Is Chrome Devtools Mcp safe to use?

Chrome Devtools Mcp has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments. Licensed under Apache-2.0.

How do I install Chrome Devtools Mcp?

Chrome Devtools Mcp supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.

What can Chrome Devtools Mcp do?

Chrome Devtools Mcp provides 10 tools: MCP, false, stable, true, webp and 5 more. See the full tools list on the server page for descriptions and parameters.

What AI clients work with Chrome Devtools Mcp?

Chrome Devtools Mcp is compatible with claude-desktop, cursor, claude-code. It uses stdio and sse and http transport.

Is Chrome Devtools Mcp actively maintained?

Chrome Devtools Mcp is actively maintained — last commit was 0 days ago. It has 49,680 GitHub stars.

Chrome Devtools MCP

Name: Chrome Devtools MCP
Author: ChromeDevTools

Official

chrome-devtools-mcp · by ChromeDevTools

Chrome DevTools for coding agents

49.7k 2.3M/wk 10 tools GitHub npm

No known CVEs

Apache-2.0 license

Actively maintained

Last commit 0d ago

Works with most clients

Transport: stdio, sse, http

10 tools · ~314 tok

Grade A · 0.2% of 200K ctx

MCPpedia last refreshed this data 4h ago

Edit this pageView history

Chrome Devtools MCP is an MCP server that chrome DevTools for coding agents. Its tool list has not been published yet over stdio, sse and http, requires no API key, and scores 96/100 on MCPpedia's security, maintenance and efficiency rubric.

Browser Developer Tools

Step 1

Install in your client

Config is the same across clients — only the file and path differ.

Supported in Claude Desktopstdio, sse, http · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "chrome-devtools": {
      "args": [
        "-y",
        "chrome-devtools-mcp@latest"
      ],
      "command": "npx"
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/chrome-devtools-mcp)](https://mcppedia.org/s/chrome-devtools-mcp)

Read me

What Chrome Devtools Mcp does

Chrome DevTools MCP server by Google. Gives AI assistants access to Chrome DevTools Protocol for debugging, profiling, and inspecting web pages. Connects to a running Chrome instance and exposes developer tools as MCP tools.

Test This Server

This server supports HTTP transport. Be the first to test it — help the community know if it works.

Loading README…

Scored, not listed

Why this score

Five weighted categories — click any category to see the underlying evidence.

Score breakdown

96/100across 5 weighted dimensions

How we score →

0255075100

−4

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

2 fixed

CVE-2026-53766medium · fixedCVSS 6.1

chrome-devtools-mcp: validatePath() does not canonicalize symlinks before enforcing roots

### Summary I originally reported this through Google Bug Hunters. The Google Bug Hunters team said this is in OSS VRP scope but not reward-eligible due to the project tier, and asked me to file an issue or PR directly with this repository. I am reporting it privately here first because it is an unfixed security issue. `McpContext.validatePath()` enforces workspace `roots` by checking whether `path.resolve(filePath)` textually falls under one of the configured root paths. `path.resolve()` does

Affected: >= 0.24.0Fixed in 1.1.0source →

CVE-2026-53765medium · fixedCVSS 6.1

Chrome DevTools for agents: daemon.pid write follows symlinks in /tmp fallback runtime directory

### Summary The chrome-devtools-mcp daemon writes its PID file with `fs.writeFileSync()` to a deterministic runtime path. On typical macOS environments, and on Linux sessions where `$XDG_RUNTIME_DIR` is unset, that runtime path falls back to `/tmp/chrome-devtools-mcp-<uid>/daemon.pid`. Because the write does not use `O_NOFOLLOW`, a local low-privilege user on the same POSIX host can pre-create `/tmp/chrome-devtools-mcp-<victim_uid>/daemon.pid` as a symlink to a file writable by the victim. Whe

Affected: >= 0.20.0Fixed in 1.1.0source →

Inventory

Tools (10)

Click any tool to inspect its schema.

~314 tokens total

Community

Reviews

Be the first to review

Have you used this server?

Share your experience — it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is Chrome Devtools Mcp safe to use?: Chrome Devtools Mcp has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments. Licensed under Apache-2.0.
How do I install Chrome Devtools Mcp?: Chrome Devtools Mcp supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
What can Chrome Devtools Mcp do?: Chrome Devtools Mcp provides 10 tools: MCP, false, stable, true, webp and 5 more. See the full tools list on the server page for descriptions and parameters.
What AI clients work with Chrome Devtools Mcp?: Chrome Devtools Mcp is compatible with claude-desktop, cursor, claude-code. It uses stdio and sse and http transport.
Is Chrome Devtools Mcp actively maintained?: Chrome Devtools Mcp is actively maintained — last commit was 0 days ago. It has 49,680 GitHub stars.

Similar servers

Others in browser / developer-tools

View all →

Context797

Context7 Platform -- Up-to-date code documentation for LLMs and AI code editors

61.2k 2

Browser Tools Mcp96

Monitor browser logs directly from Cursor and other MCP compatible IDEs.

7.3k 7

Supabase MCP Server96

Manage Supabase projects — databases, auth, storage, and edge functions

2.9k 4

Mcp Gitlab96

MCP server for using the GitLab API

1.9k 12

MCP Security Weekly

Get CVE alerts and security updates for Chrome Devtools Mcp and similar servers.

