# Brave DevTools MCP (npm · brave-mcp)

MCP server and CLI for Brave DevTools

- Trust score: 71/100 (medium)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-17

> **Malware flagged**: A supply-chain scanner flagged a high-severity malware risk in this package. Treat it as unsafe to install until the finding is cleared.

## Components

- npm · `brave-mcp`: 71/100 (this document), [markdown](https://verifymcp.io/servers/triuzzi-brave-mcp/brave-mcp.md), [page](https://verifymcp.io/servers/triuzzi-brave-mcp/brave-mcp)

## Channel facts

- Registry: `npm`
- Package: `brave-mcp`
- Version: `1.7.1`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-17.

- **Supply Chain Security**: 55/100
  - Malware check failed: a supply-chain vendor flagged a high-severity malware risk.
  - No known CVEs affecting this package version or its production dependencies.
  - No install/post-install scripts declared.
  - No production dependencies, so there is no dependency health to assess.
- **Provenance & Transparency**: 100/100
  - Source repository is publicly reachable at the declared URL.
  - Cryptographically verified build provenance (signed, bound to triuzzi/brave-devtools-mcp).
  - Clear OSI-approved license (Apache-2.0).
  - Actively maintained (last published 4 days ago).
  - Publishes a security disclosure policy (SECURITY.md).
- **Schema Quality & AI Usability**: 80/100
  - AI-judged instruction clarity (excellent).
  - Tool/resource definitions use about 2933 tokens (~101/item across 29 items; 29 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 20/100
  - Stability observed for 6 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add triuzzi-brave-mcp -- npx -y brave-mcp
```

### Codex

```bash
codex mcp add triuzzi-brave-mcp -- npx -y brave-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "triuzzi-brave-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "brave-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add triuzzi-brave-mcp --command npx --arg -y --arg brave-mcp
```

### Hermes

```yaml
mcp_servers:
  triuzzi-brave-mcp:
    command: "npx"
    args: ["-y", "brave-mcp"]
```

### Other

```json
{
  "mcpServers": {
    "triuzzi-brave-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "brave-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-17 (score 71, +1)

No change was recorded against any check on this day. Stability & Change Management went from 17 to 20. That category is still filling its 30-day observation window: 5 days of observed history at the previous scan, 6 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-08-16 (score 70, +1)

No change was recorded against any check on this day. Stability & Change Management went from 13 to 17. That category is still filling its 30-day observation window: 4 days of observed history at the previous scan, 5 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-08-13 (score 69, +1)

No change was recorded against any check on this day. Stability & Change Management went from 3 to 7. That category is still filling its 30-day observation window: 1 days of observed history at the previous scan, 2 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-08-12 (score 68, +2)

- [security regression] Malware scan: unverified → fail
- [security regression] Malware indicator (automated code analysis): high
- [security regression] Malware indicator (automated code analysis): high
- [functional improvement] Stability: unverified → 0.03
- [functional] Package version: 1.7.0 → 1.7.1

### 2026-08-11 (score 66)

First indexed and scored.

## MCP tools (29)

### `click` (~72 tokens)

Clicks on the provided element

Input parameters:

- `dblClick` (boolean): Set to true for double clicks. Default is false.
- `includeSnapshot` (boolean): Whether to include a snapshot in the response. Default is false.
- `uid` (string, required): The uid of an element on the page from the page content snapshot

### `close_page` (~46 tokens)

Closes the page by its index. The last open page cannot be closed.

Input parameters:

- `pageId` (number, required): The ID of the page to close. Call list_pages to list pages.

### `drag` (~65 tokens)

Drag an element onto another element

Input parameters:

- `from_uid` (string, required): The uid of the element to drag
- `includeSnapshot` (boolean): Whether to include a snapshot in the response. Default is false.
- `to_uid` (string, required): The uid of the element to drop into

### `emulate` (~278 tokens)

Emulates various features on the selected page.

