# Playwright E2E MCP (npm · playwright-e2e-mcp)

Diagnose and fix failing Playwright tests: traces, verified fixes, flaky/order verdicts, a11y audit.

- Trust score: 83/100 (high trust)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-10-25

## Components

- npm · `playwright-e2e-mcp`: 83/100 (this document), [markdown](https://verifymcp.io/servers/xsignon-secure-e2e/playwright-e2e-mcp.md), [page](https://verifymcp.io/servers/xsignon-secure-e2e/playwright-e2e-mcp)

## Channel facts

- Registry: `npm`
- Package: `playwright-e2e-mcp`
- Version: `0.4.2`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-10-25.

- **Supply Chain Security**: 100/100
  - No malware found by supply-chain analysis.
  - No known CVEs affecting this package version or its production dependencies.
  - No install/post-install scripts declared.
  - 0 of 4 dependencies flagged as unhealthy.
- **Provenance & Transparency**: 100/100
  - Source repository is publicly reachable at the declared URL.
  - Cryptographically verified build provenance (signed, bound to xsignon-secure/E2E).
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 2 days ago).
  - Publishes a security disclosure policy (SECURITY.md).
- **Schema Quality & AI Usability**: 71/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 2967 tokens (~247/item across 12 items; 12 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 17/100
  - Stability observed for 5 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 96/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 87% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 12 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 12 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### How do I install the Playwright E2E MCP server?

Playwright E2E MCP runs locally as an npm package, launched with npx -y playwright-e2e-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add xsignon-secure-e2e -- npx -y playwright-e2e-mcp
```

### Cursor

```json
{
  "mcpServers": {
    "xsignon-secure-e2e": {
      "command": "npx",
      "args": [
        "-y",
        "playwright-e2e-mcp"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "xsignon-secure-e2e": {
      "command": "npx",
      "args": [
        "-y",
        "playwright-e2e-mcp"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add xsignon-secure-e2e -- npx -y playwright-e2e-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "xsignon-secure-e2e": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "playwright-e2e-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add xsignon-secure-e2e --command npx --arg -y --arg playwright-e2e-mcp
```

### Hermes

```yaml
mcp_servers:
  xsignon-secure-e2e:
    command: "npx"
    args: ["-y", "playwright-e2e-mcp"]
```

### Netclaw

```json
{
  "McpServers": {
    "xsignon-secure-e2e": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "playwright-e2e-mcp"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add xsignon-secure-e2e -t stdio -c npx -a -y playwright-e2e-mcp
```

### Other

```json
{
  "mcpServers": {
    "xsignon-secure-e2e": {
      "command": "npx",
      "args": [
        "-y",
        "playwright-e2e-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-10-25 (score 83, +1)

No change was recorded against any check on this day. Stability & Change Management went from 13 to 17. That category is still filling its 30-day observation window: 4 days of observed history at the previous scan, 5 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-23 (score 82, +1)

No change was recorded against any check on this day. Stability & Change Management went from 7 to 10. That category is still filling its 30-day observation window: 2 days of observed history at the previous scan, 3 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-22 (score 81, +16)

- [security regression] Stability: 0.03 → unverified
- [security regression] Tool safety: pass → unverified
- [security improvement] Malware scan: unverified → pass
- [functional regression] Capabilities: pass → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional regression] Schema quality: 100 → unverified
- [functional improvement] Security disclosure: fail → pass
- [functional] Package version: 0.4.1 → 0.4.2

### 2026-10-21 (score 65, +11)

- [security improvement] Known CVEs: unverified → pass
- [functional regression] Schema quality: 2565 → 2967
- [functional improvement] Dependency health: unverified → 1.00
- [functional improvement] Stability: unverified → 0.03
- [functional] Package version: 0.3.2 → 0.4.1
- [functional] Package version: 0.3.2 → 0.4.0

### 2026-10-20 (score 54)

First indexed and scored.

## MCP tools (12)

### `run-test` (~375 tokens)

Run E2E tests

Run the project's Playwright tests: stats plus each failure's file:line, kind and message. Diagnoses missing installs, dead dev servers, syntax errors, crashes and timeouts (kills the tree, keeps partial results). Reports progress; background: true returns a run id for long suites. Runs are recorded for analyze-history.

