# io.github.Sahib-Sawhney-WH/looking-glass-mcp (npm · looking-glass-mcp)

AI-native browser for agents. 71 tools with self-healing, semantic extraction, vault CLI.

- Trust score: 56/100 (low)
- Change this week: +26
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `looking-glass-mcp`: 56/100 (this document), [markdown](https://verifymcp.io/servers/sahib-sawhney-wh-looking-glass-mcp/looking-glass-mcp.md), [page](https://verifymcp.io/servers/sahib-sawhney-wh-looking-glass-mcp/looking-glass-mcp)

## Channel facts

- Registry: `npm`
- Package: `looking-glass-mcp`
- Version: `3.1.1`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 70/100
  - No malware found by supply-chain analysis.
  - CVE check failed: a known high-severity CVE affects uuid 9.0.1, a direct dependency. A fixed version is available.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (99 of 100), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 71/100
  - Repository check failed: the declared repository URL returned HTTP 404.
  - Cryptographically verified build provenance (signed, bound to Sahib-Sawhney-WH/LookingGlass).
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 125 days ago).
  - Security-disclosure policy not yet verified: we couldn't inspect the source repository.
- **Schema Quality & AI Usability**: 43/100
  - AI-judged instruction clarity (poor).
  - Tool/resource definitions use about 1870 tokens (~26/item across 71 items; 71 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 33/100
  - 0% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add sahib-sawhney-wh-looking-glass-mcp -- npx -y looking-glass-mcp
```

### Codex

```bash
codex mcp add sahib-sawhney-wh-looking-glass-mcp -- npx -y looking-glass-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "sahib-sawhney-wh-looking-glass-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "looking-glass-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add sahib-sawhney-wh-looking-glass-mcp --command npx --arg -y --arg looking-glass-mcp
```

### Hermes

```yaml
mcp_servers:
  sahib-sawhney-wh-looking-glass-mcp:
    command: "npx"
    args: ["-y", "looking-glass-mcp"]
```

### Other

```json
{
  "mcpServers": {
    "sahib-sawhney-wh-looking-glass-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "looking-glass-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 56, +32)

- [security regression] CVE-2026-41907 affects this package: high
- [security regression] Known CVEs: unverified → fail
- [security improvement] Install scripts: unverified → pass
- [security improvement] Provenance: unverified → pass
- [security] The attested source repository moved: Sahib-Sawhney-WH/LookingGlass
- [functional improvement] License: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] Stability: unverified → 0.27
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Schema quality: unverified → poor
- [functional] Licence: MIT

### 2026-08-02 (score 24, +15)

- [security improvement] Malware scan: unverified → pass

### 2026-08-01 (score 9, −3)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-31 (score 12, −18)

- [security regression] Malware scan: pass → unverified

### 2026-07-30 (score 30, +11)

- [functional regression] Dependency health: partial → unverified
- [functional improvement] Tool coverage: unverified → 0

### 2026-07-28 (score 19, −11)

- [functional regression] Tool coverage: 0 → unverified
- [functional improvement] Dependency health: unverified → partial
- [functional] First check of Schema quality: unverified

### 2026-07-27 (score 30)

First indexed and scored.

## MCP tools (71)

### `browser_navigate` (~17 tokens)

Input parameters:

- `url` (string, required): URL to navigate to

### `browser_go_back` (~6 tokens)

### `browser_go_forward` (~6 tokens)

### `browser_click` (~18 tokens)

Input parameters:

- `selector` (string, required): CSS selector or text to click

### `browser_type` (~31 tokens)

Input parameters:

- `selector` (string, required): CSS selector of the input element
- `value` (string, required): Text to type into the element

### `browser_hover` (~17 tokens)

Input parameters:

- `selector` (string, required): CSS selector to hover over

### `browser_drag` (~31 tokens)

Input parameters:

- `sourceSelector` (string, required): CSS selector of drag source
- `targetSelector` (string, required): CSS selector of drop target

### `browser_select_option` (~29 tokens)

Input parameters:

- `selector` (string, required): CSS selector of the select element
- `value` (string, required): Value to select

### `browser_press_key` (~28 tokens)

Input parameters:

- `key` (string, required): Key to press (e.g., Enter, Tab, Escape, ArrowDown)

### `browser_scroll` (~43 tokens)

Input parameters:

- `direction` (string): Scroll direction
- `pixels` (number): Number of pixels to scroll (default 300)
- `selector` (string): CSS selector to scroll into view

### `browser_screenshot` (~54 tokens)

Input parameters:

