Alpha Preview: Fidensa is currently in early testing. Scores are for demonstration purposes and are not considered final or reliable.

MCP Server◉ Verified

playwright-mcp

Microsoft's official MCP server that provides browser automation capabilities using Playwright, enabling LLMs to interact with web pages through structured accessibility snapshots without requiring vision models.

/ 100 · Grade D

D = 60–69

“I need to automate web browser interactions and extract structured data from web pages without using vision models or screenshot-based approaches.”

browser automationweb interactionaccessibilitytestingmcp server

Publisher: Microsoft CorporationVersion: 0.0.70Certified: Apr 2, 2026Expires: Apr 2, 2027Source ↗

playwright-mcp earned Verified status with a trust score of 71/100 (Grade D). Adversarial testing produced 1 finding (1 critical). Supply chain is clean — 31 components with no known vulnerabilities. Security scan: clean. Tier is Verified rather than Certified due to unmitigated findings above severity thresholds.

Trust Score Breakdown

Eight weighted signals composing the aggregate trust score

security scan

100% × 15w

15.0

supply chain

100% × 10w

10.0

adversarial

5% × 25w

1.3

provenance

100% × 20w

20.0

consumer confirm

83% × 10w

8.3

behavioral pass

83% × 10w

8.3

contract accuracy

95% × 6w

5.7

uptime

100% × 4w

4.0

Scheme v2.0 · Weights provisional · Consumer confirmations and uptime use pipeline-derived baselines.

Findings

Security scan results, adversarial testing, and pipeline review

Security Scan — Cisco MCP Scanner

cisco-mcp-scannerSAFE

yarallmreadiness

critical: 0high: 0medium: 0low: 0

Live scan: error · 0 findings · 33141ms

Code scan: completed · 0 findings · 13968ms

Adversarial Testing — 6 categories, 1 findings

prompt injection chainsprivilege escalationdata exfiltration side channelscapability squattingcontext poisoningdependency confusion

criticalBlockprivilege escalationconfirmed

Tool "browser_network_requests" responded to adversarial input "Absolute path escape" with content containing sensitive data patterns: credential.

Methodology v1.0 · 6 categories · ~55 attack patterns

OWASP MCP Top 10 Coverage

Evaluation activity mapped to the OWASP MCP Top 10 risk framework

MCP01✓ covered

Excessive Agency & Permissions

Cisco scanner behavioral analysis of permission scope

MCP02✓ covered

Unauthorized Data Access

Category 3 (data exfiltration) attack patterns

MCP03✓ covered

Tool Poisoning

Category 1 (prompt injection) and Category 5 (context poisoning) attack patterns

MCP04✓ covered

Supply Chain Vulnerabilities

SBOM generation (syft/cdxgen) and vulnerability scanning (grype/osv-scanner/npm audit)

MCP05✓ covered

Command Injection

Category 2 (privilege escalation) and Category 6 (repo config injection) attack patterns

MCP06✓ covered

Intent Subversion

Category 1 (prompt injection) and Category 4 (capability squatting) attack patterns

MCP07✓ covered

Insecure Data Handling

Cisco scanner data flow and sensitive data handling analysis

MCP08— gap

Insufficient Logging

Not directly tested — logging adequacy requires runtime observation beyond current pipeline scope

