Top 9 MCP Servers for Browser Automation in 2026

Browser automation is one of the highest-leverage things you can give an AI agent. The moment a model can open a page, read the DOM, click buttons and fill forms, it stops being a chatbot and starts being an operator — running end-to-end tests, scraping structured data, filling out portals, and reproducing bugs on live web apps. The Model Context Protocol (MCP) has become the standard way to wire these capabilities into Claude, Cursor, and other agent runtimes, and browser servers are consistently among the most-installed MCP tools of 2026.

But a browser server is also one of the most powerful things you can hand an agent. Many of them can execute arbitrary JavaScript, reach any URL, and reuse your logged-in session. That is exactly why we scanned every server below with MCP Trust Checker before recommending it. Each entry carries a deterministic MCP Trust Score — a letter grade from A to F and a 0–100 number — derived from the actual published package source, not its GitHub star count.

How to read the grade: A means our scanner found a clean, well-scoped server with no high-severity issues; B/C means minor concerns worth a glance; D/F means the package requests broad capabilities or trips several high-severity rules and deserves a careful read before you grant it access. A high star count does not raise a grade — the two are independent, and that is the whole point.

1. Playwright MCP

Microsoft's official server drives Chromium, Firefox and WebKit through Playwright. Instead of feeding the model screenshots, it exposes the page's structured accessibility tree, so the agent can click, type, navigate and assert deterministically — cheaper and far more reliable than pixel-hunting on an image. With roughly 34k GitHub stars it is the de-facto standard for interactive browser automation and web-testing agents, and it is the first server we recommend for most people.

Our scan gives it a clean bill of health: minimal capability footprint and zero high-severity findings, which is exactly what you want from the tool you reach for by default.

MCP Trust Score: A (100/100) · GitHub · npm

2. Browser MCP

Browser MCP pairs an MCP server with a Chrome extension so the agent automates your existing local browser rather than spinning up a fresh headless one. Because it reuses your real profile, you stay logged in and sidestep the bot-detection that blocks clean automated browsers — handy for tasks on sites that fingerprint headless Chrome. At around 6.7k stars it is the most popular "control my own Chrome session" server.

It grades well overall, but note that driving your logged-in browser is inherently a high-capability action, and our scan flags 1 high-severity finding worth reviewing on its registry page before you connect it to a profile with sensitive sessions.

MCP Trust Score: A (92/100) · GitHub · npm

3. ExecuteAutomation Playwright MCP

A Playwright-based server aimed squarely at QA and testing workflows. On top of the usual navigation it adds screenshot capture, test-code generation, web scraping, and arbitrary JavaScript execution in a real browser. If you want scraping plus test-generation helpers rather than the lean Microsoft baseline, this ~5.5k-star community server is one of the most-installed alternatives.

The package itself scores a perfect 100, though it does surface 1 high-severity finding — unsurprising given it deliberately exposes raw JavaScript execution. Read the finding on its registry page so you understand what that capability implies for your setup.

MCP Trust Score: A (100/100) · GitHub · npm

4. Agent-Infra Browser MCP

ByteDance's browser-automation server, part of the UI-TARS / Agent TARS project, uses Puppeteer and supports both local and remote browser connections with a hybrid vision-plus-DOM interaction model. It was built to power full GUI agents, but it works perfectly well standalone as a capable navigate/click/extract server. It ships inside ByteDance's ~36k-star UI-TARS monorepo and has strong traction in the agent community.

Our scan returns a minimal capability footprint and no high-severity findings — a clean A.

MCP Trust Score: A (100/100) · GitHub · npm

5. Browserbase MCP

Browserbase's official server hands your agent a managed cloud browser with stealth, proxies, captcha handling and session recording, and bundles the Stagehand library for natural-language actions like act, extract and observe. It is the leading choice when you need scalable, hard-to-detect automation without running browsers on your own machines, and it appears in essentially every serious roundup as the go-to managed/remote option.

It scans clean: minimal capabilities, zero high-severity findings.

MCP Trust Score: A (98/100) · GitHub · npm

6. Chrome DevTools MCP

Google's official server connects an agent to a real Chrome instance over the Chrome DevTools Protocol (Puppeteer under the hood). Its distinguishing feature is inspection depth: performance traces, network capture, console logs and DOM interaction, which makes it the strongest choice for debugging and profiling live web apps rather than just clicking through them. Adoption is rising fast, and for DevTools-grade insight over MCP there is nothing else quite like it.

Be deliberate here, though. This is the one server on the list where the grade demands a pause: our scan assigns it a D (63/100) with 8 high-severity findings and a high capability level. That is not a reason to avoid it, but it is a reason to read every finding on its registry page and think carefully before granting it broad access to a browser holding sensitive sessions.

MCP Trust Score: D (63/100) · GitHub · npm

7. Hyperbrowser MCP

Hyperbrowser's official server exposes scraping, structured-data extraction, crawling and full browser-agent tools that run on managed headless infrastructure with proxy and stealth support. It leans more toward data extraction than interactive clicking, which makes it a strong pick when you want automation-at-scale focused on getting clean data out of the web without hosting any browsers yourself. It is actively maintained and widely listed across MCP directories.

The package scores a clean 100 with a minimal footprint and no high-severity findings.

MCP Trust Score: A (100/100) · GitHub · npm

8. Browser Use MCP Server

This server wraps the popular browser-use Python library so agents can control a browser with vision-plus-DOM reasoning, over stdio or SSE transports, with optional VNC streaming to watch a session live. It is aimed at autonomous, self-hosted agents that plan and execute multi-step web tasks, and it is the canonical MCP packaging of the widely used browser-use project. Note that it ships on PyPI rather than npm.

It scores a strong 98, with 1 high-severity finding to review — expected for a self-hosted autonomous agent that can act freely across the web.

MCP Trust Score: A (98/100) · GitHub · PyPI

9. Puppeteer MCP (reference)

The original reference browser server from the modelcontextprotocol project offered Puppeteer-based navigation, clicking, form-filling, screenshots and JS evaluation against headless Chrome. It defined the category and is still widely referenced in tutorials. One important caveat: it has been deprecated and moved to the servers-archived repo, with Playwright MCP named as the recommended successor. Include it here for context, but start new projects on Playwright MCP instead.

The archived package still scans clean — a minimal footprint and no high-severity findings — but "clean and abandoned" is not the same as "maintained," so treat the A as historical.

MCP Trust Score: A (98/100) · GitHub · npm

How we graded these

Every Trust Score above comes from the deterministic, open-source MCP Trust Checker engine. It reads the actual source that ships in each published npm or PyPI package and evaluates it against a fixed set of security rules — capability scoping, dangerous flows, high-severity patterns — to produce the letter grade and 0–100 number. There is no LLM in the loop and no vibe-based judgement: the same package version always produces the same score, so the grades are reproducible and auditable. You can browse every scanned server, drill into individual findings, and read how the scoring works at the registry and /registry/security.

A high grade means the code we scanned is clean — it does not vouch for what you tell the server to do. Even an A-rated browser server can exfiltrate data if you point it at a malicious site or paste in untrusted instructions. Scope its access, and treat the pages it visits as untrusted input.

Want the full picture? Browse every browser-automation server we track at the Browser Automation category, and scan any npm or PyPI package yourself — free — through the MCP Trust Checker API before you add it to your agent.

npx mcptrustchecker