playwright-e2e-mcp 0.1.2 → 0.1.3

package/README.md

@@ -42,7 +42,7 @@ and every other MCP client — pick whichever route fits:
 | --- | --- |
 | **npm (canonical, fastest)** | `npx -y playwright-e2e-mcp` |
 | **MCP Registry** (registry-aware clients discover it automatically) | `io.github.trajectiq-ai/E2E` — [listing](https://registry.modelcontextprotocol.io/) |
-| **Any client, no npm account needed** | `npx -y github:trajectiq-ai/E2E#v0.1.2` (pin a release tag) |
+| **Any client, no npm account needed** | `npx -y github:trajectiq-ai/E2E#v0.1.3` (pin a release tag) |
 | **Claude Desktop, zero Node setup** | double-click the [`.mcpb` extension](https://github.com/trajectiq-ai/E2E/releases) |
 | **Remote-only clients (ChatGPT connectors)** | `https://playwright-e2e-mcp.vercel.app/api/mcp` |
 
@@ -242,8 +242,8 @@ builds `dist/` automatically on install). Pin a release tag: an unpinned
 `github:trajectiq-ai/E2E` runs whatever is on the default branch at that moment.
 
 ```bash
-npx -y github:trajectiq-ai/E2E#v0.1.2
-npm install -D github:trajectiq-ai/E2E#v0.1.2 @playwright/test   # or as a project dependency
+npx -y github:trajectiq-ai/E2E#v0.1.3
+npm install -D github:trajectiq-ai/E2E#v0.1.3 @playwright/test   # or as a project dependency
 npx playwright install chromium
 ```
 
@@ -251,7 +251,7 @@ Or grab the packaged tarball from the repo's **GitHub Releases** page and instal
 it locally:
 
 ```bash
-npm install -D https://github.com/trajectiq-ai/E2E/releases/download/v0.1.2/playwright-e2e-mcp-0.1.2.tgz
+npm install -D https://github.com/trajectiq-ai/E2E/releases/download/v0.1.3/playwright-e2e-mcp-0.1.3.tgz
 ```
 
 Listed in the **official [MCP Registry](https://registry.modelcontextprotocol.io/)** as
@@ -267,7 +267,7 @@ Listed in the **official [MCP Registry](https://registry.modelcontextprotocol.io
   "mcpServers": {
     "playwright-e2e": {
       "command": "npx",
-      "args": ["-y", "github:trajectiq-ai/E2E#v0.1.2"],
+      "args": ["-y", "github:trajectiq-ai/E2E#v0.1.3"],
       "env": { "PW_MCP_PROJECT_ROOT": "/absolute/path/to/your/project" }
     }
   }
@@ -281,8 +281,8 @@ when the client launches it somewhere else (e.g. your home directory).
 **Codex / VS Code / Copilot CLIs:**
 
 ```bash
-codex mcp add playwright-e2e -- npx -y github:trajectiq-ai/E2E#v0.1.2
-code --add-mcp '{"name":"playwright-e2e","command":"npx","args":["-y","github:trajectiq-ai/E2E#v0.1.2"]}'
+codex mcp add playwright-e2e -- npx -y github:trajectiq-ai/E2E#v0.1.3
+code --add-mcp '{"name":"playwright-e2e","command":"npx","args":["-y","github:trajectiq-ai/E2E#v0.1.3"]}'
 ```
 
 Codex's defaults fight this server: the first launch clones the repo and runs
@@ -293,7 +293,7 @@ Codex's defaults fight this server: the first launch clones the repo and runs
 ```toml
 [mcp_servers.playwright-e2e]
 command = "npx"
-args = ["-y", "github:trajectiq-ai/E2E#v0.1.2"]
+args = ["-y", "github:trajectiq-ai/E2E#v0.1.3"]
 startup_timeout_sec = 60
 tool_timeout_sec = 600
 ```
@@ -308,7 +308,7 @@ into `PW_MCP_PROJECT_ROOT`, so the tools point at a real project from the first
 **Claude Code:**
 
 ```bash
-claude mcp add playwright-e2e -- npx -y github:trajectiq-ai/E2E#v0.1.2
+claude mcp add playwright-e2e -- npx -y github:trajectiq-ai/E2E#v0.1.3
 ```
 
