playwright-mcp 0.0.82 promotes WebMCP page tools into first-class MCP tools, and tells you to treat them as untrusted

GitHub Releases·high signalXBlueskyLinkedInCopy link

Released 2026-09-18, v0.0.82 exposes tools a page registers via the WebMCP API directly in the MCP tool list as webmcp_<tool>, carrying the page's own input schema and annotations, with the list following the active tab and a tools/list_changed notification on every switch. This replaces the browser_webmcp_list / browser_webmcp_call pair from v0.0.81. The release notes say plainly that tool names, descriptions, schemas and results all come from the page and should be treated as untrusted input, which is a live prompt-injection surface wired straight into an agent's tool list; --no-webmcp opts out.