Chrome Debugger MCP
NPM · CHROME-DEBUGGER-MCP · SCANNED AUG 3
Chrome breakpoint debugging MCP server for inspecting runtime values and stepping through code
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →
Supply Chain Security87
- No malware found by supply-chain analysis.Pass
- Only part of the dependency tree could be resolved (98 of 102), so this covers what we could see, not the whole tree.Partial
- No install/post-install scripts declared.Pass
- Only part of the dependency tree could be resolved (98 of 102), so this covers what we could see, not the whole tree. View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 140 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability40
- AI-judged instruction clarity (poor).Fail
- Context-footprint check failed: tool/resource definitions use about 2107 tokens (~117/item across 18 items; 18 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management27
- Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.
npm · chrome-debugger-mcp
claude mcp add bitepro-chrome-debugger-mcp -- npx -y chrome-debugger-mcp
codex mcp add bitepro-chrome-debugger-mcp -- npx -y chrome-debugger-mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"bitepro-chrome-debugger-mcp": {
"type": "local",
"command": [
"npx",
"-y",
"chrome-debugger-mcp"
],
"enabled": true
}
}
} openclaw mcp add bitepro-chrome-debugger-mcp --command npx --arg -y --arg chrome-debugger-mcp
mcp_servers:
bitepro-chrome-debugger-mcp:
command: "npx"
args: ["-y", "chrome-debugger-mcp"] {
"mcpServers": {
"bitepro-chrome-debugger-mcp": {
"command": "npx",
"args": [
"-y",
"chrome-debugger-mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 2 Aug 26 +57
- Provenance: unverified → fail ▼ security
- Install scripts: unverified → pass ▲ security
- Known CVEs: unverified → partial ▲ security
- Malware scan: unverified → pass ▲ security
- Security disclosure: fail → unverified ▼ functional
- Tool coverage: unverified → 100 ▲ functional
- License: unverified → pass ▲ functional
- Dependency health: unverified → partial ▲ functional
- Maintenance: unverified → pass ▲ functional
- MCP protocol: unverified → pass ▲ functional
- Stability: unverified → 0.23 ▲ functional
- Schema quality: unverified → poor ▲ functional
- Licence: MIT functional
- 1 Aug 26 −15
- Tool coverage: 100 → unverified ▼ functional
- First check of Schema quality: unverified functional
- 31 Jul 26 −8
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 30 Jul 26 −18
- Malware scan: pass → unverified ▼ security
- 27 Jul 26 46
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 3 Aug 2026 · Analysed npm/[email protected]
Provenance none
Ecosystem: npm · Outcome: none
Dependencies 98 packages
98 packages in the resolved dependency tree · 98 deprecated · 29 stale.
The dependency tree was only partially resolved, so these counts may be incomplete.
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.
connect ~154
[STEP 3] Connect the debugger to a specific Chrome tab. MANDATORY: call listTargets first, show the list to the user, wait for their explicit URL confirmation, then call this. NEVER guess the URL. NEVER skip user confirmation — even if only one tab is visible. targetUrl must be a unique substring of the tab URL the user confirmed (e.g. "localhost:5173"). Relay the "_ui" field from the response to the user.
| Name | Type | Req | Description |
|---|---|---|---|
| port | integer | — | Chrome remote debugging port (default 9222) |
| targetUrl | string | yes | Unique substring of the tab URL confirmed by the user (e.g. 'localhost:5173'). REQUIRED — always obtain from user confirmation. |
No output schema declared.
No examples provided.
disconnect ~32
Disconnect the current Chrome debugging session and clear in-memory pause state. Use this to explicitly end a debug session before connecting again.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
evaluate ~100
[STEP 6b] Evaluate any JavaScript expression in the context of the currently paused call frame. Use this to inspect nested objects, call methods, compute derived values, or verify conditions at runtime. Complements getScopeVariables for values not directly visible in scope (e.g. this.state, JSON.stringify(obj)).
| Name | Type | Req | Description |
|---|---|---|---|
| expression | string | yes | JavaScript expression to evaluate |
| frameIndex | integer | — | Call frame index (default 0) |
No output schema declared.