Input parameters:

- `colorScheme` (string): Emulate the dark or the light mode. Set to "auto" to reset to the default.
- `cpuThrottlingRate` (number): Represents the CPU slowdown factor. Omit or set the rate to 1 to disable throttling
- `extraHttpHeaders` (string): Extra HTTP headers as a JSON string object, e.g. {"X-Custom": "value", "Authorization": "Bearer token"}. Headers are included into every HTTP request originating from the page and persist across navi…
- `geolocation` (string): Geolocation (`<latitude>,<longitude>`) to emulate. Latitude between -90 and 90. Longitude between -180 and 180. Omit to clear the geolocation override.
- `networkConditions` (string): Throttle network. Omit to disable throttling.
- `userAgent` (string): User agent to emulate. Set to empty string to clear the user agent override.
- `viewport` (string): Emulate device viewports '<width>x<height>x<devicePixelRatio>[,mobile][,touch][,landscape]'. 'touch' and 'mobile' to emulate mobile devices. 'landscape' to emulate landscape mode.

### `evaluate_script` (~202 tokens)

Evaluate a JavaScript function inside the currently selected page. Returns the response as JSON, so returned values have to be JSON-serializable.

Input parameters:

- `args` (array): An optional list of arguments to pass to the function.
- `dialogAction` (string): Handle dialogs while execution. "accept", "dismiss", or string for response of window.prompt. Defaults to accept.
- `filePath` (string): The absolute or relative path to a file to save the script output to. If omitted, the output is returned inline.
- `function` (string, required): A JavaScript function declaration to be executed by the tool in the currently selected page. Example without arguments: `() => document.title` or `async () => await fetch("example.com")`. Example wit…
- `waitForStableDom` (boolean): Whether to wait for the DOM to settle. Pass false if the script only reads data. Defaults to true.

### `fill` (~99 tokens)

Type text into an input, text area or select an option from a <select> element.

Input parameters:

- `includeSnapshot` (boolean): Whether to include a snapshot in the response. Default is false.
- `uid` (string, required): The uid of an element on the page from the page content snapshot
- `value` (string, required): The value to fill in. "true" or "false" for checkboxes and toggles, "true" for radio buttons.

### `fill_form` (~109 tokens)

Fill out multiple form elements (inputs, selects, checkboxes, radios) at once. ALWAYS prefer this tool over multiple individual 'fill' or 'click' calls when interacting with forms. It is significantly faster, more reliable, and reduces turn count. Example: Fill username, password, and check "Remember Me" in one call.

Input parameters:

- `elements` (array, required): Elements from snapshot to fill out.
- `includeSnapshot` (boolean): Whether to include a snapshot in the response. Default is false.

### `get_console_message` (~51 tokens)

Gets a console message by its ID. You can get all messages by calling list_console_messages.

Input parameters:

- `msgid` (number, required): The msgid of a console message on the page from the listed console messages

### `get_network_request` (~132 tokens)

Gets a network request by an optional reqid, if omitted returns the currently selected request in the DevTools Network panel.

Input parameters:

- `reqid` (number): The reqid of the network request. If omitted returns the currently selected request in the DevTools Network panel.
- `requestFilePath` (string): The absolute or relative path to a .network-request file to save the request body to. If omitted, the body is returned inline.
- `responseFilePath` (string): The absolute or relative path to a .network-response file to save the response body to. If omitted, the body is returned inline.

### `handle_dialog` (~52 tokens)

If a browser dialog was opened, use this command to handle it

Input parameters:

- `action` (string, required): Whether to dismiss or accept the dialog
- `promptText` (string): Optional prompt text to enter into the dialog.

### `hover` (~53 tokens)

Hover over the provided element

Input parameters:

- `includeSnapshot` (boolean): Whether to include a snapshot in the response. Default is false.
- `uid` (string, required): The uid of an element on the page from the page content snapshot

### `lighthouse_audit` (~90 tokens)

Get Lighthouse score and reports for accessibility, SEO, best practices, and agentic browsing. This excludes performance. For performance audits, run performance_start_trace

Input parameters:

- `device` (string): Device to emulate.
- `mode` (string): "navigation" reloads & audits. "snapshot" analyzes current state.
- `outputDirPath` (string): Directory for reports. If omitted, uses temporary files.

