Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

Chrome Debugger MCP

NPM · CHROME-DEBUGGER-MCP · SCANNED SEP 22

Chrome breakpoint debugging MCP server for inspecting runtime values and stepping through code

Available components

0 this week 83 Trust /100
Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security98
  • No malware found by supply-chain analysis.Pass
  • No known CVEs affecting this package version or its production dependencies.Pass
  • No install/post-install scripts declared.Pass
  • 31 of 99 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency45
Schema Quality & AI Usability78
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 2107 tokens (~117/item across 18 items; 18 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management97
  • Stability observed for 29 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
Tool Safety75
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • 0 of 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "removeBreakpoint" implies "remove" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
  • An AI judge read all 18 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Install

How do I install the Chrome Debugger MCP server?

Chrome Debugger MCP runs locally as an npm package, launched with npx -y chrome-debugger-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

npm · chrome-debugger-mcp

# add to Claude Code
claude mcp add bitepro-chrome-debugger-mcp -- npx -y chrome-debugger-mcp
// .cursor/mcp.json
{
  "mcpServers": {
    "bitepro-chrome-debugger-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "chrome-debugger-mcp"
      ]
    }
  }
}
// .vscode/mcp.json
{
  "servers": {
    "bitepro-chrome-debugger-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "chrome-debugger-mcp"
      ]
    }
  }
}
# add to Codex CLI
codex mcp add bitepro-chrome-debugger-mcp -- npx -y chrome-debugger-mcp
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "bitepro-chrome-debugger-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "chrome-debugger-mcp"
      ],
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add bitepro-chrome-debugger-mcp --command npx --arg -y --arg chrome-debugger-mcp
# ~/.hermes/config.yaml
mcp_servers:
  bitepro-chrome-debugger-mcp:
    command: "npx"
    args: ["-y", "chrome-debugger-mcp"]
// ~/.netclaw/config/netclaw.json
{
  "McpServers": {
    "bitepro-chrome-debugger-mcp": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "chrome-debugger-mcp"
      ]
    }
  }
}
# add to Vellum
assistant mcp add bitepro-chrome-debugger-mcp -t stdio -c npx -a -y chrome-debugger-mcp
// mcp.json
{
  "mcpServers": {
    "bitepro-chrome-debugger-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "chrome-debugger-mcp"
      ]
    }
  }
}
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 22 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.

  • 20 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 87 to 90. That category is still filling its 30-day observation window: 26 days of observed history at the previous scan, 27 at this one. The score rises as the window fills, whether or not the server changes.

  • 18 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.

  • 17 Sept 26 −3
    • Stability: pass → 0.80 functional
  • 16 Sept 26 0
    • Stability: 0.97 → pass security
  • 15 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.

  • 14 Sept 26 0
    • Security disclosure: unverified → fail functional
  • 13 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 87 to 90. That category is still filling its 30-day observation window: 26 days of observed history at the previous scan, 27 at this one. The score rises as the window fills, whether or not the server changes.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 22 Sept 2026 · Analysed npm/chrome-debugger-mcp@1.0.4

Provenance No attestation

The registry publishes no build provenance for this version, so there is nothing to verify.

Result No attestation
Ecosystem npm

Background: How many MCP packages publish verified provenance →

Dependencies 99 packages
Packages resolved 99
Stale 31
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 18 exposed · ~2,107 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
connect ~154

[STEP 3] Connect the debugger to a specific Chrome tab. MANDATORY: call listTargets first, show the list to the user, wait for their explicit URL confirmation, then call this. NEVER guess the URL. NEVER skip user confirmation — even if only one tab is visible. targetUrl must be a unique substring of the tab URL the user confirmed (e.g. "localhost:5173"). Relay the "_ui" field from the response to the user.

NameTypeReqDescription
portintegerChrome remote debugging port (default 9222)
targetUrlstringyesUnique substring of the tab URL confirmed by the user (e.g. 'localhost:5173'). REQUIRED — always obtain from user confirmation.

No output schema declared.

No examples provided.

disconnect ~32

Disconnect the current Chrome debugging session and clear in-memory pause state. Use this to explicitly end a debug session before connecting again.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

evaluate ~100

[STEP 6b] Evaluate any JavaScript expression in the context of the currently paused call frame. Use this to inspect nested objects, call methods, compute derived values, or verify conditions at runtime. Complements getScopeVariables for values not directly visible in scope (e.g. this.state, JSON.stringify(obj)).

