@mcp-b/chrome-devtools-mcp 1.7.2 → 1.8.1

package/build/src/McpContext.js

@@ -89,6 +89,7 @@ export class McpContext {
     #networkConditionsMap = new WeakMap();
     #cpuThrottlingRateMap = new WeakMap();
     #geolocationMap = new WeakMap();
+    #bypassCSPMap = new WeakMap();
     #dialog;
     #nextSnapshotId = 1;
     #traceResults = [];
@@ -616,6 +617,20 @@ export class McpContext {
         const page = this.getSelectedPage();
         return this.#geolocationMap.get(page) ?? null;
     }
+    async setBypassCSP(enabled) {
+        const page = this.getSelectedPage();
+        await page.setBypassCSP(enabled);
+        if (enabled) {
+            this.#bypassCSPMap.set(page, true);
+        }
+        else {
+            this.#bypassCSPMap.delete(page);
+        }
+    }
+    getBypassCSP() {
+        const page = this.getSelectedPage();
+        return this.#bypassCSPMap.get(page) ?? false;
+    }
     setIsRunningPerformanceTrace(x) {
         this.#isRunningTrace = x;
     }

package/build/src/tools/pages.js

@@ -110,6 +110,10 @@ export const navigatePage = defineTool({
             .boolean()
             .optional()
             .describe('Whether to ignore cache on reload.'),
+        bypassCSP: zod
+            .boolean()
+            .optional()
+            .describe('Bypass Content-Security-Policy on the page. Useful for injecting scripts into third-party sites during development.'),
         ...timeoutSchema,
     },
     handler: async (request, response, context) => {
@@ -117,6 +121,9 @@ export const navigatePage = defineTool({
         const options = {
             timeout: request.params.timeout,
         };
+        if (request.params.bypassCSP !== undefined) {
+            await context.setBypassCSP(request.params.bypassCSP);
+        }
         if (!request.params.type && !request.params.url) {
             throw new Error('Either URL or a type is required.');
         }

package/build/src/tools/script.js

@@ -3,19 +3,26 @@
  * Copyright 2025 Google LLC
  * SPDX-License-Identifier: Apache-2.0
  */
+import { readFile } from 'node:fs/promises';
 import { zod } from '../third_party/index.js';
 import { ToolCategory } from './categories.js';
 import { defineTool } from './ToolDefinition.js';
 export const evaluateScript = defineTool({
     name: 'evaluate_script',
-    description: `Evaluate a JavaScript function inside the currently selected page. Returns the response as JSON
-so returned values have to JSON-serializable.`,
+    description: `Evaluate a JavaScript function or inject a script file into the currently selected page.
+
+When \`function\` is provided, evaluates it and returns the result as JSON (values must be JSON-serializable).
+When \`filePath\` is provided, reads the file from disk and injects it as a <script> tag (useful for large scripts like polyfills that are too big to pass inline).
+Exactly one of \`function\` or \`filePath\` must be provided.`,
     annotations: {
         category: ToolCategory.DEBUGGING,
         readOnlyHint: false,
     },
     schema: {
-        function: zod.string().describe(`A JavaScript function declaration to be executed by the tool in the currently selected page.
+        function: zod
+            .string()
+            .optional()
+            .describe(`A JavaScript function declaration to be executed by the tool in the currently selected page.
 Example without arguments: \`() => {
   return document.title
 }\` or \`async () => {
@@ -25,6 +32,10 @@ Example with arguments: \`(el) => {
   return el.innerText;
 }\`
 `),
+        filePath: zod
+            .string()
+            .optional()
+            .describe('Absolute path to a local JavaScript file to inject into the page via <script> tag. The file is read server-side so there are no size limits or CSP/mixed-content restrictions. Use this for large scripts (polyfills, bundled tools, etc).'),
         args: zod
             .array(zod.object({
             uid: zod
@@ -32,9 +43,25 @@ Example with arguments: \`(el) => {
                 .describe('The uid of an element on the page from the page content snapshot'),
         }))
             .optional()
-            .describe(`An optional list of arguments to pass to the function.`),
+            .describe(`An optional list of arguments to pass to the function. Only used with \`function\`, not \`filePath\`.`),
     },
     handler: async (request, response, context) => {
+        const { filePath } = request.params;
+        // File injection mode
+        if (filePath) {
+            if (request.params.function) {
+                throw new Error('Provide either `function` or `filePath`, not both.');
+            }
+            const content = await readFile(filePath, 'utf-8');
+            const page = context.getSelectedPage();
+            await page.addScriptTag({ content });
+            response.appendResponseLine(`Injected script from \`${filePath}\` (${content.length} bytes) into page.`);
+            return;
+        }
+        // Function evaluation mode (original behavior)
+        if (!request.params.function) {
+            throw new Error('Either `function` or `filePath` must be provided.');
+        }
         const args = [];
         try {
             const frames = new Set();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mcp-b/chrome-devtools-mcp",
-  "version": "1.7.2",
+  "version": "1.8.1",
   "description": "MCP server for Chrome DevTools with WebMCP integration for connecting to website MCP tools",
   "keywords": [
     "mcp",