{
  "schema": "varexis-public-evidence-record/0.3",
  "generated_at_utc": "2026-10-11T21:09:20.344Z",
  "record_id": "VXI-EXT-TOOL-TRUST-PLAYWRIGHT-01-v1",
  "record_kind": "external_reference",
  "title": "Playwright MCP: Browser identity and session boundaries",
  "system": "Playwright MCP",
  "evidence_family": "agent_tool_trust_review",
  "index_status": "PUBLIC_SAFE_SOURCE_REVIEW",
  "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY",
  "canonical_question": "Does an isolated Playwright MCP browser session prevent privileged web actions or data disclosure?",
  "near_questions": [
    "Does browser session isolation prevent privileged website actions?",
    "Can a browser automation tool use an existing logged-in session?",
    "Do Playwright MCP origin filters cover redirects?",
    "Is an isolated browser automatically read-only?",
    "What authority does a browser MCP inherit from cookies?",
    "Can saved browser state let someone impersonate an account?",
    "Does running a browser locally keep model processing local?",
    "Who operates a local Playwright MCP process?",
    "What should an agent check before submitting a web form?",
    "Does this browser trust profile certify network isolation?",
    "What does a saved Playwright trust record contain?",
    "Which browser state needs review before automation?"
  ],
  "supported_claims": [
    {
      "claim": "Playwright MCP documents persistent, isolated and existing-browser session modes. Isolation concerns session state; it does not make authenticated web actions read-only. Its origin filters explicitly exclude redirects from their protection, and the project states that MCP itself is not a security boundary. Review browser identity, destinations and task authorization separately.",
      "reliance": "DOCUMENTED_CAPABILITY_ONLY"
    }
  ],
  "not_demonstrated_claims": [
    "Verified buyer configuration or effective access rights",
    "Independent tool execution or security testing",
    "Vendor certification, guaranteed safety or no-training assurance"
  ],
  "public_summary": "Playwright MCP documents persistent, isolated and existing-browser session modes. Isolation concerns session state; it does not make authenticated web actions read-only. Its origin filters explicitly exclude redirects from their protection, and the project states that MCP itself is not a security boundary. Review browser identity, destinations and task authorization separately.",
  "related_record_ids": [
    "VXI-EXT-TOOL-TRUST-GITHUB-01-v1",
    "VXI-EXT-TOOL-TRUST-GITLAB-01-v1"
  ],
  "source_review": {
    "source_type": "official_external_documentation",
    "source_title": "Playwright MCP profiles and security boundary",
    "source_url": "https://github.com/microsoft/playwright-mcp",
    "checked_on": "2026-10-11",
    "candidate_record_id": "VXI-EXT-TOOL-TRUST-PLAYWRIGHT-01-v1",
    "candidate_record_sha256": "fd811e405ea48aad0bfe8613631ffe904f1fb3ad18ae0b2993cf95ce8faacf44",
    "method": "Primary documentation reviewed for the published bounded statement.",
    "deployment_tested_by_varexis": false,
    "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research."
  },
  "answer_policy": {
    "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY",
    "bounded_answer": "Playwright MCP documents persistent, isolated and existing-browser session modes. Isolation concerns session state; it does not make authenticated web actions read-only. Its origin filters explicitly exclude redirects from their protection, and the project states that MCP itself is not a security boundary. Review browser identity, destinations and task authorization separately.",
    "required_buyer_context": "Microsoft's Playwright MCP in a local/operator-run browser setup; installed package version, launch settings and browser state were not inspected. Installed release, loaded cookies, browser permissions, network enforcement and client data handling.",
    "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state."
  },
  "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.",
  "trust_profile": {
    "schema": "varexis-agent-tool-trust/1",
    "identity": {
      "tool": "Playwright MCP",
      "variant": "Microsoft's Playwright MCP in a local/operator-run browser setup; installed package version, launch settings and browser state were not inspected."
