{ "schema": "varexis-index-delivery/1", "catalog_version": "2026-10-14T20:21:57.226Z", "route_id": "agentic_pack_repository_browser_trust_v1", "question": "GitHub + Playwright access?", "answer": "GitHub MCP and Playwright MCP expose different authority boundaries. GitHub documents read-only mode separately from credential scope. Playwright session isolation does not make authenticated browser actions read-only. This pack compares the two published documentation reviews, including read/write capability, authentication, data movement, unknowns and refusal conditions. The reviews are dated 11 October 2026; neither your deployment nor current tool behaviour has been independently tested.", "records": [ { "record_id": "VXI-EXT-TOOL-TRUST-GITHUB-01-v1", "url": "/varexis-index/records/github-mcp-repository-access-trust.json", "content_sha256": "572335e5f6d8f99afe3760a11daf78adbf89833501909166782351350be027f8", "evidence": { "schema": "varexis-public-evidence-record/0.3", "generated_at_utc": "2026-10-11T21:09:20.344Z", "record_id": "VXI-EXT-TOOL-TRUST-GITHUB-01-v1", "record_kind": "external_reference", "title": "GitHub MCP: Repository access and write controls", "system": "GitHub MCP", "evidence_family": "agent_tool_trust_review", "index_status": "PUBLIC_SAFE_SOURCE_REVIEW", "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY", "canonical_question": "How can an agent review repository access without enabling GitHub MCP writes?", "near_questions": [ "How can I review repository access without enabling writes?", "Can GitHub MCP be restricted to reading pull requests?", "Does a GitHub MCP toolset reduce token permissions?", "What does GitHub MCP lockdown leave unproven?", "Which repositories can this code review connector read?", "Can an issue contain instructions an agent should ignore?", "Does read-only repository access prevent data leaving the client?", "What authentication does the official GitHub MCP use?", "Is the local GitHub MCP operated by GitHub?", "What should be checked before enabling repository write tools?", "What should a saved GitHub connector review contain?", "Does this GitHub trust record test my configuration?" ], "supported_claims": [ { "claim": "GitHub documents a read-only server mode that removes write tools and a separate choice of toolsets. Review both the credential's repository access and the configured server mode. Lockdown is a content filter with stated limitations. This profile helps scope a repository-review connection; it does not verify your token, server configuration or resistance to prompt injection.", "reliance": "DOCUMENTED_CAPABILITY_ONLY" } ], "not_demonstrated_claims": [ "Verified buyer configuration or effective access rights", "Independent tool execution or security testing", "Vendor certification, guaranteed safety or no-training assurance" ], "public_summary": "GitHub documents a read-only server mode that removes write tools and a separate choice of toolsets. Review both the credential's repository access and the configured server mode. Lockdown is a content filter with stated limitations. This profile helps scope a repository-review connection; it does not verify your token, server configuration or resistance to prompt injection.", "related_record_ids": [ "VXI-EXT-TOOL-TRUST-GITLAB-01-v1", "VXI-EXT-TOOL-TRUST-PLAYWRIGHT-01-v1" ], "source_review": { "source_type": "official_external_documentation", "source_title": "GitHub MCP server: hosting and authentication", "source_url": "https://github.com/github/github-mcp-server", "checked_on": "2026-10-11", "candidate_record_id": "VXI-EXT-TOOL-TRUST-GITHUB-01-v1", "candidate_record_sha256": "5f2e8ea373885332f961a342962445ce6ef7fef62e46adb367c1ccabf3dca50a", "method": "Primary documentation reviewed for the published bounded statement.", "deployment_tested_by_varexis": false, "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research." }, "answer_policy": { "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY", "bounded_answer": "GitHub documents a read-only server mode that removes write tools and a separate choice of toolsets. Review both the credential's repository access and the configured server mode. Lockdown is a content filter with stated limitations. This profile helps scope a repository-review connection; it does not verify your token, server configuration or resistance to prompt injection.", "required_buyer_context": "GitHub-hosted remote MCP and the documented local server configuration; deployment, release and organization policies must be supplied by the buyer. Actual token grants, effective tool list, enterprise hosting configuration and client retention/training terms.", "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state." }, "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.", "trust_profile": { "schema": "varexis-agent-tool-trust/1", "identity": { "tool": "GitHub