io.github.Dayananda-D/devcdp
NPM · DEVCDP
Chrome DevTools for AI assistants: console, network, DOM, source maps, breakpoints, live variables.
Available components
Last scanned (15 minutes ago)
Scores higher than 83% of npm servers
Category Browser Automation
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 31 of 95 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 37 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability76
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 9569 tokens (~129/item across 74 items; 74 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 2 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 74 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 17 Oct 26 0
- Stability: 0.97 → pass security
- 16 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.
- 14 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 87 to 90. That category is still filling its 30-day observation window: 26 days of observed history at the previous scan, 27 at this one. The score rises as the window fills, whether or not the server changes.
- 13 Oct 26 0
- Security disclosure: unverified → fail ▼ functional
- 12 Oct 26 +16
- Malware scan: unverified → pass ▲ security
- 11 Oct 26 −16
- Malware scan: pass → unverified ▼ security
- Security disclosure: fail → unverified ▼ functional
- 4 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.
- 2 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 73 to 77. That category is still filling its 30-day observation window: 22 days of observed history at the previous scan, 23 at this one. The score rises as the window fills, whether or not the server changes.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 17 Oct 2026 · Analysed npm/devcdp@5.0.1
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Dependencies 95 packages
| Packages resolved | 95 |
|---|---|
| Stale | 31 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
session_get_user_actions ~134
What the human has done in the browser — clicks, typed values, chosen options, submissions — and the element each one touched. Works whether or not you asked, so unprompted help is still readable. Pass the cursor back for only what is new. Values are captured during a handover or takeover; sensitive fields stay redacted.
| Name | Type | Req | Description |
|---|---|---|---|
| cursor | number | – | Only actions newer than this seq. 0 for everything retained. |
| kinds | array | – | Restrict to these kinds, e.g. ['click','input_change','option_chosen']. |
| limit | number | – | Maximum actions to return. |
No output schema declared.
No examples provided.
session_poll_user_action ~47
Check whether the human has completed what session_ask_user requested. Returns acted:false while waiting. Poll at a human pace — a few seconds apart — rather than in a tight loop.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
session_start ~100
Open a debugging session with a goal and an ordered list of steps, so progress is tracked and a failed step can fall back to asking the human. Use it for multi-step reproductions; a single-question investigation does not need it.
| Name | Type | Req | Description |
|---|---|---|---|
| goal | string | yes | What you are trying to find out or prove. |
| steps | array | yes | Ordered steps, each { id, description, actor }. actor is 'agent', 'user' or 'either'. |
No output schema declared.
No examples provided.
session_step_done ~56
Mark the current step complete with what you found, and advance. Returns the next step, or allDone when the plan is finished.
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | – | What this step established — a real observed value, not a guess. |
No output schema declared.
No examples provided.
session_step_failed ~76
Report that you cannot complete the current step yourself. Checks memory for a known recovery first, then tells you how to hand over to the human. Use it for anything automation genuinely cannot do — a login you have no credentials for, a challenge, a physical device.
| Name | Type | Req | Description |
|---|---|---|---|
| reason | string | yes | Why the step could not be completed. |
No output schema declared.
No examples provided.
sessions_list ~49
Show every DevCDP session currently running on this machine and the tabs each one holds. Use it to understand why a tab is unavailable, or to confirm two agents are not fighting over the same page.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
source_get_file ~116
Read an original pre-bundling source file via the page's source maps. Falls back to the loaded script when no map is available, and always tells you which of the two you got, so a bundle line is never mistaken for an original one.
| Name | Type | Req | Description |
|---|---|---|---|
| end_line | number | – | Last line to return (1-based). |
| path | string | yes | Original file path or a suffix of it, e.g. 'components/SaveButton.tsx'. |
| start_line | number | – | First line to return (1-based). |
No output schema declared.
No examples provided.
source_get_script ~102
Read the source Chrome actually loaded, by scriptId or URL substring, optionally a line range. Lines come back numbered so the numbers you quote to a breakpoint are the numbers you saw.
| Name | Type | Req | Description |
|---|---|---|---|
| end_line | number | – | Last line to return (1-based). |
| script_id | string | – | scriptId from source_list_scripts. |
| start_line | number | – | First line to return (1-based). |
| url | string | – | URL substring identifying the script. |
No output schema declared.
