GitHub (Outcome unclear)

  The issue body proposed origin filtering via request interception, similar to Playwright MCP's context.route() and Puppeteer's setRequestInterception(). This was a proposal, not a testable workaround.

  Source: https://github.com/ChromeDevTools/chrome-devtools-mcp/issues/239 (opens external site) ↗

  Did this work for you?WorkedDidn't work
  UpvoteStarReport
• AgentArmorHQ teamTeam4d ago

  What @edgeq tried on GitHub (Outcome unclear)

  One user considered a Claude Code hooks-based approach to guard some of the MCP server's tools but noted it 'might get pretty unmaintainable pretty quickly.' The thread does not report whether it was tried.

  Source: https://github.com/ChromeDevTools/chrome-devtools-mcp/issues/239#issuecomment-3916432707 (opens external site) ↗

  Did this work for you?WorkedDidn't work
  UpvoteStarReport