Brave DevTools MCP
NPM · BRAVE-MCP
MCP server and CLI for Brave DevTools
Available components
Last scanned (2 hours ago)
Scores higher than 98% of npm servers
Category Browser Automation
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security100
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- No production dependencies, so there is no dependency health to assess. View diagnostics → Pass
Provenance & Transparency100
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to triuzzi/brave-devtools-mcp). View diagnostics → Pass
- Clear OSI-approved license (Apache-2.0).Pass
- Actively maintained (last published 1 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability74
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 3952 tokens (~123/item across 32 items; 32 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management98
- Stability check failed: the tool surface changed between 1.9.0 and 1.11.0: 0 tool removals, 1 breaking changes, 2 additions. See how to fix → Fail
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 32 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 32 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 17 Oct 26 +2
- Package version: 1.10.1 → 1.11.0 functional
- 16 Oct 26 +16
- Malware scan: unverified → pass ▲ security
- 15 Oct 26 −19
- Malware scan: pass → unverified ▼ security
- Stability: pass → fail ▼ security
- Stability: pass → 0.80 functional
- Package version: 1.10.1 → 1.11.0 functional
- 14 Oct 26 +46
- Injection markers: unverified → pass ▲ security
- Stability: unverified → pass ▲ security
- Tool coverage: unverified → 100 ▲ functional
- MCP protocol: unverified → pass ▲ functional
- 12 Oct 26 +1
- Security disclosure: unverified → pass ▲ functional
- 11 Oct 26 −45
- Stability: 0.90 → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Security disclosure: pass → unverified ▼ functional
- First check of Schema quality: unverified functional
- Package version: 1.9.0 → 1.10.1 functional
- 3 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
- 2 Oct 26 −3
- Stability: pass → 0.83 functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 17 Oct 2026 · Analysed npm/brave-mcp@1.11.0
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | npm |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | triuzzi/brave-devtools-mcp |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/triuzzi/brave-devtools-mcp/.github/workflows/publish-to-npm-on-tag.yml@refs/heads/main |
| Rekor log index | 3267941549 |
| Predicate type | SLSA build provenance https://slsa.dev/provenance/v1 |
| Subject digest | sha512:2d148b8c0173b126823a17fe36c50ab1a3f7bb93f4acd23af50ec56d65a7e132c9d15dfbf5b22a974e17c404c815aae5d7b313c72ba852b9666b62efa |
Background: How many MCP packages publish verified provenance →
Dependencies 0 packages
| Packages resolved | 0 |
|---|---|
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
click ~86
Clicks on the provided element
| Name | Type | Req | Description |
|---|---|---|---|
| dblClick | boolean | – | Set to true for double clicks. Default is false. |
| includeSnapshot | boolean | – | Whether to include a snapshot in the response. Default is false. |
| pageId | number | yes | Targets a specific page by ID. |
| uid | string | yes | The uid of an element on the page from the page content snapshot |
No output schema declared.
No examples provided.
close_page ~46
Closes the page by its index. The last open page cannot be closed.
| Name | Type | Req | Description |
|---|---|---|---|
| pageId | number | yes | The ID of the page to close. Call list_pages to list pages. |
No output schema declared.
No examples provided.
drag ~79
Drag an element onto another element
| Name | Type | Req | Description |
|---|---|---|---|
| from_uid | string | yes | The uid of the element to drag |
| includeSnapshot | boolean | – | Whether to include a snapshot in the response. Default is false. |
| pageId | number | yes | Targets a specific page by ID. |
| to_uid | string | yes | The uid of the element to drop into |
No output schema declared.
No examples provided.
emulate ~432
Emulates various features on the target page. Each call replaces all emulation settings (except extraHttpHeaders), so pass all desired settings in a single call.