No examples provided.
source_list_files ~75
List the original source files recoverable from the page's source maps — the pre-bundling file tree. Use it to discover real file paths before calling source_get_file or setting a breakpoint on an original file.
| Name | Type | Req | Description |
|---|---|---|---|
| filter | string | – | Only paths containing this substring. |
| limit | number | – | Maximum paths to return. |
No output schema declared.
No examples provided.
source_list_scripts ~106
List the JavaScript files loaded in the page, with size and whether each has a source map. This is indexed the moment DevCDP attaches, so it works on a page that was already open. Filter by URL substring to find the file you need before setting a breakpoint.
| Name | Type | Req | Description |
|---|---|---|---|
| filter | string | – | Only scripts whose URL contains this substring. |
| limit | number | – | Maximum scripts to return. |
| with_source_maps | boolean | – | Only scripts that carry a source map. |
No output schema declared.
No examples provided.
source_search ~169
Search the text of every loaded script — and every original file recoverable from source maps — for a string or regular expression. This is the fastest way to locate a handler when you know a function name, a message or a field name but not the file. Returns file, 1-based line and the matching line.
| Name | Type | Req | Description |
|---|---|---|---|
| context_chars | number | – | Characters of the matching line to return. |
| ignore_case | boolean | – | Case-insensitive search. |
| include_original_sources | boolean | – | Also search original files from source maps. |
| max_results | number | – | Stop after this many matches. |
| query | string | yes | Text or regular expression to find. |
| regex | boolean | – | Treat query as a regular expression. |
| url_filter | string | – | Only search scripts whose URL contains this. |
No output schema declared.
No examples provided.
ui_check ~254
Set a checkbox or radio to a specific state, rather than toggling it blindly. Reads the current state first and clicks only if it differs, so calling it twice does not undo the first call — the usual way a 'toggle' helper leaves a form in the wrong state.
| Name | Type | Req | Description |
|---|---|---|---|
| checked | boolean | – | The state you want. |
| exact | boolean | – | Require the whole text to match rather than a substring. |
| frame | string | – | 'main' (default) or a substring of a frame's origin/name. Single-page apps often render the screen you want in a child frame. |
| nth | number | – | Which match to use when several qualify, 0-based. |
| role | string | – | Narrow the matches to this ARIA role. |
| selector | string | – | CSS selector. Descends into open shadow roots. |
| testid | string | – | Value of a test attribute (data-testid and friends — see the testAttributes setting). |
| text | string | – | Visible text on the control. Matches the innermost element that carries it, and follows a <label> to its input. |
| timeout_ms | number | – | How long to wait for the element to become actionable before giving up. |
No output schema declared.
No examples provided.
ui_click ~348
Click an element, identified by CSS selector, visible text or test id. Waits until it is actually clickable — rendered, enabled, stopped moving, and not covered by anything — then dispatches real (trusted) mouse events, and reports what the click caused: requests fired, console errors, whether the DOM changed at all. If it never became clickable it says which of those conditions failed and what was in the way.
| Name | Type | Req | Description |
|---|---|---|---|
| button | string | – | Which mouse button. |
| click_count | number | – | 2 for a double-click. |
| exact | boolean | – | Require the whole text to match rather than a substring. |
| force | boolean | – | Skip the hit-test and click the centre regardless of what is on top. A last resort — it is how you click the wrong thing. |
| frame | string | – | 'main' (default) or a substring of a frame's origin/name. Single-page apps often render the screen you want in a child frame. |
| modifiers | array | – | Held while clicking: shift, ctrl, alt, meta. |
| nth | number | – | Which match to use when several qualify, 0-based. |
| role | string | – | Narrow the matches to this ARIA role. |
| selector | string | – | CSS selector. Descends into open shadow roots. |
| testid | string | – | Value of a test attribute (data-testid and friends — see the testAttributes setting). |
| text | string | – | Visible text on the control. Matches the innermost element that carries it, and follows a <label> to its input. |
| timeout_ms | number | – | How long to wait for the element to become actionable before giving up. |
No output schema declared.
