npm / chrome-devtools-mcp
chrome-devtools-mcp
What changed in chrome-devtools-mcp 1, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-28.
3 breaking5 security17 new APIs and options1 performance12 behavior and defaults2 tooling29 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initchrome-devtools-mcp 169 changes
Breaking changes 3
Rejects hostname regexp groups in URL pattern options.
Rejects hostname regexp groups in URL pattern options.
Rejects unrestricted paths when an explicit workspace is configured.
Security 5
Client-supplied values are escaped in logs and errors.
Hardens serialization of third-party tool results.
Enforces URL policy across redirects.
Chrome DevTools for agents: daemon.pid write follows symlinks in /tmp fallback runtime directory
chrome-devtools-mcp: validatePath() does not canonicalize symlinks before enforcing roots
New APIs and options 17
Heap snapshots can now be analyzed without a browser connection.
Adds a Kimi Code plugin manifest.
Adds a flag to configure how much navigation history is retained.
Adds a method to reload configuration.
Introduces layered server configuration for live reload.
Slim mode screenshots now support a filepath.
Independent tool calls can run in parallel with a TaskRunner.
Adds opt-in matching against visible text.
Adds an option to reload configuration when the config file changes.
Adds an MCP tool for analyzing heap snapshot contexts.
Adds a truncation option for long names in heap snapshot comparisons.
The config file is discovered in predefined locations.
ConfigWatcher watches for changes to the configuration file.
Supports evaluating scripts from local files.
Adds a flag to reject file: URL navigations.
Adds support for truncating heap snapshot details.
Adds the ignoreCache option to performance_start_trace.
Performance 1
Loads heap snapshots in parallel during comparisons.
Behavior and default changes 12
Changes to this URL restriction can now be reloaded.
Changes to this URL restriction can now be reloaded.
Detailed diffs are paginated, and objects for each class are sorted by self size.
Heap snapshot tools now paginate by default.
Page-scoped tools can run in parallel when targeting different pages.
Adds pagination to heap snapshot comparisons.
Config defaults are resolved after merging CLI options and the config file.
Long names are truncated to 100 characters by default.
Pages opened by input actions are reported.
Returns failing audits and their DOM nodes inline.
FFmpeg-free screencast tools are enabled by default.
Text snapshots include less StaticText noise and skip more redundant data.
Tooling 2
Supports emulating additional CSS media features.
Supports debugging WebMCP tools in third-party developer tools.
Fixes and other changes 29
Non-Error values thrown or rejected during script evaluation are surfaced.
Script evaluation is blocked while a dialog is open.
The unsupported websocket resource type is removed from the request filter.
Navigation rejects devtools:// URLs.
New pages reject devtools:// URLs.
When pageSize is omitted and pageIdx is 0, pagination returns all items.
A warning is issued when screenshot dimensions exceed the 16384px limit.
The submitKey value is validated before typing.
Config files now accept native JSON objects for WebSocket headers.
CLI mode honors an explicit false value.
A healthy browser is no longer closed when a tool call outlasts 60 seconds.
The option works when connecting to an existing browser and is passed to the target filter.
Improves config support for the CLI.
Positional values beginning with a hyphen are passed through to tools.
Allows stopping the CLI if a command fails.
Reports an unknown page ID before applying the last-page guard.
Surfaces WebMCP tool exceptions in the result.
Rounds category scores and shows unscored categories as n/a.
Reports an error when called without an active trace.
Rejects non-positive resize dimensions.
Propagates a failed responseFilePath write error instead of reporting the body unavailable.
Screencasts are recorded at the page's device pixel size.
Downscaled screenshot coordinates account for scroll offsets.
Slim responses include errors.
Rejects contradictory pagination options.
Tool calls stuck after a dead browser connection fail fast.
Rejects multiple file paths when the input accepts a single file.
Rejects named groups in URL patterns and supports partial IPv4 patterns.
Rejects non-positive viewport dimensions.