### `list_console_messages` (~168 tokens)

List all console messages for the currently selected page since the last navigation.

Input parameters:

- `includePreservedMessages` (boolean): Set to true to return the preserved messages over the last 3 navigations.
- `includeStackTraces` (boolean): Set to true to include the stack trace for each message when available. Increases the response size.
- `pageIdx` (integer): Page number to return (0-based). When omitted, returns the first page.
- `pageSize` (integer): Maximum number of messages to return. When omitted, returns all messages.
- `serviceWorkerId` (string): Filter messages to only return messages of the specified service worker.
- `types` (array): Filter messages to only return messages of the specified resource types. When omitted or empty, returns all messages.

### `list_network_requests` (~121 tokens)

Lists the most recent requests for the currently selected page since the last navigation.

Input parameters:

- `includePreservedRequests` (boolean): Set to true to return the preserved requests over the last 3 navigations.
- `pageIdx` (integer): Page number to return (0-based). When omitted, returns the first page.
- `pageSize` (integer): Maximum number of requests to return. When omitted, returns all requests.
- `resourceTypes` (array): Filter requests to only return requests of the specified resource types. When omitted or empty, returns all requests.

### `list_pages` (~18 tokens)

Get a list of pages open in the browser.

### `navigate_page` (~155 tokens)

Go to a URL, or back, forward, or reload. Use project URL if not specified otherwise.

Input parameters:

- `handleBeforeUnload` (string): Whether to auto accept or beforeunload dialogs triggered by this navigation. Default is accept.
- `ignoreCache` (boolean): Whether to ignore cache on reload.
- `initScript` (string): A JavaScript script to be executed on each new document before any other scripts for the next navigation.
- `timeout` (integer): Maximum wait time in milliseconds. If set to 0, the default timeout will be used.
- `type` (string): Navigate the page by URL, back or forward in history, or reload.
- `url` (string): Target URL (only type=url)

### `new_page` (~135 tokens)

Open a new tab and load a URL. Use project URL if not specified otherwise.

Input parameters:

- `background` (boolean): Whether to open the page in the background without bringing it to the front. Default is false (foreground).
- `isolatedContext` (string): If specified, the page is created in an isolated browser context with the given name. Pages in the same browser context share cookies and storage. Pages in different browser contexts are fully isolat…
- `timeout` (integer): Maximum wait time in milliseconds. If set to 0, the default timeout will be used.
- `url` (string, required): URL to load in a new page.

### `performance_analyze_insight` (~97 tokens)

Provides more detailed information on a specific Performance Insight of an insight set that was highlighted in the results of a trace recording.

Input parameters:

- `insightName` (string, required): The name of the Insight you want more information on. For example: "DocumentLatency" or "LCPBreakdown"
- `insightSetId` (string, required): The id for the specific insight set. Only use the ids given in the "Available insight sets" list.

### `performance_start_trace` (~157 tokens)

Start a performance trace on the selected webpage. Use to find frontend performance issues, Core Web Vitals (LCP, INP, CLS), and improve page load speed.

Input parameters:

- `autoStop` (boolean): Determines if the trace recording should be automatically stopped.
- `filePath` (string): The absolute file path, or a file path relative to the current working directory, to save the raw trace data. For example, trace.json.gz (compressed) or trace.json (uncompressed).
- `reload` (boolean): Determines if, once tracing has started, the current selected page should be automatically reloaded. Navigate the page to the right URL using the navigate_page tool BEFORE starting the trace if reloa…

### `performance_stop_trace` (~66 tokens)

Stop the active performance trace recording on the selected webpage.

Input parameters:

- `filePath` (string): The absolute file path, or a file path relative to the current working directory, to save the raw trace data. For example, trace.json.gz (compressed) or trace.json (uncompressed).