| Name | Type | Req | Description |
|---|---|---|---|
| colorScheme | string | – | Emulate the dark or the light mode. Omit or set to "auto" to reset to the default. |
| cpuThrottlingRate | number | – | Represents the CPU slowdown factor. Omit or set the rate to 1 to disable throttling |
| extraHttpHeaders | string | – | Extra HTTP headers as a JSON string object, e.g. {"X-Custom": "value", "Authorization": "Bearer token"}. Headers are included into every HTTP request originating from the page and persist across navi… |
| forcedColors | string | – | Emulate the `forced-colors` CSS media feature. Omit or set to "auto" to reset to the default. |
| geolocation | string | – | Geolocation (`<latitude>,<longitude>`) to emulate. Latitude between -90 and 90. Longitude between -180 and 180. Omit to clear the geolocation override. |
| networkConditions | string | – | Throttle network. Omit to disable throttling. |
| pageId | number | yes | Targets a specific page by ID. |
| prefersContrast | string | – | Emulate the `prefers-contrast` CSS media feature. Omit or set to "auto" to reset to the default. |
| prefersReducedMotion | string | – | Emulate the `prefers-reduced-motion` CSS media feature. Omit or set to "auto" to reset to the default. |
| userAgent | string | – | User agent to emulate. Omit or set to empty string to clear the user agent override. |
| viewport | string | – | Emulate device viewports '<width>x<height>x<devicePixelRatio>[,mobile][,touch][,landscape]'. 'touch' and 'mobile' to emulate mobile devices. 'landscape' to emulate landscape mode. Omit to clear the v… |
No output schema declared.
No examples provided.
evaluate_script ~336
Evaluate JavaScript inside the target page. The source can be provided inline or loaded from a local file. Returns the response as JSON, so returned values have to be JSON-serializable.
| Name | Type | Req | Description |
|---|---|---|---|
| args | array | – | An optional list of arguments (element uids from the page content snapshot) to pass to the function. |
| dialogAction | string | – | Handle dialogs while execution. "accept", "dismiss", or string for response of window.prompt. Defaults to accept. |
| filePath | string | – | The absolute or relative path to a file to save the script output to. If omitted, the output is returned inline. |
| format | string | – | How to interpret the source. "function" treats it as a function declaration and supports args. "script" evaluates it as classic JavaScript and does not support args. Defaults to "function". ECMAScrip… |
| function | string | – | JavaScript source to execute in the target page. Provide either this or sourcePath, but not both. The source is interpreted according to format. Example without arguments: `() => document.title` or `… |
| pageId | number | yes | Targets a specific page by ID. |
| sourcePath | string | – | The absolute or relative path to a JavaScript file on the MCP server's local filesystem. Provide either this or function, but not both. |
| waitForStableDom | boolean | – | Whether to wait for the DOM to settle. Pass false if the script only reads data. Defaults to true. |
No output schema declared.
No examples provided.
fill ~113
Type text into an input, text area or select an option from a <select> element.
| Name | Type | Req | Description |
|---|---|---|---|
| includeSnapshot | boolean | – | Whether to include a snapshot in the response. Default is false. |
| pageId | number | yes | Targets a specific page by ID. |
| uid | string | yes | The uid of an element on the page from the page content snapshot |
| value | string | yes | The value to fill in. "true" or "false" for checkboxes and toggles, "true" for radio buttons. |
No output schema declared.
No examples provided.
fill_form ~123
Fill out multiple form elements (inputs, selects, checkboxes, radios) at once. ALWAYS prefer this tool over multiple individual 'fill' or 'click' calls when interacting with forms. It is significantly faster, more reliable, and reduces turn count. Example: Fill username, password, and check "Remember Me" in one call.
| Name | Type | Req | Description |
|---|---|---|---|
| elements | array | yes | Elements from snapshot to fill out. |
| includeSnapshot | boolean | – | Whether to include a snapshot in the response. Default is false. |
| pageId | number | yes | Targets a specific page by ID. |
No output schema declared.
No examples provided.
get_console_message ~65
Gets a console message by its ID. You can get all messages by calling list_console_messages.
| Name | Type | Req | Description |
|---|---|---|---|
| msgid | number | yes | The msgid of a console message on the page from the listed console messages |
| pageId | number | yes | Targets a specific page by ID. |
No output schema declared.
No examples provided.
get_css_styles ~218
Retrieve matched CSS rules, inline styles (element.style), inherited styles, custom properties, and cascade wrappers (@layer, @media, @container, @scope) for an element identified by its UID. Rules are ordered from highest to lowest cascade precedence and include source line numbers (e.g. index:196). Active (winning) declarations have no prefix tag, while (losing) overridden declarations are prefixed with [overloaded]. Treat the output as authoritative and complete. Results are paginated (10 rules per page by default); use pageIdx to page through the remaining rules. Requires a UID from take_snapshot.
| Name | Type | Req | Description |
|---|---|---|---|
| pageId | number | yes | Targets a specific page by ID. |
| pageIdx | integer | – | Page number to return (0-based). Defaults to 0 (the first page). |
| pageSize | integer | – | Maximum number of CSS rules to return per page. Defaults to 10. |
| uid | string | yes | The uid of the element on the page from the page content snapshot to inspect CSS styles for |
No output schema declared.
