PlayGuard
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| FIGMA_API_KEY | No | Figma API key forwarded to the Figma MCP child process (Framelink). | |
| FIGMA_MCP_CMD | No | Figma MCP launch command (Framelink), e.g. `npx` paired with FIGMA_MCP_ARGS. Unset (and no FIGMA_MCP_URL) = Figma disabled. | |
| FIGMA_MCP_URL | No | Official Figma desktop MCP server URL, e.g. `http://127.0.0.1:3845/mcp`. No key needed; wins over FIGMA_MCP_CMD. `mcp.figma.com` is refused (catalog-only). | |
| OUTPUT_FORMAT | No | Output format requested from Framelink (`figma-developer-mcp`). Must be `json` or `yaml` for the optimizer and Design Diff to parse it. | json |
| FIGMA_MCP_ARGS | No | Extra arguments for Figma MCP (space-separated; wrap an argument in quotes if it contains a space), e.g. `-y figma-developer-mcp --stdio`. | |
| FIGMA_SVG_REFS | No | Set `false` to keep SVG geometry inline. | true |
| FIGMA_CACHE_TTL | No | Figma response cache TTL in ms. `0` = off. Framelink only. | 0 |
| PLAYGUARD_DELTA | No | Set `false` to disable delta snapshots. | true |
| PLAYGUARD_HINTS | No | Set `false` to stop appending batching hints to tool descriptions. | true |
| CONTEXT7_API_KEY | No | Forwarded to Context7 only; raises the anonymous ~200 calls/day limit. | |
| CONTEXT7_MCP_CMD | No | Context7 MCP launch command, e.g. `npx -y @upstash/context7-mcp@latest` (Node.js ≥ 20.18.1). Unset = disabled. | |
| DEVTOOLS_MCP_CMD | No | Chrome DevTools MCP launch command, e.g. `npx -y chrome-devtools-mcp@latest`. Unset = DevTools disabled. | |
| CONTEXT7_MCP_ARGS | No | Extra arguments for the Context7 MCP (space-separated; wrap an argument in quotes if it contains a space). | |
| DEVTOOLS_MCP_ARGS | No | Extra arguments for chrome-devtools-mcp (space-separated; wrap an argument in quotes if it contains a space), e.g. `--headless --isolated`. | |
| PLAYGUARD_CODEGEN | No | Set `keep` to stop PlayGuard adding `--codegen none` to the bundled Playwright MCP. | |
| PLAYGUARD_COMPACT | No | Set `false` to disable compact snapshots and receive the raw accessibility tree. | true |
| PLAYGUARD_LOG_DIR | No | Override the NDJSON analytics log directory. | logs/ |
| FIGMA_TEXT_COMPACT | No | Max characters for the Figma text response. Over-budget responses are trimmed structurally; `0` = off. | 10000 |
| PLAYWRIGHT_MCP_CMD | No | Override the Playwright MCP command (defaults to the bundled binary). | |
| PLAYWRIGHT_MCP_ARGS | No | Extra arguments passed to Playwright MCP (space-separated; wrap an argument in quotes if it contains a space). Passing `--output-dir` here takes precedence over PLAYGUARD_OUTPUT_DIR. | |
| SHOPIFY_DEV_MCP_CMD | No | Shopify Dev MCP launch command, e.g. `npx -y @shopify/dev-mcp@latest`. Unset = disabled. | |
| PLAYGUARD_OUTPUT_DIR | No | Where all on-disk artifacts go, split by origin: `.playguard/.qa/` for everything from the site under test and `.playguard/.figma/` for Figma image exports. | .playguard/ |
| PLAYGUARD_SMART_WAIT | No | Set `1`/`true` to retry a snapshot that looks mid-load (few refs + a loading/spinner indicator) instead of returning it as-is. | false |
| SHOPIFY_DEV_MCP_ARGS | No | Extra arguments for the Shopify Dev MCP (space-separated; wrap an argument in quotes if it contains a space). | |
| PLAYGUARD_SCREENSHOTS | No | Screenshot policy: `allow` / `warn` / `block` / `redirect`. In `warn` the screenshot executes with a warning; `redirect` replaces it with browser_snapshot unless visual:true or filename/element/ref/target/fullPage is given; `block` errors; `allow` has no restriction. | warn |
| PLAYGUARD_EVAL_COMPACT | No | Max characters for eval output. `0` = off. | 10000 |
| PLAYGUARD_LIST_WAIT_MS | No | How long `tools/list` waits for an optional upstream (Figma, DevTools, Shopify Dev, Context7) before listing without it; its tools follow via `tools/list_changed`. | 6000 |
| PLAYGUARD_PROJECT_ROOT | No | The root `.playguard/` is created in. Defaults to the nearest `.git`/`package.json` above `cwd`; set this to pin the location outright. | |
| PLAYGUARD_TOKEN_BUDGET | No | Max tokens per snapshot; truncates on a line boundary so `[ref=]` tags are never split. `0` = off. | 0 |
| PLAYGUARD_UPDATE_CHECK | No | Set `false` to skip the startup check for a newer version on npm (offline, CI). | true |
| PLAYGUARD_DOCS_OPTIMIZE | No | Set `false` for a pure passthrough of Shopify Dev and Context7: no response rewriting, no repeat notes, no `tools/list` compaction. | true |
| PLAYGUARD_SMART_WAIT_MS | No | Delay between smart-wait retries, in ms. | 1000 |
| PLAYGUARD_DOCS_CACHE_TTL | No | Seconds a doc lookup stays in `.playguard/.cache/docs/` (7× for a version-pinned Context7 id). `0` = off. | 86400 |
| PLAYGUARD_EVAL_CACHE_TTL | No | `browser_evaluate` cache TTL in ms. `0` = off. | 500 |
| PLAYGUARD_HINT_THRESHOLD | No | After N consecutive snapshots without any action, inject a hint listing available interactive refs. | 4 |
| PLAYGUARD_DELTA_THRESHOLD | No | Fraction of lines that must change to trigger a full snapshot instead of a delta (0–1). | 0.4 |
