Playwright MCP Server

Instructions

Implementation Reference

• src/server.ts:282-324 (handler)

  The handler function for 'browser_evaluate' tool. Validates input with Zod, performs security checks against dangerous JavaScript patterns, ensures Playwright browser connection, executes the script using page.evaluate(), and formats the response in MCP protocol structure.

  async (params: any) => {
    try {
      const input = z.object({
        script: z.string()
      }).parse(params);
      await this.playwright.ensureConnected();
      
      // Basic security check - prevent dangerous operations
      const script = input.script.trim();
      const dangerousPatterns = [
        /require\s*\(/,
        /import\s+/,
        /eval\s*\(/,
        /Function\s*\(/,
        /process\./,
        /global\./,
        /window\.location/,
        /document\.cookie/
      ];
      
      if (dangerousPatterns.some(pattern => pattern.test(script))) {
        throw new Error('Script contains potentially dangerous operations');
      }
      
      const page = this.playwright.getPage();
      const result = await page.evaluate(input.script);
      
      return {
        content: [{
          type: 'text',
          text: `Script executed. Result: ${JSON.stringify(result)}`
        }]
      };
    } catch (error) {
      return {
        content: [{
          type: 'text',
          text: `Script evaluation failed: ${error instanceof Error ? error.message : String(error)}`
        }],
        isError: true
      };
    }
  }

• src/types.ts:41-65 (schema)

  Zod schema and TypeScript type definition for the input parameters of the browser_evaluate tool, requiring a 'script' field of type string.

  export const BrowserEvaluateInputSchema = z.object({
    script: z.string()
  });
  
  export const BrowserSnapshotInputSchema = z.object({
    selector: z.string().optional()
  });
  
  export const BrowserFileUploadInputSchema = z.object({
    selector: z.string(),
    paths: z.array(z.string()).min(1)
  });
  
  export const BrowserRefreshInputSchema = z.object({
    waitUntil: z.enum(['networkidle', 'domcontentloaded', 'load']).optional().default('load'),
    timeout: z.number().optional()
  });
  
  export type BrowserNavigateInput = z.infer<typeof BrowserNavigateInputSchema>;
  export type BrowserTakeScreenshotInput = z.infer<typeof BrowserTakeScreenshotInputSchema>;
  export type BrowserGetHtmlInput = z.infer<typeof BrowserGetHtmlInputSchema>;
  export type BrowserClickInput = z.infer<typeof BrowserClickInputSchema>;
  export type BrowserTypeInput = z.infer<typeof BrowserTypeInputSchema>;
  export type BrowserWaitForInput = z.infer<typeof BrowserWaitForInputSchema>;
  export type BrowserEvaluateInput = z.infer<typeof BrowserEvaluateInputSchema>;

• src/server.ts:273-325 (registration)

  Registration of the 'browser_evaluate' tool in the MCP server within PlaywrightMcpServer.setupTools() method, including tool name, metadata, input schema, and inline handler reference.

  this.server.registerTool(
    'browser_evaluate',
    {
      title: 'Execute JavaScript',
      description: 'Execute JavaScript code in the browser context',
      inputSchema: {
        script: z.string()
      }
    },
    async (params: any) => {
      try {
        const input = z.object({
          script: z.string()
        }).parse(params);
        await this.playwright.ensureConnected();
        
        // Basic security check - prevent dangerous operations
        const script = input.script.trim();
        const dangerousPatterns = [
          /require\s*\(/,
          /import\s+/,
          /eval\s*\(/,
          /Function\s*\(/,
          /process\./,
          /global\./,
          /window\.location/,
          /document\.cookie/
        ];
        
        if (dangerousPatterns.some(pattern => pattern.test(script))) {
          throw new Error('Script contains potentially dangerous operations');
        }
        
        const page = this.playwright.getPage();
        const result = await page.evaluate(input.script);
        
        return {
          content: [{
            type: 'text',
            text: `Script executed. Result: ${JSON.stringify(result)}`
          }]
        };
      } catch (error) {
        return {
          content: [{
            type: 'text',
            text: `Script evaluation failed: ${error instanceof Error ? error.message : String(error)}`
          }],
          isError: true
        };
      }
    }
  );