The Playwright MCP server: giving an agent a real browser

The MCP-servers post covered the protocol; the Playwright post covered driving a browser from code. The Playwright MCP server, from Microsoft, joins the two: it's an MCP server that exposes browser control as tools, so any MCP-aware agent can navigate, click, type, and read a live web page — no bespoke integration required.

The accessibility tree, not screenshots

Its defining choice: by default it drives the browser through the page's accessibility tree — a structured representation of the page — rather than screenshots and vision. That makes agent actions fast, cheap, and deterministic: the model works with real element roles and labels instead of guessing from pixels. (A vision/screenshot mode exists when you genuinely need it.)

What it exposes

• Navigation — open a URL, go back and forward.
• A page snapshot — the accessibility tree the agent reads to decide what to do.
• Actions — click, type, fill forms, select, hover, and wait for elements.
• Utilities — screenshots, tabs, and file uploads when a task needs them.

Real-life usage

• Agentic web tasks — an assistant that fills a form or completes a checkout flow on your behalf.
• Test generation and automation — describe a flow and have the agent drive and verify it end-to-end.
• Scraping dynamic sites — reach content that only appears after JavaScript runs, where a raw HTTP fetch sees nothing.
• Research and monitoring — browse, read, and extract from real pages as part of a larger agent.

Using it

Because it's a standard MCP server, you add it to an MCP-aware client and its browser tools appear alongside the model's other capabilities — no code to write.

{
  "mcpServers": {
    "playwright": {
      "command": "npx",
      "args": ["@playwright/mcp@latest"]
    }
  }
}
// the browser tools (navigate, snapshot, click, type...) now appear to the agent

The caveat

A browser-driving agent takes real actions on real sites, and web pages are untrusted input. Scope what it can do, keep a human in the loop for anything irreversible, and treat page content as data, not instructions — a page can carry a prompt injection (see the prompt-injection and guardrails posts). A real browser is a powerful tool and a real blast radius.

Playwright MCP turns 'the agent can browse' from a demo into a capability — a real browser, driven through the accessibility tree, plugged in with one line of config.