MCP", "variant": "GitHub-hosted remote MCP and the documented local server configuration; deployment, release and organization policies must be supplied by the buyer." }, "review_status": "documentation_review_only", "checked_on": "2026-10-11", "version_scope": "Dated rolling documentation snapshot; no installed or hosted runtime version independently verified.", "plan_scope": "Buyer plan, feature entitlement and effective configuration are not verified.", "findings": [ { "field": "operator", "label": "Publisher and operator", "status": "documented", "statement": "GitHub publishes the server and hosts the remote service; a local deployment has its own operator.", "source_ids": [ "github-main", "github-config" ] }, { "field": "purpose", "label": "Purpose", "status": "documented", "statement": "Review repository content, issues and pull requests.", "source_ids": [ "github-main", "github-config" ] }, { "field": "reads", "label": "Read capability", "status": "documented", "statement": "Repository files, issues and pull requests accessible through the selected tools and credential.", "source_ids": [ "github-main", "github-config" ] }, { "field": "writes", "label": "Write capability", "status": "documented", "statement": "Write-capable toolsets exist; documented read-only mode excludes their write tools.", "source_ids": [ "github-main", "github-config" ] }, { "field": "auth", "label": "Authentication", "status": "documented", "statement": "Remote OAuth or PAT authentication is documented; actual repository grants and organization policy require inspection.", "source_ids": [ "github-main", "github-config" ] }, { "field": "permissions", "label": "Permission surface", "status": "documented", "statement": "Toolset selection, exclusions and read-only mode are configurable. Lockdown does not reduce the underlying credential's authority.", "source_ids": [ "github-main", "github-config" ] }, { "field": "egress", "label": "Data leaving the environment", "status": "review_inference", "statement": "Repository results return to the connected client. If that client uses a hosted model, selected content may leave the repository service; inspect that client's data policy.", "source_ids": [ "github-main", "github-config" ] }, { "field": "failures", "label": "Failure modes to consider", "status": "review_inference", "statement": "Overbroad credentials; assuming lockdown prevents all hostile content; enabling a write tool during a review-only task.", "source_ids": [ "github-main", "github-config" ] }, { "field": "unknown", "label": "Unknowns and applicability", "status": "unknown", "statement": "Actual token grants, effective tool list, enterprise hosting configuration and client retention/training terms.", "source_ids": [] }, { "field": "gate", "label": "Suggested refusal or clarification condition", "status": "varexis_review_policy", "statement": "For a review-only task, stop before writes; resolve unknown repository grants before reading private repositories.", "source_ids": [] } ], "evidence_sources": [ { "source_id": "github-main", "url": "https://github.com/github/github-mcp-server", "final_url": "https://github.com/github/github-mcp-server", "title": "GitHub MCP server: hosting and authentication", "checked_on": "2026-10-11", "sha256": "34700e0a6091c606a24b73a2ea5e8de5152f0523884f10a74d62f1fb63d4680b", "bytes": 834307 }, { "source_id": "github-config", "url": "https://github.com/github/github-mcp-server/blob/main/docs/server-configuration.md", "final_url": "https://github.com/github/github-mcp-server/blob/main/docs/server-configuration.md", "title": "GitHub MCP server configuration", "checked_on": "2026-10-11", "sha256": "ffc582722b19340b75f3fefa625360f2cbb5e7e0753779ddb1da819e005b85c2", "bytes": 369942 }, { "source_id": "mcp-hints", "url": "https://blog.modelcontextprotocol.io/posts/2026-03-16-tool-annotations/", "final_url": "https://blog.modelcontextprotocol.io/posts/2026-03-16-tool-annotations/", "title": "MCP tool annotations and enforcement boundaries", "checked_on": "2026-10-11", "sha256": "82888044d831c3bd18f03d87a846ce5d27e028bd67a095edc04ba377fc622163", "bytes": 52715 } ], "observed_tool_execution": false, "policy_basis": "Suggested VAREXIS review gates; apply the buyer's authorized task and policy. These conditions do not execute or enforce controls.", "commercial_reliance_boundary": "A source-linked review aid, not a vendor certification, security clearance or deployment assessment. Unknown does not mean false or unsafe.", "paid_value": { "decision_context": "Retain the documented read-only and credential boundaries used when reviewing a repository connector.", "free": "Complete profile, practical questions, sources and limitations; may be saved locally.", "single_request": "Existing server-saved