Safari MCP

The repository shows substantive safeguards: pre-existing user tabs are denied by default, sessions use tab markers, lost ownership fails closed, user-tab adoption requires an explicit environment flag and switch action, and adopted tabs cannot be closed. CI blocks high-or-worse production dependency findings and pins GitHub Actions to commits. Deductions apply because the capability surface is inherently broad, including arbitrary page JavaScript, cookies, browser storage, clipboard access, uploads, and native input. Beyond operating-system grants and the user-tab opt-in, there is no evidence of per-action confirmation for form submission, storage mutation, or similar consequential operations. Local data flow and lack of telemetry are documented, but the optional HTTP daemon in the README qualifies SECURITY.md's unconditional no-open-port statement. Sensitive browser data can be read or exported; although the project says credentials are not stored, transmitted, or logged, no output redaction, access tiering, or secret-handling policy is demonstrated. Some reset or restore operations exist, but there is no general rollback for submissions, cookie deletion, or external side effects. The author, organization, email, and repository ownership are stated, but the publisher remains independently unverified.

The package metadata, description of 98 tools, and smoke test that starts the server and enumerates every registered tool are reasonably consistent. CI covers Node 20, 22, and 24 and checks syntax, undefined references, and tests. Deductions reflect the inconsistency between SECURITY.md's stdio/no-port description and the README's optional localhost HTTP daemon, plus the absence of evidence here about real Safari interaction stability. Runtime versions and macOS/Safari prerequisites are explicit and production dependencies are few, but operation depends on Safari developer settings, system permissions, an extension, and a local helper; postinstall also suppresses failure with “|| true”. Failure messaging is thoroughly addressed through actionable tab-guard errors, a doctor tool advertised with per-failure remedies, and smoke-test propagation of server stderr.

The README thoroughly identifies coding agents, concurrent agents, user-owned tabs, demos or voice assistants, web testing, and extraction scenarios. It clearly defines macOS-only support, Node 20+, Safari settings, permission boundaries, session isolation, and a third-party multiplexing caveat. Numerous MCP-client configurations, stdio and HTTP modes, and documented environment controls provide strong environment fit. Trigger precision is only adequate: the snapshot-to-ref workflow and target-selection strategies are clear, but arbitrary JavaScript, coordinate operations, native input, and batch execution provide broad discretion without systematic evidence defining when agents should avoid the higher-risk tools.

The README has clear navigation across quick start, workflow, concurrency, user-tab safety, environment variables, and categorized tools. Prerequisites and installation paths for many clients, Homebrew, and source builds are detailed. Tool names use a stable safari_ prefix, with tests enforcing format and uniqueness. Platform limits, permissions, session conflicts, and security considerations are concrete. MIT metadata matches the complete license text. Package versioning, tag-to-version verification, npm provenance, registry publishing, and a CI-enforced changelog policy demonstrate a mature update path. SECURITY.md supplies supported-version policy, scope, contact, and a response target. The deduction is that the referenced examples directory and changelog contents were not supplied, and there is no comprehensive FAQ in the available material, so their depth cannot be assessed.

Outputs are designed for agent consumption through structured page data, accessibility references, table and link extraction, network details, state verification, and combined operations. The recommended post-action snapshot workflow further improves usability. Driving an already authenticated native Safari session, implementing tab ownership, and offering Safari/WebKit-specific checks provide clear marginal value over generic automation. Cost-benefit is deducted because easy npx installation, few production dependencies, and the shared-daemon design support low setup and process cost, but the prominent approximately 5 ms, 40–60% lower CPU or heat, and zero-heat claims have no supplied benchmark method, raw measurements, or reproducible performance test.

Tool count, naming, license, Node/macOS scope, CI controls, and release controls receive some cross-file support, while the smoke test traces the registered-tool count to source. However, the principal performance claims lack benchmark code or data, and cited articles, issue comments, and testimonials cannot be independently checked within the prompt-only evidence set. The README labels testimonial provenance and separates several limitations clearly, but marketing assertions often place implementation facts, testimonials, and performance conclusions together without consistently identifying inference, measurement conditions, or independently verified fact.