microsoft/playwright-mcp

v0.0.76 Feature

This release adds 4 notable features for engineering teams evaluating rollout.

Published 1mo MCP Browser & Automation

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

mcp playwright

Affected surfaces

rce_ssrf

Summary

AI summary

Updates Bug Fixes, Tool Improvements, and New Tools across a mixed release.

Changes in this release

Type	Severity	Summary	CVE
Security	Medium	Adds path‑traversal checks to static file serving routes Adds path‑traversal checks to static file serving routes Source: granite4.1:30b@2026-06-10-audit Confidence: low	—
Feature
Feature	Medium	Adds `browser_video_show_actions` and `browser_video_hide_actions` to overlay/hide action annotations on recorded video Adds `browser_video_show_actions` and `browser_video_hide_actions` to overlay/hide action annotations on recorded video Source: llm_adapter@2026-06-10 Confidence: high	—
Feature	Medium	Changes `remoteEndpoint` to accept a ConnectOptions object instead of only a URL string Changes `remoteEndpoint` to accept a ConnectOptions object instead of only a URL string Source: llm_adapter@2026-06-10 Confidence: high	—
Feature	Medium	Introduces `--output-max-size` flag to cap tool response size with post‑response eviction Introduces `--output-max-size` flag to cap tool response size with post‑response eviction Source: llm_adapter@2026-06-10 Confidence: high	—
Feature	Medium	Adds `moz-firefox` BiDi channel support to the `--browser` flag Adds `moz-firefox` BiDi channel support to the `--browser` flag Source: llm_adapter@2026-06-10 Confidence: high	—
Bugfix
Bugfix	Medium	Supports `remoteHeaders` for the remote browser endpoint Supports `remoteHeaders` for the remote browser endpoint Source: llm_adapter@2026-06-10 Confidence: high	—
Bugfix	Medium	Uses `waitUntil: 'commit'` when navigating back/forward in pages Uses `waitUntil: 'commit'` when navigating back/forward in pages Source: llm_adapter@2026-06-10 Confidence: high	—
Bugfix	Medium	Reports invalid tool arguments instead of failing opaquely Reports invalid tool arguments instead of failing opaquely Source: llm_adapter@2026-06-10 Confidence: high	—
Bugfix	Medium	Uses a writable cache directory for MCP user data instead of the browsers path Uses a writable cache directory for MCP user data instead of the browsers path Source: llm_adapter@2026-06-10 Confidence: high	—
Bugfix	Medium	Disconnects tracked browser when the browser tracker is disposed Disconnects tracked browser when the browser tracker is disposed Source: llm_adapter@2026-06-10 Confidence: high	—
Bugfix	Medium	Reports missing `ffmpeg` distinctly from a missing browser Reports missing `ffmpeg` distinctly from a missing browser Source: llm_adapter@2026-06-10 Confidence: high	—
Bugfix	Low	Does not mark response as closed when there are no open tabs Does not mark response as closed when there are no open tabs Source: granite4.1:30b@2026-06-10-audit Confidence: low	—

Full changelog

What's New

New Tools

browser_video_show_actions / browser_video_hide_actions — Overlay action annotations on the recorded video, or hide them again (#40914)

Tool Improvements

Remote endpoint — remoteEndpoint now accepts a ConnectOptions object, not just a URL string (#40964)
--output-max-size — Cap the size of tool responses, with post-response disk eviction of oversized output (#41031)
--browser — Support moz-firefox BiDi channels (#41126)

Bug Fixes

Support remoteHeaders for the remote browser endpoint (#40828, #41156)
Use waitUntil: 'commit' when navigating back/forward (#41153)
Report invalid tool arguments instead of failing opaquely (#40979)
Use a writable cache directory for MCP user data instead of the browsers path (#40961)
Disconnect the tracked browser when the browser tracker is disposed (#40967)
Report a missing ffmpeg distinctly from a missing browser (#40867)
Don't mark the response as closed when there are no open tabs (#40743)
Validate user-provided regex patterns in MCP tools (#40752)
Pass the time parameter to page.evaluate when waiting for a timeout (#41037)
Add path-traversal checks to static file serving routes (#40715)

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track microsoft/playwright-mcp

Get notified when new releases ship.

About microsoft/playwright-mcp

Playwright MCP server

All releases →