No examples provided.
ui_drag ~203
Drag one element onto another — reordering rows, moving a card between columns, resizing a split. Dispatches a real press, several intermediate moves and a release, because drag implementations almost always ignore a press followed immediately by a release somewhere else.
| Name | Type | Req | Description |
|---|---|---|---|
| frame | string | – | 'main' (default) or a substring of a frame's origin/name. |
| selector | string | – | CSS selector for what to drag. |
| steps | number | – | Intermediate move events. More is slower but survives pickier drag handlers. |
| testid | string | – | Test id of what to drag. |
| text | string | – | Visible text of what to drag. |
| timeout_ms | number | – | How long to wait for either element to become actionable. |
| to_selector | string | – | CSS selector for where to drop it. |
| to_testid | string | – | Test id of where to drop it. |
| to_text | string | – | Visible text of where to drop it. |
No output schema declared.
No examples provided.
ui_fill ~360
Set the value of a text field, textarea or contenteditable in one step: assign it and fire input and change. Fast, and it does NOT go through the browser's key-event pipeline — no keydown, no keypress — so the field's own input rules never run. maxlength, digits-only keypress guards and input masks are all bypassed, which is exactly what you want to put a value past a mask and test what happens downstream, and exactly what you do not want when reproducing what a user did: it can leave the field in a state the UI itself would not allow. Use ui_type for that, and for anything reacting per keystroke such as a typeahead.
| Name | Type | Req | Description |
|---|---|---|---|
| exact | boolean | – | Require the whole text to match rather than a substring. |
| frame | string | – | 'main' (default) or a substring of a frame's origin/name. Single-page apps often render the screen you want in a child frame. |
| nth | number | – | Which match to use when several qualify, 0-based. |
| role | string | – | Narrow the matches to this ARIA role. |
| selector | string | – | CSS selector. Descends into open shadow roots. |
| submit | boolean | – | Press Enter afterwards. |
| testid | string | – | Value of a test attribute (data-testid and friends — see the testAttributes setting). |
| text | string | – | Visible text on the control. Matches the innermost element that carries it, and follows a <label> to its input. |
| timeout_ms | number | – | How long to wait for the element to become actionable before giving up. |
| value | string | yes | The text to put in the field. Pass an empty string to clear it. |
No output schema declared.
No examples provided.
ui_hover ~234
Move the pointer over an element and leave it there. Use before clicking anything that only appears on hover — dropdown menus, row action buttons, tooltips — because those elements do not exist to click until something is hovering over their parent.
| Name | Type | Req | Description |
|---|---|---|---|
| exact | boolean | – | Require the whole text to match rather than a substring. |
| frame | string | – | 'main' (default) or a substring of a frame's origin/name. Single-page apps often render the screen you want in a child frame. |
| nth | number | – | Which match to use when several qualify, 0-based. |
| role | string | – | Narrow the matches to this ARIA role. |
| selector | string | – | CSS selector. Descends into open shadow roots. |
| testid | string | – | Value of a test attribute (data-testid and friends — see the testAttributes setting). |
| text | string | – | Visible text on the control. Matches the innermost element that carries it, and follows a <label> to its input. |
| timeout_ms | number | – | How long to wait for the element to become actionable before giving up. |
No output schema declared.
No examples provided.
ui_inspect ~148
List what can be interacted with on the current screen — buttons, links, inputs, selects and anything with an interactive ARIA role — with the target you would use to reach each one. Use it when a selector fails and you need to see what is really there. Far cheaper than dumping the DOM, and it names elements the way these tools expect them to be named.
| Name | Type | Req | Description |
|---|---|---|---|
| filter | string | – | Only controls whose text, id or name contains this. |
| frame | string | – | 'main' (default) or a substring of a frame's origin/name. |
| kind | string | – | Restrict to one family of control. |
| limit | number | – | Maximum controls to return. |
No output schema declared.
