chrome-devtools-mcp
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPRIVILEGE_ESCALATIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches and installs the
chrome-devtools-mcppackage from the NPM registry at runtime using the unversioned@latesttag. - [COMMAND_EXECUTION]: Executes shell commands via
npxto initialize the MCP server, passing user-configurable arguments directly to the process. - [PRIVILEGE_ESCALATION]: Includes the
--allow-unrestricted-pathsflag, which explicitly allows the browser and MCP client to opt out of standard filesystem path restrictions for local workflows. - [DATA_EXFILTRATION]: Provides the
--userDataDirflag and--browserUrlfunctionality, which allows the agent to attach to existing browser sessions or reuse profiles containing sensitive data such as cookies, history, and authenticated sessions. - [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: The skill ingests untrusted data from external web pages via the DOM, console output, and network traffic observations.
- Boundary markers: The instructions do not define boundary markers or delimiters to help the agent distinguish between its instructions and content retrieved from the browser.
- Capability inventory: The agent is granted capabilities to execute arbitrary JavaScript, navigate to any URL, and capture screenshots based on instructions that could be influenced by page content.
- Sanitization: No sanitization or validation mechanisms are described for data ingested from the browser environment before it is processed by the agent.
Audit Metadata