playwriter
Chrome extension & CLI to let agents control your browser. Runs Playwright snippets in a stateful sandbox. Available as CLI or MCP
No outside reports on file
Playwriter gives an AI agent near-total control over your browser, so only use it on accounts and data you trust completely, and keep a close watch on what it does.
Based on public adoption and transparency signals as of Oct 21, 2026. Our opinion, not a code audit or security guarantee.
What it can access
- Local filesNo local folder access notedLOW
- Command executionNo shell command runner notedLOW
- Network reachFetches arbitrary web URLsREVIEW
- CredentialsNo API token requiredLOW
- Package sourceGitHub (remorses/playwriter)PUBLIC
Inferred from this listing’s public package details and description. Check the project’s source before installing.
Install
No npm or PyPI package is listed. Install from source: github.com/remorses/playwriter ↗
Everything known
We found nothing about this project in the sources we read (last checked 2026-10-30). That does not mean it has no problems.
0 incidents · 0 advisories · 0 news articles · 0 community threads · checked 2026-10-30
Popularity grade: C (from public signals such as stars and downloads, not a code review). Graded 2026-10-21.
Sources we read: OSV, GitHub Advisory Database, CISA Known Exploited Vulnerabilities, 44 security news feeds and our incident library. Last checked 2026-10-30.
About Playwriter
Playwriter is a Chrome extension and command-line tool that lets AI agents control your web browser by running Playwright code (a automation library) in a sandboxed environment. It works as an MCP connector, meaning it can integrate with Claude and other AI systems to automate clicking, typing, and reading web pages.
Who it’s for
Developers and researchers who want AI agents to perform tasks in a browser—like filling out forms, scraping data, or testing websites. It's mainly for people comfortable with code and managing their own infrastructure.
Alternatives
- Selenium with Python or Node.js: Open-source browser automation; more control but requires more setup. - Puppeteer: Lightweight Node.js library for headless Chrome automation; good for basic tasks. - Claude's native web browsing (if available in your Claude plan): Simpler but less flexible than controlling a full browser instance. - Anthropic Computer Use: Native tool-use API for controlling the entire desktop; broader but also higher risk.
Setup
Check these steps against the project’s own instructions before running anything.
Follow the project's README on GitHub for installation steps. Setup varies depending on whether you use the CLI, Chrome extension, or MCP integration with Claude Desktop.
Why this grade
Signal-based grade (3/7 points): well starred on GitHub, public source code. This reflects adoption and transparency, not a code review.
Popularity and upkeep
- GitHub stars
- 4k
- Listing last refreshed
- 2026-10-30
These are public popularity signals, not a maintenance check. Look at the repository’s commit history and open issues.
Risks to watch for
- Full browser access: The tool can see everything your browser sees, including passwords in form fields, private messages, and sensitive data on any open tab. - Malicious web pages: A crafted website could try to trick the AI into running harmful Playwright commands, like stealing cookies or redirecting you to phishing sites. - Credential exposure: If you're logged into banking, email, or work accounts, the tool has access to those sessions and could leak auth tokens or data. - Unsandboxed code execution: While there's a sandbox, Playwright code runs with broad browser permissions and could be abused if the tool has vulnerabilities. - No built-in audit trail: There's limited logging of what the AI actually did in your browser, making it hard to spot unauthorized actions after the fact.
How to lower the risk
Least-privilege permissions
- Run it only with browser profiles that have minimal sensitive data logged in.
- Use separate browser profiles for untrusted tasks versus banking and work.
Network isolation
- Keep the browser process isolated if possible; don't let it access your local network.
- Consider running it in a virtual machine or container for high-risk tasks.
Monitoring
- Log and review actions the agent takes; check browser history and network requests.
- Set time limits on agent sessions and stop them if behavior looks odd.
Red flags to watch for
- Agent visiting unexpected domains or making login attempts you didn't request.
- Sudden changes to browser settings, extensions, or saved passwords.
Questions
How do I install Playwriter?
Playwriter does not publish a standalone npm or PyPI package. Clone or follow the setup instructions in its source repository at github.com/remorses/playwriter.
Are there security reports about Playwriter?
No reports found for this package in our research (last checked 2026-10-30). Playwriter currently holds Grade C (Moderate risk signals) based on public adoption and transparency signals. Key risk areas to watch include full browser access.
Is Playwriter actively maintained?
Playwriter has 4k GitHub stars. Our directory data was last refreshed on 2026-10-30. Check recent commit activity, release tags, and open issues at github.com/remorses/playwriter before pinning it in production.
What are alternatives to Playwriter?
Notable alternatives to Playwriter include Selenium. You can also compare Playwriter side by side with other MCP servers in the Related tools section on this page.
README badge and team notes
Maintain or use Playwriter? Show its live grade in your GitHub README, docs site, or run a check from the terminal before you install.
GitHub README Markdown:
[](https://agentarmorhq.com/skills/remorses-playwriter)HTML embed:
<a href="https://agentarmorhq.com/skills/remorses-playwriter"><img src="https://agentarmorhq.com/api/badge/remorses-playwriter" alt="AgentArmorHQ Risk Grade for Playwriter" height="20" /></a>Terminal check:
curl -fsSL https://agentarmorhq.com/api/cli | node --input-type=module - check "remorses-playwriter"Share with your security lead
Need sign-off to use playwriter? Copy this note for Slack, a ticket or a pull request.
### AgentArmorHQ Security Review Memo: playwriter
- **Listing URL:** https://agentarmorhq.com/skills/remorses-playwriter
- **Type:** App connector
- **Risk Grade:** Grade C (Moderate risk signals)
- **Outside Security Advisories on File:** 0
- **Public Adoption:** 4k GitHub stars
#### Permission & Blast-Radius Signals
- **Local files:** No local folder access noted
- **Command execution:** No shell command runner noted
- **Network reach:** Fetches arbitrary web URLs
- **Credentials:** No API token required
- **Package source:** GitHub (remorses/playwriter)
#### Recommended Hardened Setup
- **Source Repo:** https://github.com/remorses/playwriter
- **Controls:** Pin an exact version in `.mcp.json`, scope access to a single workspace folder, and use a least-privilege read-only token where supported.
_Based on public adoption and transparency signals as of Oct 21, 2026. Our opinion, not a code audit or security guarantee._Key facts
- Type
- App connector
- Publisher
- remorses
- Source code
- github.com/remorses/playwriter
- Est. context load
- ~850 tokens / turn (~5 tool schemas, 0.43% of 200k context)
- Popularity
- 4k GitHub stars
- Last updated
- 2026-10-30
- Last graded
- 2026-10-21
Community
Discussions for Playwriter
Ask questions or share configuration tips. Governed by our Community Rules & Terms.
No posts match this filter yet.
Be the first to ask a question or share a working tip.
Check before you install, in Claude
Your assistant answers Block, Review or No known issues for any package before it installs it.
Get this check inside Claude