No examples provided.
forcePause ~39
Force the debugger to pause at the very next JavaScript statement. Useful when you cannot modify source code to add debugger; and setBreakpoint is not feasible.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
getScopeVariables ~103
[STEP 6a] Read all scope variables (local, closure, module) at the currently paused call frame. Call this immediately after waitForSpecificPause or waitForPause returns. Results are grouped by scope type; global scope is skipped. Use frameIndex=1, 2, ... to inspect variables in parent call frames up the stack.
| Name | Type | Req | Description |
|---|---|---|---|
| frameIndex | integer | — | Call frame index (default 0, the topmost frame) |
No output schema declared.
No examples provided.
getStatus ~73
Non-blocking: return current connection and pause state immediately without waiting. Use this to poll for pause instead of waitForPause when the MCP client has a short request timeout (e.g. MCP Inspector ~10s). Returns: connected, paused, targetUrl, pauseReason, hitBreakpoints, callStack.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
launchChrome ~262
[STEP 1] Launch a dedicated Chrome instance with remote debugging enabled (default port 9222). Uses --user-data-dir=~/.chrome-debug-profile so your normal Chrome keeps running (dual-instance). Auto-detects if the debug port is already active and skips launch (alreadyRunning=true). Use dryRun=true to preview the command — show it to the user and ask for confirmation before executing. Set openDevTools=true to automatically open DevTools panel for every new tab. If automatic launch does not succeed, relay the returned command to the user and ask them to run it manually. Relay the "_ui" field from the response to the user.
| Name | Type | Req | Description |
|---|---|---|---|
| chromePath | string | — | Chrome executable path. Overrides platform defaults and CHROME_PATH/GOOGLE_CHROME_BIN. |
| dryRun | boolean | — | If true, return the launch command without executing it |
| openDevTools | boolean | — | If true, adds --auto-open-devtools-for-tabs so DevTools opens automatically for every new tab |
| port | integer | — | Remote debugging port (default 9222) |
| url | string | — | URL to open immediately after launch |
| userDataDir | string | — | Profile directory for the debug instance (default ~/.chrome-debug-profile) |
No output schema declared.
No examples provided.
listTargets ~100
[STEP 2] List all open Chrome tabs available for debugging. MANDATORY: show the full list to the user and ask "Which URL do you want to debug?" NEVER skip this step, NEVER guess — even if only one tab is open. Wait for the user's explicit reply before proceeding to connect(). Relay the "_ui" field from the response to the user.
| Name | Type | Req | Description |
|---|---|---|---|
| port | integer | — | Chrome remote debugging port (default 9222) |
No output schema declared.
No examples provided.
reloadPage ~177
[STEP 5a] Reload the connected page via Chrome DevTools Protocol. More reliable than manual browser refresh — maintains the CDP connection and ensures debugger; statements and setBreakpoint() calls resolve correctly when scripts reload. Always call this after inserting debugger; in source code or after setBreakpoint(), before waitForSpecificPause/waitForPause. ⚠️ CRITICAL TURN RULE: After this tool returns, you MUST immediately call waitForSpecificPause (or waitForPause) in the SAME AI turn — do NOT end your turn here. waitForSpecificPause is a blocking call that will notify the user to trigger the page action and wait for the breakpoint internally. If you end your turn after reloadPage, the session will break.
| Name | Type | Req | Description |
|---|---|---|---|
| ignoreCache | boolean | — | Hard reload ignoring cache (default false) |
No output schema declared.
No examples provided.
removeBreakpoint ~39
Remove a previously set CDP breakpoint by its ID (returned by setBreakpoint).
| Name | Type | Req | Description |
|---|---|---|---|
| breakpointId | string | yes | The breakpoint ID returned by setBreakpoint |
No output schema declared.
No examples provided.
resume ~60
[STEP 8] Resume script execution after collecting all needed variable data — ends the current pause. After calling resume, remove all temporary debugger; statements added to source code during this session. Relay the "_ui" field from the response to the user.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
setBreakpoint ~129
Set a breakpoint at a specific script URL and line number via CDP — no source code modification needed. Use a full URL (https://...) for exact match, or a partial filename/keyword for regex match. Alternative to inserting debugger; when you cannot modify the source file. After setting, call reloadPage() to ensure the breakpoint resolves correctly.
| Name | Type | Req | Description |
|---|---|---|---|
| column | integer | — | 0-based column number |
| condition | string | — | Conditional breakpoint expression |
| line | integer | yes | 0-based line number |
| url | string | yes | Script URL or URL pattern to match |
No output schema declared.