- `fullPage` (boolean): Capture full page (default: viewport only)
- `savePath` (string): Custom save path (default: auto-generated in sessions dir)
- `selector` (string): CSS selector to screenshot specific element

### `browser_snapshot` (~5 tokens)

### `browser_console_messages` (~36 tokens)

Input parameters:

- `clear` (boolean): Clear messages after reading
- `type` (string): Filter by message type: log, error, warning, info

### `browser_network_requests` (~46 tokens)

Input parameters:

- `clear` (boolean): Clear requests after reading
- `method` (string): Filter by HTTP method (GET, POST, etc.)
- `urlPattern` (string): Filter by URL substring

### `browser_evaluate` (~22 tokens)

Input parameters:

- `script` (string, required): JavaScript code to execute in the browser context

### `browser_tab_list` (~6 tokens)

### `browser_tab_new` (~19 tokens)

Input parameters:

- `url` (string): URL to open in new tab

### `browser_tab_select` (~27 tokens)

Input parameters:

- `tabId` (string, required): Tab ID to switch to (first 8 chars or full UUID)

### `browser_close` (~22 tokens)

Input parameters:

- `tabId` (string): Tab ID to close (defaults to active tab)

### `test_scenario_run` (~89 tokens)

Input parameters:

- `baseUrl` (string): Base URL (e.g., http://localhost:3000)
- `dataSets` (array): Data sets for parameterized testing. The scenario runs once per data set with {{variable}} substitution.
- `name` (string, required): Scenario name
- `steps` (array, required): Array of test steps to execute. Steps can use {{variable}} placeholders when dataSets is provided.

### `test_scenario_status` (~7 tokens)

### `test_assert` (~47 tokens)

Input parameters:

- `attribute` (string): Attribute name (for hasAttribute)
- `expected` (string|number): Expected value
- `selector` (string): CSS selector
- `type` (string, required): Assertion type

### `test_fill_form` (~19 tokens)

Input parameters:

- `fields` (array, required): Array of form fields to fill

### `test_auth_flow` (~108 tokens)

Input parameters:

- `passwordSelector` (string, required): CSS selector for password input
- `passwordValue` (string, required): Password
- `submitSelector` (string, required): CSS selector for submit/login button
- `url` (string, required): Login page URL
- `usernameSelector` (string, required): CSS selector for username/email input
- `usernameValue` (string, required): Username or email
- `waitForSelector` (string): Wait for this element after login
- `waitForUrl` (string): Wait for URL to match after login

### `test_watch_events` (~49 tokens)

Input parameters:

- `events` (array, required): Event types to watch
- `maxEvents` (number): Maximum events to capture (default: 1000)
- `urlPattern` (string): Filter network events by URL pattern

### `test_stop_watch` (~6 tokens)

### `session_start` (~15 tokens)

Input parameters:

- `name` (string): Optional session name

### `session_end` (~5 tokens)

### `session_list` (~5 tokens)

### `session_replay` (~24 tokens)

Input parameters:

- `sessionId` (string, required): Session ID (first 8 chars or full UUID)

### `visual_baseline` (~26 tokens)

Input parameters:

- `name` (string, required): Baseline name (e.g., "homepage", "login-form")

### `visual_compare` (~18 tokens)

Input parameters:

- `name` (string, required): Baseline name to compare against

### `browser_resolve_element` (~33 tokens)

Input parameters:

- `query` (string, required): Natural language description of the element (e.g., "the Submit button", "email input field")

### `browser_smart_click` (~34 tokens)

Input parameters:

- `query` (string, required): Natural language description of what to click (e.g., "the login button", "Sign Up link")

### `browser_analyze_page` (~7 tokens)

### `browser_wait_until_stable` (~44 tokens)

Input parameters:

- `checkSpinners` (boolean): Check for loading spinners (default: true)
- `timeout` (number): Max wait time in ms (default: 15000)

### `browser_explore` (~61 tokens)

Input parameters:

- `maxDepth` (number): Maximum link depth to follow (default: 3)
- `maxPages` (number): Maximum pages to crawl (default: 20)
- `stayWithinPath` (boolean): Only crawl within the current URL path (default: false)

### `browser_suggest_actions` (~7 tokens)

### `browser_login` (~90 tokens)

Input parameters:

- `password` (string, required): Password
- `passwordSelector` (string): CSS selector for password field (auto-detected if omitted)
- `submitSelector` (string): CSS selector for submit button (auto-detected if omitted)
- `url` (string, required): Login page URL
- `username` (string, required): Username or email
- `usernameSelector` (string): CSS selector for username field (auto-detected if omitted)

### `browser_fill_and_submit` (~45 tokens)

Input parameters:

