playwright-secure-mcp

Discovery: list or find items for the current page

Three tools look up 1Password LOGIN items and return only those usable on the current browser page: the proxy reads the page'slocation.hrefitself (the caller never supplies a URL) and keeps an item only when one of its URLs matches the page by host and path prefix. If the current URL cannot be determined, discovery fails with an error. Results are a JSON array of item identities plus non-secret field metadata —vault,item,title,urls,tags,fields(id, label, type, purpose, section), andsections— never a field value. All three accept an optionalvault(ID or name) to scope the search.

Mirrors the upstreambrowser_typetool, but instead of a literaltextvalue it takes the 1Password coordinates of the secret:

- Required:element,ref(as inbrowser_type),vault(1Password vault ID),item(1Password item ID),field(e.g.usernameorpassword)
- Optional:submit,slowly(as inbrowser_type)

The proxy resolves the field from the cached item (fetching the item from 1Password on demand when it is not cached), decrypts the value locally, and issues an internalbrowser_typecall to the upstream server with the resolved value. Typing is refused unless the current page is in the item's URL set (the same host + path-prefix match as discovery), and refused when the current page URL cannot be determined.

Discovered items — with their field values encrypted — are cached in memory, write-once. Calling the upstreambrowser_closetool empties this cache (the close is still forwarded to the browser as usual); otherwise it lives for the process lifetime.
- Navigate to the login page, then call a discovery tool — e.g.browser_list_items— to obtain thevaultanditemIDs of an item usable on that page.
- Callbrowser_type_secretwith those IDs and thefieldto type.

Install from the Homebrew tap. The formula installs the prebuilt binary from the latest GitHub release (the macOS builds are signed and notarized):

brew install jochenseeber/tap/playwright-secure-mcp

- Crystal>= 1.20
- The 1Password CLI (op), signed in
- pnpmornpmto download@playwright/mcpon demand, or a pre-installed Playwright MCP server binary

At startup the proxy picks the best available protection tier for the vault's AES-256 data key and logs the choice:
- Secure Enclave(macOS, hardware): an ephemeral, non-extractable P-256 key is generated inside the Secure Enclave, and the data key is ECIES-wrapped under it. The wrapped key is unwrapped in the enclave per crypto batch and the plaintext key is zeroed afterwards; the long-lived key never exists in process memory or on disk.
- TPM 2.0(Linux, hardware): the data key is sealed inside the platform TPM via the tpm2-tss ESYS library over/dev/tpmrm0and unsealed transiently per crypto batch, then zeroed. The binary links tpm2-tss, which is assumed present on the host.
- Kernel keyring(Linux,nothardware): the data key is stored in the kernel keyring and AES runs in the kernel via an AF_ALG socket, so the key never re-enters process memory — but it is kernel-backed, not hardware-backed. Requires Linux ≥ 5.4.
- In-memory(fallback): a plain per-process key, with a startup warning that hardware-backed protection is unavailable.

On Linux the order is TPM → keyring → in-memory. Pass--require-hardware-keyto fail closed: the proxy refuses to start unless a hardware-backed tier (Secure Enclave / TPM) initializes. The kernel keyring tier doesnotsatisfy--require-hardware-key.

Deployment requirement (macOS):the Secure Enclave is only usable when the distributed binary iscode-signed with the appropriate entitlement(Secure Enclave / keychain access). An unsigned binary cannot generate an enclave key (Security.framework fails with OSStatus -26276) and falls back to the in-process key — or refuses to start under--require-hardware-key.

- The unwrapped data key is in process memory transiently per crypto batch, then best-effort zeroed.
- Decrypted secret plaintext still transits process memory during redaction and typing (out of scope; would require a sidecar).
- Per-message hot-path cost with the Secure Enclave is ~2–20 ms (one key unwrap per message batch).

This is a web browser that enables your coding agent, such as Claude Code, to visit websites on your behalf and assist you in identifying bugs or creating UI test cases.

Create crafted UI components inspired by the best 21st.dev design engineers.

Bring agent evaluations, observability, and synthetic test set generation directly into your IDE for free with Galileo's new MCP server

An MCP server to help AI assistants to answer questions and generate AccelByte Extend SDK code more effectively .

MCP server for AI Diagram Maker — generate beautiful software engineering diagrams directly inside Cursor, Claude Desktop, Claude Code, or any MCP-compatible AI agent

ALAPI MCP Tools,Call hundreds of API interfaces via MCP

AI-powered SVG animation generator that transforms static files into animated SVG components using the Allyson platform

MCP server that gives AI assistants on-demand access to 1,500+ amCharts docs, ~300 code examples, and 1000+ class API references.

APIMatic MCP Server is used to validate OpenAPI specifications using APIMatic. The server processes OpenAPI files and returns validation summaries by leveraging APIMatic’s API.

One shared context layer for AI agents and humans — live API specs, DB schemas, and versioned contracts across repos so every agent and teammate works from the same source of truth.