What it is
Playwright MCP lets an agent open pages, click, type, fill forms and read content in a real browser. Instead of screenshots it hands the model Playwright's accessibility snapshot, with a reference for each element, so a text-only model can act on the page.
Install with npx @playwright/mcp@latest (Node.js 18 or newer). The browser keeps a persistent profile on disk by default; --isolated keeps it in memory, --extension attaches to your running Chrome or Edge, and --port serves it over HTTP. About 25 core tools load by default, and 47 more for network, storage, DevTools, coordinate clicks, PDF and test assertions are opt-in through --caps.
The current release is 0.0.83, from 28 September 2026. Microsoft's own README now steers coding agents towards its Playwright CLI with skills, which it says is more token-efficient, and positions MCP for long-running, stateful browser loops.
Install
npx @playwright/mcp@latestOur review
Playwright MCP remains the default browser server for agents, and the reason is the snapshot model. Tools such as browser_navigate, browser_click and browser_snapshot work on element references from the accessibility tree, not screen coordinates, so any text model can drive it and actions land on the right element. It runs Chromium, Firefox and WebKit, which Chrome DevTools MCP does not.
Tokens are the cost, and Microsoft says so. Its README now recommends the separate Playwright CLI with skills for coding agents, because the CLI avoids loading tool schemas and verbose accessibility trees into context, and reserves MCP for exploratory automation, self-healing tests and long-running workflows. Mitigations exist: browser_find searches a snapshot instead of returning the whole thing, and --mobile emulates a Pixel 10 or iPhone 17, which the README notes usually means lighter pages.
The defaults deserve a look. The browser profile persists on disk, so anything the agent logs into stays logged in, and one profile cannot serve two clients at once. File access is limited to workspace roots and file:// URLs are blocked unless you pass --allow-unrestricted-file-access. --allowed-origins and --blocked-origins exist, but the docs say neither is a security boundary nor applies to redirects. HTTP mode binds to localhost unless you set --host 0.0.0.0, which the Docker example does.
The 0.0.x version numbers undersell a project with 38,500 GitHub stars and releases every week or two; the September fixes covered dialogs during page load and orphaned browser processes in Docker. Against Browserbase, the trade is local control and no bill against a hosted browser that copes better with scale and bot detection.
Where it earns its place
A QA engineer on a web team with a flaky Playwright test suite
Have an agent reproduce a failing checkout flow and suggest a stable locator
Runs the server with --isolated and --caps=testing so the agent can step through the flow and use the assertion tools. It costs nothing but model tokens, though each snapshot of a large checkout page adds to them.
An operations analyst at a 30-person logistics firm
Pull weekly figures from a supplier portal that has no API
Uses a saved profile so the agent stays signed in, and a dotenv --secrets file so the password is not typed into chat. The risk is that the persistent profile keeps that session for any later task, so it should be a dedicated account.
A front-end developer checking a Safari-only layout bug
See how a page renders in WebKit without owning a Mac
Starts the server with the WebKit browser and asks the agent to navigate and snapshot the broken component. Chrome DevTools MCP cannot do this, since it supports Chrome only.
Before you commit
- Setup
- npx @playwright/mcp@latest in any MCP client; the README has install steps for Claude Code, Codex, Copilot CLI, Cursor, VS Code, Gemini CLI and more. A first browser_navigate call works within minutes once a browser is installed.
- Integrations
- About 25 tools by default, including browser_navigate, browser_click, browser_type, browser_fill_form and browser_snapshot; --caps adds network (4), storage (17), devtools (13), vision (6), testing (5), pdf and config tools.
- Data and privacy
- Runs locally; nothing goes to Microsoft. Pages are untrusted input that can carry prompt injection, the persistent profile keeps cookies, and the README states the server is not a security boundary.
- Cost at scale
- Free; the cost is model tokens for snapshots, which Microsoft does not quantify. Shared hosting means the Docker image, which supports headless Chromium only.
- Limits
- One persistent profile per browser instance, so parallel clients need --isolated or separate --user-data-dir; browser_wait_for caps waits at 30 seconds; extension mode is Chrome and Edge only.
What's good
- Element references from accessibility snapshots, no vision model needed
- Chromium, Firefox and WebKit
- Opt-in capability groups keep the default set near 25 tools
- Isolated, persistent and extension modes
What's not
- Snapshots of busy pages are long and repeat after each action
- Persistent profile by default keeps logins between runs
- Origin allow and block lists are not a security boundary
- Microsoft points coding agents to its CLI instead
Best for
Developers and QA engineers who want an agent to explore, test or automate web apps across browser engines.
Alternatives
Playwright MCP: common questions
- Is Playwright MCP worth it?
- Playwright MCP is the browser server to start with, provided you budget for long snapshots and remember Microsoft calls it no security boundary. We rate it 4.7 out of 5.
- How much does Playwright MCP cost?
- Free and Apache-2.0 licensed; you pay only for the model tokens the snapshots consume.
- What are the downsides of Playwright MCP?
- Snapshots of busy pages are long and repeat after each action; persistent profile by default keeps logins between runs; origin allow and block lists are not a security boundary; microsoft points coding agents to its CLI instead.
- Who is Playwright MCP best for?
- Developers and QA engineers who want an agent to explore, test or automate web apps across browser engines.
- How much does Playwright MCP cost for a team or in production?
- Free; the cost is model tokens for snapshots, which Microsoft does not quantify. Shared hosting means the Docker image, which supports headless Chromium only.
- Is Playwright MCP safe for company data?
- Runs locally; nothing goes to Microsoft. Pages are untrusted input that can carry prompt injection, the persistent profile keeps cookies, and the README states the server is not a security boundary.
- What are the best Playwright MCP alternatives?
- The closest alternatives we have reviewed are Chrome DevTools MCP and Browserbase MCP.
Answers checked Oct 22, 2026.
Make Playwright MCP? Show this rating on your site