### `press_key` (~106 tokens)

Press a key or key combination. Use this when other input methods like fill() cannot be used (e.g., keyboard shortcuts, navigation keys, or special key combinations).

Input parameters:

- `includeSnapshot` (boolean): Whether to include a snapshot in the response. Default is false.
- `key` (string, required): A key or a combination (e.g., "Enter", "Control+A", "Control++", "Control+Shift+R"). Modifiers: Control, Shift, Alt, Meta

### `resize_page` (~41 tokens)

Resizes the selected page's window so that the page has specified dimension

Input parameters:

- `height` (number, required): Page height
- `width` (number, required): Page width

### `select_page` (~62 tokens)

Select a page as a context for future tool calls.

Input parameters:

- `bringToFront` (boolean): Whether to focus the page and bring it to the top.
- `pageId` (number, required): The ID of the page to select. Call list_pages to get available pages.

### `take_heapsnapshot` (~58 tokens)

Capture a heap snapshot of the currently selected page. Use to analyze the memory distribution of JavaScript objects and debug memory leaks.

Input parameters:

- `filePath` (string, required): A path to a .heapsnapshot file to save the heapsnapshot to.

### `take_screenshot` (~165 tokens)

Take a screenshot of the page or element.

Input parameters:

- `filePath` (string): The absolute path, or a path relative to the current working directory, to save the screenshot to instead of attaching it to the response.
- `format` (string): Type of format to save the screenshot as. Default is "png"
- `fullPage` (boolean): If set to true takes a screenshot of the full page instead of the currently visible viewport. Incompatible with uid.
- `quality` (number): Compression quality for JPEG and WebP formats (0-100). Higher values mean better quality but larger file sizes. Ignored for PNG format.
- `uid` (string): The uid of an element on the page from the page content snapshot. If omitted, takes a page screenshot.

### `take_snapshot` (~130 tokens)

Take a text snapshot of the currently selected page based on the a11y tree. The snapshot lists page elements along with a unique
identifier (uid). Always use the latest snapshot. Prefer taking a snapshot over taking a screenshot. The snapshot indicates the element selected
in the DevTools Elements panel (if any).

Input parameters:

- `filePath` (string): The absolute path, or a path relative to the current working directory, to save the snapshot to instead of attaching it to the response.
- `verbose` (boolean): Whether to include all possible information available in the full a11y tree. Default is false.

### `type_text` (~55 tokens)

Type text using keyboard into a previously focused input

Input parameters:

- `submitKey` (string): Optional key to press after typing. E.g., "Enter", "Tab", "Escape"
- `text` (string, required): The text to type

### `upload_file` (~83 tokens)

Upload a file through a provided element.

Input parameters:

- `filePaths` (array, required): One or more local paths of files to upload.
- `includeSnapshot` (boolean): Whether to include a snapshot in the response. Default is false.
- `uid` (string, required): The uid of the file input element or an element that will open file chooser on the page from the page content snapshot

### `wait_for` (~67 tokens)

Wait for the specified text to appear on the selected page.

Input parameters:

- `text` (array, required): Non-empty list of texts. Resolves when any value appears on the page.
- `timeout` (integer): Maximum wait time in milliseconds. If set to 0, the default timeout will be used.

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/triuzzi-brave-mcp/brave-mcp#diagnostics

## Score history

- 2026-08-17: 71
- 2026-08-16: 70
- 2026-08-15: 69
- 2026-08-14: 69
- 2026-08-13: 69
- 2026-08-12: 68
- 2026-08-11: 66

## Links

- npm package: https://www.npmjs.com/package/brave-mcp
- Socket report: https://socket.dev/npm/package/brave-mcp
- Repository: https://github.com/triuzzi/brave-devtools-mcp
- Changelog RSS feed: https://verifymcp.io/servers/triuzzi-brave-mcp/brave-mcp.xml
- Changelog JSON feed: https://verifymcp.io/servers/triuzzi-brave-mcp/brave-mcp.json
- HTML version of this page: https://verifymcp.io/servers/triuzzi-brave-mcp/brave-mcp