Input parameters:

- `args` (array): Extra Playwright flags from an allowlist, as --flag or --flag=value (e.g. --repeat-each=3, --shard=1/2, --trace=on)
- `background` (boolean): Return a run id at once; poll get-run-status
- `browser` (string): Playwright project name to run (matched against playwright.config projects)
- `config` (string): playwright.config path or 1-based index when the project has several configs
- `grep` (string): Only run tests whose title matches this regex
- `headed` (boolean): Run with a visible browser window
- `lastFailed` (boolean): Only re-run tests that failed in the previous run (Playwright --last-failed) — the fast fix → re-run loop
- `projectRoot` (string): Project directory; defaults to the server working directory
- `retries` (integer)
- `retryOnFailure` (boolean): Auto retry failing tests once before reporting failure (default true; ignored when retries is set)
- `testFiles` (array): Test files/directories relative to the project root; "file:line" is supported. Omit to run the whole suite.
- `testTimeoutMs` (integer): Per-test timeout passed to Playwright
- `timeoutMs` (integer): Hard wall-clock limit for the whole run; the process tree is killed past it (default 120000)
- `workers` (integer)

### `get-run-status` (~88 tokens)

Check a background run

Progress (tests done/total, failures so far) or the final result of a run-test background run; the result becomes the last run for get-failure. waitSeconds waits; cancel stops it. Default: the latest run.

Input parameters:

- `cancel` (boolean)
- `runId` (string)
- `waitSeconds` (integer): Wait up to this long for it to finish

### `get-failure` (~112 tokens)

Analyze a test failure

Analyze one failure from the most recent run-test execution: full message and code frame, expected vs actual, stack trace, failed network requests (4xx/5xx and dead endpoints), console errors, failure kind (assertion/timeout/browser-crash/syntax/config/server-unreachable) and concrete next steps. Use run-test first.

Input parameters:

- `index` (integer): 1-based failure index from the last run (default 1)
- `projectRoot` (string): Only used to re-read the stored report

### `suggest-fix` (~253 tokens)

Suggest (and apply) a fix

Patch a failure from the last run: a drifted locator is matched against the DOM at failure (trace, or live url) and replaced with one proven unique; changed copy gets the new expected text. Returns a diff and confidence; apply: true writes it, re-runs the test and reverts if still red. Refuses when the element is truly missing (app bug).

Input parameters:

- `allowExpectationUpdate` (boolean): Allow applying changed expected text (can hide regressions)
- `apply` (boolean): Write the fix (default: diff only)
- `config` (string): playwright.config path or 1-based index
- `headers` (object): Extra HTTP headers, e.g. Authorization
- `index` (integer): 1-based failure index (default 1)
- `projectRoot` (string)
- `storageState` (string): Logged-in session: storageState JSON inside the project, e.g. playwright/.auth/user.json
- `timeoutMs` (integer): Verification run limit (default 120000)
- `url` (string): Heal against this live page instead of the trace snapshot
- `verify` (boolean): Re-run after applying; revert if still failing (default true)

### `inspect-page` (~308 tokens)

Inspect live page DOM

Open a URL headlessly and return its elements with Playwright locators proven unique on the page (role + name first), CSS selectors, visibility, text and console messages. storageState/headers open it signed in; actions click/fill first to reach a state. view 'locators' is the compact map.

Input parameters:

- `actions` (array): Steps run after load to reach a state (modal, step 3)
- `headers` (object): Extra HTTP headers, e.g. Authorization
- `includeHtml` (boolean): Include the rendered HTML (truncated)
- `maxHtmlChars` (integer): HTML cap when includeHtml is set (default 20000)
- `projectRoot` (string): Project whose Playwright launches the browser (default: server root)
- `selector` (string): CSS selector: inspect matches instead of the whole DOM
- `storageState` (string): Logged-in session: storageState JSON inside the project, e.g. playwright/.auth/user.json
- `timeoutMs` (integer): Overall inspection limit in ms (default 45000)
- `url` (string, required): Full URL of the page to open (http/https)
- `view` (string): 'locators': compact map of interactive elements (cheapest); 'elements' (default): DOM inventory
- `viewport` (object)
- `waitFor` (string): Wait for this selector first
- `waitUntil` (string): Navigation wait condition (default domcontentloaded)

### `list-tests` (~149 tokens)

List available tests

List the Playwright tests available in the project (file, line, full title, projects), with optional filtering. Uses `playwright test --list` when Playwright works and falls back to a source scan when the install or config is broken, reporting why.

