# io.github.YawLabs/vew-mcp (npm · @yawlabs/vew-mcp)

Browser MCP: drive a real Chromium via Playwright with compact ref-addressable page snapshots

- Trust score: 66/100 (medium)
- Change this week: +65
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-07

## Components

- npm · `@yawlabs/vew-mcp`: 66/100 (this document), [markdown](https://verifymcp.io/servers/yawlabs-vew-mcp/yawlabs-vew-mcp.md), [page](https://verifymcp.io/servers/yawlabs-vew-mcp/yawlabs-vew-mcp)

## Channel facts

- Registry: `npm`
- Package: `@yawlabs/vew-mcp`
- Version: `0.4.3`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-07.

- **Supply Chain Security**: 87/100
  - No malware found by supply-chain analysis.
  - Known CVEs were checked across the 97 of 101 dependencies we could resolve, so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Dependency health was assessed across the 97 of 101 dependencies we could resolve, so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 19/100
  - Repository check failed: no source repository is declared.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 16 days ago).
  - Security-disclosure policy not yet verified: we couldn't inspect the source repository.
- **Schema Quality & AI Usability**: 74/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 2301 tokens (~143/item across 16 items; 16 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 40/100
  - Stability observed for 12 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add yawlabs-vew-mcp -- npx -y @yawlabs/vew-mcp
```

### Codex

```bash
codex mcp add yawlabs-vew-mcp -- npx -y @yawlabs/vew-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "yawlabs-vew-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@yawlabs/vew-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add yawlabs-vew-mcp --command npx --arg -y --arg @yawlabs/vew-mcp
```

### Hermes

```yaml
mcp_servers:
  yawlabs-vew-mcp:
    command: "npx"
    args: ["-y", "@yawlabs/vew-mcp"]
```

### Other

```json
{
  "mcpServers": {
    "yawlabs-vew-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@yawlabs/vew-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-07 (score 66, +1)

No change was recorded against any check on this day. Stability & Change Management went from 37 to 40. That category is still filling its 30-day observation window: 11 days of observed history at the previous scan, 12 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-08-05 (score 65, +1)

No change was recorded against any check on this day. Stability & Change Management went from 30 to 33. That category is still filling its 30-day observation window: 9 days of observed history at the previous scan, 10 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-08-03 (score 64, +4)

- [functional improvement] Stability: unverified → 0.27

### 2026-08-02 (score 60, +60)

- [security regression] Provenance: unverified → fail
- [security improvement] Install scripts: unverified → pass
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Malware scan: unverified → pass
- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional improvement] Schema quality: unverified → excellent
- [functional improvement] License: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Tool coverage: unverified → 100
- [functional] Licence: MIT

### 2026-08-01 (score 0, −1)

- [functional regression] Dependency health: partial → unverified

### 2026-07-31 (score 1, −37)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-27 (score 38)

First indexed and scored.

## MCP tools (16)

### `browser_navigate` (~184 tokens)

Navigate the persistent browser page to a URL and return a fresh snapshot of the resulting page. This is usually the first call: it loads the page and immediately gives you the ref-addressable element list + readable text so you can act without a second round-trip. Waits for the load event by default. The page renders at Playwright's default 1280x720 viewport. The snapshot lists every rendered element with a recognized interactive role (button, link, textbox, checkbox, ...), including ones below the fold; scroll only to load content injected lazily as you scroll.

Input parameters:

- `timeout_ms` (integer): Navigation timeout in ms (default 30000).
- `url` (string, required): Absolute http(s) URL to navigate to.
- `wait_until` (string): When to consider navigation finished (default 'load'). Use 'networkidle' for SPA-heavy pages.

### `browser_back` (~39 tokens)

Go back one entry in the browser history, then return a fresh snapshot of the page you land on. No-op error if there is no previous entry.

### `browser_forward` (~39 tokens)

Go forward one entry in the browser history, then return a fresh snapshot of the page you land on. No-op error if there is no forward entry.

### `browser_snapshot` (~165 tokens)

Return a compact, token-efficient view of the CURRENT page: a ref-tagged list of interactive elements (each line is `[ref] role "name"`, optionally with value/checked/disabled) followed by the readable page text. This is the core capability -- prefer it over a raw DOM dump. Refs (e1, e2, ...) are stable within this snapshot and RENUMBER on the next one; always act off the most recent snapshot. Pass a ref to browser_click / browser_type. Lists every rendered element with a recognized interactive role, including below-the-fold ones; scroll only to surface content that loads lazily on scroll.

