@mcp-b/chrome-devtools-mcp 2.0.2 → 2.0.5

package/build/src/tools/script.js

@@ -3,19 +3,26 @@
  * Copyright 2025 Google LLC
  * SPDX-License-Identifier: Apache-2.0
  */
+import { readFile } from 'node:fs/promises';
 import { zod } from '../third_party/index.js';
 import { ToolCategory } from './categories.js';
 import { defineTool } from './ToolDefinition.js';
 export const evaluateScript = defineTool({
     name: 'evaluate_script',
-    description: `Evaluate a JavaScript function inside the currently selected page. Returns the response as JSON
-so returned values have to JSON-serializable.`,
+    description: `Evaluate a JavaScript function or inject a script file into the currently selected page.
+
+When \`function\` is provided, evaluates it and returns the result as JSON (values must be JSON-serializable).
+When \`filePath\` is provided, reads the file from disk and injects it as a <script> tag (useful for large scripts like polyfills that are too big to pass inline).
+Exactly one of \`function\` or \`filePath\` must be provided.`,
     annotations: {
         category: ToolCategory.DEBUGGING,
         readOnlyHint: false,
     },
     schema: {
-        function: zod.string().describe(`A JavaScript function declaration to be executed by the tool in the currently selected page.
+        function: zod
+            .string()
+            .optional()
+            .describe(`A JavaScript function declaration to be executed by the tool in the currently selected page.
 Example without arguments: \`() => {
   return document.title
 }\` or \`async () => {
@@ -25,6 +32,10 @@ Example with arguments: \`(el) => {
   return el.innerText;
 }\`
 `),
+        filePath: zod
+            .string()
+            .optional()
+            .describe('Absolute path to a local JavaScript file to inject into the page via <script> tag. The file is read server-side so there are no size limits or CSP/mixed-content restrictions. Use this for large scripts (polyfills, bundled tools, etc).'),
         args: zod
             .array(zod.object({
             uid: zod
@@ -32,9 +43,25 @@ Example with arguments: \`(el) => {
                 .describe('The uid of an element on the page from the page content snapshot'),
         }))
             .optional()
-            .describe(`An optional list of arguments to pass to the function.`),
+            .describe(`An optional list of arguments to pass to the function. Only used with \`function\`, not \`filePath\`.`),
     },
     handler: async (request, response, context) => {
+        const { filePath } = request.params;
+        // File injection mode
+        if (filePath) {
+            if (request.params.function) {
+                throw new Error('Provide either `function` or `filePath`, not both.');
+            }
+            const content = await readFile(filePath, 'utf-8');
+            const page = context.getSelectedPage();
+            await page.addScriptTag({ content });
+            response.appendResponseLine(`Injected script from \`${filePath}\` (${content.length} bytes) into page.`);
+            return;
+        }
+        // Function evaluation mode (original behavior)
+        if (!request.params.function) {
+            throw new Error('Either `function` or `filePath` must be provided.');
+        }
         const args = [];
         try {
             const frames = new Set();

package/build/src/tools/tools.js

@@ -3,8 +3,10 @@
  * Copyright 2025 Google LLC
  * SPDX-License-Identifier: Apache-2.0
  */
+import * as browserTools from './browser.js';
 import * as consoleTools from './console.js';
 import * as emulationTools from './emulation.js';
+import * as extensionTools from './extension.js';
 import * as inputTools from './input.js';
 import * as networkTools from './network.js';
 import * as pagesTools from './pages.js';
@@ -14,8 +16,10 @@ import * as scriptTools from './script.js';
 import * as snapshotTools from './snapshot.js';
 import * as webmcpTools from './webmcp.js';
 const tools = [
+    ...Object.values(browserTools),
     ...Object.values(consoleTools),
     ...Object.values(emulationTools),
+    ...Object.values(extensionTools),
     ...Object.values(inputTools),
     ...Object.values(networkTools),
     ...Object.values(pagesTools),

