Chrome DevTools MCP

The evidence shows MCP roots, path validation, symlink-write defenses, and optional URL allow/block rules, with tests covering several boundaries. Least privilege is not complete because the OS temporary directory remains accessible, the network controls are explicitly not a full sandbox, and browser-control authority is broad. The server assigns validation of tool calls and parameters to the client and shows no built-in per-action user confirmation, so confirmation scores zero. The README thoroughly discloses browser-content exposure, default-on usage statistics, CrUX requests, update checks, and opt-outs, justifying full data-flow transparency. Sensitive-data handling includes warnings and opt-outs, but telemetry is enabled by default, browser data is exposed to clients, WebSocket headers may contain credentials, and no secret-redaction mechanism is shown. Dependency pins, script restrictions, commit-pinned Actions, and prerelease verification provide meaningful supply-chain controls; deductions remain because several dependencies use ranges and no vulnerability scanning or known-vulnerability response evidence is supplied. File writes, extension installation, navigation, and browser modifications are documented external effects, but there is no uniform confirmation gate. Isolation and selected close/uninstall operations offer limited recovery, not general rollback for page or filesystem changes. Repository, author, and licensing attribution are explicit, but registry verification is absent and the supplied files cannot independently establish publisher identity.

The README, configuration, package metadata, and tests are strongly consistent about page identifiers, reconnection, snapshots, structured output, timeout adjustment, and resource access, supporting full self-consistency. Node, Chrome, and npm requirements are clear and important runtime dependencies are pinned, but recommended @latest installation can drift, official browser support is narrow, and no offline or downgrade path is documented. Tests demonstrate explicit errors plus reconnect and fallback notices, and the README links troubleshooting material; however, the supplied excerpts do not show systematic error categories, remedies, and diagnostic context for every tool, so failure messaging is not full-score.

Documentation covers coding agents, a non-MCP CLI, slim basic-browser operation, debugging, performance, network, memory, extensions, and many client configurations, thoroughly addressing audiences and scenarios. Supported browsers, filesystem roots, temporary-directory access, incomplete network guardrails, prompt-injection exposure, and caller responsibilities are stated clearly, earning full capability-boundary credit. Tools are triggered through explicit MCP calls with structured parameters, but the server does not validate agent intent or require confirmation, leaving safety precision dependent on the client. Node and Chrome requirements, a Windows-specific configuration, numerous IDE and CLI integrations, headless operation, browser connection modes, profile paths, and isolation provide strong environment fit.

The README organizes tool reference, CLI, changelog, contribution, troubleshooting, design principles, and generated tool/option indexes well. Installation notes are unusually extensive, covering prerequisites, platforms, clients, and a first verification prompt. Package and MCP names are explicit and option aliases are maintained, but widespread @latest use and inconsistent omission of @latest in some examples reduce naming/version stability. Examples are plentiful, although a complete FAQ is not present in the supplied material. Browser support, telemetry, content exposure, prompt injection, roots, and network-sandbox limitations are documented thoroughly. Apache-2.0 metadata matches the full license text. Package versioning, a changelog link, conventional-commit enforcement, and prerelease checks show a clear update path. SECURITY reporting, an issue tracker, and the Google LLC author field provide maintenance channels, but registry provenance is unverified and no named maintainers or support commitment are supplied.

The product supplies text, images, and optional structured results, while tests cover stable element identifiers, page state, network details, file paths, and snapshot formatting; this strongly supports output usability. Combining DevTools, Puppeteer, performance insights, network, memory, extension, and PWA operations behind MCP and CLI offers clear marginal value beyond basic web automation. Slim and headless modes plus telemetry and CrUX opt-outs mitigate cost, but full operation has a large tool surface, requires launching or attaching to Chrome, and may impose performance, privacy, token, and maintenance costs. No quantitative benchmark is supplied, so cost-benefit is not full-score.

Core capability, risk, and configuration claims trace to concrete README, SECURITY, package, workflow, and test evidence, supporting full claim traceability. Version, license, tool behavior, path restrictions, structured output, and release checks are corroborated across multiple supplied sources. The documentation generally distinguishes official support, possible compatibility, incomplete sandboxing, and client responsibility; however, promotional claims such as reliable automation and full DevTools power lack benchmarks or comprehensive support in the supplied evidence, so fact/inference separation is not complete.