Chrome DevTools MCP is the Chrome team's own bridge between coding agents and the browser. Added to Claude Code, Codex, Gemini CLI, Cursor, Copilot or any other MCP client, it lets the agent open pages in a real Chrome, click and type, read console messages with source-mapped stack traces, inspect network requests, take screenshots, and record performance traces that DevTools turns into concrete findings such as a slow Largest Contentful Paint and what caused it.
That closes the loop that agents usually miss in front-end work: instead of guessing whether a fix worked, the agent can load the page and look. It uses Puppeteer under the hood, so actions wait for their results, and there is a slim mode with fewer tools for simple browsing, a headless option, and a plain CLI for use without MCP. It can also attach to a Chrome you already have open.
It is Apache-2.0, published on npm as chrome-devtools-mcp, at v1.11.0 when scanned, with about 53,800 stars and 149 contributors. It officially supports Google Chrome and Chrome for Testing only.
- Repository: github.com/ChromeDevTools/chrome-devtools-mcp
- Licence: Apache-2.0 (Apache License 2.0)
- Language: TypeScript. Stars: 53.8K. Forks: 6,991. Last push: Oct 19, 2026.
- Scan: safe, Oct 19, 2026, commit e96ee6c
Who it is for
Web developers who use a coding agent and want it to test, debug and profile pages in a real browser, rather than only reading the code.
Getting started
1. Claude Code
claude mcp add chrome-devtools --scope user npx chrome-devtools-mcp@latest2. Codex
codex mcp add chrome-devtools -- npx chrome-devtools-mcp@latest3. Gemini CLI
gemini mcp add chrome-devtools npx chrome-devtools-mcp@latest4. Then ask your agent, to check it works
Check the performance of https://developers.chrome.comNeeds Node.js and a current Chrome. Other MCP clients take the same command in their JSON config (command npx, args -y chrome-devtools-mcp@latest). Add --no-usage-statistics to the args to turn off Google's usage statistics, and --no-performance-crux to stop trace URLs going to the CrUX API.
Safety scan
We cloned ChromeDevTools/chrome-devtools-mcp at commit e96ee6c on Oct 19, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- The one secret hit is the public Chrome UX Report API key that DevTools itself ships, with a comment in the code saying the team knows it is public. No suspicious code patterns and no committed binaries across 355 files and about 80,000 lines of TypeScript.
- Usage statistics (tool success rates, latency, environment details) go to Google by default, as the README says up front; --no-usage-statistics or the CHROME_DEVTOOLS_MCP_NO_USAGE_STATISTICS variable turns them off. Performance tools may also send the URLs you trace to Google's CrUX API for real-user data, which --no-performance-crux stops, and the server checks npm for updates unless told not to.
- The README's own warning is the one that matters: the agent can inspect and change anything in the browser it controls. By default it starts its own Chrome profile; connecting it to your everyday browser hands the agent your signed-in sessions.
- 550 npm packages in package-lock.json with no known advisories. The only lifecycle script is prepare, which patches a type declaration for contributors building from a clone and does not run when you use npx.
- 8 workflows; the one pull_request_target workflow only validates PR titles with read-only permissions and does not check out PR code. 2 of 3 third-party actions are pinned to commits. Security policy, licence, contributing guide and Dependabot present.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | 1 candidate found and read; see the notes above. |
| Suspicious code | None found. |
| Install-time code | 1 npm lifecycle script |
| Committed binaries | None. |
| CI workflows | 8 workflows. 1 uses pull_request_target, none check out the pull request head. 1 of 3 third-party actions pinned to a tag rather than a commit. |
| Network hosts | 30 distinct hosts referenced from source; most often a.com, github.com, b.com, trace.example. 1 URL to a bare IP address, listed under the raw findings. |
| Known vulnerabilities | 0 advisories across 534 pinned packages: 0 critical, 0 high, 0 moderate, 0 low. package-lock.json: 550 packages, 0 advisories. |
| Project hygiene | Has security policy, automated dependency updates, licence file, contributing guide. Missing CodeQL. |
| OpenSSF Scorecard | Not scored: the project is not in Scorecard's weekly index. |
The raw findings
Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.
Secret candidates (1, redacted)
| Where | Rule | Match |
|---|---|---|
| src/tools/performance.ts:272 | google-api-key | AIzaSy…Ufk (39 chars) |
URLs to bare IP addresses (1)
| Where | Rule | Match |
|---|---|---|
| tests/utils/url.test.ts:68 | ip-literal-url | assert.strictEqual(isLocalhost('http://128.0.0.1'), false); |
npm lifecycle scripts (1)
package.jsonprepare:node scripts/prepare.ts
Workflows worth a look
- .github/workflows/conventional-commit.yml: pull_request_target
By the numbers
| Stars | 53.8K |
|---|---|
| Forks | 6,991 |
| Contributors | 149 |
| Commits | 1,448 |
| Open issues | 119 |
| Open pull requests | 50 |
| Releases | 63 |
| Latest release | chrome-devtools-mcp-v1.11.0 |
| Licence | Apache-2.0 |
| Main language | TypeScript |
| Project age | 1 year |
| Last push | Oct 19, 2026 |
| Tracked files | 355 |
| Lines of code | 80.1K |
| Checkout size | 14 MB |
Lines by language: TypeScript 69.8K, Markdown 5,366, JSON 2,394, JavaScript 1,848, YAML 696, HTML 24.
Questions
Is Chrome DevTools MCP free?
Yes. It is Apache-2.0 and free on npm, with no Google account needed. The agent driving it, such as Claude Code, Codex or Gemini CLI, has its own pricing.
How is it different from Playwright MCP?
Both let an agent drive a browser. Playwright MCP is built for automation across Chromium, Firefox and WebKit using accessibility snapshots. Chrome DevTools MCP is Chrome only but brings DevTools itself: performance traces with insights, network inspection and source-mapped console errors, which makes it the stronger pick for debugging and speed work.
Can it use my logged-in Chrome?
It can attach to a running Chrome through its remote debugging port, which the advanced usage guide explains, but by default it launches a separate profile. Keeping it separate is the safer habit, because the agent can read anything in the browser it controls.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.