Gives AI agents full browser automation capabilities via Playwright. Extremely powerful for web tasks but carries the highest risk profile of any MCP server.
Security Rating
58 / 100
Vendor Type
Official (Microsoft)
Risk Category
Critical Risk
Exposed Tools & Function Calls
- browser_navigate
- browser_click
- browser_type
- browser_snapshot
- browser_take_screenshot
- browser_select_option
- browser_drag
- browser_wait_for
Required Permission Scopes
- browser:full
- clipboard:read
- clipboard:write
Vulnerability & Risk Analysis
Full internet access with no restrictions (Critical)
Playwright agents can navigate to any URL including internal network endpoints, cloud metadata services (169.254.169.254), and localhost admin interfaces.
Fix: Run Playwright in a sandboxed container with network egress filtering. Block access to private IP ranges and cloud metadata endpoints.
Session hijacking via cookie access (Critical)
Agents can access browser cookies and session tokens for any site the browser has authenticated with, enabling account takeover attacks.
Fix: Use isolated browser profiles for agent sessions. Never share authenticated browser profiles between agent and personal use.
Prompt injection via web content (High)
Malicious web pages can embed hidden text instructing the agent to perform unintended actions, exfiltrate data, or navigate to attacker-controlled sites.
Fix: Implement strict instruction hierarchy. Parse web content as data, not as instructions. Log all navigation and action sequences.