playwriter
Code Issues

Update README.md

Browse Source
This commit is contained in:
Tommy D. Rossi
2025-11-16 13:29:20 +01:00
parent de54e7ac29
commit 7d7eb46ac4
1 changed files with 26 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+26 -26
View File
@@ -60,32 +60,6 @@ Once enabled on one or more tabs, your AI assistant can:
The MCP will automatically start a relay server and connect to your enabled browser tabs.
## Security
Playwriter is designed with security in mind, ensuring that only you can control your browser.
### How It Works
1. **Local WebSocket Server**: When the MCP starts, it launches a singleton WebSocket server on `localhost:19988`
2. **Dual Connection**: Both the Chrome extension and MCP client connect to this local server
3. **User-Controlled Access**: The extension can only control tabs where you explicitly clicked the extension icon (green icon indicates connected tabs)
4. **Localhost-Only**: The WebSocket server does not send CORS headers, preventing any web pages or remote servers from connecting to it - only processes running on your local machine can establish a connection
5. **Explicit Consent**: Chrome displays an "automation banner" on controlled tabs, making it obvious when a tab is being automated
### What Can Be Controlled
- **Only enabled tabs**: Tabs you explicitly connected by clicking the extension icon
- **New tabs created by automation**: Tabs created programmatically through Playwright commands
- **Nothing else**: Other browser tabs, your browsing history, or any tabs you haven't explicitly connected remain inaccessible
### What Cannot Happen
- **No remote access**: External websites or servers cannot connect to the WebSocket (localhost-only)
- **No passive monitoring**: The extension cannot read or monitor tabs you haven't connected
- **No automatic spreading**: The debugger won't automatically attach to new tabs you open manually
This architecture ensures that browser automation only happens with your explicit permission on tabs you choose.
### Using with Playwright
You can use playwriter programmatically with playwright-core:
@@ -148,3 +122,29 @@ Navigation:
- `browsermcp_browser_press_key` - Press a key on the keyboard
Utilities:
- `browsermcp_browser_wait` - Wait for a specified time in seconds
## Security
Playwriter is designed with security in mind, ensuring that only you can control your browser.
### How It Works
1. **Local WebSocket Server**: When the MCP starts, it launches a singleton WebSocket server on `localhost:19988`
2. **Dual Connection**: Both the Chrome extension and MCP client connect to this local server
3. **User-Controlled Access**: The extension can only control tabs where you explicitly clicked the extension icon (green icon indicates connected tabs)
4. **Localhost-Only**: The WebSocket server does not send CORS headers, preventing any web pages or remote servers from connecting to it - only processes running on your local machine can establish a connection
5. **Explicit Consent**: Chrome displays an "automation banner" on controlled tabs, making it obvious when a tab is being automated
### What Can Be Controlled
- **Only enabled tabs**: Tabs you explicitly connected by clicking the extension icon
- **New tabs created by automation**: Tabs created programmatically through Playwright commands
- **Nothing else**: Other browser tabs, your browsing history, or any tabs you haven't explicitly connected remain inaccessible
### What Cannot Happen
- **No remote access**: External websites or servers cannot connect to the WebSocket (localhost-only)
- **No passive monitoring**: The extension cannot read or monitor tabs you haven't connected
- **No automatic spreading**: The debugger won't automatically attach to new tabs you open manually
This architecture ensures that browser automation only happens with your explicit permission on tabs you choose.