jev-playwright-mcp

Drop-in proxy for Playwright MCP that adds Jev page triage, prompt-injection masking, snapshot pruning and risky-action gating.

MCP serverbetaMIT

View on GitHub ↗

Overview

jev-playwright-mcp is a Jev-augmented proxy for the official Playwright MCP server. Any coding agent, including Claude Code, Codex CLI, Cursor, Windsurf, VS Code, Zed and Gemini CLI, connects to it and gets the same tools, names and schemas as stock Playwright MCP, plus a judgment layer that runs inside the proxy.

Every snapshot or navigation response is classified (login wall, captcha, error, rate limited, paywall and so on) and annotated with a one-line hint. Page text that tries to redirect the AI is detected and masked before it reaches the agent's context, so page content cannot prompt its way past a filter it never sees. With a goal set, large accessibility snapshots are collapsed to relevant regions to save tokens. Typing, clicking, uploading and similar calls are risk-assessed before they run, and the unsafe run-code tool is blocked by default. Without a TypeSafe key everything degrades to pure passthrough.

What the decision model decides

Type	Question	Answers
Choice	What state is this page in?	login_wall · captcha · error · rate_limited · paywall · ok
Yes / no	Does this page text try to redirect the AI?	yes · no
Yes / no	Is this browser action risky enough to block?(inferred)	yes · no

How it works

Point the agent's MCP config at the proxy
The proxy spawns @playwright/mcp and forwards calls
Responses are triaged, injection text masked and snapshots pruned
Risky actions are assessed before forwarding

Strengths

Same tool surface as stock Playwright MCP
Injection masking happens before the agent sees text
Works with any MCP client at once
Passthrough when no key is set

Caveats

Adds a hosted dependency for judgments
Masking may hide legitimate page text
Pinned to a specific @playwright/mcp version

At a glance

Type: MCP server
Status: beta
Language: TypeScript
Runtime: MCP proxy (stdio)
Has code: yes
License: MIT

Use cases and integrations

Verification & Guardrails272

How curated lists describe it

Jev-augmented Playwright MCP proxy — page-state triage, prompt-injection shielding, goal-based snapshot pruning, risky-action gating. Drop-in wrapper around @playwright/mcp for any coding agent.
logicrw/awesome-jev-projects
Jev-augmented Playwright MCP proxy — page-state triage, prompt-injection shielding, goal-based snapshot pruning, risky-action gating. Drop-in wrapper around @playwright/mcp for any coding agent.
hellogumbo/awesome-jev

Frequently asked questions

What does Jev decide?

Page state, whether page text is an injection attempt, and whether actions are risky.

Does it change Playwright MCP's tools?

No. It keeps the same tools and adds two small proxy tools.

What if I have no TypeSafe key?

It acts as a pure passthrough to stock Playwright MCP.

Related projects

jev-ultrafast-mcp
MCP server that takes a whole browser task (URL, goal, checks) in one call and drives Chrome server-side with a decision model.
MCP serverbetaPython
Skill Scanner
Cisco's security scanner for agent skills, with a System One analyzer as an advisory tier that cannot emit findings or change severity.
Agent skillproductionPython
jev-max
Jev browser agent that pierces shadow DOM and iframes, adds canvas fallback and full actions, with one Jev request per cycle.
MCP serverbetaPython
jev-security-scan
Reviews agent skills, MCP configs and source with local static checks plus Jev before install, reporting evidence, risk and coverage gaps.
MCP serverbetaPython
jev-agent-authorization
Starter kit that gates every MCP tool call with Kinde identity checks plus Jev risk signals, then allows, holds for approval or stops it.
MCP serverbetaTypeScript
jev-guard (leepokai)
Security hook giving Codex, Copilot, Gemini, Cursor, pi, OpenCode and ACP an auto-mode-like guard via three Jev questions.
LibrarybetaTypeScript