Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

io.github.Dayananda-D/devcdp

NPM · DEVCDP

Chrome DevTools for AI assistants: console, network, DOM, source maps, breakpoints, live variables.

Available components

+2 this week 84 Trust /100

Last scanned (15 minutes ago)

Scores higher than 83% of npm servers

Category Browser Automation

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security98
  • No malware found by supply-chain analysis.Pass
  • No known CVEs affecting this package version or its production dependencies.Pass
  • No install/post-install scripts declared.Pass
  • 31 of 95 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency45
Schema Quality & AI Usability76
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 9569 tokens (~129/item across 74 items; 74 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
  • No destabilizing schema changes in the last 30 days.Pass
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • All 2 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
  • An AI judge read all 74 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 17 Oct 26 0
    • Stability: 0.97 → pass security
  • 16 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.

  • 14 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 87 to 90. That category is still filling its 30-day observation window: 26 days of observed history at the previous scan, 27 at this one. The score rises as the window fills, whether or not the server changes.

  • 13 Oct 26 0
    • Security disclosure: unverified → fail ▼ functional
  • 12 Oct 26 +16
    • Malware scan: unverified → pass ▲ security
  • 11 Oct 26 −16
    • Malware scan: pass → unverified ▼ security
    • Security disclosure: fail → unverified ▼ functional
  • 4 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.

  • 2 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 73 to 77. That category is still filling its 30-day observation window: 22 days of observed history at the previous scan, 23 at this one. The score rises as the window fills, whether or not the server changes.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 17 Oct 2026 · Analysed npm/devcdp@5.0.1

Provenance No attestation

The registry publishes no build provenance for this version, so there is nothing to verify.

Result No attestation
Ecosystem npm

Background: How many MCP packages publish verified provenance →

Dependencies 95 packages
Packages resolved 95
Stale 31
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 74 exposed · ~9,569 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
session_get_user_actions ~134

What the human has done in the browser — clicks, typed values, chosen options, submissions — and the element each one touched. Works whether or not you asked, so unprompted help is still readable. Pass the cursor back for only what is new. Values are captured during a handover or takeover; sensitive fields stay redacted.

NameTypeReqDescription
cursornumber–Only actions newer than this seq. 0 for everything retained.
kindsarray–Restrict to these kinds, e.g. ['click','input_change','option_chosen'].
limitnumber–Maximum actions to return.

No output schema declared.

No examples provided.

session_poll_user_action ~47

Check whether the human has completed what session_ask_user requested. Returns acted:false while waiting. Poll at a human pace — a few seconds apart — rather than in a tight loop.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

session_start ~100

Open a debugging session with a goal and an ordered list of steps, so progress is tracked and a failed step can fall back to asking the human. Use it for multi-step reproductions; a single-question investigation does not need it.

NameTypeReqDescription
goalstringyesWhat you are trying to find out or prove.
stepsarrayyesOrdered steps, each { id, description, actor }. actor is 'agent', 'user' or 'either'.

No output schema declared.

No examples provided.

session_step_done ~56

Mark the current step complete with what you found, and advance. Returns the next step, or allDone when the plan is finished.

NameTypeReqDescription
resultstring–What this step established — a real observed value, not a guess.

No output schema declared.

No examples provided.

session_step_failed ~76

Report that you cannot complete the current step yourself. Checks memory for a known recovery first, then tells you how to hand over to the human. Use it for anything automation genuinely cannot do — a login you have no credentials for, a challenge, a physical device.

NameTypeReqDescription
reasonstringyesWhy the step could not be completed.

No output schema declared.

No examples provided.

sessions_list ~49

Show every DevCDP session currently running on this machine and the tabs each one holds. Use it to understand why a tab is unavailable, or to confirm two agents are not fighting over the same page.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

source_get_file ~116

Read an original pre-bundling source file via the page's source maps. Falls back to the loaded script when no map is available, and always tells you which of the two you got, so a bundle line is never mistaken for an original one.

