Playwright MCP 0.0.84: Redacted URL Parameters, Isolated Contexts and a README That Says It Is Not a Security Boundary

Microsoft's Playwright MCP v0.0.84 was published on GitHub on October 31, 2026. It adds the ability to open tabs in named isolated contexts inside one browser, an option that replaces chosen URL parameter values with a "redacted" placeholder (written in angle brackets in the README) in tool responses, and a cap on how many matches browser_find returns. The README at the same tag also says, in bold, that Playwright MCP is not a security boundary. If you give a browser to an agent, read both.

I read the v0.0.84 release notes and the README at that tag through the GitHub API. I did not install the package or run a browser. The behavior below is what those documents say.

What the release adds

The release highlights list six items:

• Separate sessions in one browser. browser_tabs with action: "new" accepts isolatedContext set to a name of your choosing. Tabs with the same name share a context, different names stay isolated, and omitting it or using "default" uses the default context. Cookie and storage tools act on the current tab's context.
• Redaction of runtime values in URLs. --redact-url-params=access_token,code (config redactUrlParams, env PLAYWRIGHT_MCP_REDACT_URL_PARAMS) replaces those query and fragment values with a "redacted" placeholder (written in angle brackets in the README) in tool responses.
• Bounded find results. browser_find accepts a positive maxResults, returns the first matches, and reports the total count.
• Request history across navigations. browser_network_requests accepts all: true to include retained history, up to 200 requests from earlier navigations.
• Locators in your language. Element tools accept JavaScript, Python, Java and C# locators in target, alongside refs and CSS selectors.
• Cookie deletion by domain and path. browser_cookie_delete accepts optional domain and path filters, and is opt-in through a capability flag.

A new --ignore-roots flag skips the workspace roots request for clients that advertise roots but cannot answer, and uses the server's working directory instead.

The fixes section includes the HTTP server accepting loopback hosts by default for all bind addresses, with other hosts still needing --allowed-hosts, credentials in --proxy-server being passed as proxy authentication, and an idle timer per isolated client under HTTP with --isolated. Several accessibility snapshot fixes also change what browser_snapshot includes, such as dropping inert content and content outside the topmost modal dialog.

Why the redaction option exists

The release says session and grant values minted at runtime cannot be listed in a secrets file ahead of time. The README's configuration comments describe two mechanisms. secrets replaces matching plain text in tool responses so the model does not accidentally see sensitive data. redactUrlParams does the same for named URL parameters. Both comments say the same thing: it is "a convenience and not a security feature", and you should examine information going to and from the tool on the client.

My reading: this controls what the model sees in tool output, a useful reduction in accidental exposure, and nothing else. The README does not say it stops a page, a script or a deliberate request from reaching those values.

What the README says it does not protect

• Security section: "Playwright MCP is not a security boundary." It points to MCP security best practices for deployment guidance.
• --allowed-origins and --blocked-origins are described as not a security boundary and as not affecting redirects.
• allowUnrestrictedFileAccess is a guardrail against the model wandering outside its workspace, "not a secure boundary", and the README says to rely on client-level permissions for true security.
• browser_run_code_unsafe is described as executing arbitrary JavaScript in the Playwright server process and being "RCE-equivalent".
• The persistent profile can only be used by one browser instance at a time. For several clients in parallel, the README says to use --isolated or a distinct --user-data-dir. --isolated keeps the profile in memory and does not save it to disk.

A docs mismatch I found

The release notes say browser_cookie_delete and browser_route are opt-in through --caps=storage and --caps=network, and the README's tool sections list Storage and Network under those flags. The README's --caps option row, though, lists only vision, pdf, devtools as possible values. Both are in the same file at the tag. I did not run the server to see which values it accepts, so I cannot say which is current. If you rely on those capabilities, test the flag before depending on it.

What I would check

These are my untested suggestions, not documented behavior.

• If one agent drives several accounts, use isolatedContext names per account and check from a cookie list that contexts really do not share state.
• Decide which URL parameters in your flows carry tokens, and list them in --redact-url-params. Treat it only as output hygiene.
• Keep browser_run_code_unsafe out of agent tool lists you do not control. The README's own description is the reason.
• Put real restrictions outside the MCP server: a separate OS user, container or network policy, per the README's advice to rely on client-level permissions.
• Pin the version, for example with npx @playwright/mcp@0.0.84, since configs on @latest pick up changes at the next client restart.

What I would not conclude

• I would not conclude redaction keeps a secret from the agent. It changes tool output text.
• I would not conclude isolated contexts defend against a hostile page. The docs describe them for separate sessions and accounts.
• I would not conclude anything about the 0.0.83 to 0.0.84 diff beyond the release notes.
• I would not conclude how other browser agents handle any of this.

Frequently asked questions

What is new in Playwright MCP 0.0.84?

Named isolated browser contexts, URL parameter redaction, a maxResults cap for browser_find, network request history across navigations, language-specific locators, cookie deletion by domain and path, and --ignore-roots.

How do I redact URL parameters?

Pass --redact-url-params=access_token,code, or set redactUrlParams in config or PLAYWRIGHT_MCP_REDACT_URL_PARAMS. Values for those query and fragment parameters are replaced with that redacted placeholder in tool responses.

Is redaction a security feature?

No. The README calls both secrets and redactUrlParams a convenience and not a security feature.

Is Playwright MCP a security boundary?

The README says it is not.

How do I run several accounts in one browser?

Per the release notes, open tabs with browser_tabs and isolatedContext set to a name. Same name shares a context, different names are isolated.

Do the origin allow and block lists restrict the browser?

The README says they do not serve as a security boundary and do not affect redirects.

Did you run it?

No. I read the release notes and the README at the tag. I did not install or run the server.

Sources

All read on November 3, 2026.

• playwright-mcp v0.0.84 release notes
• playwright-mcp README at v0.0.84

Not read: the Playwright pull requests the release links, the MCP security best practices page, and the package source.