# io.github.vola-trebla/playwright-trace-decoder-mcp (npm · playwright-trace-decoder-mcp)

MCP server for unpacking and analyzing Playwright trace.zip archives

- Trust score: 61/100 (medium)
- Change this week: +15
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `playwright-trace-decoder-mcp`: 61/100 (this document), [markdown](https://verifymcp.io/servers/vola-trebla-playwright-trace-decoder-mcp/playwright-trace-decoder-mcp.md), [page](https://verifymcp.io/servers/vola-trebla-playwright-trace-decoder-mcp/playwright-trace-decoder-mcp)

## Channel facts

- Registry: `npm`
- Package: `playwright-trace-decoder-mcp`
- Version: `0.2.3`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 70/100
  - No malware found by supply-chain analysis.
  - CVE check failed: a known high-severity CVE affects adm-zip 0.5.18, a direct dependency. A fixed version is available.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 76 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 81/100
  - AI-judged instruction clarity (excellent).
  - Tool/resource definitions use about 1495 tokens (~93/item across 16 items; 16 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

**Unverified: 1 category.** A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

## Install

### Claude

```bash
claude mcp add vola-trebla-playwright-trace-decoder-mcp -- npx -y playwright-trace-decoder-mcp
```

### Codex

```bash
codex mcp add vola-trebla-playwright-trace-decoder-mcp -- npx -y playwright-trace-decoder-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "vola-trebla-playwright-trace-decoder-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "playwright-trace-decoder-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add vola-trebla-playwright-trace-decoder-mcp --command npx --arg -y --arg playwright-trace-decoder-mcp
```

### Hermes

```yaml
mcp_servers:
  vola-trebla-playwright-trace-decoder-mcp:
    command: "npx"
    args: ["-y", "playwright-trace-decoder-mcp"]
```

