Secrets
CheckedThe latest scan completed this check. It does not guarantee full coverage of the repository.
MCP servers · Security report
No alerts flaggedmicrosoft/playwright-mcpIs playwright-mcp safe to use?
Short answer
Our latest scan found no alerts in the checks that ran. That is a good sign, but not proof of safety: some areas were not checked, and new code can change the picture.
- Automated alerts
- 0
- High or critical
- 0
- Most flagged
- None
- Last scanned
Playwright MCP server
The assessment, at a glance
No alerts in the current repository snapshot
The current visible findings query returned zero alerts. This does not establish that the project is safe or that all checks ran.
Repository snapshot from Plexicus staging. Counts may include earlier scans and are not attributed to an exact run or commit. Check categories come from the latest observed job and can differ from the scans contributing findings. Completed categories describe bundle delivery, not full repository coverage.
What we found
What the scan flagged
Alerts are leads for review, sorted by type and severity. They are not confirmed vulnerabilities.
A breakdown by type is not available yet. Severity totals do not show what kind of issues were flagged.
Repository findings snapshot
Current repository findings
0automated alerts
Findings currently visible in the Plexicus repository record. These alerts have not been validated as vulnerabilities or attributed to this exact scan or commit.
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Informational
- 0
Source: Plexicus staging · Collected
Scope and counting limits
These are current repository totals, which may include findings from earlier scans. Scan-specific counts and the scanned commit remain unverified. The snapshot excludes findings marked as false positives, duplicates, deleted, or sandbox results, and findings still awaiting processing or enrichment.
Next steps
How to use playwright-mcp more safely
Practical steps based on what the scan flagged. They are general guidance, not confirmation of an exploitable vulnerability.
Check the evidenced scan scope before relying on the absence of alerts.
Try it in a container or virtual machine first, with throwaway credentials.
Pin a specific release or commit instead of tracking the latest code.
This public report shows totals only. File names, exploitability, and false-positive rates are not included.
What we checked
Which checks ran?
Each card shows whether the latest scan completed that type of check. A completed check does not mean every file or rule was covered.
Code security
Not checkedDo not assume this area was assessed.
Dependencies
Not checkedDo not assume this area was assessed.
Configuration
Not checkedDo not assume this area was assessed.
Limits
What this report cannot tell you
- Alert totals can include results from earlier scans and are not tied to one exact commit.
- Automated alerts need investigation. Severity is a scanner's estimate, not a confirmed impact.
- Zero alerts means nothing was flagged in the checks that ran, not that the project is safe.
- Runtime behavior, deployment settings, MCP permissions, and prompt injection are not assessed unless listed above.
Technical scan record & repository metadata
- Platform execution
- Platform job completed
- Commit evidence
- Scanned commit not verified
- Last checked (UTC)
- 2026-10-16T05:03:37.349Z
- Default branch
- main
Result bundles: 1 of 1 complete; 0 failed; 0 degraded. Bundle completion alone does not establish full scan coverage.
Requested commit b8b4183e099f136cbec0388a6088d4aa2f6b9685
Scan source fork: View fork ↗
Repository metadata retrieved 2026-10-15T08:13:54.818Z. Candidate commit from metadata: b8b4183e099f136cbec0388a6088d4aa2f6b9685. A candidate commit is not proof of the scanned commit.
Questions about playwright-mcp
Is playwright-mcp safe to use?
Our latest scan found no alerts in the checks that ran. That is a good sign, but not proof of safety: some areas were not checked, and new code can change the picture.
What did Plexicus find in playwright-mcp?
The current visible findings query returned zero alerts. This does not establish that the project is safe or that all checks ran.
What did the scan not check?
Runtime behavior, deployment settings, MCP and tool permissions, and prompt injection are not covered unless listed in the checks above. Review those before giving the tool access to real data.
How can I check my own fork or project?
Scan it with the free Plexicus SAST tool. Connect GitHub and get a report for your own repository.
For maintainers
Add the playwright-mcp security report to your README
Show users where to find this report. The badge links to this page and makes no safety claim.
[](https://www.plexicus.ai/open-source/microsoft/playwright-mcp/)Your own code
Scan your own repository for free.
Connect GitHub and see what Plexicus flags in your code.
Scan your repository free ↗