 **Gemini CLI / Qwen Code:** paste the `mcpServers` block above into
@@ -349,7 +349,7 @@ Streamable HTTP bridge for exactly that case:
 | --- | --- |
 | **Endpoint** | `https://playwright-e2e-mcp.vercel.app/api/mcp` |
 | **Transport** | MCP Streamable HTTP (`POST` JSON in, JSON or SSE out) |
-| **Auth** | optional bearer token (`PW_MCP_HTTP_TOKEN`); without one only read-only tools are served |
+| **Auth** | bearer token (`PW_MCP_HTTP_TOKEN`). The deployment at this URL requires it; a bridge started without the variable serves only the read-only tools |
 | **Source** | [`api/mcp.ts`](api/mcp.ts) → [`src/http.ts`](src/http.ts) |
 
 The bridge runs the *same* `createServer()` as the stdio transport; the SDK
@@ -357,28 +357,43 @@ serves every request with a fresh server instance, which is what a serverless
 function wants. `test/http-bridge.test.mjs` drives the real Node adapter over
 `node:http` so a broken bridge fails in CI, not in ChatGPT.
 
-**Open vs. token-protected.** When the deployment has no `PW_MCP_HTTP_TOKEN`,
-anyone can reach the URL, so the bridge serves only `list-tests` and
-`get-failure`, in restricted mode: `list-tests` scans sources instead of running
-`playwright test --list` (which would execute the project's config), callers
-cannot pick another `projectRoot`, and nothing spawns a process, drives a browser
-or writes a file. Set `PW_MCP_HTTP_TOKEN` (at least 16 characters; use a random
-value) to serve all eight tools to clients that send `Authorization: Bearer <token>`;
-other requests get `401`. Child processes started over HTTP get only an allowlisted
-environment. `PW_MCP_ALLOWED_HOSTS` (comma separated, `*` for any) limits the
-accepted `Host` header; without a token and without that variable, only
-`localhost` names and the deployment's own Vercel hostnames are accepted
+**This deployment is token-protected.** `https://playwright-e2e-mcp.vercel.app`
+has `PW_MCP_HTTP_TOKEN` set, so a request without `Authorization: Bearer <token>`
+— including a ChatGPT connector created with authentication *None* — gets
+`401 {"error":"unauthorized"}`. Ask the operator for the token, or run your own
+bridge (below).
+
+**Open vs. token-protected.** With `PW_MCP_HTTP_TOKEN` set (at least 16
+characters; use a random value) all eight tools are served to clients that send
+`Authorization: Bearer <token>`, and every other request gets `401`. Without that
+variable anyone who reaches the URL can call the bridge, so it degrades to
+`list-tests` and `get-failure` in restricted mode: `list-tests` scans sources
+instead of running `playwright test --list` (which would execute the project's
+config), callers cannot pick another `projectRoot`, and nothing spawns a process,
+drives a browser or writes a file. Child processes started over HTTP get only an
+allowlisted environment. `PW_MCP_ALLOWED_HOSTS` (comma separated, `*` for any)
+limits the accepted `Host` header; without a token and without that variable,
+only `localhost` names and the deployment's own Vercel hostnames are accepted
 (DNS-rebinding protection).
 
 **Add it to ChatGPT:** Settings → Connectors → turn on **Advanced → Developer
-mode** → *Create custom connector* → paste the endpoint above → authentication
-**None** (read-only tools).
+mode** → *Create custom connector* → paste the endpoint above. Authentication
+**None** only works against a bridge with no token (read-only tools), so for this
+deployment choose the connector's **API key** authentication and send
+`Authorization: Bearer <token>` — or point the connector at your own deployment
+with `PW_MCP_HTTP_TOKEN` unset.
+
+To self-host the open, read-only variant, deploy this repo with
+`PW_MCP_HTTP_TOKEN` unset; nothing else changes.
 
 Codex can also take the remote transport instead of spawning `npx`, if you'd
-rather not ship Playwright to every machine:
+rather not ship Playwright to every machine. Point it at the token through an
+environment variable so the secret stays out of the config file:
 
 ```bash
-codex mcp add playwright-e2e-remote --url https://playwright-e2e-mcp.vercel.app/api/mcp
+export PW_MCP_HTTP_TOKEN=…   # ask the operator for the value
+codex mcp add playwright-e2e-remote --url https://playwright-e2e-mcp.vercel.app/api/mcp \
+  --bearer-token-env-var PW_MCP_HTTP_TOKEN
 ```
 
 **What to expect:** `list-tests` works and reports the specs bundled with the
@@ -389,10 +404,12 @@ hint. Use the stdio install for real runs; the hosted endpoint is for discovery
 and for clients that cannot run local processes.
 
 ```bash
-# verify the handshake without any client
+# verify the handshake without any client (the live deployment needs the token;
+# drop the authorization header and it answers 401 instead)
 curl -X POST https://playwright-e2e-mcp.vercel.app/api/mcp \
   -H 'content-type: application/json' \
   -H 'accept: application/json, text/event-stream' \
+  -H "authorization: Bearer $PW_MCP_HTTP_TOKEN" \
   -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"curl","version":"1.0"}}}'
 ```
 