| PLAYGUARD_DEVTOOLS_BODY_MAX | No | Max characters of a non-JSON request/response body in `get_network_request`. `0` = off. | 3000 |
| PLAYGUARD_DEVTOOLS_DEFAULTS | No | Set `false` to stop appending `--no-usage-statistics`, `--no-performance-crux`, `--no-page-id-routing` and `--workspace` to the upstream argv. | true |
| PLAYGUARD_DEVTOOLS_OPTIMIZE | No | Set `false` for a pure passthrough: no response rewriting, no `tools/list` compaction, no error hints. | true |
| PLAYGUARD_PREFETCH_SNAPSHOT | No | Set `true` to prefetch a snapshot in the background after `browser_navigate`. | false |
| PLAYGUARD_SMART_WAIT_MIN_REFS | No | A snapshot with at least this many `[ref=]` elements is never considered "still loading". | 5 |
| PLAYGUARD_DEVTOOLS_NETWORK_MAX | No | `list_network_requests` with more rows than this (and no paging/filter params) is summarized. `0` = off. | 30 |
| PLAYGUARD_SMART_WAIT_MAX_RETRIES | No | Max smart-wait retries before giving up and returning the snapshot with a warning. | 3 |
| PLAYGUARD_DESIGN_DIFF_TOLERANCE_PX | No | Size difference, in px, still counted as a match in design diff. | 2 |
| PLAYGUARD_DESIGN_DIFF_TOLERANCE_COLOR | No | Per-channel RGB difference still counted as a match in design diff. | 5 |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| browser_closeB | Close the page |
| browser_resizeB | Resize the browser window |
| browser_console_messagesB | Returns all console messages |
| browser_handle_dialogC | Handle a dialog |
| browser_evaluateA | Evaluate JavaScript expression on page or element [PlayGuard] Each call waits ≥0.5–1.5 s for the page to settle. Combine related checks into one function that returns an object instead of calling this repeatedly. |
| browser_file_uploadB | Upload one or multiple files |
| browser_dropA | Drop files or MIME-typed data onto an element, as if dragged from outside the page. At least one of "paths" or "data" must be provided. |
| browser_fill_formB | Fill multiple form fields |
| browser_press_keyB | Press a key on the keyboard |
| browser_typeB | Type text into editable element |
| browser_navigateC | Navigate to a URL |
| browser_navigate_backA | Go back to the previous page in the history |
| browser_network_requestsA | Returns a numbered list of network requests since loading the page. Use browser_network_request with the number to get full details. |
| browser_network_requestA | Returns full details (headers and body) of a single network request, or a single part if |
| browser_run_code_unsafeA | Run a Playwright code snippet. Unsafe: executes arbitrary JavaScript in the Playwright server process and is RCE-equivalent. [PlayGuard] Each call waits for the page to settle. Prefer one script that loops over viewports/states over several calls. |
| browser_take_screenshotA | Take a screenshot of the current page. You can't perform actions based on the screenshot, use browser_snapshot for actions. |
| browser_snapshotB | Capture accessibility snapshot of the current page, this is better than screenshot |
| browser_clickB | Perform click on a web page |
| browser_dragA | Perform drag and drop between two elements |
| browser_hoverA | Hover over element on page |
| browser_select_optionB | Select an option in a dropdown |
| browser_tabsA | List, create, close, or select a browser tab. |
| browser_wait_forA | Wait for text to appear or disappear or a specified time to pass [PlayGuard] Prefer waiting for text over a fixed time. |
| playguard_a11y_auditA | Run an axe-core accessibility audit on the page currently open in the browser_* browser. Returns WCAG violations grouped by rule, most severe first, with CSS selectors, a short html excerpt and the fix for each element. Navigate first; re-run after a click/state change to audit dialogs or menus. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 24 tools
Most tools target clearly distinct browser actions, and descriptions help separate close pairs like screenshot vs snapshot and network request list vs detail. A few overlaps remain, especially browser_evaluate vs browser_run_code_unsafe and drag vs drop, but these are mostly resolvable from context.
Nearly all tools use a consistent browser_prefix with snake_case naming, and the one playguard_ prefix is understandable as a product-specific audit tool. The set mixes verb-first names with noun-phrase names like browser_console_messages and browser_tabs, so it is not perfectly uniform.
The 24-tool surface is broad and mostly justified by browser automation needs, but it sits at the heavy end of the scale and includes many granular primitives. Some consolidation, such as grouping network inspection helpers or runtime evaluation tools, would make the set easier to manage.
The server covers the main browser automation lifecycle: navigation, interaction, forms, tabs, dialogs, network inspection, console access, screenshots, and accessibility auditing. Minor gaps remain around forward navigation, storage/cookie management, request interception, and richer accessibility-audit configuration or reporting.