v0.2.2 — a signed bundle and a release that verifies itself

What's in it

0.2.2 is about how a release is produced and checked, not about new tools: the bundle can now be signed, and every published release is re-derived from its tag by CI instead of being taken on trust.

A signed bundle

playwright-e2e-mcp-0.2.2.signed.mcpb is the reproducible bundle plus a PKCS#7 signature block. The unsigned bundle is still published and is still the artifact to reproduce — mcpb unsign on the signed file returns its exact bytes, which is asserted on every signing run and re-checked by this release's own verification.

• Signer: CN=playwright-e2e-mcp, O=trajectiq-ai, C=US
• SHA-256 fingerprint: 53:83:ED:DD:9A:48:5E:D3:39:24:6D:37:12:BD:56:CC:FD:40:47:D8:14:03:CE:8D:BD:EB:C2:3E:4C:7A:B9:22
• The certificate is published as playwright-e2e-mcp-signing-cert.pem. The private key is not in the repository and never leaves the machine that signs.

What "signed" means here is decided by the certificate. mcpb verify and mcpb info only accept a signature when the certificate chains into the OS trust store, so with this self-signed certificate a host still reports Not signed until you install it. That is integrity and key continuity, not third-party identity; a CA-issued certificate is what changes a host's answer.

The signature is nevertheless real and verifiable without trusting anything — checked against this exact artifact:

# pull the PKCS#7 block out of the signed bundle
node -e "const fs=require('fs');const s=fs.readFileSync('playwright-e2e-mcp-0.2.2.signed.mcpb');const h=Buffer.from('MCPB_SIG_V1'),f=Buffer.from('MCPB_SIG_END');const fi=s.lastIndexOf(f),hi=s.lastIndexOf(h,fi),n=s.readUInt32LE(hi+h.length);fs.writeFileSync('sig.der',s.subarray(hi+h.length+4,hi+h.length+4+n));fs.writeFileSync('content.mcpb',s.subarray(0,hi));"

openssl smime -verify -inform DER -in sig.der -content content.mcpb \
  -CAfile playwright-e2e-mcp-signing-cert.pem -purpose any -out /dev/null
# Verification successful            (exit 0)
# a byte changed in content.mcpb    → digest failure      (exit 4)
# any other certificate as -CAfile  → signature failure   (exit 1)

And content.mcpb above is byte-identical to playwright-e2e-mcp-0.2.2.mcpb.

Releases verify themselves

.github/workflows/verify-release.yml now runs on every published release. It checks that the tag matches package.json, that the published bundle is byte-identical to a fresh npm run mcpb, that .mcpb.sha256 and SHA256SUMS.txt agree with every asset (and cover all of them), that the signed bundle strips back to the reproducible bytes, that the published archive still extracts with this version's manifest — and then drives the published file with the official MCP SDK client. Run it on demand for any past tag from Actions → Verify release → Run workflow.

Assets

asset	what it is
playwright-e2e-mcp-0.2.2.mcpb	the bundle — byte-reproducible across platforms
playwright-e2e-mcp-0.2.2.signed.mcpb	the same bundle plus a PKCS#7 signature
playwright-e2e-mcp-0.2.2.tgz	the exact artifact published to npm, with provenance
playwright-e2e-mcp-signing-cert.pem	the public certificate the signature chains to
SHA256SUMS.txt	hashes of everything above
*.mcpb.sha256	each bundle, plus the lockfile hash it was built from

sha256sum -c SHA256SUMS.txt

Reproducing the bundle

git clone https://github.com/trajectiq-ai/E2E && cd E2E
git checkout v0.2.2
npm ci && npm run mcpb
sha256sum playwright-e2e-mcp-0.2.2.mcpb
# 547c3dff0bd62a67bd8cd4b9f13446e7a15eb62015c7e598bbe9fc349c7cfa9c

Or in one command, from a checkout of the tag: npm run release:verify -- v0.2.2.