@@ -411,10 +428,17 @@ every push, so there is no token to manage and no CLI step — watch the
 | `PW_MCP_PASSTHROUGH_ENV` | — | HTTP bridge only: comma-separated extra variables passed to test runs (e.g. `BASE_URL`) |
 | `PW_MCP_MAX_CHILDREN` | `4` | HTTP bridge only: how many test runs and browser probes may run at once |
 | `PW_MCP_BLOCK_PRIVATE_URLS` | off (on for the HTTP bridge) | `1` makes the URL tools refuse loopback, private-network and cloud-metadata addresses, including redirects and subresources |
-| `LOG_LEVEL` | `info` | `debug` \| `info` \| `warn` \| `error` \| `silent` |
-| `LOG_FORMAT` | `text` | `text` or `json` (structured) |
+| `LOG_LEVEL` / `MCP_LOG_LEVEL` | `info` | `debug` \| `info` \| `warn` \| `error` \| `silent`; `LOG_LEVEL` wins when both are set |
+| `LOG_FORMAT` / `MCP_LOG_FORMAT` | `text` | `text`, or `json` (also `ndjson`) for one structured JSON object per line — ready for a log ingester |
+
+Logs always go to **stderr** — stdout is reserved for the MCP protocol. Unrecognized values
+fall back to the default, so a typo in `LOG_LEVEL` logs at `info` and one in `LOG_FORMAT`
+logs as text rather than silencing the server. With `LOG_FORMAT=json` each line is a single
+object (`time`, `level`, `message` plus context):
 
-Logs always go to **stderr** — stdout is reserved for the MCP protocol.
+```json
+{"time":"2026-10-07T08:00:00.000Z","level":"info","message":"server ready","name":"playwright-e2e-mcp"}
+```
 
 ## Typical workflow
 
@@ -509,6 +533,8 @@ npm install
 npm run build   # tsc → dist/ (zero errors)
 npm test        # build + test/run-tests.mjs (unit tests, any Node ≥20)
 npm run e2e     # build + e2e/run.mjs: live MCP ↔ Playwright integration suite
+npm run mcpb    # build + bundle dist/ into playwright-e2e-mcp-<version>.mcpb (+ .sha256)
+npm run mcpb:smoke   # ...then install that bundle in a temp dir, launch it and assert the handshake
 ```
 
 Tests cover the report parser (sample Playwright JSON, trace attachments), path utils
@@ -521,8 +547,8 @@ helpers, the **trace reader** (synthetic trace.zip: error, failed action, DOM sn
 (failure signatures, CONSISTENTLY FAILING / FLAKY / NOT REPRODUCING / NO TESTS RAN),
 the **HTTP bridge** (token, restricted mode, Host allowlist), the **security
 regressions** (sandbox escapes, argument smuggling, symlink writes, code injection,
-SSRF ranges, env scrubbing, decode limits), the `.mcpb` manifest and the MCP config
-files.
+SSRF ranges, env scrubbing, decode limits), the `.mcpb` manifest, the `.mcpb` zip
+extractor, and the MCP config files.
 
 ### Integration suite (`npm run e2e`)
 

package/package.json

@@ -1,7 +1,8 @@
 {
   "name": "playwright-e2e-mcp",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "MCP server that runs, debugs, and inspects Playwright end-to-end tests from any MCP client",
+  "author": "trajectiq-ai <trajectiq@gmail.com>",
   "mcpName": "io.github.trajectiq-ai/E2E",
   "type": "module",
   "license": "MIT",
@@ -49,6 +50,7 @@
     "test": "npm run build && node test/run-tests.mjs",
     "e2e": "npm run build && node e2e/run.mjs",
     "mcpb": "npm run build && node scripts/build-mcpb.mjs",
+    "mcpb:smoke": "npm run mcpb && node scripts/mcpb-launch-sim.mjs",
     "prepublishOnly": "npm test"
   },
   "engines": {
@@ -56,7 +58,7 @@
   },
   "dependencies": {
     "zod": "^4.2.0",
-    "@modelcontextprotocol/server": "^2.3.0"
+    "@modelcontextprotocol/server": "^2.3.1"
   },
   "devDependencies": {
     "@playwright/test": "1.63.0",