No examples provided.
ui_press ~338
Press a key — Enter to submit, Tab to move on, Escape to dismiss, arrows to move through a list or grid. Optionally focuses an element first. This is the tool for keyboard-driven screens, where clicking the control is not how the application expects to be used.
| Name | Type | Req | Description |
|---|---|---|---|
| exact | boolean | – | Require the whole text to match rather than a substring. |
| frame | string | – | 'main' (default) or a substring of a frame's origin/name. Single-page apps often render the screen you want in a child frame. |
| key | string | yes | Key name: Enter, Tab, Escape, Backspace, Delete, ArrowUp, ArrowDown, ArrowLeft, ArrowRight, Home, End, PageUp, PageDown, Space. |
| modifiers | array | – | Held while pressing: shift, ctrl, alt, meta. |
| nth | number | – | Which match to use when several qualify, 0-based. |
| role | string | – | Narrow the matches to this ARIA role. |
| selector | string | – | CSS selector. Descends into open shadow roots. Optional: focuses this element first. |
| testid | string | – | Value of a test attribute (data-testid and friends — see the testAttributes setting). Optional: focuses this element first. |
| text | string | – | Visible text on the control. Matches the innermost element that carries it, and follows a <label> to its input. Optional: focuses this element first. |
| timeout_ms | number | – | How long to wait for the element to become actionable before giving up. |
| times | number | – | Press it this many times. |
No output schema declared.
No examples provided.
ui_scroll ~178
Scroll the page, or scroll a specific container. Needed before interacting with anything in a virtualised list or grid, where rows outside the viewport do not exist in the DOM at all — scrolling is what creates them.
| Name | Type | Req | Description |
|---|---|---|---|
| dx | number | – | Horizontal pixels; positive is right. |
| dy | number | – | Vertical pixels; positive is down. |
| frame | string | – | 'main' (default) or a substring of a frame's origin/name. |
| selector | string | – | CSS selector of the container to scroll. Omit to scroll the page. |
| testid | string | – | Test id of the container to scroll. |
| text | string | – | Visible text inside the container to scroll. |
| timeout_ms | number | – | How long to wait for the container. |
| to | string | – | Jump instead of scrolling by an amount. |
No output schema declared.
No examples provided.
ui_select ~286
Choose an option in a dropdown, by visible label or by value. Handles a native <select> directly; for the custom dropdowns most applications actually use — a div that opens a list — it opens the control and clicks the matching option. Reports the options it could see when nothing matches, which is usually the whole answer.
| Name | Type | Req | Description |
|---|---|---|---|
| by | string | – | Match the label, the value, or either. |
| exact | boolean | – | Require the whole text to match rather than a substring. |
| frame | string | – | 'main' (default) or a substring of a frame's origin/name. Single-page apps often render the screen you want in a child frame. |
| nth | number | – | Which match to use when several qualify, 0-based. |
| option | string | yes | The option's visible label, or its value attribute. |
| role | string | – | Narrow the matches to this ARIA role. |
| selector | string | – | CSS selector. Descends into open shadow roots. |
| testid | string | – | Value of a test attribute (data-testid and friends — see the testAttributes setting). |
| text | string | – | Visible text on the control. Matches the innermost element that carries it, and follows a <label> to its input. |
| timeout_ms | number | – | How long to wait for the element to become actionable before giving up. |
No output schema declared.
No examples provided.
ui_type ~367
Type into a field one character at a time with real key events, through the same input pipeline a person's keyboard uses — so the field's own rules apply: maxlength truncates, a keypress guard rejects what it rejects, and a mask reformats as it goes. This is the tool for reproducing user behaviour, and for anything reacting per keystroke: search-as-you-type, autocomplete, validation-on-key. Slower than ui_fill by design. Note that typing leaves the field focused and `change` fires on blur, so pass submit:true (or press Tab) when the application validates on change.
| Name | Type | Req | Description |
|---|---|---|---|
| clear_first | boolean | – | Select all and delete before typing. |
| delay_ms | number | – | Pause between keystrokes. Raise it if the field drops characters. |
| exact | boolean | – | Require the whole text to match rather than a substring. |
| frame | string | – | 'main' (default) or a substring of a frame's origin/name. Single-page apps often render the screen you want in a child frame. |
| nth | number | – | Which match to use when several qualify, 0-based. |
| role | string | – | Narrow the matches to this ARIA role. |
| selector | string | – | CSS selector. Descends into open shadow roots. |
| submit | boolean | – | Press Enter afterwards. |
| testid | string | – | Value of a test attribute (data-testid and friends — see the testAttributes setting). |
| text | string | – | Visible text on the control. Matches the innermost element that carries it, and follows a <label> to its input. |
| text_to_type | string | yes | Characters to type. |
| timeout_ms | number | – | How long to wait for the element to become actionable before giving up. |
No output schema declared.