NameTypeReqDescription
expressionstringyesJavaScript expression to evaluate
frameIndexintegerCall frame index (default 0)

No output schema declared.

No examples provided.

forcePause ~39

Force the debugger to pause at the very next JavaScript statement. Useful when you cannot modify source code to add debugger; and setBreakpoint is not feasible.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

getScopeVariables ~103

[STEP 6a] Read all scope variables (local, closure, module) at the currently paused call frame. Call this immediately after waitForSpecificPause or waitForPause returns. Results are grouped by scope type; global scope is skipped. Use frameIndex=1, 2, ... to inspect variables in parent call frames up the stack.

NameTypeReqDescription
frameIndexintegerCall frame index (default 0, the topmost frame)

No output schema declared.

No examples provided.

getStatus ~73

Non-blocking: return current connection and pause state immediately without waiting. Use this to poll for pause instead of waitForPause when the MCP client has a short request timeout (e.g. MCP Inspector ~10s). Returns: connected, paused, targetUrl, pauseReason, hitBreakpoints, callStack.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

launchChrome ~262

[STEP 1] Launch a dedicated Chrome instance with remote debugging enabled (default port 9222). Uses --user-data-dir=~/.chrome-debug-profile so your normal Chrome keeps running (dual-instance). Auto-detects if the debug port is already active and skips launch (alreadyRunning=true). Use dryRun=true to preview the command — show it to the user and ask for confirmation before executing. Set openDevTools=true to automatically open DevTools panel for every new tab. If automatic launch does not succeed, relay the returned command to the user and ask them to run it manually. Relay the "_ui" field from the response to the user.

NameTypeReqDescription
chromePathstringChrome executable path. Overrides platform defaults and CHROME_PATH/GOOGLE_CHROME_BIN.
dryRunbooleanIf true, return the launch command without executing it
openDevToolsbooleanIf true, adds --auto-open-devtools-for-tabs so DevTools opens automatically for every new tab
portintegerRemote debugging port (default 9222)
urlstringURL to open immediately after launch
userDataDirstringProfile directory for the debug instance (default ~/.chrome-debug-profile)

No output schema declared.

No examples provided.

listTargets ~100

[STEP 2] List all open Chrome tabs available for debugging. MANDATORY: show the full list to the user and ask "Which URL do you want to debug?" NEVER skip this step, NEVER guess — even if only one tab is open. Wait for the user's explicit reply before proceeding to connect(). Relay the "_ui" field from the response to the user.

NameTypeReqDescription
portintegerChrome remote debugging port (default 9222)

No output schema declared.

No examples provided.

reloadPage ~177

[STEP 5a] Reload the connected page via Chrome DevTools Protocol. More reliable than manual browser refresh — maintains the CDP connection and ensures debugger; statements and setBreakpoint() calls resolve correctly when scripts reload. Always call this after inserting debugger; in source code or after setBreakpoint(), before waitForSpecificPause/waitForPause. ⚠️ CRITICAL TURN RULE: After this tool returns, you MUST immediately call waitForSpecificPause (or waitForPause) in the SAME AI turn — do NOT end your turn here. waitForSpecificPause is a blocking call that will notify the user to trigger the page action and wait for the breakpoint internally. If you end your turn after reloadPage, the session will break.

NameTypeReqDescription
ignoreCachebooleanHard reload ignoring cache (default false)

No output schema declared.

No examples provided.

removeBreakpoint ~39

Remove a previously set CDP breakpoint by its ID (returned by setBreakpoint).

NameTypeReqDescription
breakpointIdstringyesThe breakpoint ID returned by setBreakpoint

No output schema declared.

No examples provided.

resume ~60

[STEP 8] Resume script execution after collecting all needed variable data — ends the current pause. After calling resume, remove all temporary debugger; statements added to source code during this session. Relay the "_ui" field from the response to the user.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

setBreakpoint ~129

Set a breakpoint at a specific script URL and line number via CDP — no source code modification needed. Use a full URL (https://...) for exact match, or a partial filename/keyword for regex match. Alternative to inserting debugger; when you cannot modify the source file. After setting, call reloadPage() to ensure the breakpoint resolves correctly.

NameTypeReqDescription
columninteger0-based column number
conditionstringConditional breakpoint expression
lineintegeryes0-based line number
urlstringyesScript URL or URL pattern to match

No output schema declared.

