Accessibility snapshots give agents named controls
Playwright MCP turns a page into structured text with roles, names, and element references. An agent can see a button by its accessible name, click its reference, fill a textbox, inspect a console message, or save a screenshot. This usually gives language models clearer targets than guessing coordinates from pixels. The server is still Playwright underneath, so browser contexts, navigation, storage, network events, traces, and assertions follow a well-known automation engine.
The approach works best on accessible websites. A canvas application, visual editor, map, game, or poorly labeled control may not expose enough structure. Coordinate actions are available through an opt-in vision capability, but enabling them changes the text-first advantage. Test actual pages before deciding that an accessibility tree can carry the workflow.
Microsoft now prefers the CLI for coding agents
The README makes an unusually direct product distinction. MCP suits loops that need persistent browser state, detailed introspection, and repeated reasoning over page structure. Playwright CLI with skills is recommended for coding agents because commands avoid loading large tool schemas and verbose accessibility trees into the model's context. That advice comes from the project itself and should shape the first trial.
A coding agent that opens a site, checks one flow, and takes 2 screenshots may get more done with the CLI. An agent that explores an unfamiliar application over many turns, reuses login state, observes requests, and changes tactics may benefit from MCP's persistent tool interface. Protocol support alone is not a reason to choose the server. Estimate how much page state the model must repeatedly read and how long the browser needs to stay alive.
What happened when we ran it
Our sandbox installed 112 packages in 7 seconds, occupying 48 MB, and built the 35-file repository in 6 seconds. The checkout contained about 1,360 lines of source. The npm audit found 0 known vulnerabilities across critical, high, moderate, and low severities. The repository also had 2 CI workflow files, a Dockerfile, and a tests directory.
Tests stopped after 6 seconds without executing the suite. The output said the process was running Node.js 18.20.8 and that Playwright requires Node.js 20 or higher. Our harness named its image lab-node:22, which makes the observed runtime surprising, but the log does not explain the mismatch. We report both facts and do not blame the package, image, shell, or test runner without evidence.
There is also a documentation conflict worth fixing: the current README states Node.js 18 or newer, while the test command rejected Node 18.20.8. A new user following the written minimum can therefore hit the same immediate stop. Until those two sources agree, use Node 20 or newer and verify the version in the exact process that launches the server.
Profiles decide where browser credentials live
The default mode uses a persistent profile, retaining cookies and logged-in state between sessions. Isolated mode keeps the profile in memory and drops state when the browser closes; it can preload a storage-state file. The extension connects to an existing Chrome or Edge browser and can reuse open tabs and login state. Each option answers a different convenience and trust question.
A persistent profile can serve only 1 browser instance at a time, according to the README. Parallel clients need isolated mode or separate user-data directories. Storage-state files, dotenv secret files, and persistent profiles are credentials even when they look like test artifacts. Keep them outside repositories, narrow file permissions, and give each user or job its own browser boundary. Connecting an agent to a personal browser profile exposes far more than a test account.
Origin flags do not contain a hostile page
Configuration includes allowed hosts, allowed origins, blocked origins, workspace-root file restrictions, service-worker blocking, proxy settings, and secret files. Those controls help prevent accidental access. The README explicitly says origin lists are not a security boundary and do not affect redirects. The standalone server section repeats that Playwright MCP itself is not a security boundary.
That warning matters because a browser agent consumes untrusted page text and can act with stored credentials. A page can try to redirect the browser, instruct the model, or induce a sensitive action. Client-level tool permissions, network isolation, separate accounts, human confirmation for consequential steps, and short-lived credentials must do the security work. Remote HTTP mode needs authentication and a restricted audience; exposing it as a general browser service is a poor default.
The tool surface is broad and mostly optional
Core actions cover navigation, tabs, clicks, typing, forms, uploads, dialogs, snapshots, screenshots, console messages, and network requests. Optional capabilities add PDF generation, coordinate input, DevTools, network controls, storage operations, configuration changes, and test assertions. A Chrome extension can attach to a running browser. The Docker recipe offers a contained start, though its documented browser support is headless Chromium only.
Do not enable every capability because it exists. File upload, PDF output, storage export, network mocking, and DevTools each widen what the agent can read or alter. Start with the smallest tool set that completes a known workflow. Add one capability when a test demonstrates the need, then log its use. This also reduces schema weight, which is central to the project's own case for choosing CLI over MCP in many coding tasks.
Current maintenance is active but the package is young
Version 0.0.79 was released on 2026-08-06, and the repository was pushed on 2026-08-21. GitHub listed 6 open issues and pull requests combined. Recent activity included dependency updates, a tracing archive report after page crashes, documentation about a client guard, and a standing direction to file shared Playwright problems in the main repository.
The Apache 2.0 license, compact source, official Microsoft ownership, and Playwright foundation are reassuring. The 0.0 version line and fast-moving division between MCP and CLI still call for version pinning. Playwright MCP is a good fit for persistent exploratory browser agents. For ordinary coding-agent checks, Microsoft's CLI recommendation is more convincing, cheaper in model context, and easier to contain.