package/build/src/transports/CDPClientTransport.js

@@ -0,0 +1,184 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/**
+ * MCP Client Transport that connects to an extension's MCP server via CDP.
+ *
+ * Discovers the extension's service worker, attaches to it, and establishes
+ * a bidirectional message channel using Runtime.evaluate (client → server)
+ * and Runtime.addBinding (server → client).
+ *
+ * CDP attaches ONLY to the service worker. Pages remain clean with no
+ * navigator.webdriver flag, bypassing bot detection entirely.
+ */
+export class CDPClientTransport {
+    #browser;
+    #extensionId;
+    #connectTimeout;
+    #session = null;
+    #started = false;
+    #closed = false;
+    #bindingHandler = null;
+    #disconnectHandler = null;
+    onclose;
+    onerror;
+    onmessage;
+    constructor(options) {
+        this.#browser = options.browser;
+        this.#extensionId = options.extensionId;
+        this.#connectTimeout = options.connectTimeout ?? 10_000;
+    }
+    async start() {
+        if (this.#started) {
+            throw new Error('CDPClientTransport already started. If using Client class, note that connect() calls start() automatically.');
+        }
+        if (this.#closed) {
+            throw new Error('CDPClientTransport has been closed');
+        }
+        this.#started = true;
+        try {
+            // Handle browser disconnect
+            this.#disconnectHandler = () => {
+                if (this.#closed)
+                    return;
+                this.#browser = null;
+                this.onclose?.();
+            };
+            this.#browser.on('disconnected', this.#disconnectHandler);
+            // Find extension service worker target with retry
+            const swTarget = await this.#findExtensionServiceWorker();
+            if (!swTarget) {
+                throw new Error(this.#extensionId
+                    ? `Extension ${this.#extensionId} service worker not found`
+                    : 'No extension service worker found. Is an MCP-enabled extension installed?');
+            }
+            // Create a CDP session directly on the service worker target
+            this.#session = await swTarget.createCDPSession();
+            // Enable Runtime domain
+            await this.#session.send('Runtime.enable');
+            // Add binding for receiving messages from the extension
+            await this.#session.send('Runtime.addBinding', {
+                name: '__mcpCDPToClient',
+            });
+            // Set up handler for binding calls
+            this.#bindingHandler = (event) => {
+                if (event.name !== '__mcpCDPToClient')
+                    return;
+                if (this.#closed)
+                    return;
+                try {
+                    const message = JSON.parse(event.payload);
+                    this.onmessage?.(message);
+                }
+                catch (err) {
+                    this.onerror?.(new Error(`Failed to parse message from extension: ${err}`));
+                }
+            };
+            this.#session.on('Runtime.bindingCalled', this.#bindingHandler);
+            // Verify the extension has the CDP transport ready
+            const { result } = await this.#session.send('Runtime.evaluate', {
+                expression: 'globalThis.__mcpCDPTransport?.isReady === true',
+                returnByValue: true,
+            });
+            if (!result.value) {
+                throw new Error('Extension CDP transport not ready. Ensure the extension has CDP bridge support enabled.');
+            }
+            // Connect our binding to the extension's transport
+            await this.#session.send('Runtime.evaluate', {
+                expression: `
+          globalThis.__mcpCDPTransport._sendBinding = (jsonStr) => {
+            __mcpCDPToClient(jsonStr);
+          };
+        `,
+            });
+        }
+        catch (err) {
+            this.#started = false;
+            await this.#cleanup();
+            throw err;
+        }
+    }
+    async send(message) {
+        if (!this.#started) {
+            throw new Error('CDPClientTransport not started');
+        }
+        if (this.#closed) {
+            throw new Error('CDPClientTransport has been closed');
+        }
+        if (!this.#session) {
+            throw new Error('CDP session not available');
+        }
+        const jsonStr = JSON.stringify(message);
+        try {
+            await this.#session.send('Runtime.evaluate', {
+                expression: `globalThis.__mcpCDPTransport.receiveMessage(${JSON.stringify(jsonStr)})`,
+            });
+        }
+        catch (err) {
+            const error = new Error(`Failed to send message to extension: ${err}`);
+            this.onerror?.(error);
+            throw error;
+        }
+    }
+    async close() {
+        if (this.#closed)
+            return;
+        this.#closed = true;
+        this.#started = false;
+        await this.#cleanup();
+        if (this.#browser && this.#disconnectHandler) {
+            this.#browser.off('disconnected', this.#disconnectHandler);
+            this.#disconnectHandler = null;
+        }
+        this.onclose?.();
+    }
+    /**
+     * Find the extension's service worker target with retry.
+     */
+    async #findExtensionServiceWorker() {
+        const deadline = Date.now() + this.#connectTimeout;
+        const retryInterval = 1_000;
+        while (Date.now() < deadline) {
+            const targets = this.#browser.targets();
+            const sw = targets.find(t => {
+                if (t.type() !== 'service_worker')
+                    return false;
+                if (!t.url().startsWith('chrome-extension://'))
+                    return false;
+                if (this.#extensionId && !t.url().includes(this.#extensionId))
+                    return false;
+                return true;
+            });
+            if (sw)
+                return sw;
+            const remaining = deadline - Date.now();
+            if (remaining > retryInterval) {
+                await new Promise(resolve => setTimeout(resolve, retryInterval));
+            }
+            else {
+                break;
+            }
+        }
+        return null;
+    }
+    /**
+     * Clean up CDP resources.
+     */
+    async #cleanup() {
+        if (this.#session && this.#bindingHandler) {
+            this.#session.off('Runtime.bindingCalled', this.#bindingHandler);
+            this.#bindingHandler = null;
+        }
+        if (this.#session) {
+            try {
+                await this.#session.detach();
+            }
+            catch {
+                // Ignore detach errors
+            }
+            this.#session = null;
+        }
+    }
+}