Input parameters:

- `text_budget` (integer): Max characters of page text to include (default 8000). Lower it to save tokens.

### `browser_click` (~98 tokens)

Click the interactive element addressed by `ref` (from the most recent snapshot), then return a fresh snapshot of the resulting page. Use this for buttons, links, checkboxes, tabs, menu items.

Input parameters:

- `ref` (string, required): Element ref from the most recent browser_snapshot (e.g. 'e3'). Stale refs from an older snapshot are invalid.
- `timeout_ms` (integer): Click timeout in ms (default 10000).

### `browser_type` (~138 tokens)

Type `text` into the textbox/searchbox/combobox addressed by `ref` (from the most recent snapshot). The field is cleared first. Set `submit: true` to press Enter afterward (e.g. to run a search). Returns a fresh snapshot.

Input parameters:

- `ref` (string, required): Element ref from the most recent browser_snapshot (e.g. 'e3'). Stale refs from an older snapshot are invalid.
- `submit` (boolean): Press Enter after typing (default false).
- `text` (string, required): Text to type into the field.
- `timeout_ms` (integer): Action timeout in ms (default 10000).

### `browser_select_option` (~152 tokens)

Select an option in a native <select> dropdown addressed by `ref` (from the most recent snapshot). The `value` is matched against each option's visible label OR its value attribute. browser_type cannot fill a <select> -- use this instead. On a <select multiple>, this selects only the matching option and clears any others. Returns a fresh snapshot.

Input parameters:

- `ref` (string, required): Element ref from the most recent browser_snapshot (e.g. 'e3'). Stale refs from an older snapshot are invalid.
- `timeout_ms` (integer): Action timeout in ms (default 10000).
- `value` (string, required): Option to select, matched against its visible label or its value attribute.

### `browser_scroll` (~70 tokens)

Scroll the page one viewport in the given direction, then return a fresh snapshot. Useful to bring lazily-loaded content (infinite scroll, IntersectionObserver widgets) into the DOM so it appears in the snapshot.

Input parameters:

- `direction` (string, required): Scroll direction. 'top'/'bottom' jump to page extremes.

### `browser_press_key` (~222 tokens)

Press a single keyboard key, optionally on the element addressed by `ref`. Use Playwright key names: Enter, Tab, Escape, Backspace, Delete, ArrowUp/Down/Left/Right, Home, End, PageUp/PageDown, or a single character; combos use '+', e.g. 'Control+A'. With a `ref` the element is focused first (e.g. to submit a field or drive a focused widget); without one the key goes to whatever currently has focus (e.g. Escape to close a modal). Returns a fresh snapshot.

Input parameters:

- `key` (string, required): Key to press, e.g. 'Enter', 'Escape', 'ArrowDown', 'Control+A'.
- `ref` (string): Optional. Element ref from the most recent browser_snapshot (e.g. 'e3'). Stale refs from an older snapshot are invalid. If omitted, the key goes to the currently focused element.
- `timeout_ms` (integer): Action timeout in ms (default 10000). Applies only when a ref is given.

### `browser_hover` (~104 tokens)

Hover the pointer over the element addressed by `ref` (from the most recent snapshot), then return a fresh snapshot. Use this to reveal hover-only menus, tooltips, or action icons that are not in the page until hovered.

Input parameters:

- `ref` (string, required): Element ref from the most recent browser_snapshot (e.g. 'e3'). Stale refs from an older snapshot are invalid.
- `timeout_ms` (integer): Action timeout in ms (default 10000).

### `browser_file_upload` (~140 tokens)

Set one or more local files on the file input addressed by `ref` (from the most recent snapshot). Paths resolve on the machine running the browser. The ref must point at an <input type=file> (it appears in the snapshot as a textbox). Returns a fresh snapshot.

Input parameters:

- `paths` (array, required): Absolute path(s) to the file(s) to upload, on the machine running the browser.
- `ref` (string, required): Element ref from the most recent browser_snapshot (e.g. 'e3'). Stale refs from an older snapshot are invalid.
- `timeout_ms` (integer): Action timeout in ms (default 10000).

### `browser_get_text` (~92 tokens)

Return the readable text (innerText) of the current page, normalized and clamped to a character budget. Use this when you want the page content WITHOUT the interactive-element list that browser_snapshot includes.

Input parameters:

- `text_budget` (integer): Max characters of NORMALIZED text to return (default 8000). The cap is applied after whitespace normalization, so a page with heavy indentation may produce less output than the budget.