Input parameters:

- `config` (string): playwright.config path or 1-based index when the project has several configs
- `filter` (string): Case-insensitive substring filter on "file › title"
- `limit` (integer): Max tests to return (default 500)
- `projectRoot` (string): Project directory; defaults to the server working directory
- `testDir` (string): Restrict scanning to this directory (inside the project)

### `validate-selector` (~221 tokens)

Validate selector or locator

Check a CSS selector, Playwright selector or locator (getByRole/getByTestId…, .first(), .filter()) on a live page: validity, match count (actions need exactly 1), sample matches and a sturdier verified locator for each. Accepts storageState/headers/actions.

Input parameters:

- `actions` (array): Steps run after load to reach a state (modal, step 3)
- `headers` (object): Extra HTTP headers, e.g. Authorization
- `projectRoot` (string): Project whose Playwright launches the browser (default: server root)
- `selector` (string, required): Selector or locator, e.g. getByRole('button', { name: 'Save' })
- `storageState` (string): Logged-in session: storageState JSON inside the project, e.g. playwright/.auth/user.json
- `timeoutMs` (integer): Overall limit in ms (default 45000)
- `url` (string, required): Full URL of the live page to test against (http/https)
- `viewport` (object)

### `audit-accessibility` (~317 tokens)

Audit page accessibility

Run axe-core on a live page (WCAG 2.2 AA by default) and return violations worst first, each with the offending elements as verified Playwright locators, the fix, and a regression check to paste into a spec. Accepts storageState/headers/actions to audit pages behind a login or after a step.

Input parameters:

- `actions` (array): Steps run after load to reach a state (modal, step 3)
- `headers` (object): Extra HTTP headers, e.g. Authorization
- `minImpact` (string): Hide violations below this impact (default: minor, show all)
- `projectRoot` (string): Project whose Playwright launches the browser (default: server root)
- `selector` (string): CSS selector: audit only this part of the page
- `standard` (string): Rule set: WCAG level (default wcag22aa, i.e. 2.0–2.2 A+AA), 'best-practice' adds axe's extra rules, 'all' runs everything
- `storageState` (string): Logged-in session: storageState JSON inside the project, e.g. playwright/.auth/user.json
- `timeoutMs` (integer): Overall audit limit in ms (default 60000)
- `url` (string, required): Full URL of the page to audit (http/https)
- `viewport` (object)
- `waitFor` (string): Wait for this selector first
- `waitUntil` (string): Navigation wait condition (default load)

### `generate-e2e-test` (~265 tokens)

Generate an E2E test

Scaffold a Playwright test from a description using the project's REAL selectors. Scans the agent's recent file changes (git working tree / last commit, mtime fallback), extracts data-testid / role / label / placeholder / id locators with their source locations, optionally cross-checks them against the live page, writes a ready-to-run spec, and returns next steps.

Input parameters:

- `config` (string): playwright.config path or 1-based index
- `description` (string, required): What the test should cover, e.g. "login with valid credentials"
- `file` (string): Exact spec path (*.spec.ts / *.test.ts) inside the project instead of the default location
- `liveInspect` (boolean): Verify discovered selectors against the live page (default true when a URL is known)
- `overwrite` (boolean): Replace an existing spec at the target path (only specs this tool generated)
- `pageUrl` (string): Page the test starts on (default: baseURL from playwright.config)
- `projectRoot` (string): Project directory; defaults to the server working directory
- `testDir` (string): Directory for the generated spec (default: detected testDir or tests/)
- `write` (boolean): Write the file to disk (default true)

### `compare-visual-state` (~331 tokens)

Compare visual state

Visual regression check: screenshot a live page (or element), compare it to a stored baseline, and report how many pixels changed, WHERE they changed (bounding regions), and the average color shift ("blue → red"). First call saves the baseline; later calls compare. Writes a red-highlighted diff image for review.

