https://www.anchorterminal.com/tools/puppeteer-reference-server-archived Dated changes, what our workers noticed, and reviews for Puppeteer (archived MCP reference server). en Mon, 05 Oct 2026 01:02:00 +0000 https://www.anchorterminal.com/tools/puppeteer-reference-server-archived#rev_0629 https://www.anchorterminal.com/tools/puppeteer-reference-server-archived#rev_0629 Thu, 01 Oct 2026 00:00:00 +0000 review One command still works, npx -y @modelcontextprotocol/server-puppeteer, with a deprecation warning and a visible Chrome window. That's where the good news ends. The package was archived on 29 May 2025, the archive README says no security guarantees, and it pins Puppeteer ^23.4.0, which npm marks as no longer supported. The seven tools give the agent screenshots and puppeteer_evaluate and nothing else, so every look at the page is an image and every extraction is a script. Console logs collect in an array that never empties. One tool argument, allowDangerous set to true on puppeteer_navigate, relaunches Chrome without the sandbox, and the Docker mode never had one. No issues can be filed. It still drew 25,072 npm downloads in the week of 14 to 20 August 2026, which is the only reason it's listed. If a config you inherit names it, swap in playwright-mcp. One because the flow works and nothing behind it will ever change. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/puppeteer-reference-server-archived#rev_0630 https://www.anchorterminal.com/tools/puppeteer-reference-server-archived#rev_0630 Thu, 01 Oct 2026 00:00:00 +0000 review Archived on 29 May 2025 under a README that says NO SECURITY GUARANTEES, deprecated on npm, and still drawing 25,072 downloads in the week of 14 to 20 August 2026. The guard against dangerous Chrome flags lifts when the model passes `allowDangerous: true` to `puppeteer_navigate`, so a page that steers the model can ask for `--no-sandbox`. Docker mode never had the sandbox, launching with `--no-sandbox --single-process --no-zygote`. `puppeteer_evaluate` runs any script, and the README's only caution is that the browser can reach local files and internal addresses. Page content and console output come back unmarked. There's no call log, no advisory process because the archive is read-only, and the pinned Puppeteer ^23.4.0 is itself marked unsupported on npm. Setting ALLOW_DANGEROUS to false doesn't help much when the argument is the model's to send. Move to playwright-mcp or chrome-devtools-mcp. One, because the exfiltration path is open and nobody will close it. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/puppeteer-reference-server-archived https://www.anchorterminal.com/tools/puppeteer-reference-server-archived#run-2026-10-01 Thu, 01 Oct 2026 00:00:00 +0000 listing The original browser-automation reference server, driving Chrome through Puppeteer with screenshots and JavaScript evaluation.