ChromeDevTools/chrome-devtools-mcp server skill
browser automation
Chrome DevTools MCP is a Model-Context-Protocol server that lets AI coding agents control and inspect a live Chrome browser instance. It provides access to Chrome DevTools capabilities for browser automation, network debugging, performance analysis, and console inspection through both an MCP interface and a CLI.
Automate browser actions and interactions reliably using Puppeteer-based controls Capture performance traces and extract actionable performance insights from live sessions Debug network requests, take screenshots, and inspect browser console messages with source mapping Integrate with coding agents like Claude, Cursor, Copilot, or Antigravity for hands-on web development Run in slim mode for basic browser tasks or full mode for advanced DevTools access 1 CRITICAL✓ 2 HIGH✓ 17 MEDIUM 5 LOW
✓ CRITICAL/HIGH reflect AI-verified findings (false positives excluded) · MEDIUM/LOW/INFO are unverified scanner output
AI-verified (CRITICAL/HIGH): 3 likely real (100%) 2 false positive — excluded from CRITICAL/HIGH count above
Findings by checker · 2 high-signal, 2 mostly false-positive (hidden by default)
CHK-081 1 finding 1 likely
0% FP CHK-042 1 finding 1 likely
0% FP ▼ Show 2 checkers that are mostly false positives (3 findings) 25 findings click to expand
CHK-081 Command injection risk — exec/execSync with string interpolation in scripts/verify-server-json-version.ts
scripts/verify-server-json-version.ts
AI: likely real confirmed ▼
CHK-042 Google API Key detected in src/tools/performance.ts
src/tools/performance.ts
AI: likely real likely ▼
CHK-125 execSync() — synchronous shell execution — no scope constraint in scripts/verify-server-json-version.ts
scripts/verify-server-json-version.ts
AI: likely real likely ▼
CHK-125 execSync() — synchronous shell execution — no scope constraint in scripts/verify-npm-package.mjs
scripts/verify-npm-package.mjs
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in src/browser.ts
src/browser.ts
possible ▼
CHK-125 exec() — arbitrary code execution — no scope constraint in eslint_rules/no-direct-third-party-imports-rule.js
scripts/eslint_rules/no-direct-third-party-imports-rule.js
possible ▼
CHK-125a fs.writeFile — unrestricted file write — no scope constraint in workflows/publish-to-npm-on-tag.yml
.github/workflows/publish-to-npm-on-tag.yml
possible ▼
CHK-125b sudo invocation — privilege escalation — no scope constraint in workflows/run-tests.yml
.github/workflows/run-tests.yml
possible ▼
CHK-125b sudo invocation — privilege escalation — no scope constraint in references/installation.md
skills/chrome-devtools-cli/references/installation.md
possible ▼
CHK-125 execSync() — synchronous shell execution — no scope constraint in bin/check-latest-version.ts
src/bin/check-latest-version.ts
possible ▼
CHK-125a fs.writeFile — unrestricted file write — no scope constraint in bin/check-latest-version.ts
src/bin/check-latest-version.ts
possible ▼
CHK-125a fs.writeFile — unrestricted file write — no scope constraint in utils/check-for-updates.ts
src/utils/check-for-updates.ts
possible ▼
CHK-125a fs.unlinkSync — file deletion — no scope constraint in daemon/daemon.ts
src/daemon/daemon.ts
possible ▼
CHK-125a fs.unlinkSync — file deletion — no scope constraint in daemon/client.ts
src/daemon/client.ts
possible ▼
CHK-125a fs.writeFile — unrestricted file write — no scope constraint in telemetry/persistence.ts
src/telemetry/persistence.ts
possible ▼
CHK-035 [GHSA-8988-4f7v-96qf] @opentelemetry/core — OpenTelemetry Core: Unbounded memory allocation in W3C Baggage propagation
possible ▼
CHK-036 [GHSA-8988-4f7v-96qf] @opentelemetry/core 1.30.1 — see advisory: GHSA-8988-4f7v-96qf
possible ▼
CHK-125 execSync() — synchronous shell execution — no scope constraint in scripts/test.mjs
scripts/test.mjs
possible ▼
CHK-125 execSync() — synchronous shell execution — no scope constraint in scripts/update-lighthouse.ts
scripts/update-lighthouse.ts
possible ▼
CHK-125a fs.writeFile — unrestricted file write — no scope constraint in src/McpContext.ts
src/McpContext.ts
possible ▼
CHK-131 [prepare] Install hook present — review required
package.json
possible ▼
CHK-025 Hardcoded endpoint in skill: https://developer.chrome.com/docs/devtools
skills/chrome-devtools/SKILL.md
possible ▼
CHK-025 Hardcoded endpoint in skill: https://developer.chrome.com/docs/devtools/ai-assistance
skills/chrome-devtools/SKILL.md
possible ▼
CHK-025 Hardcoded endpoint in skill: https://web.dev/articles/accessible-tap-targets
skills/a11y-debugging/SKILL.md
possible ▼
CHK-025 Hardcoded endpoint in skill: https://web.dev/articles/accessible-tap-targets.md.txt
skills/a11y-debugging/SKILL.md
possible ▼
▼ Show 2 false positives (7% of this view) Last scanned: Jul 12, 2026
More servers
google-gemini/gemini-cli 85
An open-source AI agent that brings the power of Gemini directly into your terminal.
106k★
skypilot-org/skypilot 85
obra/superpowers 85
Foundational skill pack by Jesse Vincent now in anthropics/claude-plugins-official. Includes ffuf web-fuzzing/pentest skill. Partial analysis done — full hook and plugin inspection pending. tier=T2
191k★
Significant-Gravitas/AutoGPT 85
AutoGPT is the vision of accessible AI for everyone, to use and to build on. Our mission is to provide the tools, so that you can focus on what matters.
186k★
nanocoai/nanoclaw 85
A lightweight alternative to OpenClaw that runs in containers for security. Connects to WhatsApp, Telegram, Slack, Discord, Gmail and other messaging apps,, has memory, scheduled jobs, and runs directly on Anthropic's Agents SDK
30k★
google-gemini/gemini-cli 85
An open-source AI agent that brings the power of Gemini directly into your terminal.
106k★
Scan your entire org's MCP deployment
2,500+ repos pre-scored. 22% carry CRITICAL findings.