version-bound route snapshot for later authenticated retrieval.", "evidence_receipt": "The same snapshot plus the existing unsigned delivery receipt.", "excluded": [ "Fresh vendor research", "Continuous monitoring or change alerts", "Testing the buyer configuration", "Private evidence or vendor certification" ], "integrity": "Hashes identify content versions; they do not prove truth or provide a signature." }, "revalidation": { "trigger": "Recheck when permissions, deployment, authentication, source guidance or intended use changes; a purchase does not trigger revalidation.", "specific_watch": "Review the effective tool inventory and client data policy before a new integration decision." }, "change_history": [ { "version": 1, "date": "2026-10-11", "change": "Initial documentation review; no earlier vendor assessment claimed." } ] }, "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.", "service_route": { "request_guide": "/varexis-index/request.html", "request_workflow": "/varexis-index/request-workflow.json", "service_id": "single_request", "service_routes_url": "/varexis-index/service-routes.json", "payment_required": true, "availability_endpoint": "/api/index/capabilities", "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED", "checkout_url": "/index-access" }, "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.", "human_page": "/varexis-index/catalog.html#github-mcp-repository-access-trust", "machine_readable_record": "/varexis-index/records/github-mcp-repository-access-trust.json" } }, { "record_id": "VXI-EXT-TOOL-TRUST-PLAYWRIGHT-01-v1", "url": "/varexis-index/records/playwright-mcp-browser-session-trust.json", "content_sha256": "31bcff69fce09710d75d7f21be3bd97d7e5e3b4f9f3a44d8903e1e3b4b549c72", "evidence": { "schema": "varexis-public-evidence-record/0.3", "generated_at_utc": "2026-10-11T21:09:20.344Z", "record_id": "VXI-EXT-TOOL-TRUST-PLAYWRIGHT-01-v1", "record_kind": "external_reference", "title": "Playwright MCP: Browser identity and session boundaries", "system": "Playwright MCP", "evidence_family": "agent_tool_trust_review", "index_status": "PUBLIC_SAFE_SOURCE_REVIEW", "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY", "canonical_question": "Does an isolated Playwright MCP browser session prevent privileged web actions or data disclosure?", "near_questions": [ "Does browser session isolation prevent privileged website actions?", "Can a browser automation tool use an existing logged-in session?", "Do Playwright MCP origin filters cover redirects?", "Is an isolated browser automatically read-only?", "What authority does a browser MCP inherit from cookies?", "Can saved browser state let someone impersonate an account?", "Does running a browser locally keep model processing local?", "Who operates a local Playwright MCP process?", "What should an agent check before submitting a web form?", "Does this browser trust profile certify network isolation?", "What does a saved Playwright trust record contain?", "Which browser state needs review before automation?" ], "supported_claims": [ { "claim": "Playwright MCP documents persistent, isolated and existing-browser session modes. Isolation concerns session state; it does not make authenticated web actions read-only. Its origin filters explicitly exclude redirects from their protection, and the project states that MCP itself is not a security boundary. Review browser identity, destinations and task authorization separately.", "reliance": "DOCUMENTED_CAPABILITY_ONLY" } ], "not_demonstrated_claims": [ "Verified buyer configuration or effective access rights", "Independent tool execution or security testing", "Vendor certification, guaranteed safety or no-training assurance" ], "public_summary": "Playwright MCP documents persistent, isolated and existing-browser session modes. Isolation concerns session state; it does not make authenticated web actions read-only. Its origin filters explicitly exclude redirects from their protection, and the project states that MCP itself is not a security boundary. Review browser identity, destinations and task authorization separately.", "related_record_ids": [ "VXI-EXT-TOOL-TRUST-GITHUB-01-v1", "VXI-EXT-TOOL-TRUST-GITLAB-01-v1" ], "source_review": { "source_type": "official_external_documentation", "source_title": "Playwright MCP profiles and security boundary", "source_url": "https://github.com/microsoft/playwright-mcp", "checked_on": "2026-10-11", "candidate_record_id": "VXI-EXT-TOOL-TRUST-PLAYWRIGHT-01-v1", "candidate_record_sha256": "fd811e405ea48aad0bfe8613631ffe904f1fb3ad18ae0b2993cf95ce8faacf44", "method": "Primary documentation reviewed for the published bounded statement.", "deployment_tested_by_varexis": false, "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research." }, "answer_policy": { "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY", "bounded_answer": "Playwright