NameTypeReqDescription
end_linenumber–Last line to return (1-based).
pathstringyesOriginal file path or a suffix of it, e.g. 'components/SaveButton.tsx'.
start_linenumber–First line to return (1-based).

No output schema declared.

No examples provided.

source_get_script ~102

Read the source Chrome actually loaded, by scriptId or URL substring, optionally a line range. Lines come back numbered so the numbers you quote to a breakpoint are the numbers you saw.

NameTypeReqDescription
end_linenumber–Last line to return (1-based).
script_idstring–scriptId from source_list_scripts.
start_linenumber–First line to return (1-based).
urlstring–URL substring identifying the script.

No output schema declared.

No examples provided.

source_list_files ~75

List the original source files recoverable from the page's source maps — the pre-bundling file tree. Use it to discover real file paths before calling source_get_file or setting a breakpoint on an original file.

NameTypeReqDescription
filterstring–Only paths containing this substring.
limitnumber–Maximum paths to return.

No output schema declared.

No examples provided.

source_list_scripts ~106

List the JavaScript files loaded in the page, with size and whether each has a source map. This is indexed the moment DevCDP attaches, so it works on a page that was already open. Filter by URL substring to find the file you need before setting a breakpoint.

NameTypeReqDescription
filterstring–Only scripts whose URL contains this substring.
limitnumber–Maximum scripts to return.
with_source_mapsboolean–Only scripts that carry a source map.

No output schema declared.

No examples provided.

source_search ~169

Search the text of every loaded script — and every original file recoverable from source maps — for a string or regular expression. This is the fastest way to locate a handler when you know a function name, a message or a field name but not the file. Returns file, 1-based line and the matching line.

NameTypeReqDescription
context_charsnumber–Characters of the matching line to return.
ignore_caseboolean–Case-insensitive search.
include_original_sourcesboolean–Also search original files from source maps.
max_resultsnumber–Stop after this many matches.
querystringyesText or regular expression to find.
regexboolean–Treat query as a regular expression.
url_filterstring–Only search scripts whose URL contains this.

No output schema declared.

No examples provided.

ui_check ~254

Set a checkbox or radio to a specific state, rather than toggling it blindly. Reads the current state first and clicks only if it differs, so calling it twice does not undo the first call — the usual way a 'toggle' helper leaves a form in the wrong state.

NameTypeReqDescription
checkedboolean–The state you want.
exactboolean–Require the whole text to match rather than a substring.
framestring–'main' (default) or a substring of a frame's origin/name. Single-page apps often render the screen you want in a child frame.
nthnumber–Which match to use when several qualify, 0-based.
rolestring–Narrow the matches to this ARIA role.
selectorstring–CSS selector. Descends into open shadow roots.
testidstring–Value of a test attribute (data-testid and friends — see the testAttributes setting).
textstring–Visible text on the control. Matches the innermost element that carries it, and follows a <label> to its input.
timeout_msnumber–How long to wait for the element to become actionable before giving up.

No output schema declared.

No examples provided.

ui_click ~348

Click an element, identified by CSS selector, visible text or test id. Waits until it is actually clickable — rendered, enabled, stopped moving, and not covered by anything — then dispatches real (trusted) mouse events, and reports what the click caused: requests fired, console errors, whether the DOM changed at all. If it never became clickable it says which of those conditions failed and what was in the way.

NameTypeReqDescription
buttonstring–Which mouse button.
click_countnumber–2 for a double-click.
exactboolean–Require the whole text to match rather than a substring.
forceboolean–Skip the hit-test and click the centre regardless of what is on top. A last resort — it is how you click the wrong thing.
framestring–'main' (default) or a substring of a frame's origin/name. Single-page apps often render the screen you want in a child frame.
modifiersarray–Held while clicking: shift, ctrl, alt, meta.
nthnumber–Which match to use when several qualify, 0-based.
rolestring–Narrow the matches to this ARIA role.
selectorstring–CSS selector. Descends into open shadow roots.
testidstring–Value of a test attribute (data-testid and friends — see the testAttributes setting).
textstring–Visible text on the control. Matches the innermost element that carries it, and follows a <label> to its input.
timeout_msnumber–How long to wait for the element to become actionable before giving up.