package/build/src/transports/WebMCPBridgeScript.js

@@ -100,6 +100,15 @@ export const WEB_MCP_BRIDGE_SCRIPT = `
     return false;
   }
 
+  function getTargetOrigin() {
+    var origin = window.location && typeof window.location.origin === 'string'
+      ? window.location.origin
+      : '';
+    // about:blank, file://, and sandboxed contexts expose "null" origin.
+    // Use "*" so postMessage remains functional in those contexts.
+    return origin && origin !== 'null' ? origin : '*';
+  }
+
   // Initial check
   checkWebMCPAvailable();
 
@@ -125,7 +134,7 @@ export const WEB_MCP_BRIDGE_SCRIPT = `
           type: 'mcp',
           direction: 'client-to-server',
           payload: payload
-        }, window.location.origin);
+        }, getTargetOrigin());
 
         return true;
       } catch (err) {
@@ -169,7 +178,7 @@ export const WEB_MCP_BRIDGE_SCRIPT = `
         type: 'mcp',
         direction: 'client-to-server',
         payload: 'mcp-check-ready'
-      }, window.location.origin);
+      }, getTargetOrigin());
     },
 
     /**

package/build/src/utils/ExtensionRegistry.js

@@ -0,0 +1,35 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import fs from 'node:fs/promises';
+import path from 'node:path';
+export class ExtensionRegistry {
+    #extensions = new Map();
+    async registerExtension(id, extensionPath) {
+        const manifestPath = path.join(extensionPath, 'manifest.json');
+        const manifestContent = await fs.readFile(manifestPath, 'utf-8');
+        const manifest = JSON.parse(manifestContent);
+        const name = manifest.name ?? 'Unknown';
+        const version = manifest.version ?? 'Unknown';
+        const extension = {
+            id,
+            name,
+            version,
+            isEnabled: true,
+            path: extensionPath,
+        };
+        this.#extensions.set(extension.id, extension);
+        return extension;
+    }
+    remove(id) {
+        this.#extensions.delete(id);
+    }
+    list() {
+        return Array.from(this.#extensions.values());
+    }
+    getById(id) {
+        return this.#extensions.get(id);
+    }
+}

