Fork of mcp-patchright that adds a per-call world:'main' option to browser_evaluate / browser_run_code_unsafe, so page-defined window globals are visible and callable. Defaults to Patchright's isolated stealth world; opt into main only when you need it. E
Inferred from the transports this listing declares (stdio). A client not listed here hasn’t been ruled out — it just isn’t something Forge can confirm.
Verification confirms publisher identity (repo ownership), not code safety. The security scan covers known CVEs and suspicious install scripts.
Read out of the source npm actually ships, at scan time. The package was never executed. Tools registered dynamically at runtime, or hidden inside bundled or minified code, can be missed — so this is a floor on the tool surface, not a complete census of it.
browser_startStart a browser session. Defaults to patchright chromium headed Chrome with a persistent profile.Start a browser session. Defaults to patchright chromium headed Chrome with a persistent profile.
No input schema was published for this tool.
browser_statusReturn current browser status.Return current browser status.
No input schema was published for this tool.
browser_navigateNavigate the active page to a URL.Navigate the active page to a URL.
No input schema was published for this tool.
browser_new_pageOpen a new page/tab and make it active. Optionally navigate to a URL.Open a new page/tab and make it active. Optionally navigate to a URL.
No input schema was published for this tool.
browser_pagesList open pages/tabs with ids, active state, URL, and title.List open pages/tabs with ids, active state, URL, and title.
No input schema was published for this tool.
browser_switch_pageSwitch the active page/tab by pageId from browser_pages.Switch the active page/tab by pageId from browser_pages.
No input schema was published for this tool.
browser_close_pageClose a page/tab by pageId, or the active page if omitted.Close a page/tab by pageId, or the active page if omitted.
No input schema was published for this tool.
browser_snapshotReturn a distilled AI-oriented aria snapshot (verbose /url lines dropped and data: URLs collapsed to save tokens). Use [ref=eN] values with browser_click/fill/type/hover/press/wait_for.Return a distilled AI-oriented aria snapshot (verbose /url lines dropped and data: URLs collapsed to save tokens). Use [ref=eN] values with browser_click/fill/type/hover/press/wait_for.
No input schema was published for this tool.
browser_findSearch the current page's aria snapshot for text or a regex. Returns matching nodes with their [ref] and a few lines of surrounding context — cheaper than a full browser_snapshot when you only need to locate an element.Search the current page's aria snapshot for text or a regex. Returns matching nodes with their [ref] and a few lines of surrounding context — cheaper than a full browser_snapshot when you only need to locate an element.
No input schema was published for this tool.
browser_take_screenshotTake a screenshot. Returns base64 if path is omitted.Take a screenshot. Returns base64 if path is omitted.
No input schema was published for this tool.
browser_clickClick an element by CSS selector or aria ref from browser_snapshot.Click an element by CSS selector or aria ref from browser_snapshot.
No input schema was published for this tool.
browser_fillFill an input by CSS selector or aria ref from browser_snapshot.Fill an input by CSS selector or aria ref from browser_snapshot.
No input schema was published for this tool.
browser_typeType text into an element (CSS selector or aria ref) with human-like input: real per-key events, real Shift keyDown/up for capitals & symbols, variable dwell and inter-key gaps. Verifies the result against the request for input/textarea and errors on mismatch.Type text into an element (CSS selector or aria ref) with human-like input: real per-key events, real Shift keyDown/up for capitals & symbols, variable dwell and inter-key gaps. Verifies the result against the request for input/textarea and errors on mismatch.
No input schema was published for this tool.
browser_hoverHover an element by CSS selector or aria ref from browser_snapshot.Hover an element by CSS selector or aria ref from browser_snapshot.
No input schema was published for this tool.
browser_press_keyPress a keyboard key, optionally focused on a selector or aria ref first.Press a keyboard key, optionally focused on a selector or aria ref first.
No input schema was published for this tool.
browser_wait_forWait for time or for selector/ref state. If no selector/ref, waits timeout milliseconds.Wait for time or for selector/ref state. If no selector/ref, waits timeout milliseconds.
No input schema was published for this tool.
browser_evaluateNo description publishedThis tool published no description. Forge does not invent one.
browser_fingerprint_checkCollect browser fingerprint diagnostics from the active page.Collect browser fingerprint diagnostics from the active page.
No input schema was published for this tool.
browser_navigate_backNavigate back in browser history.Navigate back in browser history.
No input schema was published for this tool.
browser_select_optionSelect options from a <select> element by CSS selector or aria ref.Select options from a <select> element by CSS selector or aria ref.
No input schema was published for this tool.
browser_handle_dialogAccept or dismiss a JavaScript dialog (alert / confirm / prompt).Accept or dismiss a JavaScript dialog (alert / confirm / prompt).
No input schema was published for this tool.
browser_file_uploadprivilegedUpload files to a <input type=file> by CSS selector or aria ref.Upload files to a <input type=file> by CSS selector or aria ref.
No input schema was published for this tool.
browser_network_requestsList captured network requests. Set activeOnly=true for in-flight only.List captured network requests. Set activeOnly=true for in-flight only.