No output schema declared.

No examples provided.

ui_drag ~203

Drag one element onto another — reordering rows, moving a card between columns, resizing a split. Dispatches a real press, several intermediate moves and a release, because drag implementations almost always ignore a press followed immediately by a release somewhere else.

NameTypeReqDescription
framestring–'main' (default) or a substring of a frame's origin/name.
selectorstring–CSS selector for what to drag.
stepsnumber–Intermediate move events. More is slower but survives pickier drag handlers.
testidstring–Test id of what to drag.
textstring–Visible text of what to drag.
timeout_msnumber–How long to wait for either element to become actionable.
to_selectorstring–CSS selector for where to drop it.
to_testidstring–Test id of where to drop it.
to_textstring–Visible text of where to drop it.

No output schema declared.

No examples provided.

ui_fill ~360

Set the value of a text field, textarea or contenteditable in one step: assign it and fire input and change. Fast, and it does NOT go through the browser's key-event pipeline — no keydown, no keypress — so the field's own input rules never run. maxlength, digits-only keypress guards and input masks are all bypassed, which is exactly what you want to put a value past a mask and test what happens downstream, and exactly what you do not want when reproducing what a user did: it can leave the field in a state the UI itself would not allow. Use ui_type for that, and for anything reacting per keystroke such as a typeahead.

NameTypeReqDescription
exactboolean–Require the whole text to match rather than a substring.
framestring–'main' (default) or a substring of a frame's origin/name. Single-page apps often render the screen you want in a child frame.
nthnumber–Which match to use when several qualify, 0-based.
rolestring–Narrow the matches to this ARIA role.
selectorstring–CSS selector. Descends into open shadow roots.
submitboolean–Press Enter afterwards.
testidstring–Value of a test attribute (data-testid and friends — see the testAttributes setting).
textstring–Visible text on the control. Matches the innermost element that carries it, and follows a <label> to its input.
timeout_msnumber–How long to wait for the element to become actionable before giving up.
valuestringyesThe text to put in the field. Pass an empty string to clear it.

No output schema declared.

No examples provided.

ui_hover ~234

Move the pointer over an element and leave it there. Use before clicking anything that only appears on hover — dropdown menus, row action buttons, tooltips — because those elements do not exist to click until something is hovering over their parent.

NameTypeReqDescription
exactboolean–Require the whole text to match rather than a substring.
framestring–'main' (default) or a substring of a frame's origin/name. Single-page apps often render the screen you want in a child frame.
nthnumber–Which match to use when several qualify, 0-based.
rolestring–Narrow the matches to this ARIA role.
selectorstring–CSS selector. Descends into open shadow roots.
testidstring–Value of a test attribute (data-testid and friends — see the testAttributes setting).
textstring–Visible text on the control. Matches the innermost element that carries it, and follows a <label> to its input.
timeout_msnumber–How long to wait for the element to become actionable before giving up.

No output schema declared.

No examples provided.

ui_inspect ~148

List what can be interacted with on the current screen — buttons, links, inputs, selects and anything with an interactive ARIA role — with the target you would use to reach each one. Use it when a selector fails and you need to see what is really there. Far cheaper than dumping the DOM, and it names elements the way these tools expect them to be named.

NameTypeReqDescription
filterstring–Only controls whose text, id or name contains this.
framestring–'main' (default) or a substring of a frame's origin/name.
kindstring–Restrict to one family of control.
limitnumber–Maximum controls to return.

No output schema declared.