No examples provided.
get_network_request ~169
Gets a network request by an optional reqid, if omitted returns the currently selected request in the DevTools Network panel. Useful for inspecting request headers (including 'Cookie') and response headers (including 'Set-Cookie' and directives).
| Name | Type | Req | Description |
|---|---|---|---|
| pageId | number | yes | Targets a specific page by ID. |
| reqid | number | – | The reqid of the network request. If omitted returns the currently selected request in the DevTools Network panel. |
| requestFilePath | string | – | The absolute or relative path to a .network-request file to save the request body to. If omitted, the body is returned inline. |
| responseFilePath | string | – | The absolute or relative path to a .network-response file to save the response body to. If omitted, the body is returned inline. |
No output schema declared.
No examples provided.
handle_dialog ~66
If a browser dialog was opened, use this command to handle it
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Whether to dismiss or accept the dialog |
| pageId | number | yes | Targets a specific page by ID. |
| promptText | string | – | Optional prompt text to enter into the dialog. |
No output schema declared.
No examples provided.
hover ~67
Hover over the provided element
| Name | Type | Req | Description |
|---|---|---|---|
| includeSnapshot | boolean | – | Whether to include a snapshot in the response. Default is false. |
| pageId | number | yes | Targets a specific page by ID. |
| uid | string | yes | The uid of an element on the page from the page content snapshot |
No output schema declared.
No examples provided.
lighthouse_audit ~119
Get Lighthouse scores, failing audits, and the DOM nodes they flag for accessibility, SEO, best practices, and agentic browsing. Full reports are saved to disk. This excludes performance. For performance audits, run performance_start_trace
| Name | Type | Req | Description |
|---|---|---|---|
| device | string | – | Device to emulate. |
| mode | string | – | "navigation" reloads & audits. "snapshot" analyzes current state. |
| outputDirPath | string | – | Directory for reports. If omitted, uses temporary files. |
| pageId | number | yes | Targets a specific page by ID. |
No output schema declared.
No examples provided.
list_console_messages ~181
List all console messages for the target page since the last navigation.
| Name | Type | Req | Description |
|---|---|---|---|
| includePreservedMessages | boolean | – | Set to true to return the preserved messages over the last 3 navigations. |
| includeStackTraces | boolean | – | Set to true to include the stack trace for each message when available. Increases the response size. |
| pageId | number | yes | Targets a specific page by ID. |
| pageIdx | integer | – | Page number to return (0-based). When omitted, returns the first page. |
| pageSize | integer | – | Maximum number of messages to return. When omitted, returns all messages. |
| serviceWorkerId | string | – | Filter messages to only return messages of the specified service worker. |
| types | array | – | Filter messages to only return messages of the specified resource types. When omitted or empty, returns all messages. |
No output schema declared.
No examples provided.
list_network_requests ~134
Lists the most recent requests for the target page since the last navigation.
| Name | Type | Req | Description |
|---|---|---|---|
| includePreservedRequests | boolean | – | Set to true to return the preserved requests over the last 3 navigations. |
| pageId | number | yes | Targets a specific page by ID. |
| pageIdx | integer | – | Page number to return (0-based). When omitted, returns the first page. |
| pageSize | integer | – | Maximum number of requests to return. When omitted, returns all requests. |
| resourceTypes | array | – | Filter requests to only return requests of the specified resource types. When omitted or empty, returns all requests. |
No output schema declared.
No examples provided.
list_pages ~18
Get a list of pages open in the browser.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
navigate_page ~169
Go to a URL, or back, forward, or reload. Use project URL if not specified otherwise.
| Name | Type | Req | Description |
|---|---|---|---|
| handleBeforeUnload | string | – | Whether to auto accept or beforeunload dialogs triggered by this navigation. Default is accept. |
| ignoreCache | boolean | – | Whether to ignore cache on reload. |
| initScript | string | – | A JavaScript script to be executed on each new document before any other scripts for the next navigation. |
| pageId | number | yes | Targets a specific page by ID. |
| timeout | integer | – | Maximum wait time in milliseconds. If set to 0, the default timeout will be used. |
| type | string | – | Navigate the page by URL, back or forward in history, or reload. |
| url | string | – | Target URL (only type=url) |
No output schema declared.