### `browser_screenshot` (~89 tokens)

Capture a PNG screenshot of the current page and return it as an image. Defaults to the viewport; set full_page to capture the entire scrollable page. Prefer browser_snapshot for acting on the page -- a screenshot is for when you need to SEE pixels (layout, charts, visual verification).

Input parameters:

- `full_page` (boolean): Capture the full scrollable page instead of just the viewport (default false).

### `browser_evaluate` (~248 tokens)

Evaluate a JavaScript EXPRESSION in the current page's context and return the JSON-serializable result. This is the escape hatch for reading computed state or extracting structured data the snapshot does not surface -- e.g. 'document.title', 'location.href', or '({ count: document.querySelectorAll("a").length })'. Runs in the page sandbox (not the server process). The result must be JSON-serializable; DOM nodes and functions come back empty. Arbitrary JS can also mutate the page, so this is not a read-only call. The call is bounded by timeout_ms and returns an error if the expression has not resolved by then (note: a synchronous infinite loop pins the page's JS thread, so control returns to you but the page may need a re-navigate to fully recover -- prefer terminating expressions).

Input parameters:

- `expression` (string, required): A JavaScript expression evaluated in the page. Wrap an object literal in parens, e.g. '({a: 1})'; this is an expression, not a statement block.
- `timeout_ms` (integer): Max ms to wait for the expression to resolve before returning a timeout error (default 30000).

### `browser_wait_for` (~230 tokens)

Wait for a condition on the current page, then return a fresh snapshot. Provide at least one of: `text` (wait until that text becomes visible), `text_gone` (wait until that text is no longer visible), or `time_ms` (wait a fixed time); when several are given they apply in that order. Use this after an action that triggers async / SPA rendering so the next snapshot reflects the settled page instead of racing a half-rendered DOM.

Input parameters:

- `text` (string): Wait until this (substring) text becomes visible on the page.
- `text_gone` (string): Wait until this (substring) text is no longer visible anywhere in the page's rendered text. Returns immediately if the text is not currently visible (so a typo or already-gone text is a fast no-op, n…
- `time_ms` (integer): Instead of a text condition, just wait this many ms (max 30000).
- `timeout_ms` (integer): Max time to wait for a text / text_gone condition in ms (default 10000).

### `browser_handle_dialog` (~291 tokens)

Configure how the browser answers the next native JS dialog (alert / confirm / prompt / beforeunload), and report the most recent dialog seen. By default vew auto-ACCEPTS dialogs when driving its own launched browser (so a confirm()-gated action proceeds and alert() text is captured) and auto-DISMISSES them when attached to an existing browser (VEW_CDP_URL) so it does not hijack the human's dialogs. Pass `accept` to override that for the next dialog (and `prompt_text` to answer a prompt()); the override stays armed until a dialog actually fires (then it reverts to the mode default) or you call this again -- so if the action you expected to raise a dialog does not, re-issue or clear the override before the next one. Calling with NO arguments does NOT change the disposition -- it just reports the last dialog, leaving the mode default in place (important in attach mode, where a stray accept would auto-confirm the human's dialogs). This call never opens a dialog or changes the page.

Input parameters:

- `accept` (boolean): Accept (true) or dismiss/cancel (false) the next dialog. Omit to leave the mode default in place (accept in launched mode, dismiss when attached).
- `prompt_text` (string): Text to enter into a prompt() dialog before accepting it. Ignored when accept is false.

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/yawlabs-vew-mcp/yawlabs-vew-mcp#diagnostics

## Score history

- 2026-08-07: 66
- 2026-08-06: 65
- 2026-08-05: 65
- 2026-08-04: 64
- 2026-08-03: 64
- 2026-08-02: 60
- 2026-08-01: 0
- 2026-07-31: 1
- 2026-07-30: 38
- 2026-07-28: 38
- 2026-07-27: 38

## Links

- npm package: https://www.npmjs.com/package/@yawlabs/vew-mcp
- Socket report: https://socket.dev/npm/package/@yawlabs/vew-mcp
- Changelog RSS feed: https://verifymcp.io/servers/yawlabs-vew-mcp/yawlabs-vew-mcp.xml
- Changelog JSON feed: https://verifymcp.io/servers/yawlabs-vew-mcp/yawlabs-vew-mcp.json
- HTML version of this page: https://verifymcp.io/servers/yawlabs-vew-mcp/yawlabs-vew-mcp