package/build/src/utils/string.js

@@ -0,0 +1,36 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/**
+ * Converts a given string to snake_case.
+ * This function handles camelCase, PascalCase, and acronyms, including transitions between letters and numbers.
+ * It uses Unicode-aware regular expressions (`\p{L}`, `\p{N}`, `\p{Lu}`, `\p{Ll}` with the `u` flag)
+ * to correctly process letters and numbers from various languages.
+ *
+ * @param text The input string to convert to snake_case.
+ * @returns The snake_case version of the input string.
+ */
+export function toSnakeCase(text) {
+    if (!text) {
+        return '';
+    }
+    // First, handle case-based transformations to insert underscores correctly.
+    // 1. Add underscore between a letter and a number.
+    //    e.g., "version2" -> "version_2"
+    // 2. Add underscore between an uppercase letter sequence and a following uppercase+lowercase sequence.
+    //    e.g., "APIFlags" -> "API_Flags"
+    // 3. Add underscore between a lowercase/number and an uppercase letter.
+    //    e.g., "lastName" -> "last_Name", "version_2Update" -> "version_2_Update"
+    // 4. Replace sequences of non-alphanumeric with a single underscore
+    // 5. Remove any leading or trailing underscores.
+    const result = text
+        .replace(/(\p{L})(\p{N})/gu, '$1_$2') // 1
+        .replace(/(\p{Lu}+)(\p{Lu}\p{Ll})/gu, '$1_$2') // 2
+        .replace(/(\p{Ll}|\p{N})(\p{Lu})/gu, '$1_$2') // 3
+        .toLowerCase()
+        .replace(/[^\p{L}\p{N}]+/gu, '_') // 4
+        .replace(/^_|_$/g, ''); // 5
+    return result;
+}

package/build/vendor/chrome-devtools-frontend/front_end/core/common/Base64.js

@@ -29,13 +29,31 @@ export function decode(input) {
     }
     return bytes;
 }
+/**
+ * Note: if input can be very large (larger than the max string size), callers should
+ * expect this to throw an error.
+ */
 export function encode(input) {
     return new Promise((resolve, reject) => {
         const reader = new FileReader();
-        reader.onerror = () => reject(new Error('failed to convert to base64'));
+        reader.onerror = () => reject(new Error('failed to convert to base64: internal error'));
         reader.onload = () => {
+            // The input was too large to encode as a string. The caller should anticipate
+            // this and use a workaround. See TimelinePanel.ts innerSaveToFile for an example.
+            // For more information, see crbug.com/436482118.
+            if (reader.result === '') {
+                reject(new Error('failed to convert to base64: input too large to encode as base64 string'));
+                return;
+            }
+            // This string can be very large, so take care to not double memory. `split`
+            // was used here before, which always results in new strings in V8. By using
+            // slice instead, we leverage the sliced string optimization in V8 and avoid
+            // doubling the memory requirement (even if temporarily: that is a potential
+            // source of OOM crashes given large enough input, such as is common with
+            // Performance traces).
             const blobAsUrl = reader.result;
-            const [, base64] = blobAsUrl.split(',', 2);
+            const index = blobAsUrl.indexOf(',');
+            const base64 = blobAsUrl.slice(index + 1);
             resolve(base64);
         };
         reader.readAsDataURL(new Blob([input]));

package/build/vendor/chrome-devtools-frontend/front_end/core/common/Debouncer.js

@@ -8,7 +8,14 @@ export const debounce = function (func, delay) {
     let timer;
     const debounced = (...args) => {
         clearTimeout(timer);
-        timer = setTimeout(() => func(...args), delay);
+        timer = setTimeout(() => func(...args), testDebounceOverride ? 0 : delay);
     };
     return debounced;
 };
+let testDebounceOverride = false;
+export function enableTestOverride() {
+    testDebounceOverride = true;
+}
+export function disableTestOverride() {
+    testDebounceOverride = false;
+}

package/build/vendor/chrome-devtools-frontend/front_end/core/common/Gzip.js

@@ -64,3 +64,14 @@ export function compressStream(stream) {
     const cs = new CompressionStream('gzip');
     return stream.pipeThrough(cs);
 }
+export function createMonitoredStream(stream, onProgress) {
+    let bytesRead = 0;
+    const progressTransformer = new TransformStream({
+        transform(chunk, controller) {
+            bytesRead += chunk.byteLength;
+            onProgress(bytesRead);
+            controller.enqueue(chunk);
+        }
+    });
+    return stream.pipeThrough(progressTransformer);
+}