- `fields` (object, required): Map of field selector or label → value to fill
- `submitSelector` (string): CSS selector or text of submit button (auto-detected if omitted)

### `browser_diagnose` (~41 tokens)

Input parameters:

- `error` (string): Error message to diagnose (or leave empty for general diagnostics)
- `selector` (string): CSS selector of the element involved in the error

### `browser_error_report` (~6 tokens)

### `browser_get_cookies` (~18 tokens)

Input parameters:

- `url` (string): Filter cookies by URL

### `browser_set_cookie` (~46 tokens)

Input parameters:

- `domain` (string): Cookie domain
- `name` (string, required): Cookie name
- `path` (string): Cookie path (default: /)
- `value` (string, required): Cookie value

### `browser_get_localstorage` (~23 tokens)

Input parameters:

- `key` (string): Specific key to retrieve (or omit for all)

### `browser_set_localstorage` (~25 tokens)

Input parameters:

- `key` (string, required): Storage key
- `value` (string, required): Storage value

### `browser_clear_storage` (~16 tokens)

Input parameters:

- `type` (string, required): What to clear

### `browser_snapshot_state` (~6 tokens)

### `browser_diff_state` (~6 tokens)

### `browser_action_history` (~23 tokens)

Input parameters:

- `last` (number): Return only the last N entries (default: all)

### `browser_clear_history` (~6 tokens)

### `browser_health_check` (~6 tokens)

### `browser_recover` (~6 tokens)

### `browser_clean_slate` (~7 tokens)

### `test_accessibility_audit` (~8 tokens)

### `browser_performance_audit` (~8 tokens)

### `test_generate_assertions` (~7 tokens)

### `test_chaos` (~59 tokens)

Input parameters:

- `delayMs` (number): Max delay for random-delays profile (default: 2000ms)
- `profile` (string, required): Chaos condition to apply
- `urlPattern` (string): URL pattern for block-api profile (default: /api/)

### `test_chaos_clear` (~8 tokens)

### `session_export_playwright` (~43 tokens)

Input parameters:

- `outputPath` (string): Custom output path for the .spec.ts file
- `sessionId` (string, required): Session ID to export (use session_list to find IDs)

### `browser_mock_route` (~68 tokens)

Input parameters:

- `body` (string): Response body (default: {})
- `contentType` (string): Content-Type header (default: application/json)
- `status` (number): HTTP status code (default: 200)
- `urlPattern` (string, required): URL pattern to mock (e.g., /api/users)

### `browser_clear_mocks` (~7 tokens)

### `browser_list_mocks` (~7 tokens)

### `browser_extract` (~53 tokens)

Input parameters:

- `fields` (object, required): Schema: field name → type
- `hint` (string): Hint to narrow extraction region (e.g. "product listings")
- `limit` (number): Max items to extract (default: 50)

### `browser_go` (~30 tokens)

Input parameters:

- `intent` (string, required): Where to navigate (e.g. "settings page", "user profile", "billing section")

### `browser_wait_for` (~51 tokens)

Input parameters:

- `condition` (string, required): What to wait for (e.g. "search results loaded", "spinner disappears", "URL contains /dashboard")
- `timeout` (number): Timeout in ms (default: 15000)

### `browser_workflow` (~6 tokens)

### `vault_list` (~5 tokens)

### `vault_delete` (~16 tokens)

Input parameters:

- `profile` (string, required): Profile name to delete

### `vault_login` (~33 tokens)

Input parameters:

- `profile` (string, required): Vault profile to use for login
- `url` (string): URL to navigate to before login (optional)

### `vault_inject` (~24 tokens)

Input parameters:

- `profile` (string, required): Vault profile whose fields to inject into the current page form

## Diagnostics

Captured diagnostic sections: Provenance, Vulnerabilities, Dependencies. The full working is on the page: https://verifymcp.io/servers/sahib-sawhney-wh-looking-glass-mcp/looking-glass-mcp#diagnostics

## Score history

- 2026-08-03: 56
- 2026-08-02: 24
- 2026-08-01: 9
- 2026-07-31: 12
- 2026-07-30: 30
- 2026-07-28: 19
- 2026-07-27: 30

## Links

- npm package: https://www.npmjs.com/package/looking-glass-mcp
- Socket report: https://socket.dev/npm/package/looking-glass-mcp
- Changelog RSS feed: https://verifymcp.io/servers/sahib-sawhney-wh-looking-glass-mcp/looking-glass-mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/sahib-sawhney-wh-looking-glass-mcp/looking-glass-mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/sahib-sawhney-wh-looking-glass-mcp/looking-glass-mcp