MCP documents persistent, isolated and existing-browser session modes. Isolation concerns session state; it does not make authenticated web actions read-only. Its origin filters explicitly exclude redirects from their protection, and the project states that MCP itself is not a security boundary. Review browser identity, destinations and task authorization separately.", "required_buyer_context": "Microsoft's Playwright MCP in a local/operator-run browser setup; installed package version, launch settings and browser state were not inspected. Installed release, loaded cookies, browser permissions, network enforcement and client data handling.", "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state." }, "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.", "trust_profile": { "schema": "varexis-agent-tool-trust/1", "identity": { "tool": "Playwright MCP", "variant": "Microsoft's Playwright MCP in a local/operator-run browser setup; installed package version, launch settings and browser state were not inspected." }, "review_status": "documentation_review_only", "checked_on": "2026-10-11", "version_scope": "Dated rolling documentation snapshot; no installed or hosted runtime version independently verified.", "plan_scope": "Buyer plan, feature entitlement and effective configuration are not verified.", "findings": [ { "field": "operator", "label": "Publisher and operator", "status": "documented", "statement": "Microsoft publishes Playwright MCP; the organization running the process operates the browser connection.", "source_ids": [ "playwright-main", "playwright-auth" ] }, { "field": "purpose", "label": "Purpose", "status": "documented", "statement": "Inspect and interact with web pages through browser automation.", "source_ids": [ "playwright-main", "playwright-auth" ] }, { "field": "reads", "label": "Read capability", "status": "documented", "statement": "Page content and browser-visible information under the active session.", "source_ids": [ "playwright-main", "playwright-auth" ] }, { "field": "writes", "label": "Write capability", "status": "documented", "statement": "Browser interactions can submit forms and change remote state using the session's authority.", "source_ids": [ "playwright-main", "playwright-auth" ] }, { "field": "auth", "label": "Authentication", "status": "documented", "statement": "Websites use the browser's authentication state; isolated mode can load saved state. No hosted vendor OAuth login is assumed for local stdio.", "source_ids": [ "playwright-main", "playwright-auth" ] }, { "field": "permissions", "label": "Permission surface", "status": "documented", "statement": "Origin filters are documented as incomplete boundaries. Browser identity and surrounding runtime/network controls require separate review.", "source_ids": [ "playwright-main", "playwright-auth" ] }, { "field": "egress", "label": "Data leaving the environment", "status": "review_inference", "statement": "The browser contacts websites and returns content to the MCP client; a local browser process does not establish local-only model processing.", "source_ids": [ "playwright-main", "playwright-auth" ] }, { "field": "failures", "label": "Failure modes to consider", "status": "review_inference", "statement": "Reusing a privileged browser session; treating isolation as read-only authority; sharing a saved state file that enables impersonation.", "source_ids": [ "playwright-main", "playwright-auth" ] }, { "field": "unknown", "label": "Unknowns and applicability", "status": "unknown", "statement": "Installed release, loaded cookies, browser permissions, network enforcement and client data handling.", "source_ids": [] }, { "field": "gate", "label": "Suggested refusal or clarification condition", "status": "varexis_review_policy", "statement": "Use an authorized session and destination set; stop before form submissions outside the task and keep saved auth state out of evidence exports.", "source_ids": [] } ], "evidence_sources": [ { "source_id": "playwright-main", "url": "https://github.com/microsoft/playwright-mcp", "final_url": "https://github.com/microsoft/playwright-mcp", "title": "Playwright MCP profiles and security boundary", "checked_on": "2026-10-11", "sha256": "2fbbc3dcbb59f2924e1ee433d40a49ecab2d34cc3c5287a716b7f240be4b9d0e", "bytes": 636267 }, { "source_id": "playwright-auth", "url": "https://playwright.dev/docs/auth", "final_url": "https://playwright.dev/docs/auth", "title": "Playwright authentication state", "checked_on": "2026-10-11", "sha256": "4e739589b0cf3fda2b65536a8cb3455f00342dc0765ad2cba38adcfe31592918", "bytes": 232035 }, { "source_id": "mcp-hints", "url": "https://blog.modelcontextprotocol.io/posts/2026-03-16-tool-annotations/", "final_url": "https://blog.modelcontextprotocol.io/posts/2026-03-16-tool-annotations/", "title": "MCP