Developer · MCP Server

Chrome DevTools MCP: setup, permissions and security risks

The Chrome DevTools MCP server gives an agent a real Chrome browser: navigation, input, JavaScript evaluation, network, and performance traces. That is useful, and it is also a set of real capabilities pointed at a real system. Here is what it exposes, why it is worth governing, and the policy to put in front of it.

Exposure grade D

6 of 7 points, default setup. Last checked October 21, 2026.

Returns text written by people outside your team	Yes, +2
Can change things outside your machine	Yes, +1
Can do something hard to undo	Yes, +1
Can read local files or run code locally	Yes, +1
Default credential is long-lived and broad	No
Advisory or disclosure in the 12 months before the check	Yes, +1

0–1 points is A, 2–3 B, 4 C, 5–6 D, 7 F. The grade measures how much the default setup can reach, not the quality of the code. The hardening options below lower it.

Setup

Claude Code, throwaway profile

claude mcp add chrome-devtools -- npx -y chrome-devtools-mcp@latest --isolated

How it logs in

None. Whoever can reach the MCP connection drives the browser. What the agent can reach on the web is whatever the browser profile is logged in to: a dedicated persistent profile under ~/.cache/chrome-devtools-mcp by default, or your own browser with --autoConnect or --browserUrl.

Tools that change things

evaluate_scriptfillfill_formclickupload_filenavigate_pageinstall_extension

Built-in hardening

--isolated uses a temporary profile that is deleted when the browser closes, so no sessions carry over.
Do not use --autoConnect or --browserUrl against the browser you are signed in to.
Pin chrome-devtools-mcp to 1.1.0 or later for the two symlink fixes.
--no-usage-statistics turns off usage reporting, which is on by default.

Known advisories and incidents

What the server hands your agent

A Chrome instance the agent drives through DevTools: opening and navigating pages, clicking and filling forms, uploading local files, reading console and network traffic, taking screenshots and traces, and evaluating JavaScript inside any page.

Why it is worth governing

Every page the agent opens is text written by whoever runs that site, and the agent reads it with the same tools it uses to act.
evaluate_script runs arbitrary JavaScript in the page, with whatever cookies and logged-in sessions that browser profile holds.
upload_file takes a local path, so a steered agent can hand a file from your disk to any web form.
The default profile persists between runs, and --autoConnect can attach to the Chrome you browse with every day.

Tag what the tools actually do

Prismor tags every tool by behavior rather than by name, so rules survive a server adding tools you have never seen. A sensible starting map for Chrome DevTools:

Tool pattern	Tags	Why
mcp__chrome-devtools__navigate_page	untrusted_content	page content is written by the site
mcp__chrome-devtools__take_snapshot	untrusted_content	snapshots return page text to the model
mcp__chrome-devtools__evaluate_script	critical_action	runs code in a logged-in page
mcp__chrome-devtools__fill*	critical_actionexternal_comms	typed data goes to the site
mcp__chrome-devtools__upload_file	critical_actionprivate_data	sends a local file to the site

Patterns are illustrative globs. Run prismor tags list to see how your installed tools actually resolve.

The policy

Rules read as a sentence: a tag, then or with another tag, and what to do about it. Note the mode - start by watching, not blocking.

settings:
  tool_tags:
    enabled: true
    mode: observe            # switch to enforce once the log looks right
    tags:
      "mcp__chrome-devtools__navigate_page": [untrusted_content]
      "mcp__chrome-devtools__take_snapshot": [untrusted_content]
      "mcp__chrome-devtools__evaluate_script": [critical_action]
      "mcp__chrome-devtools__fill*": [critical_action, external_comms]
      "mcp__chrome-devtools__upload_file": [critical_action, private_data]
    rules:
      - "untrusted_content then critical_action -> block"
      - "private_data then external_comms -> block"

Putting Chrome DevTools behind the gateway

You do not change the Chrome DevTools server or how it is configured. Move your existing mcpServers block behind the Prismor gateway and point your agent at Prismor instead:

prismor mcp-gateway install    # moves your .mcp.json servers behind the gateway
prismor mcp-gateway uninstall  # restores the original, backup kept

Your agent sees the same Chrome DevTools tools, namespaced as mcp__chrome-devtools__<tool>. Every call is evaluated against policy before it is forwarded, and every result is scanned as untrusted content before the model sees it.

Frequently asked questions

Is the Chrome DevTools MCP server safe to give an AI agent?

It is as safe as the credential behind it and the policy in front of it. The server itself is not the problem: the risk is that an agent can combine Chrome DevTools access with everything else in the session, with no record of what it did. Front it with a gateway that evaluates each call and logs the verdict.

Does Prismor replace the Chrome DevTools MCP server?

No. You keep running the same server, unchanged. Prismor aggregates it behind a single connector so your agent sees the same tools, namespaced as mcp__<server>__<tool>, with every call and every result passing through policy first.

Will this block work my team actually needs to do?

Not if you start in observe mode. Every call is recorded with the decision that would have applied, and nothing is blocked. You promote rules to enforce once the log shows the policy matches how your agents really work.

What about tool results, not just tool calls?

Results are scanned as untrusted content before the model sees them. A response carrying injected instructions or poisoned output is withheld and replaced with the reason, which matters most for servers that return text other people wrote.

One gateway for every MCP server

Chrome DevTools is one connector. The same policy covers the rest of them, plus the shell commands and file access your agents already have.

Install Prismor How MCP security works

Other developer servers

GitHub

GitLab FIFilesystem

Playwright All servers

Chrome DevTools is a trademark of its respective owner. Prismor is not affiliated with or endorsed by it. The Chrome DevTools MCP server is third-party software; Prismor governs it the same way it governs any MCP server, without modifying it.