No examples provided.

ui_press ~338

Press a key — Enter to submit, Tab to move on, Escape to dismiss, arrows to move through a list or grid. Optionally focuses an element first. This is the tool for keyboard-driven screens, where clicking the control is not how the application expects to be used.

NameTypeReqDescription
exactboolean–Require the whole text to match rather than a substring.
framestring–'main' (default) or a substring of a frame's origin/name. Single-page apps often render the screen you want in a child frame.
keystringyesKey name: Enter, Tab, Escape, Backspace, Delete, ArrowUp, ArrowDown, ArrowLeft, ArrowRight, Home, End, PageUp, PageDown, Space.
modifiersarray–Held while pressing: shift, ctrl, alt, meta.
nthnumber–Which match to use when several qualify, 0-based.
rolestring–Narrow the matches to this ARIA role.
selectorstring–CSS selector. Descends into open shadow roots. Optional: focuses this element first.
testidstring–Value of a test attribute (data-testid and friends — see the testAttributes setting). Optional: focuses this element first.
textstring–Visible text on the control. Matches the innermost element that carries it, and follows a <label> to its input. Optional: focuses this element first.
timeout_msnumber–How long to wait for the element to become actionable before giving up.
timesnumber–Press it this many times.

No output schema declared.

No examples provided.

ui_scroll ~178

Scroll the page, or scroll a specific container. Needed before interacting with anything in a virtualised list or grid, where rows outside the viewport do not exist in the DOM at all — scrolling is what creates them.

NameTypeReqDescription
dxnumber–Horizontal pixels; positive is right.
dynumber–Vertical pixels; positive is down.
framestring–'main' (default) or a substring of a frame's origin/name.
selectorstring–CSS selector of the container to scroll. Omit to scroll the page.
testidstring–Test id of the container to scroll.
textstring–Visible text inside the container to scroll.
timeout_msnumber–How long to wait for the container.
tostring–Jump instead of scrolling by an amount.

No output schema declared.

No examples provided.

ui_select ~286

Choose an option in a dropdown, by visible label or by value. Handles a native <select> directly; for the custom dropdowns most applications actually use — a div that opens a list — it opens the control and clicks the matching option. Reports the options it could see when nothing matches, which is usually the whole answer.

NameTypeReqDescription
bystring–Match the label, the value, or either.
exactboolean–Require the whole text to match rather than a substring.
framestring–'main' (default) or a substring of a frame's origin/name. Single-page apps often render the screen you want in a child frame.
nthnumber–Which match to use when several qualify, 0-based.
optionstringyesThe option's visible label, or its value attribute.
rolestring–Narrow the matches to this ARIA role.
selectorstring–CSS selector. Descends into open shadow roots.
testidstring–Value of a test attribute (data-testid and friends — see the testAttributes setting).
textstring–Visible text on the control. Matches the innermost element that carries it, and follows a <label> to its input.
timeout_msnumber–How long to wait for the element to become actionable before giving up.

No output schema declared.

No examples provided.

ui_type ~367

Type into a field one character at a time with real key events, through the same input pipeline a person's keyboard uses — so the field's own rules apply: maxlength truncates, a keypress guard rejects what it rejects, and a mask reformats as it goes. This is the tool for reproducing user behaviour, and for anything reacting per keystroke: search-as-you-type, autocomplete, validation-on-key. Slower than ui_fill by design. Note that typing leaves the field focused and `change` fires on blur, so pass submit:true (or press Tab) when the application validates on change.

NameTypeReqDescription
clear_firstboolean–Select all and delete before typing.
delay_msnumber–Pause between keystrokes. Raise it if the field drops characters.
exactboolean–Require the whole text to match rather than a substring.
framestring–'main' (default) or a substring of a frame's origin/name. Single-page apps often render the screen you want in a child frame.
nthnumber–Which match to use when several qualify, 0-based.
rolestring–Narrow the matches to this ARIA role.
selectorstring–CSS selector. Descends into open shadow roots.
submitboolean–Press Enter afterwards.
testidstring–Value of a test attribute (data-testid and friends — see the testAttributes setting).
textstring–Visible text on the control. Matches the innermost element that carries it, and follows a <label> to its input.
text_to_typestringyesCharacters to type.
timeout_msnumber–How long to wait for the element to become actionable before giving up.