tool annotations and enforcement boundaries", "checked_on": "2026-10-11", "sha256": "82888044d831c3bd18f03d87a846ce5d27e028bd67a095edc04ba377fc622163", "bytes": 52715 } ], "observed_tool_execution": false, "policy_basis": "Suggested VAREXIS review gates; apply the buyer's authorized task and policy. These conditions do not execute or enforce controls.", "commercial_reliance_boundary": "A source-linked review aid, not a vendor certification, security clearance or deployment assessment. Unknown does not mean false or unsafe.", "paid_value": { "decision_context": "Save browser-state and destination limitations considered when choosing an automation tool.", "free": "Complete profile, practical questions, sources and limitations; may be saved locally.", "single_request": "Existing server-saved version-bound route snapshot for later authenticated retrieval.", "evidence_receipt": "The same snapshot plus the existing unsigned delivery receipt.", "excluded": [ "Fresh vendor research", "Continuous monitoring or change alerts", "Testing the buyer configuration", "Private evidence or vendor certification" ], "integrity": "Hashes identify content versions; they do not prove truth or provide a signature." }, "revalidation": { "trigger": "Recheck when permissions, deployment, authentication, source guidance or intended use changes; a purchase does not trigger revalidation.", "specific_watch": "Review the effective tool inventory and client data policy before a new integration decision." }, "change_history": [ { "version": 1, "date": "2026-10-11", "change": "Initial documentation review; no earlier vendor assessment claimed." } ] }, "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.", "service_route": { "request_guide": "/varexis-index/request.html", "request_workflow": "/varexis-index/request-workflow.json", "service_id": "single_request", "service_routes_url": "/varexis-index/service-routes.json", "payment_required": true, "availability_endpoint": "/api/index/capabilities", "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED", "checkout_url": "/index-access" }, "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.", "human_page": "/varexis-index/catalog.html#playwright-mcp-browser-session-trust", "machine_readable_record": "/varexis-index/records/playwright-mcp-browser-session-trust.json" } } ], "basis": "A saved snapshot of the reviewed public route and source records. No fresh source review, independent experiment, deployment assessment or bespoke claim analysis is performed by this delivery. This fixed pack preserves two dated documentation reviews and their comparison.", "boundary": "Public answers remain free. Payment provides automatic retrieval, version binding and a saved delivery. It does not upgrade evidence or disclose protected material. The saved pack is not continually refreshed. Hashes bind its contents; the optional delivery receipt is unsigned.", "pack": { "schema": "varexis-index-evidence-pack/1", "pack_id": "repository-browser-trust", "version": "1.0.0", "title": "Repository and browser Tool-Trust Evidence Pack", "prepared_at_utc": "2026-10-15T18:46:23.204Z", "review_status": "documentation_review_only", "source_checked_on": [ "2026-10-11" ], "source_capture_date": null, "source_capture_boundary": "The records report when sources were checked. A separate source capture timestamp and an independently tested runtime version are not established.", "summary_markdown": "# Repository and browser permissions\n\nGitHub MCP and Playwright MCP expose different authority boundaries. GitHub documents read-only mode separately from credential scope. Playwright session isolation does not make authenticated browser actions read-only. This pack compares the two published documentation reviews, including read/write capability, authentication, data movement, unknowns and refusal conditions. The reviews are dated 11 October 2026; neither your deployment nor current tool behaviour has been independently tested.\n\n## GitHub MCP\nGitHub documents a read-only server mode that removes write tools and a separate choice of toolsets. Review both the credential's repository access and the configured server mode. Lockdown is a content filter with stated limitations. This profile helps scope a repository-review connection; it does not verify your token, server configuration or resistance to prompt injection.\n\n## Playwright MCP\nPlaywright MCP documents persistent, isolated and existing-browser session modes. Isolation concerns session state; it does not make authenticated web actions read-only. Its origin filters explicitly exclude redirects from their protection, and the project states that MCP itself is not a security boundary. Review browser identity, destinations and task authorization separately.