No examples provided.
new_page ~147
Open a new tab and load a URL. Use project URL if not specified otherwise.
| Name | Type | Req | Description |
|---|---|---|---|
| background | boolean | – | Whether to open the page in the background without bringing it to the front. Default is false (foreground). |
| isolatedContext | string | – | If specified, the page is created in an isolated browser context with the given name. Pages in the same browser context share cookies and storage. Pages in different browser contexts are fully isolat… |
| timeout | integer | – | Maximum wait time in milliseconds. If set to 0, the default timeout will be used. |
| url | string | yes | URL to load in a new page. |
No output schema declared.
No examples provided.
performance_analyze_insight ~111
Provides more detailed information on a specific Performance Insight of an insight set that was highlighted in the results of a trace recording.
| Name | Type | Req | Description |
|---|---|---|---|
| insightName | string | yes | The name of the Insight you want more information on. For example: "DocumentLatency" or "LCPBreakdown" |
| insightSetId | string | yes | The id for the specific insight set. Only use the ids given in the "Available insight sets" list. |
| pageId | number | yes | Targets a specific page by ID. |
No output schema declared.
No examples provided.
performance_start_trace ~203
Start a performance trace on the target webpage. Use to find frontend performance issues, Core Web Vitals (LCP, INP, CLS), and improve page load speed.
| Name | Type | Req | Description |
|---|---|---|---|
| autoStop | boolean | – | Determines if the trace recording should be automatically stopped. |
| filePath | string | – | The absolute file path, or a file path relative to the current working directory, to save the raw trace data. For example, trace.json.gz (compressed) or trace.json (uncompressed). |
| ignoreCache | boolean | – | Whether to bypass the HTTP cache when reloading the page, to measure a cold page load. Only applies if reload is true. |
| pageId | number | yes | Targets a specific page by ID. |
| reload | boolean | – | Determines if, once tracing has started, the target page should be automatically reloaded. Navigate the page to the right URL using the navigate_page tool BEFORE starting the trace if reload or autoS… |
No output schema declared.
No examples provided.
performance_stop_trace ~80
Stop the active performance trace recording on the target webpage.
| Name | Type | Req | Description |
|---|---|---|---|
| filePath | string | – | The absolute file path, or a file path relative to the current working directory, to save the raw trace data. For example, trace.json.gz (compressed) or trace.json (uncompressed). |
| pageId | number | yes | Targets a specific page by ID. |
No output schema declared.
No examples provided.
press_key ~120
Press a key or key combination. Use this when other input methods like fill() cannot be used (e.g., keyboard shortcuts, navigation keys, or special key combinations).
| Name | Type | Req | Description |
|---|---|---|---|
| includeSnapshot | boolean | – | Whether to include a snapshot in the response. Default is false. |
| key | string | yes | A key or a combination (e.g., "Enter", "Control+A", "Control++", "Control+Shift+R"). Modifiers: Control, Shift, Alt, Meta |
| pageId | number | yes | Targets a specific page by ID. |
No output schema declared.
No examples provided.
resize_page ~54
Resizes the page's window so that the page has specified dimension
| Name | Type | Req | Description |
|---|---|---|---|
| height | integer | yes | Page height |
| pageId | number | yes | Targets a specific page by ID. |
| width | integer | yes | Page width |
No output schema declared.
No examples provided.
screencast_start ~65
Starts recording a screencast (video) of the target page.
| Name | Type | Req | Description |
|---|---|---|---|
| filePath | string | – | Output file path (.mp4). Uses mkdtemp to generate a unique path if not provided. |
| pageId | number | yes | Targets a specific page by ID. |
No output schema declared.
No examples provided.
screencast_stop ~36
Stops the active screencast recording on the target page.
| Name | Type | Req | Description |
|---|---|---|---|
| pageId | number | yes | Targets a specific page by ID. |
No output schema declared.
