web-eval-agent
An MCP server that autonomously evaluates web applications.
No outside reports on file
This tool can browse the web on your behalf and handle sensitive data, so it requires strict network isolation, permission limits, and careful monitoring to avoid leaking credentials or accessing restricted systems.
Based on public adoption and transparency signals as of Oct 22, 2026. Our opinion, not a code audit or security guarantee.
What it can access
- Local filesNo local folder access notedLOW
- Command executionNo shell command runner notedLOW
- Network reachFetches arbitrary web URLsREVIEW
- CredentialsRequires API key or tokenREVIEW
- Package sourceGitHub (refreshdotdev/web-eval-agent)PUBLIC
Inferred from this listing’s public package details and description. Check the project’s source before installing.
Install
No npm or PyPI package is listed. Install from source: github.com/refreshdotdev/web-eval-agent ↗
About Web Eval Agent
This is an MCP server that automatically visits and tests web applications, analyzing how they work and behave. It appears designed to let AI assistants interact with websites programmatically to evaluate functionality, performance, or quality.
Who it’s for
Developers or teams who want to automate testing of web applications using AI agents. It may be useful for quality assurance teams testing multiple sites or applications.
Alternatives
- Puppeteer (web automation library for Node.js)
- Selenium (browser automation tool)
- Playwright (cross-browser testing framework)
Setup
Check these steps against the project’s own instructions before running anything.
Follow the project's README for installation and configuration instructions specific to this tool.
Why this grade
Signal-based grade (3/7 points): well starred on GitHub, public source code. This reflects adoption and transparency, not a code review.
Popularity and upkeep
- GitHub stars
- 1.2k
- Listing last refreshed
- 2026-10-29
These are public popularity signals, not a maintenance check. Look at the repository’s commit history and open issues.
Security reports
No reports found for this package in our research (last checked 2026-10-29).
Risks to watch for
- Full web browsing capability: Can visit any URL the user directs it to, potentially accessing internal networks or sensitive websites if misconfigured.
- Cookie and session access: May access and transmit cookies, authentication tokens, or session data from your browser to wherever the server runs.
- Credential exposure: If credentials are stored in environment variables or config files, they could be logged or leaked during evaluation.
- Malicious page execution: Websites with deceptive content (like fake login forms or javascript redirects) could trick the agent into revealing data or taking unwanted actions.
- Data exfiltration: Test results and page content analyzed by the agent could be logged or stored insecurely, exposing information about the websites you evaluate.
How to lower the risk
Least-privilege permissions
- Run the server with minimal file system and network access.
- Only allow it to visit whitelisted domains if possible.
Network isolation
- Run it in a sandbox or isolated container away from internal networks.
- Use a proxy or firewall to prevent access to localhost or private IP ranges.
Monitoring
- Log all URLs visited and track what data is sent or received.
- Review server logs regularly for unexpected activity or data leaks.
Red flags to watch for
- Unusual network traffic to internal services or unexpected external hosts.
- Credentials appearing in logs or test output files.
- Performance issues suggesting heavy resource use or data processing.
Questions
How do I install Web Eval Agent?
Web Eval Agent does not publish a standalone npm or PyPI package. Clone or follow the setup instructions in its source repository at github.com/refreshdotdev/web-eval-agent.
Are there security reports about Web Eval Agent?
No reports found for this package in our research (last checked 2026-10-29). Web Eval Agent currently holds Grade C (Moderate risk signals) based on public adoption and transparency signals. Key risk areas to watch include full web browsing capability, cookie and session access, credential exposure.
Is Web Eval Agent actively maintained?
Web Eval Agent has 1.2k GitHub stars. Our directory data was last refreshed on 2026-10-29. Check recent commit activity, release tags, and open issues at github.com/refreshdotdev/web-eval-agent before pinning it in production.
What are alternatives to Web Eval Agent?
Notable alternatives to Web Eval Agent include Puppeteer, Selenium, Playwright. You can also compare Web Eval Agent side by side with other MCP servers in the Related tools section on this page.
README badge and team notes
Maintain or use Web Eval Agent? Show its live grade in your GitHub README, docs site, or run a check from the terminal before you install.
GitHub README Markdown:
[](https://agentarmorhq.com/skills/refreshdotdev-web-eval-agent)HTML embed:
<a href="https://agentarmorhq.com/skills/refreshdotdev-web-eval-agent"><img src="https://agentarmorhq.com/api/badge/refreshdotdev-web-eval-agent" alt="AgentArmorHQ Risk Grade for Web Eval Agent" height="20" /></a>Terminal check:
curl -fsSL https://agentarmorhq.com/api/cli | node --input-type=module - check "refreshdotdev-web-eval-agent"Share with your security lead
Need sign-off to use web-eval-agent? Copy this note for Slack, a ticket or a pull request.
### AgentArmorHQ Security Review Memo: web-eval-agent
- **Listing URL:** https://agentarmorhq.com/skills/refreshdotdev-web-eval-agent
- **Type:** App connector
- **Risk Grade:** Grade C (Moderate risk signals)
- **Outside Security Advisories on File:** 0
- **Public Adoption:** 1.2k GitHub stars
#### Permission & Blast-Radius Signals
- **Local files:** No local folder access noted
- **Command execution:** No shell command runner noted
- **Network reach:** Fetches arbitrary web URLs
- **Credentials:** Requires API key or token
- **Package source:** GitHub (refreshdotdev/web-eval-agent)
#### Recommended Hardened Setup
- **Source Repo:** https://github.com/refreshdotdev/web-eval-agent
- **Controls:** Pin an exact version in `.mcp.json`, scope access to a single workspace folder, and use a least-privilege read-only token where supported.
_Based on public adoption and transparency signals as of Oct 22, 2026. Our opinion, not a code audit or security guarantee._Key facts
- Type
- App connector
- Publisher
- refreshdotdev
- Source code
- github.com/refreshdotdev/web-eval-agent
- Est. context load
- ~850 tokens / turn (~5 tool schemas, 0.43% of 200k context)
- Popularity
- 1.2k GitHub stars
- Last updated
- 2026-10-29
- Last graded
- 2026-10-22
Community
Discussions for Web Eval Agent
Ask questions or share configuration tips. Governed by our Community Rules & Terms.
No posts match this filter yet.
Be the first to ask a question or share a working tip.
Check before you install, in Claude
Your assistant answers Block, Review or No known issues for any package before it installs it.
Get this check inside Claude