No examples provided.
ui_upload ~240
Attach one or more local files to a file input, without opening the operating system's file picker — which automation cannot drive at all. Give the absolute paths of files on the machine running Chrome.
| Name | Type | Req | Description |
|---|---|---|---|
| exact | boolean | – | Require the whole text to match rather than a substring. |
| files | array | yes | Absolute paths to the files to attach. |
| frame | string | – | 'main' (default) or a substring of a frame's origin/name. Single-page apps often render the screen you want in a child frame. |
| nth | number | – | Which match to use when several qualify, 0-based. |
| role | string | – | Narrow the matches to this ARIA role. |
| selector | string | – | CSS selector. Descends into open shadow roots. |
| testid | string | – | Value of a test attribute (data-testid and friends — see the testAttributes setting). |
| text | string | – | Visible text on the control. Matches the innermost element that carries it, and follows a <label> to its input. |
| timeout_ms | number | – | How long to wait for the element to become actionable before giving up. |
No output schema declared.
No examples provided.
ui_wait_for ~303
Block until the page reaches a state: an element appears, disappears, becomes enabled, or some text shows up. This is the honest alternative to guessing a sleep — it returns as soon as the condition holds, and when it does not, it says what the page looked like instead of just timing out.
| Name | Type | Req | Description |
|---|---|---|---|
| contains_text | string | – | Also require the element to contain this text. |
| exact | boolean | – | Require the whole text to match rather than a substring. |
| frame | string | – | 'main' (default) or a substring of a frame's origin/name. Single-page apps often render the screen you want in a child frame. |
| nth | number | – | Which match to use when several qualify, 0-based. |
| role | string | – | Narrow the matches to this ARIA role. |
| selector | string | – | CSS selector. Descends into open shadow roots. |
| state | string | – | What to wait for: 'visible' (default), 'hidden', 'enabled', 'detached', or 'stable' (present and no longer moving). |
| testid | string | – | Value of a test attribute (data-testid and friends — see the testAttributes setting). |
| text | string | – | Visible text on the control. Matches the innermost element that carries it, and follows a <label> to its input. |
| timeout_ms | number | – | How long to wait for the element to become actionable before giving up. |
No output schema declared.
No examples provided.
workflow_guide ~54
How to use DevCDP effectively: the observe/act division of labour, the fastest path from a bug report to an exact line, and the traps worth knowing. Call it once at the start of a debugging session.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
How do I install the io.github.Dayananda-D/devcdp MCP server?
io.github.Dayananda-D/devcdp runs locally as an npm package, launched with npx -y devcdp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · devcdp
claude mcp add dayananda-d-devcdp -- npx -y devcdp
What is the io.github.Dayananda-D/devcdp MCP server?
io.github.Dayananda-D/devcdp is an MCP server listed in the public MCP registry as io.github.Dayananda-D/devcdp. Chrome DevTools for AI assistants: console, network, DOM, source maps, breakpoints, live variables. This page covers its npm package (devcdp).
Is the io.github.Dayananda-D/devcdp MCP server safe to use?
io.github.Dayananda-D/devcdp scores 84 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 17 October 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.Dayananda-D/devcdp MCP server expose?
io.github.Dayananda-D/devcdp exposes 74 tools: workflow_guide, devtools_connect, devtools_status, devtools_disconnect, list_tabs, and 69 more. Their descriptions and schemas cost roughly 9,569 tokens of context every time the server is loaded.
Is the io.github.Dayananda-D/devcdp MCP server still maintained?
io.github.Dayananda-D/devcdp is still listed as active in the MCP registry. We last reached this channel on 17 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.github.Dayananda-D/devcdp MCP server under?
io.github.Dayananda-D/devcdp declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.