Input parameters:

- `action` (string): 'baseline' overwrites the stored baseline; 'compare' (default) compares against it
- `actions` (array): Steps run after load to reach a state (modal, step 3)
- `fullPage` (boolean): Capture the full scrollable page (default false)
- `headers` (object): Extra HTTP headers, e.g. Authorization
- `name` (string, required): Baseline id, e.g. "checkout-page" or "submit-button"
- `pixelThreshold` (integer): Combined per-pixel channel delta considered different (default 60)
- `projectRoot` (string): Project directory; defaults to the server working directory
- `selector` (string): Capture only this element (selector or locator)
- `storageState` (string): Logged-in session: storageState JSON inside the project, e.g. playwright/.auth/user.json
- `timeoutMs` (integer)
- `tolerance` (number): Percent of pixels that may differ before reporting a change (default 0.1)
- `url` (string, required): Full URL of the page (or element target) to capture
- `viewport` (object)
- `waitFor` (string): Wait for this selector before capturing
- `waitUntil` (string)

### `diagnose-flaky` (~427 tokens)

Diagnose flaky test

Repeat failing tests with retries disabled and return a per-test, evidence-based verdict: CONSISTENTLY FAILING (real bug), FLAKY (pass/fail counts, error-signature variance, duration spread) or NOT REPRODUCING. Runs all repetitions in one process by default. `isolate: true` also re-runs the failures with one worker to tell parallelism bugs (shared state) from flakiness inside the test; `order: true` (Playwright 1.64+) runs the files in random orders to catch tests that depend on what ran before them. Defaults to the tests that failed in the most recent run.

Input parameters:

- `browser` (string): Playwright project name to run
- `config` (string): playwright.config path or 1-based index when the project has several configs
- `headed` (boolean): Run with a visible browser window
- `isolate` (boolean): Also tell parallelism bugs from real flakiness: repeat in parallel (fully parallel, `workers` default 4), then repeat the failing tests with one worker
- `order` (boolean): Also run the target files in `runs` random orders (Playwright 1.64+ --shuffle, one worker) to find tests that depend on what ran before them; returns the seed that reproduces it and the likely culpri…
- `projectRoot` (string): Project directory; defaults to the server working directory
- `runs` (integer): How many times to run the tests (default 3)
- `separateProcesses` (boolean): Start a fresh Playwright process per run instead of one --repeat-each process (slower; use when the flake depends on global setup or a cold start)
- `testFiles` (array): Tests to diagnose ("file:line" supported). Defaults to the tests that failed in the most recent run.
- `timeoutMs` (integer): Hard wall-clock limit per run (default 120000); one --repeat-each process gets this × runs
- `workers` (integer)

### `analyze-history` (~121 tokens)

Analyze run history

Analyze the local run history (.playwright-e2e-mcp/history.jsonl, written by every run): 'flaky' ranks tests that flip pass/fail and lists broken or regressed ones; 'patterns' groups failures by cause; 'test' shows one test's timeline.

Input parameters:

- `lastRuns` (integer): Runs to analyze (default 30)
- `limit` (integer)
- `projectRoot` (string)
- `test` (string): Filter: substring of file or title
- `view` (string): Default 'flaky'

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/xsignon-secure-e2e/playwright-e2e-mcp#diagnostics

## Score history

- 2026-10-25: 83
- 2026-10-24: 82
- 2026-10-23: 82
- 2026-10-22: 81
- 2026-10-21: 65
- 2026-10-20: 54

## Common questions

### What is the Playwright E2E MCP server?

Playwright E2E MCP is listed in the public MCP registry as io.github.xsignon-secure/E2E. Diagnose and fix failing Playwright tests: traces, verified fixes, flaky/order verdicts, a11y audit. This page covers its npm package (playwright-e2e-mcp).

### Is the Playwright E2E MCP server safe to use?

Playwright E2E MCP scores 83 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 25 October 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the Playwright E2E MCP server expose?

Playwright E2E MCP exposes 12 tools: run-test, get-run-status, get-failure, suggest-fix, inspect-page, and 7 more. Their descriptions and schemas cost roughly 2,967 tokens of context every time the server is loaded.

### Is the Playwright E2E MCP server still maintained?

Playwright E2E MCP is still listed as active in the MCP registry. We last reached this channel on 25 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What licence is the Playwright E2E MCP server under?

Playwright E2E MCP declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

## Links

- npm package: https://www.npmjs.com/package/playwright-e2e-mcp
- Socket report: https://socket.dev/npm/package/playwright-e2e-mcp
- Repository: https://github.com/xsignon-secure/E2E
- Changelog RSS feed: https://verifymcp.io/servers/xsignon-secure-e2e/playwright-e2e-mcp.xml
- Changelog JSON feed: https://verifymcp.io/servers/xsignon-secure-e2e/playwright-e2e-mcp.json
- HTML version of this page: https://verifymcp.io/servers/xsignon-secure-e2e/playwright-e2e-mcp