> ## Documentation Index
> Fetch the complete documentation index at: https://mintlify.com/microsoft/playwright-mcp/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

> Security considerations and best practices for Playwright MCP

<Warning>
  Playwright MCP is **not** a security boundary. Follow proper security practices when deploying.
</Warning>

See [MCP Security Best Practices](https://modelcontextprotocol.io/docs/tutorials/security/security_best_practices) for comprehensive guidance on securing your MCP deployment.

## Security Considerations

### Network Access Control

Playwright MCP provides origin filtering to control which websites the browser can access. However, these controls do not serve as a security boundary.

<Info>
  Origin filtering does **not** serve as a security boundary and does **not** affect redirects.
</Info>

#### Allowed Origins

Specify trusted origins the browser is allowed to request:

```json theme={null}
{
  "mcpServers": {
    "playwright": {
      "command": "npx",
      "args": [
        "@playwright/mcp@latest",
        "--allowed-origins",
        "https://example.com:8080;http://localhost:*"
      ]
    }
  }
}
```

**Supported formats:**

* Full origin: `https://example.com:8080` - matches only that origin
* Wildcard port: `http://localhost:*` - matches any port on localhost with http protocol

#### Blocked Origins

Specify origins to block. Blocklist is evaluated before allowlist:

```json theme={null}
{
  "mcpServers": {
    "playwright": {
      "command": "npx",
      "args": [
        "@playwright/mcp@latest",
        "--blocked-origins",
        "https://malicious.com;https://tracking.com"
      ]
    }
  }
}
```

Origins matching both `allowedOrigins` and `blockedOrigins` will be blocked.

### File System Access

By default, file system access is restricted to workspace root directories (or current working directory if no roots are configured). Navigation to `file://` URLs is also blocked.

#### Unrestricted File Access

<Warning>
  Only enable unrestricted file access in trusted environments.
</Warning>

To allow access to files outside workspace roots:

```json theme={null}
{
  "mcpServers": {
    "playwright": {
      "command": "npx",
      "args": [
        "@playwright/mcp@latest",
        "--allow-unrestricted-file-access"
      ]
    }
  }
}
```

This also allows unrestricted access to `file://` URLs.

### Secrets Management

Secrets are used to prevent the LLM from getting sensitive data while automating scenarios such as authentication.

<Note>
  Prefer `browser.contextOptions.storageState` over secrets file as a more secure alternative.
</Note>

#### Using Secrets File

```json theme={null}
{
  "mcpServers": {
    "playwright": {
      "command": "npx",
      "args": [
        "@playwright/mcp@latest",
        "--secrets",
        "path/to/secrets.env"
      ]
    }
  }
}
```

The secrets file should be in dotenv format:

```bash theme={null}
API_KEY=secret123
PASSWORD=mypassword
```

### Host Validation

The server validates the `Host` header to prevent DNS rebinding attacks. By default, only the host the server is bound to is allowed.

#### Custom Allowed Hosts

```json theme={null}
{
  "mcpServers": {
    "playwright": {
      "command": "npx",
      "args": [
        "@playwright/mcp@latest",
        "--allowed-hosts",
        "example.com,localhost"
      ]
    }
  }
}
```

Pass `'*'` to disable the host check (not recommended in production).

### Service Workers

Block service workers to prevent background script execution:

```json theme={null}
{
  "mcpServers": {
    "playwright": {
      "command": "npx",
      "args": [
        "@playwright/mcp@latest",
        "--block-service-workers"
      ]
    }
  }
}
```

## Isolation Strategies

### Docker Isolation

For stronger isolation, run Playwright MCP in a Docker container. See the [Docker guide](/guides/docker) for details.

### Isolated Browser Contexts

Use isolated mode to ensure no persistent state between sessions:

```json theme={null}
{
  "mcpServers": {
    "playwright": {
      "command": "npx",
      "args": [
        "@playwright/mcp@latest",
        "--isolated"
      ]
    }
  }
}
```

### Sandbox Mode

Enable browser sandbox for additional process isolation:

```json theme={null}
{
  "mcpServers": {
    "playwright": {
      "command": "npx",
      "args": [
        "@playwright/mcp@latest",
        "--sandbox"
      ]
    }
  }
}
```

<Warning>
  In Docker environments, you may need to use `--no-sandbox` due to kernel restrictions.
</Warning>

## Best Practices

<AccordionGroup>
  <Accordion title="Use Docker for production deployments">
    Run Playwright MCP in a containerized environment to limit the blast radius of potential security issues.
  </Accordion>

  <Accordion title="Restrict file system access">
    Only enable `--allow-unrestricted-file-access` when absolutely necessary and in trusted environments.
  </Accordion>

  <Accordion title="Use isolated mode for untrusted workflows">
    Enable `--isolated` to ensure no persistent state between sessions when running untrusted automation.
  </Accordion>

  <Accordion title="Implement proper secrets management">
    Use storage state files instead of passing secrets directly. Store sensitive files outside the workspace.
  </Accordion>

  <Accordion title="Configure origin filtering">
    While not a security boundary, origin filtering can help prevent accidental access to unexpected resources.
  </Accordion>

  <Accordion title="Monitor and log activity">
    Use `--save-session` and `--save-trace` to maintain audit logs of browser automation activity.
  </Accordion>
</AccordionGroup>