Community

Discussion

Start a conversation

Ask a question, share a tip, or report an issue.

Has anyone used this with Cursor?How do you handle auth?Any alternatives?

Edit this pageView history

Browser Developer Tools

Step 1

Install in your client

Config is the same across clients — only the file and path differ.

Supported in Claude Desktopstdio, sse, http · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "chrome-devtools": {
      "args": [
        "-y",
        "chrome-devtools-mcp@latest"
      ],
      "command": "npx"
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/chrome-devtools-mcp)](https://mcppedia.org/s/chrome-devtools-mcp)

Read me

What Chrome Devtools Mcp does

Test This Server

This server supports HTTP transport. Be the first to test it — help the community know if it works.

README

Chrome DevTools for agents

Chrome DevTools for agents (chrome-devtools-mcp) lets your coding agent (such as Antigravity, Claude, Cursor or Copilot) control and inspect a live Chrome browser. It acts as a Model-Context-Protocol (MCP) server, giving your AI coding assistant access to the full power of Chrome DevTools for reliable automation, in-depth debugging, and performance analysis. A CLI is also provided for use without MCP.

Tool reference | Changelog | Contributing | Troubleshooting | Design Principles

Key features

Get performance insights: Uses Chrome DevTools to record traces and extract actionable performance insights.
Advanced browser debugging: Analyze network requests, take screenshots and check browser console messages (with source-mapped stack traces).
Reliable automation. Uses puppeteer to automate actions in Chrome and automatically wait for action results.

Disclaimers

chrome-devtools-mcp exposes content of the browser instance to the MCP clients allowing them to inspect, debug, and modify any data in the browser or DevTools. Avoid sharing sensitive or personal information that you don't want to share with MCP clients.

chrome-devtools-mcp officially supports Google Chrome and Chrome for Testing only. Other Chromium-based browsers may work, but this is not guaranteed, and you may encounter unexpected behavior. Use at your own discretion. We are committed to providing fixes and support for the latest version of Extended Stable Chrome.

Performance tools may send trace URLs to the Google CrUX API to fetch real-user experience data. This helps provide a holistic performance picture by presenting field data alongside lab data. This data is collected by the Chrome User Experience Report (CrUX). To disable this, run with the --no-performance-crux flag.

Usage statistics

Google collects usage statistics (such as tool invocation success rates, latency, and environment information) to improve the reliability and performance of Chrome DevTools MCP.

Data collection is enabled by default. You can opt-out by passing the --no-usage-statistics flag when starting the server:

"args": ["-y", "chrome-devtools-mcp@latest", "--no-usage-statistics"]

Google handles this data in accordance with the Google Privacy Policy.

Google's collection of usage statistics for Chrome DevTools MCP is independent from the Chrome browser's usage statistics. Opting out of Chrome metrics does not automatically opt you out of this tool, and vice-versa.

Collection is disabled if CHROME_DEVTOOLS_MCP_NO_USAGE_STATISTICS or CI env variables are set.

Update checks

By default, the server periodically checks the npm registry for updates and logs a notification when a newer version is available. You can disable these update checks by setting the CHROME_DEVTOOLS_MCP_NO_UPDATE_CHECKS environment variable.

Requirements

Node.js LTS version.
Chrome current stable version or newer.
npm

Getting started

Add the following config to your MCP client:

{
  "mcpServers": {
    "chrome-devtools": {
      "command": "npx",
      "args": ["-y", "chrome-devtools-mcp@latest"]
    }
  }
}

[!NOTE] Using chrome-devtools-mcp@latest ensures that your MCP client will always

... View full README on GitHub

Loading README…

Scored, not listed

Why this score

Five weighted categories — click any category to see the underlying evidence.

Score breakdown

96/100across 5 weighted dimensions

How we score →

0255075100

−4

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

2 fixed

CVE-2026-53766medium · fixedCVSS 6.1

chrome-devtools-mcp: validatePath() does not canonicalize symlinks before enforcing roots

Affected: >= 0.24.0Fixed in 1.1.0source →

CVE-2026-53765medium · fixedCVSS 6.1

Chrome DevTools for agents: daemon.pid write follows symlinks in /tmp fallback runtime directory

Affected: >= 0.20.0Fixed in 1.1.0source →

Inventory

Tools (10)

Click any tool to inspect its schema.

~314 tokens total

Community

Reviews

Be the first to review

Have you used this server?

Share your experience — it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is Chrome Devtools Mcp safe to use?: Chrome Devtools Mcp has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments. Licensed under Apache-2.0.
How do I install Chrome Devtools Mcp?: Chrome Devtools Mcp supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
What can Chrome Devtools Mcp do?: Chrome Devtools Mcp provides 10 tools: MCP, false, stable, true, webp and 5 more. See the full tools list on the server page for descriptions and parameters.
What AI clients work with Chrome Devtools Mcp?: Chrome Devtools Mcp is compatible with claude-desktop, cursor, claude-code. It uses stdio and sse and http transport.
Is Chrome Devtools Mcp actively maintained?: Chrome Devtools Mcp is actively maintained — last commit was 0 days ago. It has 49,680 GitHub stars.