Changed

• Version → 0.2.2 in package.json, package-lock.json and server.json; README pins and the documented download URL move to v0.2.2.
• README demo image regenerated so the endpoint card shows the released version.
• npm run mcpb:sign and npm run release:verify are the two new entry points; the private key is read only from a path you pass in (--cert/--key or MCPB_CERT/MCPB_KEY) and error messages never echo it.

v0.2.1 — reproducible .mcpb builds

What's in it

0.2.1 is a release about the release: the .mcpb is now byte-reproducible, so the bundle published here can be rebuilt from this tag and come out identical — and CI fails if it doesn't.

The v0.2.0 tag predates these fixes, so its bundle cannot be rebuilt reproducibly. Reproducibility starts with this tag.

Reproducible .mcpb

• Bundles are written by a deterministic in-Node zip writer (scripts/zip-writer.mjs) instead of bsdtar/zip: entries in sorted order, one fixed timestamp, no extra fields and no host-derived attributes.
• Text payloads are normalised to LF as they are archived, so a CRLF checkout and an LF checkout produce the same bytes.
• A CI job builds the bundle on Linux and Windows and fails the build if the two hashes differ.

Checks that keep the release honest

• mcpb:smoke installs the bundle the way a host does and drives it with the official @modelcontextprotocol/client SDK: the official mcpb CLI validates the manifest, initialize reports this version, tools/list and prompts/list are complete, and list-tests is really called against a fixture project.
• The .mcpb.sha256 sidecar now hashes LF-normalised lockfile content, so the package-lock.json hash it records matches the file committed in this repository rather than a Windows working-tree copy.

Reproducing this bundle

git clone https://github.com/trajectiq-ai/E2E && cd E2E/playwright-e2e-mcp
git checkout v0.2.1
npm ci && npm run mcpb
sha256sum playwright-e2e-mcp-0.2.1.mcpb
# 1e02c31e81e93614fbe839757e13d3d287a22571d7ea0a49075e28024b55985b

Verifying this download

# from the folder you downloaded into:
sha256sum -c SHA256SUMS.txt

The .mcpb.sha256 sidecar also records the hash of the package-lock.json the bundle was built from, which ties the bundle back to this repository. Check it inside a checkout of this tag, with the downloaded bundle alongside it:

git checkout v0.2.1
sha256sum -c playwright-e2e-mcp-0.2.1.mcpb.sha256
# playwright-e2e-mcp-0.2.1.mcpb: OK
# package-lock.json: OK

The recorded lockfile hash is taken over LF-normalised content — the file as committed. On a Windows checkout with core.autocrlf=true your working copy is CRLF, so that one line will not match it; compare against git show v0.2.1:package-lock.json instead. (v0.2.0 recorded a Windows working-tree hash that nobody else could reproduce, which is what this release corrects.)

asset	what it is
playwright-e2e-mcp-0.2.1.mcpb	Claude Desktop / MCP bundle — byte-reproducible
playwright-e2e-mcp-0.2.1.mcpb.sha256	bundle hash, plus the hash of the lockfile it was built from
playwright-e2e-mcp-0.2.1.tgz	npm tarball
SHA256SUMS.txt	hashes of both artifacts above

Changed

• Version moves to 0.2.1 in package.json, package-lock.json and server.json; README pins and the documented download URL move to v0.2.1.
• README demo images regenerated so the endpoint card shows the released version.

A note on the hashes

• The .mcpb is byte-identical regardless of platform, Node version or line endings. It is the artifact to reproduce: the recipe above rebuilds it exactly.

• The .tgz here is the exact artifact published to npm by the Publish to npm workflow on this tag, with provenance, so it can be checked against the registry too:

  sha512-THfK1YANDQpbI6bNjG81A/iwCWuQhrrPqCaNwcrH3rD8mr1ZDEHwc2caht+SKAQ0hl4nQ/UfFd62qOalqbAMKQ==
  

  npm preserves the packer's line endings for README.md, package.json and dist/tools/probe-script.js, so a tarball you pack yourself can differ byte-for-byte from this one — a Windows pack differs in exactly those three files.

v0.2.0 — diagnose and fix failing tests with verified locators

What's in it

0.2.0 turns this server from run and diagnose into diagnose and fix: a failing locator now
comes back with a replacement that was proven unique on the page, and the fix is applied and
re-verified before it is reported.

