vibetest-use
Vibetest MCP - automated QA testing using Browser-Use agents
No outside reports on file
Use this tool only on websites you own or fully trust, with browser sessions that have minimal permissions, and never let untrusted people define what the AI should test.
Based on public adoption and transparency signals as of Oct 25, 2026. Our opinion, not a code audit or security guarantee.
What it can access
- Local filesNo local folder access notedLOW
- Command executionNo shell command runner notedLOW
- Network reachFetches arbitrary web URLsREVIEW
- CredentialsNo API token requiredLOW
- Package sourceGitHub (browser-use/vibetest-use)PUBLIC
Inferred from this listing’s public package details and description. Check the project’s source before installing.
Install
No npm or PyPI package is listed. Install from source: github.com/browser-use/vibetest-use ↗
Everything known
We found nothing about this project in the sources we read (last checked 2026-10-30). That does not mean it has no problems.
0 incidents · 0 advisories · 0 news articles · 0 community threads · checked 2026-10-30
Popularity grade: C (from public signals such as stars and downloads, not a code review). Graded 2026-10-25.
Sources we read: OSV, GitHub Advisory Database, CISA Known Exploited Vulnerabilities, 44 security news feeds and our incident library. Last checked 2026-10-30.
About Vibetest Use
Vibetest is an MCP connector that lets AI agents run automated quality assurance (QA) tests on websites using Browser-Use, which is a tool that controls web browsers. It helps test web applications by having AI agents interact with pages, click buttons, fill forms, and check if things work correctly.
Who it’s for
Software development teams who want to automate website testing with AI agents, and developers building tools that need to test web applications programmatically.
Alternatives
- Playwright - Open-source tool for automating browser testing with code.
- Cypress - JavaScript-based testing framework for web applications.
- Selenium - Long-established framework for automated browser testing across languages.
- Puppeteer - Node.js library for controlling headless browsers programmatically.
Setup
Check these steps against the project’s own instructions before running anything.
Follow the project's README. The repository is at https://github.com/browser-use/vibetest-use (opens external site), which should have instructions for installing and configuring this MCP server.
Why this grade
Signal-based grade (3/7 points): well starred on GitHub, public source code. This reflects adoption and transparency, not a code review.
Popularity and upkeep
- GitHub stars
- 832
- Listing last refreshed
- 2026-10-29
These are public popularity signals, not a maintenance check. Look at the repository’s commit history and open issues.
Risks to watch for
- Full browser control: The tool controls a real web browser, so it can access any website or service the browser can reach, including private internal sites if configured that way.
- Session data exposure: Any cookies, authentication tokens, or login sessions in the browser can be read or manipulated by the AI agent during testing.
- Deceptive test pages: A malicious website could use hidden text, fake buttons, or misleading page structures to trick the AI into doing unintended actions or revealing information.
- Data leakage in test results: Test output and logs might accidentally capture passwords, API keys, or personal data that appeared on the tested pages.
- Untrusted test instructions: If an attacker controls what the AI should test, they could trick it into accessing sensitive sites or performing harmful actions.
How to lower the risk
Least-privilege permissions
- Run the browser in a sandboxed account with no access to other systems.
- Only add credentials for the specific test sites needed, never share general login details.
Network isolation
- Restrict the browser to only reach test domains you control.
- Block access to internal company networks or sensitive services.
Monitoring
- Log all URLs visited and actions taken by the AI agent.
- Review test results for unexpected data or unauthorized access attempts.
Red flags to watch for
- Tests suddenly accessing sites not in your test plan.
- Logs showing passwords, tokens, or private data in plain text.
- Errors or crashes that suggest the browser tried forbidden actions.
Questions
How do I install Vibetest Use?
Vibetest Use does not publish a standalone npm or PyPI package. Clone or follow the setup instructions in its source repository at github.com/browser-use/vibetest-use.
Are there security reports about Vibetest Use?
No reports found for this package in our research (last checked 2026-10-30). Vibetest Use currently holds Grade C (Moderate risk signals) based on public adoption and transparency signals. Key risk areas to watch include full browser control, session data exposure, deceptive test pages.
Is Vibetest Use actively maintained?
Vibetest Use has 832 GitHub stars. Our directory data was last refreshed on 2026-10-29. Check recent commit activity, release tags, and open issues at github.com/browser-use/vibetest-use before pinning it in production.
What are alternatives to Vibetest Use?
Notable alternatives to Vibetest Use include Playwright (Open-source tool for automating browser testing with code), Cypress (JavaScript-based testing framework for web applications), Selenium (Long-established framework for automated browser testing across languages), Puppeteer (Node.js library for controlling headless browsers programmatically). You can also compare Vibetest Use side by side with other MCP servers in the Related tools section on this page.
README badge and team notes
Maintain or use Vibetest Use? Show its live grade in your GitHub README, docs site, or run a check from the terminal before you install.
GitHub README Markdown:
[](https://agentarmorhq.com/skills/browser-use-vibetest-use)HTML embed:
<a href="https://agentarmorhq.com/skills/browser-use-vibetest-use"><img src="https://agentarmorhq.com/api/badge/browser-use-vibetest-use" alt="AgentArmorHQ Risk Grade for Vibetest Use" height="20" /></a>Terminal check:
curl -fsSL https://agentarmorhq.com/api/cli | node --input-type=module - check "browser-use-vibetest-use"Share with your security lead
Need sign-off to use vibetest-use? Copy this note for Slack, a ticket or a pull request.
### AgentArmorHQ Security Review Memo: vibetest-use
- **Listing URL:** https://agentarmorhq.com/skills/browser-use-vibetest-use
- **Type:** App connector
- **Risk Grade:** Grade C (Moderate risk signals)
- **Outside Security Advisories on File:** 0
- **Public Adoption:** 832 GitHub stars
#### Permission & Blast-Radius Signals
- **Local files:** No local folder access noted
- **Command execution:** No shell command runner noted
- **Network reach:** Fetches arbitrary web URLs
- **Credentials:** No API token required
- **Package source:** GitHub (browser-use/vibetest-use)
#### Recommended Hardened Setup
- **Source Repo:** https://github.com/browser-use/vibetest-use
- **Controls:** Pin an exact version in `.mcp.json`, scope access to a single workspace folder, and use a least-privilege read-only token where supported.
_Based on public adoption and transparency signals as of Oct 25, 2026. Our opinion, not a code audit or security guarantee._Key facts
- Type
- App connector
- Publisher
- browser-use
- Source code
- github.com/browser-use/vibetest-use
- Est. context load
- ~700 tokens / turn (~4 tool schemas, 0.35% of 200k context)
- Popularity
- 832 GitHub stars
- Last updated
- 2026-10-29
- Last graded
- 2026-10-25
Community
Discussions for Vibetest Use
Ask questions or share configuration tips. Governed by our Community Rules & Terms.
No posts match this filter yet.
Be the first to ask a question or share a working tip.
Check before you install, in Claude
Your assistant answers Block, Review or No known issues for any package before it installs it.
Get this check inside Claude