No examples provided.
select_page ~62
Select a page as a context for future tool calls.
| Name | Type | Req | Description |
|---|---|---|---|
| bringToFront | boolean | – | Whether to focus the page and bring it to the top. |
| pageId | number | yes | The ID of the page to select. Call list_pages to get available pages. |
No output schema declared.
No examples provided.
take_heapsnapshot ~71
Capture a heap snapshot of the target page. Use to analyze the memory distribution of JavaScript objects and debug memory leaks.
| Name | Type | Req | Description |
|---|---|---|---|
| filePath | string | yes | A path to a .heapsnapshot file to save the heapsnapshot to. |
| pageId | number | yes | Targets a specific page by ID. |
No output schema declared.
No examples provided.
take_screenshot ~179
Take a screenshot of the page or element.
| Name | Type | Req | Description |
|---|---|---|---|
| filePath | string | – | The absolute path, or a path relative to the current working directory, to save the screenshot to instead of attaching it to the response. |
| format | string | – | Type of format to save the screenshot as. Default is "png" |
| fullPage | boolean | – | If set to true takes a screenshot of the full page instead of the currently visible viewport. Incompatible with uid. |
| pageId | number | yes | Targets a specific page by ID. |
| quality | number | – | Compression quality for JPEG and WebP formats (0-100). Higher values mean better quality but larger file sizes. Ignored for PNG format. |
| uid | string | – | The uid of an element on the page from the page content snapshot. If omitted, takes a page screenshot. |
No output schema declared.
No examples provided.
take_snapshot ~143
Take a text snapshot of the target page based on the a11y tree. The snapshot lists page elements along with a unique identifier (uid). Always use the latest snapshot. Prefer taking a snapshot over taking a screenshot. The snapshot indicates the element selected in the DevTools Elements panel (if any).
| Name | Type | Req | Description |
|---|---|---|---|
| filePath | string | – | The absolute path, or a path relative to the current working directory, to save the snapshot to instead of attaching it to the response. |
| pageId | number | yes | Targets a specific page by ID. |
| verbose | boolean | – | Whether to include all possible information available in the full a11y tree. Default is false. |
No output schema declared.
No examples provided.
type_text ~69
Type text using keyboard into a previously focused input
| Name | Type | Req | Description |
|---|---|---|---|
| pageId | number | yes | Targets a specific page by ID. |
| submitKey | string | – | Optional key to press after typing. E.g., "Enter", "Tab", "Escape" |
| text | string | yes | The text to type |
No output schema declared.
No examples provided.
upload_file ~110
Upload a file through a provided element.
| Name | Type | Req | Description |
|---|---|---|---|
| filePaths | array | yes | One or more files paths to upload. File paths have to be local to the browser instance (not the MCP). |
| includeSnapshot | boolean | – | Whether to include a snapshot in the response. Default is false. |
| pageId | number | yes | Targets a specific page by ID. |
| uid | string | yes | The uid of the file input element or an element that will open file chooser on the page from the page content snapshot |
No output schema declared.
No examples provided.
wait_for ~81
Wait for the specified text to appear on the selected page.
| Name | Type | Req | Description |
|---|---|---|---|
| pageId | number | yes | Targets a specific page by ID. |
| text | array | yes | Non-empty list of texts. Resolves when any value appears on the page. |
| timeout | integer | – | Maximum wait time in milliseconds. If set to 0, the default timeout will be used. |
No output schema declared.
No examples provided.
How do I install the Brave DevTools MCP server?
Brave DevTools MCP runs locally as an npm package, launched with npx -y brave-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · brave-mcp
claude mcp add triuzzi-brave-mcp -- npx -y brave-mcp
What is the Brave DevTools MCP server?
Brave DevTools MCP is listed in the public MCP registry as io.github.triuzzi/brave-mcp. MCP server and CLI for Brave DevTools. This page covers its npm package (brave-mcp).
Is the Brave DevTools MCP server safe to use?
Brave DevTools MCP scores 95 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 17 October 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Brave DevTools MCP server expose?
Brave DevTools MCP exposes 32 tools: click, close_page, drag, emulate, evaluate_script, and 27 more. Their descriptions and schemas cost roughly 3,952 tokens of context every time the server is loaded.
Is the Brave DevTools MCP server still maintained?
Brave DevTools MCP is still listed as active in the MCP registry. We last reached this channel on 17 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the Brave DevTools MCP server under?
Brave DevTools MCP declares the Apache-2.0 licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.