Added

• suggest-fix — matches a broken locator against the DOM at failure, swaps in a Playwright
  locator proven unique on the page, and with apply: true writes it, re-runs the test and reverts
  the edit if it is still red. When nothing on the page plausibly matches it refuses and reports the
  element as missing, instead of patching a test to hide a real bug.
• probe-script — run a small script against a live page and get structured results back.
• get-run-status — background runs report progress and the final result, and can be cancelled.
• analyze-history — ranks flaky, regressed and broken tests from the local run history, groups
  failures that share one cause, and shows a single test's timeline.
• Two prompts — fix-failing-test and triage-flaky-tests, for clients that surface prompts.
• Verified locators — inspect-page and validate-selector only report locators that were
  checked on the page to resolve to exactly that element.
• Agent Skill — the server also ships as a skill under skill/playwright-e2e-mcp.
• Benchmarks — bench/ measures the token cost of the diagnose-and-fix loop against
  Playwright MCP plus a shell.

Changed

• The version moves to 0.2.0 in package.json, package-lock.json and server.json; the tag,
  package and server versions are cross-checked before anything is published.
• README pins and the documented download URL move to v0.2.0.
• One bug CI caught before this shipped: table cells escaped | without escaping backslashes
  first, so text holding a \ before a pipe could split a Markdown row (CodeQL
  js/incomplete-sanitization, high severity). Backslashes are now escaped first, in both
  analyze-history and diagnose-flaky.

Verified

• CI green on the release PR and on main: test matrix (3 OS × Node 20/24), e2e on Ubuntu and
  Windows, the .mcpb build + launch simulation, npm pack dry run and npm audit.
• npm: playwright-e2e-mcp@0.2.0 published with provenance.
• MCP Registry: io.github.trajectiq-ai/E2E@0.2.0 — active, isLatest.
• Vercel production deployment of the merge commit succeeded.

Assets

• playwright-e2e-mcp-0.2.0.mcpb — one-click desktop extension: double-click to install.
• playwright-e2e-mcp-0.2.0.tgz — the exact tarball npm published (byte-identical).
• SHA256SUMS.txt — checksums for both.

v0.1.4 — the registry publish stops racing npm

What's in it

A version-only release. Its purpose is a workflow, not a feature: the fix that stopped the
MCP Registry publish from racing the npm publish landed after tag v0.1.3, so no release
had ever exercised it. This one did — on the tag path, first try.

Why this release exists

A tag push starts the npm publish and the registry publish side by side. The registry refuses
an npm package whose version it cannot yet see, and npm needs a moment to serve a fresh
version, so on v0.1.3 the registry job asked npm within seconds of the tag, got a 404, and
failed the release.

The workflow now waits for npm before it publishes, and it decides whether a version is
already out by asking …/v0/servers/<name>/versions/<version> rather than the search index,
which had once reported a version as present while that endpoint still answered 404. The
receipt step reads that same authoritative endpoint through curl -f, so a run that did not
actually publish now fails instead of printing whatever search returned.

The v0.1.4 run needed five of its fifteen npm waits (~100 s) before npm served the version,
then published for real:

npm does not serve playwright-e2e-mcp@0.1.4 yet (attempt 5/15) — waiting 20s.
npm serves playwright-e2e-mcp@0.1.4.
✓ Successfully published
✓ Server io.github.trajectiq-ai/E2E version 0.1.4
{"name":"io.github.trajectiq-ai/E2E","version":"0.1.4","status":"active","isLatest":true}

Changed

• The version moves to 0.1.4 in package.json, package-lock.json and server.json; the
  tag, package and server versions are cross-checked before anything is published.
• The README's install pins and the release download URL leave v0.1.3, so the documented
  commands keep resolving.
• The endpoint demo card is regenerated because it renders the version its handshake reports.
  The pixel diff is one 15×18 region — the single glyph holding the version.