### Other

```json
{
  "mcpServers": {
    "vola-trebla-playwright-trace-decoder-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "playwright-trace-decoder-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-02 (score 61, +35)

- [security regression] CVE-2026-39244 affects this package: high
- [security regression] Provenance: unverified → fail
- [security regression] Known CVEs: unverified → fail
- [security improvement] Install scripts: unverified → pass
- [security improvement] Malware scan: unverified → pass
- [security] Stability: Stability not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet.
- [functional regression] Capabilities: pass → unverified
- [functional improvement] Schema quality: unverified → excellent
- [functional improvement] License: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Maintenance: unverified → pass
- [functional] Licence: MIT

### 2026-08-01 (score 26, +5)

- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional improvement] MCP protocol: unverified → pass

### 2026-07-31 (score 21, −25)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-27 (score 46)

First indexed and scored.

## MCP tools (16)

### `get_test_metadata` (~50 tokens)

Returns test metadata: title, browser, platform, viewport, and start time

Input parameters:

- `trace_path` (string, required): Absolute path to trace.zip, or a URL (https://) to download it from

### `get_trace_summary` (~49 tokens)

Returns the failing action and top-level error message from a Playwright trace

Input parameters:

- `trace_path` (string, required): Absolute path to trace.zip, or a URL (https://) to download it from

### `get_action_timeline` (~82 tokens)

Returns a paginated timeline of all actions with locators and timings. Use limit/offset to page through large traces.

Input parameters:

- `limit` (integer): Max items to return
- `offset` (integer): Number of items to skip
- `trace_path` (string, required): Absolute path to trace.zip, or a URL (https://) to download it from

### `get_filtered_network_logs` (~82 tokens)

Returns only 4xx/5xx network responses, stripping static assets. Use limit/offset to page through results.

Input parameters:

- `limit` (integer): Max items to return
- `offset` (integer): Number of items to skip
- `trace_path` (string, required): Absolute path to trace.zip, or a URL (https://) to download it from

### `get_console_errors` (~72 tokens)

Returns JS exceptions and warnings. Use limit/offset to page through results.

Input parameters:

- `limit` (integer): Max items to return
- `offset` (integer): Number of items to skip
- `trace_path` (string, required): Absolute path to trace.zip, or a URL (https://) to download it from

### `get_aria_accessibility_tree` (~115 tokens)

Returns the ARIA accessibility tree (YAML) for a frame snapshot in the trace. Reduces DOM token cost by ~90% vs raw HTML. Use action_index to target a specific action — defaults to the failed action, or the last snapshot if no failure.

Input parameters:

- `action_index` (integer): Index of the action whose snapshot to use (0-based). Defaults to failed action.
- `trace_path` (string, required): Absolute path to trace.zip, or a URL (https://) to download it from

### `get_element_state_at_failure` (~49 tokens)

Returns DOM attributes of the failing element at the moment of failure

Input parameters:

- `trace_path` (string, required): Absolute path to trace.zip, or a URL (https://) to download it from

### `analyze_race_conditions` (~63 tokens)

Detects potential race conditions by finding network requests that were still in-flight when a user interaction action fired. Returns flagged actions with pending requests.

Input parameters:

- `trace_path` (string, required): Absolute path to trace.zip, or a URL (https://) to download it from

### `get_dom_mutation_delta` (~91 tokens)

Diffs the ARIA tree before and after a specific action. Returns added and removed elements so the agent sees exactly what changed without comparing two full DOM dumps.

Input parameters:

- `action_index` (integer, required): Index of the action to diff (0-based, from get_action_timeline)
- `trace_path` (string, required): Absolute path to trace.zip, or a URL (https://) to download it from

### `get_causal_chain_for_failure` (~93 tokens)

Walks backwards from the failed action and builds a chronological chain of preceding actions, network errors, and console errors. Surfaces the most likely root cause.

Input parameters:

- `lookback_ms` (integer): How far back from the failure to look, in milliseconds (default 5000)
- `trace_path` (string, required): Absolute path to trace.zip, or a URL (https://) to download it from

### `generate_error_signature` (~77 tokens)

Generates a stable 12-char hash signature for a test failure by normalizing the error message (stripping paths, numbers, UUIDs). Use to group duplicate failures across parallel CI runs without reading each trace manually.

Input parameters:

- `trace_path` (string, required): Absolute path to trace.zip, or a URL (https://) to download it from

### `compare_traces` (~90 tokens)

Compares a passing and a failing trace of the same test. Aligns actions by sequence, finds the first timing or structural divergence, and summarises network differences. Use to diagnose flakiness — what was different in the run that failed.

Input parameters:

- `failing_trace_path` (string, required): Absolute path to the failing trace.zip
- `passing_trace_path` (string, required): Absolute path to the passing trace.zip

### `get_screenshot_at_failure` (~130 tokens)

Returns the screenshot (base64 JPEG) from the trace closest to the moment of failure. Use when get_aria_accessibility_tree returns an empty or unhelpful tree — the image shows exactly what was on screen. Pass screenshot_index to retrieve any specific screenshot from the trace (0-based); omit to get the one nearest to the failure.

Input parameters:

- `screenshot_index` (integer): 0-based index into the screenshot list. Omit to get the one at failure.
- `trace_path` (string, required): Absolute path to trace.zip, or a URL (https://) to download it from

### `correlate_dom_and_network` (~124 tokens)

Joins the HAR network log and DOM snapshots into an explicit causal chain. For each action where a network response completed and the DOM mutated within ±100ms, returns the triggering request URL, response status, body snippet, and the exact DOM nodes that appeared or disappeared. Background polling and analytics pixels are filtered out. Use to diagnose race conditions and async rendering bugs — removes hallucination from the question 'did this fetch cause this DOM change?'

Input parameters:

- `trace_path` (string, required): Absolute path to trace.zip, or a URL (https://) to download it from

### `extract_trace_metadata_strict` (~141 tokens)

Strictly inspects a Playwright trace archive and returns format version, retry session breakdown, and HAR payload mode. Handles .pwtrace.zip extensions (newer Playwright CI), multi-retry archives (identifies which retry failed), and all three HAR modes: embed (bodies inline), attach (bodies as separate files), omit (headers only). Use before other trace tools when the archive may be from an unfamiliar Playwright version or CI configuration — confirms the trace is valid and tells you what data is available.

Input parameters:

- `trace_path` (string, required): Absolute path to trace.zip, or a URL (https://) to download it from

### `detect_performance_anomalies` (~187 tokens)

Detects Long Tasks and frame drops that cause Playwright timeouts. Analyses screencast-frame timestamps for main-thread blocking (gaps > 50ms), flags actions that took longer than 500ms, counts concurrent in-flight network requests during each slow action, and checks for monotonically increasing action durations (suspected memory leak). Returns a ranked list of anomalies with a suspected_cause so the agent can distinguish a blocked main thread from network saturation or a navigation timeout — without blaming a missing element.

Input parameters:

- `frame_drop_threshold_ms` (integer): Screencast frame gaps longer than this count as a drop (default 50ms)
- `slow_action_threshold_ms` (integer): Actions longer than this are flagged (default 500ms)
- `trace_path` (string, required): Absolute path to trace.zip, or a URL (https://) to download it from

## Diagnostics

Captured diagnostic sections: Provenance, Vulnerabilities, Dependencies. The full working is on the page: https://verifymcp.io/servers/vola-trebla-playwright-trace-decoder-mcp/playwright-trace-decoder-mcp#diagnostics

## Score history

- 2026-08-03: 61
- 2026-08-02: 61
- 2026-08-01: 26
- 2026-07-31: 21
- 2026-07-30: 46
- 2026-07-28: 46
- 2026-07-27: 46

## Links

- npm package: https://www.npmjs.com/package/playwright-trace-decoder-mcp
- Socket report: https://socket.dev/npm/package/playwright-trace-decoder-mcp
- Repository: https://github.com/vola-trebla/playwright-trace-decoder-mcp
- Changelog RSS feed: https://verifymcp.io/servers/vola-trebla-playwright-trace-decoder-mcp/playwright-trace-decoder-mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/vola-trebla-playwright-trace-decoder-mcp/playwright-trace-decoder-mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/vola-trebla-playwright-trace-decoder-mcp/playwright-trace-decoder-mcp