No input schema was published for this tool.
browser_network_requestGet details for a single network request by stable id from browser_network_requests. Legacy zero-based index is also accepted.Get details for a single network request by stable id from browser_network_requests. Legacy zero-based index is also accepted.
No input schema was published for this tool.
browser_console_messagesList captured console messages (log / warn / error etc.).List captured console messages (log / warn / error etc.).
No input schema was published for this tool.
browser_resizeResize the active page viewport.Resize the active page viewport.
No input schema was published for this tool.
browser_dragDrag an element from source to target by CSS selector or aria ref.Drag an element from source to target by CSS selector or aria ref.
No input schema was published for this tool.
browser_fill_formFill multiple form fields at once. Each field needs selector or ref, and value.Fill multiple form fields at once. Each field needs selector or ref, and value.
No input schema was published for this tool.
browser_run_code_unsafeExecute arbitrary JavaScript in page context. Prefer browser_evaluate when possible. Runs in the isolated stealth world by default; set world:'main' to run in the page's real world (page-defined window globals visible/callable).Execute arbitrary JavaScript in page context. Prefer browser_evaluate when possible. Runs in the isolated stealth world by default; set world:'main' to run in the page's real world (page-defined window globals visible/callable).
No input schema was published for this tool.
browser_add_init_scriptNo description publishedThis tool published no description. Forge does not invent one.
browser_network_state_setSet network state: pass offline=true to simulate offline, offline=false to restore connectivity.Set network state: pass offline=true to simulate offline, offline=false to restore connectivity.
No input schema was published for this tool.
browser_api_requestMake an HTTP request reusing the browser session's cookies/storage (authenticated API calls without re-login). Returns status, headers, and body.Make an HTTP request reusing the browser session's cookies/storage (authenticated API calls without re-login). Returns status, headers, and body.
No input schema was published for this tool.
browser_get_visible_textGet the visible text (document.body.innerText) of the active page. Lighter than a full aria snapshot.Get the visible text (document.body.innerText) of the active page. Lighter than a full aria snapshot.
No input schema was published for this tool.
browser_get_visible_htmlGet page HTML, optionally scoped to a selector. Strips script/style/svg by default for token efficiency.Get page HTML, optionally scoped to a selector. Strips script/style/svg by default for token efficiency.
No input schema was published for this tool.
browser_iframe_clickShorthand for clicking inside an iframe. (Most tools now accept a frameSelector directly — prefer browser_click with frameSelector.)Shorthand for clicking inside an iframe. (Most tools now accept a frameSelector directly — prefer browser_click with frameSelector.)
No input schema was published for this tool.
browser_iframe_fillShorthand for filling inside an iframe. (Most tools now accept a frameSelector directly — prefer browser_fill with frameSelector.)Shorthand for filling inside an iframe. (Most tools now accept a frameSelector directly — prefer browser_fill with frameSelector.)
No input schema was published for this tool.
browser_route_blockBlock requests by resource type and/or URL pattern (e.g. block images/fonts/media to speed up loads and shrink fingerprint surface). Applies to all pages in the context.Block requests by resource type and/or URL pattern (e.g. block images/fonts/media to speed up loads and shrink fingerprint surface). Applies to all pages in the context.
No input schema was published for this tool.
browser_route_mockMock matching requests with a canned response (fulfill). Useful for stubbing APIs or bypassing endpoints.Mock matching requests with a canned response (fulfill). Useful for stubbing APIs or bypassing endpoints.
No input schema was published for this tool.
browser_route_clearRemove all active block/mock routes.Remove all active block/mock routes.
No input schema was published for this tool.
browser_storage_saveExport current session (cookies + localStorage) as a Playwright storageState. Saves to path, or returns the state JSON if path omitted.Export current session (cookies + localStorage) as a Playwright storageState. Saves to path, or returns the state JSON if path omitted.
No input schema was published for this tool.
38 of 40 tools published a description.
Tool names and descriptions are written by the publisher and shown verbatim as inert text. They are the strings an MCP client passes to a model, so Forge scans them for prompt-injection patterns — any finding appears with the security scan above. “Privileged” is a keyword match on the tool name, not an audit of what the tool does: a benign-sounding name can still do anything.
Fork of mcp-patchright that adds a per-call world:'main' option to browser_evaluate / browser_run_code_unsafe, so page-defined window globals are visible and callable. Defaults to Patchright's isolated stealth world; opt into main only when you need it. E
Linked names open Forge’s index of every entry observed exposing that tool. Browse all indexed tools.
The crawl stopped at the 60-package limit. The rest of the tree was never resolved.
36 more resolved packages are not drawn here (display cap: 24). Every dependency carrying an advisory is drawn regardless of the cap. Full inventory (CycloneDX SBOM)
44 declared dependencies never landed in the tree. They are missing from Forge's resolution, not from the package.
+32 more not listed. The counts by reason above cover all of them.
Not followed: optionalDependencies, peerDependencies. This tree covers runtime dependencies only, so anything those pull in was never resolved.