\n\n## Before relying on either review\nIdentify the actual operator, deployment version, effective permissions and data destinations. Read the documented unknowns and refusal conditions in each included record. A missing statement is not proof of safety. No fresh investigation, certification or workload qualification is included.\n\n## What payment adds\nThe entire pack is free to inspect. Single Request preserves this complete version-bound JSON as one saved result. Evidence Receipt also records delivery in an unsigned receipt. An eligible subscriber retrieves the same pack through one existing query; it is not a purchase of each member. Keep the existing access key for recovery.\n", "comparison": [ { "record_id": "VXI-EXT-TOOL-TRUST-GITHUB-01-v1", "tool": "GitHub MCP", "review_status": "documentation_review_only", "checked_on": "2026-10-11", "findings": [ { "field": "operator", "label": "Publisher and operator", "status": "documented", "statement": "GitHub publishes the server and hosts the remote service; a local deployment has its own operator.", "source_ids": [ "github-main", "github-config" ] }, { "field": "purpose", "label": "Purpose", "status": "documented", "statement": "Review repository content, issues and pull requests.", "source_ids": [ "github-main", "github-config" ] }, { "field": "reads", "label": "Read capability", "status": "documented", "statement": "Repository files, issues and pull requests accessible through the selected tools and credential.", "source_ids": [ "github-main", "github-config" ] }, { "field": "writes", "label": "Write capability", "status": "documented", "statement": "Write-capable toolsets exist; documented read-only mode excludes their write tools.", "source_ids": [ "github-main", "github-config" ] }, { "field": "auth", "label": "Authentication", "status": "documented", "statement": "Remote OAuth or PAT authentication is documented; actual repository grants and organization policy require inspection.", "source_ids": [ "github-main", "github-config" ] }, { "field": "permissions", "label": "Permission surface", "status": "documented", "statement": "Toolset selection, exclusions and read-only mode are configurable. Lockdown does not reduce the underlying credential's authority.", "source_ids": [ "github-main", "github-config" ] }, { "field": "egress", "label": "Data leaving the environment", "status": "review_inference", "statement": "Repository results return to the connected client. If that client uses a hosted model, selected content may leave the repository service; inspect that client's data policy.", "source_ids": [ "github-main", "github-config" ] }, { "field": "failures", "label": "Failure modes to consider", "status": "review_inference", "statement": "Overbroad credentials; assuming lockdown prevents all hostile content; enabling a write tool during a review-only task.", "source_ids": [ "github-main", "github-config" ] }, { "field": "unknown", "label": "Unknowns and applicability", "status": "unknown", "statement": "Actual token grants, effective tool list, enterprise hosting configuration and client retention/training terms.", "source_ids": [] }, { "field": "gate", "label": "Suggested refusal or clarification condition", "status": "varexis_review_policy", "statement": "For a review-only task, stop before writes; resolve unknown repository grants before reading private repositories.", "source_ids": [] } ] }, { "record_id": "VXI-EXT-TOOL-TRUST-PLAYWRIGHT-01-v1", "tool": "Playwright MCP", "review_status": "documentation_review_only", "checked_on": "2026-10-11", "findings": [ { "field": "operator", "label": "Publisher and operator", "status": "documented", "statement": "Microsoft publishes Playwright MCP; the organization running the process operates the browser connection.", "source_ids": [ "playwright-main", "playwright-auth" ] }, { "field": "purpose", "label": "Purpose", "status": "documented", "statement": "Inspect and interact with web pages through browser automation.", "source_ids": [ "playwright-main", "playwright-auth" ] }, { "field": "reads", "label": "Read capability", "status": "documented", "statement": "Page content and browser-visible information under the active session.", "source_ids": [ "playwright-main", "playwright-auth" ] }, { "field": "writes", "label": "Write capability", "status": "documented", "statement": "Browser interactions can submit forms and change remote state using the session's authority.", "source_ids": [ "playwright-main", "playwright-auth" ] }, { "field": "auth", "label": "Authentication", "status": "documented", "statement": "Websites use the browser's authentication state; isolated mode can load saved state. No hosted vendor OAuth login is assumed for local stdio.", "source_ids": [ "playwright-main", "playwright-auth" ] }, { "field": "permissions", "label": "Permission