Shiplight MCP server
An MCP server that provides browser automation
1.7k downloads/wk
Reviews
Write oneNobody has reviewed Shiplight yet.
If you have run it, two minutes of your experience saves the next person an afternoon.
Shiplight tools (17, 2 write)
write = sends, deletes, buys or postsRead from the package source without running it. The installed server may list more.
attach_to_browserConnect to a browser for testing. Two modes: 1. Direct CDP: pass cdp_url (e.g. from a debugger's /api/browser-cdp endpoint) to connect directly via Chrome DevTools Protocol. 2. Extension relay: omit cdp_url to auto-discover Chrome tabs via the Shiplight AI Chrome extension. Returns session_id for use with inspect_page, act, get_page_info, switch_tab, etc.
clear_execution_historyClear the execution history for a session. The execution history tracks past browser operations within a session. Clear it to start fresh or reduce memory usage.
clear_logsClear console and network logs for a session
close_allClose all browser sessions
close_sessionClose a browser session. Omit session_id entirely to close ALL open sessions.
generate_html_reportGenerate a self-contained HTML session report. Can be called while the session is live OR after close_session. Embeds per-step screenshots, an optional video player, and a Playwright trace viewer link. The session must have been started with record_evidence: true. Pass local_video_path (returned by close_session) to embed the video. Pass local_trace_path (returned by close_session) to include trac
get_browser_console_logsGet console logs from the browser (errors, warnings, etc.)
get_browser_network_logsGet network request logs from the browser
get_local_artifactGet a local artifact file (screenshot, DOM snapshot, etc.) from a live browser session. Only accepts local file paths, NOT S3 URIs. For test run artifacts, use get_step_artifacts instead.
get_locatorsExtract Playwright locators for one or more elements by index. Call inspect_page first. Returns locator, xpath, frame path, tag name, and text for each element. Use this to collect locator data for building test flows without interacting with the page. Pass multiple indices in a single call to save round-trips.
get_page_infoGet basic page information (URL and title) without taking a screenshot. Use this as a lightweight way to check what page you're on. For visual inspection, use inspect_page.
get_relay_statusGet extension relay server status and tab mapping
get_session_stateGet current state of a session (URL, session type)
inspect_pageInspect the current page: extracts the DOM tree and saves a Set-of-Mark screenshot. Returns the DOM file path (with element indices [0], [1], etc. for the act tool) and a screenshot file path. The DOM and screenshot are captured atomically so element indices always match. IMPORTANT: Read the DOM file to understand page state and decide actions. Only view the screenshot file when the DOM is insuffi
new_sessionwrite actionCreate a new browser session with optional device emulation. Returns a session_id for subsequent operations. Use storage_state_path to restore a previously saved session (cookies, localStorage, IndexedDB). SCREEN RECORDING: Set browser_options.record_evidence=true only when you believe implementation is complete and are doing a final verification pass \u2014 not for exploration, investigation, or
save_storage_stateSave the browser session's storage state (cookies, localStorage, IndexedDB) to a file. Use this after logging in to cache the session for fast restores via new_session's storage_state_path.
update_variableswrite actionUpdate session variables for use in subsequent browser operations. Variables are key-value pairs that can be referenced in browser tasks. Mark sensitive values (passwords, tokens) with sensitive_keys to prevent logging. Example: variables: { username: "john", password: "secret123" } sensitive_keys: ["password"]
Public scan report
scanner v0.1.9 · 2026-09-20 · same rubric, same numbers if you re-run it
- Code scan6 source files scanned20/25
- –Live reliabilityno gateway calls yet and no remote to proben/a
- –Tool poisoningtools not inspected (local package is not executed); not countedn/a
- Auth qualitylocal package, no credentials required12/15
- Maintenancerepository not readable: repo not found3/15
- Maintainer identityverified namespace with website, no repo4/10
Findings (1)
- mediumeval / new Function used
exec.evaldist/index.js: …()}function j(e,t){let i=Je(t);return i?new Function("page",`return ${i}`)(e):null}async func…
Install directly
Runs npx -y @shiplightai/mcp on your machine. Read the scan report first; the gateway never runs local packages.
claude mcp add shiplight -- npx -y @shiplightai/mcp
Shiplight: common questions
- Is Shiplight MCP server safe?
- With care: it is graded C, so read the findings first (60/100). Read the Shiplight safety report
- How do I install Shiplight?
- It runs on your machine. Copy the Claude Code, Claude Desktop or Cursor config from the install section.
- Does Shiplight need an API key?
- No secret keys are declared. It reads 1 setting from the environment.
- Is Shiplight maintained?
- The latest release is v0.2.2.
- What can I use instead of Shiplight?
- Servers from other publishers that do the same job: SeleniumBase MCP server, AIHawk MCP server and Ui.Vision MCP server. Compare all Shiplight alternatives.
Alternatives to Shiplight
Same job from other publishers: the closest match first, then the best rated.
- SeleniumBase MCPStealthy browser automation, testing, and web-scraping via CDP Mode.not reviewedWidely usedA
- AIHawkAI browser agent: browses, clicks, types, and reads real web pages from plain-English instructions.not reviewedWidely usedA
Ui.Vision MCPMCP server for browser and desktop automation: OCR, image recognition, real mouse and keyboard inputnot reviewedEstablishedC
walkerOS Source BrowserGenerate, parse, and validate walkerOS data-elb HTML tagging attributesnot reviewedEstablishedA- SafariNative Safari browser automation for AI agents — 98 tools, zero Chrome overhead.not reviewedEstablishedC