No output schema declared.

No examples provided.

ui_upload ~240

Attach one or more local files to a file input, without opening the operating system's file picker — which automation cannot drive at all. Give the absolute paths of files on the machine running Chrome.

NameTypeReqDescription
exactboolean–Require the whole text to match rather than a substring.
filesarrayyesAbsolute paths to the files to attach.
framestring–'main' (default) or a substring of a frame's origin/name. Single-page apps often render the screen you want in a child frame.
nthnumber–Which match to use when several qualify, 0-based.
rolestring–Narrow the matches to this ARIA role.
selectorstring–CSS selector. Descends into open shadow roots.
testidstring–Value of a test attribute (data-testid and friends — see the testAttributes setting).
textstring–Visible text on the control. Matches the innermost element that carries it, and follows a <label> to its input.
timeout_msnumber–How long to wait for the element to become actionable before giving up.

No output schema declared.

No examples provided.

ui_wait_for ~303

Block until the page reaches a state: an element appears, disappears, becomes enabled, or some text shows up. This is the honest alternative to guessing a sleep — it returns as soon as the condition holds, and when it does not, it says what the page looked like instead of just timing out.

NameTypeReqDescription
contains_textstring–Also require the element to contain this text.
exactboolean–Require the whole text to match rather than a substring.
framestring–'main' (default) or a substring of a frame's origin/name. Single-page apps often render the screen you want in a child frame.
nthnumber–Which match to use when several qualify, 0-based.
rolestring–Narrow the matches to this ARIA role.
selectorstring–CSS selector. Descends into open shadow roots.
statestring–What to wait for: 'visible' (default), 'hidden', 'enabled', 'detached', or 'stable' (present and no longer moving).
testidstring–Value of a test attribute (data-testid and friends — see the testAttributes setting).
textstring–Visible text on the control. Matches the innermost element that carries it, and follows a <label> to its input.
timeout_msnumber–How long to wait for the element to become actionable before giving up.

No output schema declared.

No examples provided.

workflow_guide ~54

How to use DevCDP effectively: the observe/act division of labour, the fastest path from a bug report to an exact line, and the traps worth knowing. Call it once at the start of a debugging session.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

Install

How do I install the io.github.Dayananda-D/devcdp MCP server?

io.github.Dayananda-D/devcdp runs locally as an npm package, launched with npx -y devcdp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

npm · devcdp

# add to Claude Code
claude mcp add dayananda-d-devcdp -- npx -y devcdp
Common questions

What is the io.github.Dayananda-D/devcdp MCP server?

io.github.Dayananda-D/devcdp is an MCP server listed in the public MCP registry as io.github.Dayananda-D/devcdp. Chrome DevTools for AI assistants: console, network, DOM, source maps, breakpoints, live variables. This page covers its npm package (devcdp).

Is the io.github.Dayananda-D/devcdp MCP server safe to use?

io.github.Dayananda-D/devcdp scores 84 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 17 October 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the io.github.Dayananda-D/devcdp MCP server expose?

io.github.Dayananda-D/devcdp exposes 74 tools: workflow_guide, devtools_connect, devtools_status, devtools_disconnect, list_tabs, and 69 more. Their descriptions and schemas cost roughly 9,569 tokens of context every time the server is loaded.

Is the io.github.Dayananda-D/devcdp MCP server still maintained?

io.github.Dayananda-D/devcdp is still listed as active in the MCP registry. We last reached this channel on 17 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the io.github.Dayananda-D/devcdp MCP server under?

io.github.Dayananda-D/devcdp declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.