    },
    "review_status": "documentation_review_only",
    "checked_on": "2026-10-11",
    "version_scope": "Dated rolling documentation snapshot; no installed or hosted runtime version independently verified.",
    "plan_scope": "Buyer plan, feature entitlement and effective configuration are not verified.",
    "findings": [
      {
        "field": "operator",
        "label": "Publisher and operator",
        "status": "documented",
        "statement": "Microsoft publishes Playwright MCP; the organization running the process operates the browser connection.",
        "source_ids": [
          "playwright-main",
          "playwright-auth"
        ]
      },
      {
        "field": "purpose",
        "label": "Purpose",
        "status": "documented",
        "statement": "Inspect and interact with web pages through browser automation.",
        "source_ids": [
          "playwright-main",
          "playwright-auth"
        ]
      },
      {
        "field": "reads",
        "label": "Read capability",
        "status": "documented",
        "statement": "Page content and browser-visible information under the active session.",
        "source_ids": [
          "playwright-main",
          "playwright-auth"
        ]
      },
      {
        "field": "writes",
        "label": "Write capability",
        "status": "documented",
        "statement": "Browser interactions can submit forms and change remote state using the session's authority.",
        "source_ids": [
          "playwright-main",
          "playwright-auth"
        ]
      },
      {
        "field": "auth",
        "label": "Authentication",
        "status": "documented",
        "statement": "Websites use the browser's authentication state; isolated mode can load saved state. No hosted vendor OAuth login is assumed for local stdio.",
        "source_ids": [
          "playwright-main",
          "playwright-auth"
        ]
      },
      {
        "field": "permissions",
        "label": "Permission surface",
        "status": "documented",
        "statement": "Origin filters are documented as incomplete boundaries. Browser identity and surrounding runtime/network controls require separate review.",
        "source_ids": [
          "playwright-main",
          "playwright-auth"
        ]
      },
      {
        "field": "egress",
        "label": "Data leaving the environment",
        "status": "review_inference",
        "statement": "The browser contacts websites and returns content to the MCP client; a local browser process does not establish local-only model processing.",
        "source_ids": [
          "playwright-main",
          "playwright-auth"
        ]
      },
      {
        "field": "failures",
        "label": "Failure modes to consider",
        "status": "review_inference",
        "statement": "Reusing a privileged browser session; treating isolation as read-only authority; sharing a saved state file that enables impersonation.",
        "source_ids": [
          "playwright-main",
          "playwright-auth"
        ]
      },
      {
        "field": "unknown",
        "label": "Unknowns and applicability",
        "status": "unknown",
        "statement": "Installed release, loaded cookies, browser permissions, network enforcement and client data handling.",
        "source_ids": []
      },
      {
        "field": "gate",
        "label": "Suggested refusal or clarification condition",
        "status": "varexis_review_policy",
        "statement": "Use an authorized session and destination set; stop before form submissions outside the task and keep saved auth state out of evidence exports.",
        "source_ids": []
      }
    ],
    "evidence_sources": [
      {
        "source_id": "playwright-main",
        "url": "https://github.com/microsoft/playwright-mcp",
        "final_url": "https://github.com/microsoft/playwright-mcp",
        "title": "Playwright MCP profiles and security boundary",
        "checked_on": "2026-10-11",
        "sha256": "2fbbc3dcbb59f2924e1ee433d40a49ecab2d34cc3c5287a716b7f240be4b9d0e",
        "bytes": 636267
      },
      {
        "source_id": "playwright-auth",
        "url": "https://playwright.dev/docs/auth",
        "final_url": "https://playwright.dev/docs/auth",
        "title": "Playwright authentication state",
        "checked_on": "2026-10-11",
        "sha256": "4e739589b0cf3fda2b65536a8cb3455f00342dc0765ad2cba38adcfe31592918",
        "bytes": 232035
      },
      {
        "source_id": "mcp-hints",
        "url": "https://blog.modelcontextprotocol.io/posts/2026-03-16-tool-annotations/",
        "final_url": "https://blog.modelcontextprotocol.io/posts/2026-03-16-tool-annotations/",
        "title": "MCP tool annotations and enforcement boundaries",
        "checked_on": "2026-10-11",
        "sha256": "82888044d831c3bd18f03d87a846ce5d27e028bd67a095edc04ba377fc622163",
        "bytes": 52715
      }
    ],
    "observed_tool_execution": false,
    "policy_basis": "Suggested VAREXIS review gates; apply the buyer's authorized task and policy. These conditions do not execute or enforce controls.",
    "commercial_reliance_boundary": "A source-linked review aid, not a vendor certification, security clearance or deployment assessment. Unknown does not mean false or unsafe.",
    "paid_value": {
      "decision_context": "Save browser-state and destination limitations considered when choosing an automation tool.",
      "free": "Complete profile, practical questions, sources and limitations; may be saved locally.",
      "single_request": "Existing server-saved version-bound route snapshot for later authenticated retrieval.",
      "evidence_receipt": "The same snapshot plus the existing unsigned delivery receipt.",
      "excluded": [
        "Fresh vendor research",
        "Continuous monitoring or change alerts",
        "Testing the buyer configuration",
        "Private evidence or vendor certification"
      ],
      "integrity": "Hashes identify content versions; they do not prove truth or provide a signature."
    },
    "revalidation": {
      "trigger": "Recheck when permissions, deployment, authentication, source guidance or intended use changes; a purchase does not trigger revalidation.",
      "specific_watch": "Review the effective tool inventory and client data policy before a new integration decision."
    },
    "change_history": [
      {
        "version": 1,
        "date": "2026-10-11",
        "change": "Initial documentation review; no earlier vendor assessment claimed."
      }
    ]
  },
  "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.",
  "service_route": {
    "request_guide": "/varexis-index/request.html",
    "request_workflow": "/varexis-index/request-workflow.json",
    "service_id": "single_request",
    "service_routes_url": "/varexis-index/service-routes.json",
    "payment_required": true,
    "availability_endpoint": "/api/index/capabilities",
    "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED",
    "checkout_url": "/index-access"
  },
  "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.",
  "human_page": "/varexis-index/catalog.html#playwright-mcp-browser-session-trust",
  "machine_readable_record": "/varexis-index/records/playwright-mcp-browser-session-trust.json"
}