No examples provided.

startDebuggingSession ~107

CALL THIS FIRST whenever browser-side debugging is needed — before any other tool. Auto-trigger when user mentions any of: debug, breakpoint, debugger, inspect, trace, step through, runtime value, variable value, why is this, implement based on API response, bug, error, unexpected behavior, not working, check this, confirm this. Returns the complete debugging workflow and critical rules. The response contains a "_ui" field — relay it to the user verbatim.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

stepInto ~64

[STEP 7] BLOCKING: step into the next function call, then wait until the debugger pauses again. Follow with getScopeVariables() to observe inner-function state.

NameTypeReqDescription
timeoutintegerTimeout in milliseconds to wait for the next pause (default 30000)

No output schema declared.

No examples provided.

stepOut ~68

[STEP 7] BLOCKING: step out of the current function and wait until the debugger pauses again in the caller. Use to observe the return value and the state of the calling context.

NameTypeReqDescription
timeoutintegerTimeout in milliseconds to wait for the next pause (default 30000)

No output schema declared.

No examples provided.

stepOver ~68

[STEP 7] BLOCKING: step over the current statement without entering function calls, then wait until the debugger pauses again. Follow with getScopeVariables() to observe how local variables change.

NameTypeReqDescription
timeoutintegerTimeout in milliseconds to wait for the next pause (default 30000)

No output schema declared.

No examples provided.

waitForPause ~175

[STEP 5b — FALLBACK] BLOCKING call — waits until ANY debugger pause occurs (breakpoint, debugger; statement, or exception). Before blocking, sends a notification to the user to trigger the page action. Must be called IMMEDIATELY after reloadPage() in the SAME AI turn — do NOT end your turn before calling this. Prefer waitForSpecificPause when you know the exact file and line — it uses smarter two-tier matching. Use this only when the target location is unknown or when setBreakpoint is used without a specific line.

NameTypeReqDescription
actionHintstringOptional hint to tell the user what action to perform on the page (e.g. 'click the button', 'submit the form').
timeoutintegerTimeout in milliseconds (default 30000)

No output schema declared.

No examples provided.

waitForSpecificPause ~357

[STEP 5b — PREFERRED] BLOCKING call — waits for the next debugger pause, then checks if it matches the target location. ⚠️ NO AUTO-RESUME: execution stays paused after this returns, regardless of matched value. You decide what to do based on the "matched" field in the response: matched=true → call getScopeVariables() immediately to read variables matched=false → the wrong breakpoint fired; call resume() to continue, then call waitForSpecificPause() again if you need to wait for the next pause. Must be called IMMEDIATELY after reloadPage() in the SAME AI turn. Before blocking, sends a notification to the user to trigger the page action. Editor line N → pass line=N-1 (CDP uses 0-based line numbers). Relay the "_ui" field from the response to the user once it returns.

NameTypeReqDescription
actionHintstringDescribe the page action to trigger the breakpoint (e.g. 'click the Search button'). Shown in the waiting notification to the user.
lineintegeryes0-based line number where debugger; was inserted. Editor line N → pass N-1.
lineToleranceinteger±line tolerance for Tier 1 matching (default 10). Increase to 20+ for heavily bundled code.
timeoutintegerTimeout in ms to wait for any pause (default 90000). Increase for slow interactions.
urlFragmentstringyesSubstring of the script URL where debugger; was added (e.g. 'LoginForm.vue', 'utils.ts'). Does NOT need to be the full URL.

No output schema declared.

No examples provided.

Common questions

What is the Chrome Debugger MCP server?

Chrome Debugger MCP is listed in the public MCP registry as io.github.BitePro/chrome-debugger-mcp. Chrome breakpoint debugging MCP server for inspecting runtime values and stepping through code. This page covers its npm package (chrome-debugger-mcp).

Is the Chrome Debugger MCP server safe to use?

Chrome Debugger MCP scores 83 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 22 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the Chrome Debugger MCP server expose?

Chrome Debugger MCP exposes 18 tools: startDebuggingSession, launchChrome, listTargets, connect, disconnect, and 13 more. Their descriptions and schemas cost roughly 2,107 tokens of context every time the server is loaded.

Is the Chrome Debugger MCP server still maintained?

Chrome Debugger MCP is still listed as active in the MCP registry. We last reached this channel on 22 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the Chrome Debugger MCP server under?

Chrome Debugger MCP declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.