package/build/vendor/chrome-devtools-frontend/front_end/core/common/Object.js

@@ -57,7 +57,12 @@ export class ObjectWrapper {
         // new listeners.
         for (const listener of [...listeners]) {
             if (!listener.disposed) {
-                listener.listener.call(listener.thisObject, event);
+                try {
+                    listener.listener.call(listener.thisObject, event);
+                }
+                catch (err) {
+                    console.error(`Event listener for ${String(eventType)} throw an error:`, err);
+                }
             }
         }
     }

package/build/vendor/chrome-devtools-frontend/front_end/core/common/ParsedURL.js

@@ -263,6 +263,9 @@ export class ParsedURL {
         return '';
     }
     static extractName(url) {
+        if (url.endsWith('/')) {
+            url = url.slice(0, -1);
+        }
         let index = url.lastIndexOf('/');
         const pathAndQuery = index !== -1 ? url.substr(index + 1) : url;
         index = pathAndQuery.indexOf('?');

package/build/vendor/chrome-devtools-frontend/front_end/core/common/ResourceType.js

@@ -229,6 +229,12 @@ export class ResourceType {
         const regex = new RegExp('^application(.*json$|\/json\+.*)');
         return regex.test(contentType) ? 'application/json' : contentType;
     }
+    /**
+     * Checks whether the given MIME type represents JavaScript content.
+     */
+    static isJavaScriptMimeType(mimeType) {
+        return mimeType === 'application/javascript' || mimeType === 'text/javascript';
+    }
     /**
      * Adds suffixes iff the mimeType is 'text/javascript' to denote whether the JS is minified or from
      * a source map.

package/build/vendor/chrome-devtools-frontend/front_end/core/common/Revealer.js

@@ -31,10 +31,6 @@ const UIStrings = {
      * @description The UI destination when right clicking an item that can be revealed
      */
     applicationPanel: 'Application panel',
-    /**
-     * @description The UI destination when right clicking an item that can be revealed
-     */
-    securityPanel: 'Security panel',
     /**
      * @description The UI destination when right clicking an item that can be revealed
      */
@@ -158,7 +154,6 @@ export const RevealerDestination = {
     TIMELINE_PANEL: i18nLazyString(UIStrings.timelinePanel),
     APPLICATION_PANEL: i18nLazyString(UIStrings.applicationPanel),
     SOURCES_PANEL: i18nLazyString(UIStrings.sourcesPanel),
-    SECURITY_PANEL: i18nLazyString(UIStrings.securityPanel),
     MEMORY_INSPECTOR_PANEL: i18nLazyString(UIStrings.memoryInspectorPanel),
     ANIMATIONS_PANEL: i18nLazyString(UIStrings.animationsPanel),
 };

package/build/vendor/chrome-devtools-frontend/front_end/core/common/Settings.js

@@ -162,18 +162,28 @@ export class Settings {
         return this.#registry;
     }
 }
-export const NOOP_STORAGE = {
-    register: () => { },
-    set: () => { },
-    get: () => Promise.resolve(''),
-    remove: () => { },
-    clear: () => { },
-};
+export class InMemoryStorage {
+    #store = new Map();
+    register(_setting) {
+    }
+    set(key, value) {
+        this.#store.set(key, value);
+    }
+    get(key) {
+        return this.#store.get(key);
+    }
+    remove(key) {
+        this.#store.delete(key);
+    }
+    clear() {
+        this.#store.clear();
+    }
+}
 export class SettingsStorage {
     object;
     backingStore;
     storagePrefix;
-    constructor(object, backingStore = NOOP_STORAGE, storagePrefix = '') {
+    constructor(object, backingStore = new InMemoryStorage(), storagePrefix = '') {
         this.object = object;
         this.backingStore = backingStore;
         this.storagePrefix = storagePrefix;