surface", "status": "documented", "statement": "Origin filters are documented as incomplete boundaries. Browser identity and surrounding runtime/network controls require separate review.", "source_ids": [ "playwright-main", "playwright-auth" ] }, { "field": "egress", "label": "Data leaving the environment", "status": "review_inference", "statement": "The browser contacts websites and returns content to the MCP client; a local browser process does not establish local-only model processing.", "source_ids": [ "playwright-main", "playwright-auth" ] }, { "field": "failures", "label": "Failure modes to consider", "status": "review_inference", "statement": "Reusing a privileged browser session; treating isolation as read-only authority; sharing a saved state file that enables impersonation.", "source_ids": [ "playwright-main", "playwright-auth" ] }, { "field": "unknown", "label": "Unknowns and applicability", "status": "unknown", "statement": "Installed release, loaded cookies, browser permissions, network enforcement and client data handling.", "source_ids": [] }, { "field": "gate", "label": "Suggested refusal or clarification condition", "status": "varexis_review_policy", "statement": "Use an authorized session and destination set; stop before form submissions outside the task and keep saved auth state out of evidence exports.", "source_ids": [] } ] } ], "members": [ { "schema": "varexis-index-delivery/1", "catalog_version": "2026-10-14T20:21:57.226Z", "route_id": "agentic_reviewed_github_mcp_repository_access_trust", "question": "How can an agent review repository access without enabling GitHub MCP writes?", "answer": "GitHub documents a read-only server mode that removes write tools and a separate choice of toolsets. Review both the credential's repository access and the configured server mode. Lockdown is a content filter with stated limitations. This profile helps scope a repository-review connection; it does not verify your token, server configuration or resistance to prompt injection.", "basis": "A saved snapshot of the reviewed public route and source records. No fresh source review, independent experiment, deployment assessment or bespoke claim analysis is performed by this delivery.", "boundary": "Public answers remain free. Payment provides automatic retrieval, version binding and a saved delivery. It does not upgrade evidence or disclose protected material.", "snapshot_sha256": "eb5bf8ee35598f2a504d20a544e26f93a965ce291386ceee7ca22ae8eee7de7e", "record_ids": [ "VXI-EXT-TOOL-TRUST-GITHUB-01-v1" ] }, { "schema": "varexis-index-delivery/1", "catalog_version": "2026-10-14T20:21:57.226Z", "route_id": "agentic_reviewed_playwright_mcp_browser_session_trust", "question": "Does an isolated Playwright MCP browser session prevent privileged web actions or data disclosure?", "answer": "Playwright MCP documents persistent, isolated and existing-browser session modes. Isolation concerns session state; it does not make authenticated web actions read-only. Its origin filters explicitly exclude redirects from their protection, and the project states that MCP itself is not a security boundary. Review browser identity, destinations and task authorization separately.", "basis": "A saved snapshot of the reviewed public route and source records. No fresh source review, independent experiment, deployment assessment or bespoke claim analysis is performed by this delivery.", "boundary": "Public answers remain free. Payment provides automatic retrieval, version binding and a saved delivery. It does not upgrade evidence or disclose protected material.", "snapshot_sha256": "94008f2569c1b1e8a4317a921e0efa119d77215124d041f76b4748018bc96f60", "record_ids": [ "VXI-EXT-TOOL-TRUST-PLAYWRIGHT-01-v1" ] } ], "rights_review": { "reviewed_on": "2026-10-15", "scope": "This exact public compilation of VAREXIS-authored review prose, factual identifiers, source links, dates and hashes.", "included": "Existing public VAREXIS review records and their limitations; an attributed comparison using the same documented findings.", "excluded": "Upstream documentation bodies, source code, screenshots, logos, private operator templates and protected evidence.", "redistribution_boundary": "Source links and hashes identify upstream material; they do not grant rights to redistribute that material. This package includes no upstream document bodies or code. Existing VAREXIS service terms apply to the supplied compilation.", "terms_url": "https://varexis.tech/checkout-terms", "independent_testing": false }, "delivery_unit": { "kind": "one_published_route", "member_count": 2, "developer_query_units": 1, "research_query_units": 1, "extra_member_purchases": false, "automatic_refresh": false } }, "snapshot_sha256": "efb07a282354db948fa9d9d3c36b24633824c2c821e748792793c14c4669e526" }