Skip to content

A

A — Few risk signals Graded October 16, 2026Strong public adoption and transparency signals.Based on public adoption and transparency signals as of October 16, 2026. Our opinion, not a code audit or security guarantee.

App connector · General

chrome-devtools-mcp

Chrome DevTools for coding agents

Bottom line: Signal-based grade (7/7 points): very widely starred on GitHub, heavily downloaded, listed in several sources, public source code. This reflects adoption and transparency, not a code review.

Popularity score: 98/100
Rank: #3 of 500
GitHub stars: 53.6k
Weekly downloads: 1.3M

What it does

Chrome DevTools for coding agents enables AI agents to interact with Chrome browsers programmatically, inspect DOM elements, execute JavaScript, and debug web applications. It acts as an MCP connector that bridges coding agents with Chrome's debugging protocol for automated testing, web scraping, and browser automation tasks.

Who it’s for

Software developers and AI builders who need agents to interact with web applications, perform automated testing, or debug web pages. Teams using Claude or other AI agents for web development and QA workflows.

Copy-paste setup

Check these steps against the project’s own instructions before running anything.

Install from npm (check the project page first):

bash

npx -y chrome-devtools-mcp

Follow the official instructions: https://www.npmjs.com/package/chrome-devtools-mcp (opens external site)

Risks

Credential exposure: Agents gain full access to Chrome DevTools, which may expose session cookies, auth tokens, and stored credentials to injected prompts or malicious agents.
Prompt injection: Malicious instructions in webpage content or agent prompts could execute arbitrary JavaScript in the browser context.
Data exfiltration: Agents can inspect and extract sensitive page content (PII, financial data, personal messages) without additional guardrails.
Supply chain: npm package security depends on maintainer account hygiene; verify publisher identity before use in production.
Scope creep: DevTools access grants broad browser capabilities; agents may exceed intended scope if prompt controls are weak.

How to stay secure

Chrome DevTools MCP Security Hardening Guide

Least-privilege permissions

Run the MCP connector in a dedicated, unprivileged user/container account with no access to sensitive local files or environment variables
Restrict DevTools scope via allowlist: disable access to Network, Storage, and Audits tabs unless explicitly required; use domain/URL restrictions if available
Never grant agent direct access to credential stores or browser password managers; use isolated sessions without saved credentials
Implement role-based access controls in your agent orchestration layer to limit which agents can invoke chrome-devtools-mcp

Network isolation

Run chrome-devtools-mcp in a sandboxed container or VM with egress filtering; block unexpected outbound connections to C2 or exfiltration servers
Use a proxy or firewall rule to whitelist only necessary target domains the browser should access; deny access to internal networks and metadata services
Disable or restrict DevTools Remote Debugging Protocol (RDP) port exposure; bind to localhost only and require authentication if enabled
Route all browser traffic through a corporate proxy with SSL inspection and data loss prevention (DLP) policies active

Monitoring

Log all DevTools commands and responses (DOM queries, JavaScript evaluation, network requests) with timestamps and agent identifiers; alert on suspicious patterns like localStorage or sessionStorage access
Monitor for unusual file access or environment variable reads from the browser context; detect exfiltration attempts via console output or network requests
Set up alerts for prompt injection indicators: unusual script execution, fetch/XHR to unexpected domains, or repeated failed authentication attempts
Periodically audit npm package versions and maintainer identity; subscribe to security advisories for chrome-devtools-mcp and its dependencies

Red flags to watch for

Agent attempting to access document.cookie, localStorage, or sessionStorage when not part of the intended workflow
Webpage content or agent prompt containing JavaScript execution requests (eval(), Function(), dynamic <script> tags) directed at the DevTools connector
DevTools commands that extract full page HTML/content without legitimate filtering or access control context
Unexpected outbound HTTP requests from the browser to unrecognized domains, or agent requesting credentials/secrets as input parameters

Alternatives

Puppeteer – Lower-level Node.js library for headless Chrome automation with finer permission control.
Playwright – Cross-browser automation supporting Chrome, Firefox, and Safari with similar MCP patterns.
Selenium – Mature browser automation framework with language bindings and more mature permission boundaries.
Browserless – Managed browser automation service offering sandboxed execution and audit logging.

Sources