package/build/vendor/chrome-devtools-frontend/front_end/core/host/AidaClient.js

@@ -194,6 +194,12 @@ export class AidaClient {
         if (!InspectorFrontendHostInstance.doAidaConversation) {
             throw new Error('doAidaConversation is not available');
         }
+        // Disable logging for now.
+        // For context, see b/454563259#comment35.
+        // We should be able to remove this ~end of April.
+        if (Root.Runtime.hostConfig.devToolsGeminiRebranding?.enabled) {
+            request.metadata.disable_user_content_logging = true;
+        }
         const stream = (() => {
             let { promise, resolve, reject } = Promise.withResolvers();
             options?.signal?.addEventListener('abort', () => {
@@ -316,6 +322,12 @@ export class AidaClient {
         };
     }
     registerClientEvent(clientEvent) {
+        // Disable logging for now.
+        // For context, see b/454563259#comment35.
+        // We should be able to remove this ~end of April.
+        if (Root.Runtime.hostConfig.devToolsGeminiRebranding?.enabled) {
+            clientEvent.disable_user_content_logging = true;
+        }
         const { promise, resolve } = Promise.withResolvers();
         InspectorFrontendHostInstance.registerAidaClientEvent(JSON.stringify({
             client: CLIENT_NAME,
@@ -328,6 +340,12 @@ export class AidaClient {
         if (!InspectorFrontendHostInstance.aidaCodeComplete) {
             throw new Error('aidaCodeComplete is not available');
         }
+        // Disable logging for now.
+        // For context, see b/454563259#comment35.
+        // We should be able to remove this ~end of April.
+        if (Root.Runtime.hostConfig.devToolsGeminiRebranding?.enabled) {
+            request.metadata.disable_user_content_logging = true;
+        }
         const { promise, resolve } = Promise.withResolvers();
         InspectorFrontendHostInstance.aidaCodeComplete(JSON.stringify(request), resolve);
         const completeCodeResult = await promise;
@@ -369,6 +387,12 @@ export class AidaClient {
         return { generatedSamples, metadata };
     }
     async generateCode(request, options) {
+        // Disable logging for now.
+        // For context, see b/454563259#comment35.
+        // We should be able to remove this ~end of April.
+        if (Root.Runtime.hostConfig.devToolsGeminiRebranding?.enabled) {
+            request.metadata.disable_user_content_logging = true;
+        }
         const response = await DispatchHttpRequestClient.makeHttpRequest({
             service: SERVICE_NAME,
             path: '/v1/aida:generateCode',

package/build/vendor/chrome-devtools-frontend/front_end/core/host/InspectorFrontendHostStub.js

@@ -87,6 +87,9 @@ export class InspectorFrontendHostStub {
     setInjectedScriptForOrigin(_origin, _script) {
     }
     inspectedURLChanged(url) {
+        if (!('document' in globalThis)) {
+            return;
+        }
         document.title = i18nString(UIStrings.devtoolsS, { PH1: url.replace(/^https?:\/\//, '') });
     }
     copyText(text) {
@@ -175,6 +178,12 @@ export class InspectorFrontendHostStub {
         }
         this.recordedPerformanceHistograms.push({ histogramName, duration });
     }
+    recordPerformanceHistogramMedium(histogramName, duration) {
+        if (this.recordedPerformanceHistograms.length >= MAX_RECORDED_HISTOGRAMS_SIZE) {
+            this.recordedPerformanceHistograms.shift();
+        }
+        this.recordedPerformanceHistograms.push({ histogramName, duration });
+    }
     recordUserMetricsAction(_umaName) {
     }
     recordNewBadgeUsage(_featureName) {
@@ -297,9 +306,6 @@ export class InspectorFrontendHostStub {
             devToolsFlexibleLayout: {
                 verticalDrawerEnabled: true,
             },
-            devToolsStartingStyleDebugging: {
-                enabled: false,
-            },
         };
         if ('hostConfigForTesting' in globalThis) {
             const { hostConfigForTesting } = globalThis;
@@ -427,4 +433,6 @@ export class InspectorFrontendHostStub {
     }
     recordFunctionCall(_event) {
     }
+    setChromeFlag(_flagName, _value) {
+    }
 }

package/build/vendor/chrome-devtools-frontend/front_end/core/host/ResourceLoader.js

@@ -169,7 +169,7 @@ async function fetchToString(url) {
 }
 function canBeRemoteFilePath(url) {
     try {
-        const urlObject = new URL(url);
+        const urlObject = new URL(new URL(url).toString()); // Normalize first.
         return urlObject.protocol === 'file:' && urlObject.host !== '';
     }
     catch {