AI Extensions: three official MCP servers, three different permissions
A September 28 check of Chrome DevTools MCP, Playwright MCP and GitHub MCP Server: official setup, license, activity and access boundaries.
AI EXTENSIONS · DAILY DIGEST · 28 SEP 2026
Three first-party MCP servers, all busy and maintained, and none of them interchangeable. One looks inside Chrome. One drives a browser for you. One can act as you on GitHub. Stars show how much attention each got on the day I checked, which is a different thing from quality. I did not install or run any of them.
Three permission boundaries
- Chrome DevTools MCP: Debugs a live Chrome, which may be showing logged-in pages.
- Playwright MCP: Clicks and types for the agent, so one click can submit a form.
- GitHub MCP Server: Acts through your token, so its reach is the token's reach.
Chrome DevTools MCP
What it does
Google’s Chrome DevTools MCP exposes Chrome debugging, page inspection and performance tools to an agent. It can help diagnose layout and network problems, but the connected browser may show authenticated content. [README]
Official setup path
The README shows npx -y chrome-devtools-mcp@latest in an MCP client configuration. A slim/headless example exists. Node LTS and Chrome are prerequisites; pin a version after review rather than leaving production on @latest. [README]
License, maintenance and community
Apache-2.0 at repository root (LICENSE file). Last repository push 28 Sep 2026 10:27 UTC; 52,692 stars and 5,109 forks, observed 28 Sep 2026 via GitHub. [repository] · [latest release]. Popularity is not a quality or safety score.
Security and privacy boundary
The README says usage statistics are collected by default and describes --no-usage-statistics. Performance tools may send trace URLs to the CrUX API; --no-performance-crux disables those lookups. Use a disposable profile, inspect what a trace contains, and never treat page text as commands. [README]
Playwright MCP
What it does
Microsoft’s Playwright MCP offers browser navigation and interaction to agents through structured page information. This is a more active surface than simply reading a screenshot; a click can submit a form. [README]
Official setup path
The official README shows an MCP client command npx @playwright/mcp@latest. It documents --isolated for an in-memory browser profile, and a Docker route. Verify the binary and pin a version before connecting an account. [README]
License, maintenance and community
Apache-2.0 at repository root (LICENSE file). Last repository push 25 Sep 2026 22:43 UTC; 37,643 stars and 3,200 forks, observed 28 Sep 2026 via GitHub. [repository] · [latest release]. Popularity is not a quality or safety score.
Security and privacy boundary
The README explicitly says its --allowed-origins option is not a security boundary and does not affect redirects. An isolated profile reduces saved session state but does not authorize clicks. Keep a separate test login and review sends, purchases or account edits. [README]
GitHub MCP Server
What it does
GitHub’s official MCP server makes repository, issue and collaboration operations available through an MCP client. Its reach depends on the OAuth app or personal access token, not on the model’s confidence. [README]
Official setup path
The README shows a remote MCP endpoint for supported clients and a PAT option; local Docker setup is also documented. Configure the host using the official installation guide and give the app or token only the required repositories and permissions. [README]
License, maintenance and community
MIT at repository root (LICENSE file). Last repository push 28 Sep 2026 09:47 UTC; 33,253 stars and 5,059 forks, observed 28 Sep 2026 via GitHub. [repository] · [latest release]. Popularity is not a quality or safety score.
Security and privacy boundary
The README documents toolsets and --read-only, which skips write tools. Read-only in the server does not fix an overbroad token or unintended private data disclosure. Start with a throwaway repository, review tool output and keep the credential out of chat. [README]
A safe first trial
For Chrome, inspect a local test page in a clean profile and watch outbound telemetry. For Playwright, navigate a disposable site but disable any real account action. For GitHub, use a test repository and a narrowly scoped credential with read-only tools. Record allowed tools, returned private fields, network destinations, and the exact human approval point before moving to a real account. None of these reviews is a security audit.
Sources and method: Chrome DevTools MCP · Playwright MCP · GitHub MCP Server. Official project README and LICENSE files, repository activity, stars and forks checked 28 Sep 2026; dates are observations, not a quality ranking. No project was installed or tested.