Upstream issue draft — microsoft/playwright-mcp

Title: Request: a server-side way to disable browser_run_code_unsafe (+ WebMCP off by default for headless/agent deployments)

Body:

Context: we run @playwright/mcp v0.0.82 as the browser-automation server for an autonomous AI-agent fleet (stdio mode, headless chromium, inside per-agent containers). Before rollout we did a full security review of the server. Overall posture is good — no listening ports in stdio mode, file:// blocked, secrets redacted, the old DNS-rebinding issue fixed. Two defaults, however, are unsafe for agent/automation deployments, and one of them has no server-side mitigation at all:

1. browser_run_code_unsafe is enabled by default and cannot be disabled server-side.

The tool's own description says it best — "Unsafe: executes arbitrary JavaScript in the Playwright server process and is RCE-equivalent" (it runs via vm.runInContext, which is not a security boundary). In an agent context, prompt injection (e.g., from a hostile web page or repo) can attempt to invoke this tool; the blast radius is the whole container, not just a browser tab. --caps is add-only (it cannot remove core tools), and as far as we can tell from the source (coreBundle.js tool filter) there is no CLI option or config field to exclude a core tool. The only effective mitigation we found is client-side tool filtering (our MCP client's includeTools allowlist), which not every client has.

Suggested fixes (any one would work for us):

• a --exclude-tools / --allowed-tools flag (server-side allowlist);
• gating browser_run_code_unsafe behind an explicit opt-in flag (e.g. --allow-run-code), mirroring how browser_evaluate-style power tools are opt-in elsewhere;
• or adding it to a capability that is NOT core (so --caps can omit it).

2. WebMCP is enabled by default.

With WebMCP on, any visited page can register MCP tools into the agent's tool list (page-controlled tool names/descriptions/schemas — a tool-injection channel). There is a --no-webmcp flag (we use it; thank you), but for headless/automation deployments the safer default would be off, with an opt-in flag for interactive use.

We verified both behaviors empirically on 0.0.82 (tool listing, page-registered tools), and are happy to share our evidence. Thank you for the project — as the official Playwright MCP server it's the natural choice for agent fleets, which is exactly why these defaults deserve an agent-safe posture.