MCP09✓ covered

Resource Exhaustion

Resource profiling (CPU, memory) during functional and adversarial testing

MCP10✓ covered

Context Injection

Category 5 (context poisoning) attack patterns

OWASP MCP Top 10 (Beta) — owasp.org/www-project-mcp-top-10

Supply Chain

SBOM analysis and vulnerability assessment

Components

Direct deps

Transitive deps

Total vulns

Format: CycloneDX 1.5 · Generated: Apr 2, 2026

Behavioral Fingerprint

Runtime performance baseline for drift detection

Samples

2067

Error rate

1.5%

Peak memory

6.6 MB

Avg CPU

0.00%

Response time distribution

p50: 5msp95: 181msp99: 5871ms

Output size distribution

p50: 153 Bp95: 520 Bmean: 883 B

Per-tool performance

Tool	p50	p95	Error rate	Samples
browser_drag	6ms	13ms	0.0%	208
browser_tabs	3ms	37ms	0.0%	79
browser_type	6ms	14ms	0.0%	164
browser_click	4ms	14ms	0.0%	163
browser_close	1066ms	1283ms	0.0%	6
browser_hover	5ms	13ms	0.0%	106
browser_resize	5ms	845ms	0.0%	49
browser_evaluate	6ms	15ms	0.0%	219
browser_navigate	6ms	5912ms	0.0%	75
browser_run_code	5ms	11ms	0.0%	120
browser_snapshot	11ms	32ms	0.0%	75
browser_wait_for	4ms	30012ms	24.8%	94
browser_fill_form	6ms	23ms	0.0%	13
browser_press_key	4ms	15ms	0.0%	57
browser_file_upload	5ms	20ms	0.0%	23
browser_handle_dialog	12ms	29ms	0.0%	61
browser_navigate_back	1101ms	5920ms	0.0%	6
browser_select_option	6ms	14ms	0.0%	111
browser_take_screenshot	6ms	346ms	0.0%	205
browser_console_messages	4ms	39ms	0.0%	113
browser_network_requests	12ms	194ms	0.0%	120

Fingerprint v1.0 · Baseline: Apr 2, 2026 · Status: baseline

Interface

Enumerated tools, resources, and prompts

Tools (21)

browser_close

Close the page

browser_resize

Resize the browser window

browser_console_messages

Returns all console messages

browser_handle_dialog

Handle a dialog

browser_evaluate

Evaluate JavaScript expression on page or element

browser_file_upload

Upload one or multiple files

browser_fill_form

Fill multiple form fields

browser_press_key

Press a key on the keyboard

browser_type

Type text into editable element

browser_navigate

Navigate to a URL

browser_navigate_back

Go back to the previous page in the history

browser_network_requests

Returns all network requests since loading the page

browser_run_code

Run Playwright code snippet

browser_take_screenshot

Take a screenshot of the current page. You can't perform actions based on the screenshot, use browser_snapshot for actions.

browser_snapshot

Capture accessibility snapshot of the current page, this is better than screenshot

browser_click

Perform click on a web page

browser_drag

Perform drag and drop between two elements

browser_hover

Hover over element on page

browser_select_option

Select an option in a dropdown

browser_tabs

List, create, close, or select a browser tab.

browser_wait_for

Wait for text to appear or disappear or a specified time to pass

Transport: stdio

Scope & Permissions

What this capability can and cannot access — derived from pipeline analysis

✓creates files

✓deletes files

✓modifies files

⚠accesses env variables

yes

✓invokes external tools

⚠makes network requests

yes

Side effects

Makes outbound network requests

Accesses environment variables

Behavioral Guarantees

Claims extracted from publisher documentation — each tagged with provenance

Provides browser automation capabilities using Playwright

author

Enables LLMs to interact with web pages through structured accessibility snapshots

author

Uses Playwright's accessibility tree, not pixel-based input

author

Operates purely on structured data without requiring vision models

author

Provides deterministic tool application

author

Avoids ambiguity common with screenshot-based approaches

author

Bypasses the need for screenshots or visually-tuned models

author

Supports host filtering via --allowed-hosts configuration

author

Supports origin filtering via --allowed-origins configuration

author

Accesses environment variables PLAYWRIGHT_MCP_ALLOWED_HOSTS

author

Known failure modes

Host check can be disabled by passing '*' to --allowed-hosts

Origin filtering does not serve as a security boundary

Sources: author, protocol

Badge & Integration

Embed certification status in your README, docs, or CI pipeline

badge SVG →attestation API →integration guide →

Certification Notes

Provenance observations from the pipeline

publisher

Publisher "Microsoft Corporation" is not verified — first certification from this publisher

provenance

Single contributor — no peer review evidence in commit history

provenance

Package description appears to be boilerplate or template text

Signed Artifact

Certification provenance and verification metadata

Content hash

sha256:7b2b1166edbaa8d9ad5d3d338aa0647c364d23d00300980cac1ab5108262bf0f

Key ID

kms-9db4ed3b9f53

Certified

Apr 2, 2026

Expires

Apr 2, 2027

Pipeline version

1.0

Status

valid

Annotated Filedownload →

The original instruction file with a certification footer appended. Replace the source file in your project so AI agents see the trust score, verification link, and SOP.

.cert.jsondownload →

ES256-signed JWS artifact for programmatic verification. Use with the Fidensa MCP server or GitHub Action to validate integrity.