No examples provided.
startDebuggingSession ~107
CALL THIS FIRST whenever browser-side debugging is needed — before any other tool. Auto-trigger when user mentions any of: debug, breakpoint, debugger, inspect, trace, step through, runtime value, variable value, why is this, implement based on API response, bug, error, unexpected behavior, not working, check this, confirm this. Returns the complete debugging workflow and critical rules. The response contains a "_ui" field — relay it to the user verbatim.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
stepInto ~64
[STEP 7] BLOCKING: step into the next function call, then wait until the debugger pauses again. Follow with getScopeVariables() to observe inner-function state.
| Name | Type | Req | Description |
|---|---|---|---|
| timeout | integer | — | Timeout in milliseconds to wait for the next pause (default 30000) |
No output schema declared.
No examples provided.
stepOut ~68
[STEP 7] BLOCKING: step out of the current function and wait until the debugger pauses again in the caller. Use to observe the return value and the state of the calling context.
| Name | Type | Req | Description |
|---|---|---|---|
| timeout | integer | — | Timeout in milliseconds to wait for the next pause (default 30000) |
No output schema declared.
No examples provided.
stepOver ~68
[STEP 7] BLOCKING: step over the current statement without entering function calls, then wait until the debugger pauses again. Follow with getScopeVariables() to observe how local variables change.
| Name | Type | Req | Description |
|---|---|---|---|
| timeout | integer | — | Timeout in milliseconds to wait for the next pause (default 30000) |
No output schema declared.
No examples provided.
waitForPause ~175
[STEP 5b — FALLBACK] BLOCKING call — waits until ANY debugger pause occurs (breakpoint, debugger; statement, or exception). Before blocking, sends a notification to the user to trigger the page action. Must be called IMMEDIATELY after reloadPage() in the SAME AI turn — do NOT end your turn before calling this. Prefer waitForSpecificPause when you know the exact file and line — it uses smarter two-tier matching. Use this only when the target location is unknown or when setBreakpoint is used without a specific line.
| Name | Type | Req | Description |
|---|---|---|---|
| actionHint | string | — | Optional hint to tell the user what action to perform on the page (e.g. 'click the button', 'submit the form'). |
| timeout | integer | — | Timeout in milliseconds (default 30000) |
No output schema declared.
No examples provided.
waitForSpecificPause ~357
[STEP 5b — PREFERRED] BLOCKING call — waits for the next debugger pause, then checks if it matches the target location. ⚠️ NO AUTO-RESUME: execution stays paused after this returns, regardless of matched value. You decide what to do based on the "matched" field in the response: matched=true → call getScopeVariables() immediately to read variables matched=false → the wrong breakpoint fired; call resume() to continue, then call waitForSpecificPause() again if you need to wait for the next pause. Must be called IMMEDIATELY after reloadPage() in the SAME AI turn. Before blocking, sends a notification to the user to trigger the page action. Editor line N → pass line=N-1 (CDP uses 0-based line numbers). Relay the "_ui" field from the response to the user once it returns.
| Name | Type | Req | Description |
|---|---|---|---|
| actionHint | string | — | Describe the page action to trigger the breakpoint (e.g. 'click the Search button'). Shown in the waiting notification to the user. |
| line | integer | yes | 0-based line number where debugger; was inserted. Editor line N → pass N-1. |
| lineTolerance | integer | — | ±line tolerance for Tier 1 matching (default 10). Increase to 20+ for heavily bundled code. |
| timeout | integer | — | Timeout in ms to wait for any pause (default 90000). Increase for slow interactions. |
| urlFragment | string | yes | Substring of the script URL where debugger; was added (e.g. 'LoginForm.vue', 'utils.ts'). Does NOT need to be the full URL. |
No output schema declared.
No examples provided.