Install

• npx -y playwright-e2e-mcp
• npx -y github:trajectiq-ai/E2E#v0.1.4
• Claude Desktop: download playwright-e2e-mcp-0.1.4.mcpb below and double-click it.

The .tgz attached here is the exact tarball npm published — its sha1 and sha512 match the
registry's dist.shasum and dist.integrity, and its provenance names this repository, this
tag and the workflow that built it. Verify every download against SHA256SUMS.txt.

v0.1.3 — endpoint docs match the deployment, dependency patch

What's in it

A maintenance release: one dependency patch, and documentation that had drifted away from
what the deployment actually does.

Fixed

• The hosted endpoint docs now match the deployment. https://playwright-e2e-mcp.vercel.app/api/mcp
  requires PW_MCP_HTTP_TOKEN, so an anonymous request is answered 401. The README and the
  landing page previously promised that a token-less call "serves only the read-only tools"
  and shipped a copy-paste handshake with no Authorization header, and the ChatGPT
  instructions said to create the connector with authentication None — three ways into
  the same auth wall. Both documents now say which mode this deployment is in, show the
  bearer header, and describe the keyless read-only mode as what a self-hosted bridge does
  when the variable is unset. No token is published.

Dependencies

• @modelcontextprotocol/server 2.3.0 → 2.3.1, with its @modelcontextprotocol/core
  dependency. npm audit reports zero vulnerabilities.
• typescript 7.x and @types/node 26 stay deferred on purpose: 7.x is the native-port
  compiler line, and @types/node 26 types APIs the engines: >=20 floor and the Node
  20/24 CI matrix cannot run.

Docs and packaging

• npm run mcpb and npm run mcpb:smoke are documented — the smoke check unpacks the
  freshly built bundle into a temp dir, launches it, and asserts a real handshake.
• The .mcpb zip extractor is listed in the test coverage.

Install

• npx -y playwright-e2e-mcp
• npx -y github:trajectiq-ai/E2E#v0.1.3
• Claude Desktop: download playwright-e2e-mcp-0.1.3.mcpb below and double-click it.

The .tgz attached here is the exact tarball npm published — its sha512 matches the
registry's dist.integrity. Verify every download against SHA256SUMS.txt.

v0.1.2 — security hardening, restricted HTTP mode, v0.1.2 release

Security hardening

This release is the result of two security audits and hardens every place the server
touches your machine or the network. The hosted HTTP bridge now requires a token.

HTTP bridge

• Token required: set PW_MCP_HTTP_TOKEN (≥16 chars — shorter values make the
  function refuse to start). Requests without it get 401. With a token, all eight
  tools are served.
• Restricted mode for unauthenticated/localhost callers: list-tests scans
  sources instead of running the project's config, and projectRoot cannot be changed.
• Host allowlist: without a token, only localhost and the deployment's own
  Vercel hostnames are accepted. Set PW_MCP_ALLOWED_HOSTS for a custom domain
  (* for any).
• Child processes get only an allowlisted environment; client disconnects abort the
  run and free its slot; oversize bodies get a 413; internal errors are not leaked.

Tools

• Playwright flags from args now require checked --flag=value values; argument
  smuggling through --only-changed or a --prefixed test path is rejected.
• Generated specs, baselines and diffs never write through a symlink, and only files
  with this tool's own header line can be overwritten.
• SSRF guard also blocks IPv6 forms that embed an IPv4 address; WebRTC UDP disabled.

Supply chain

• Every GitHub Action pinned to a version SHA; CodeQL now scans workflows too.
• npm publish runs from CI with provenance; registry and npm versions are checked
  against the release tag before publishing.

Install

• npx -y playwright-e2e-mcp
• npx -y github:trajectiq-ai/E2E#v0.1.2
• Claude Desktop: download playwright-e2e-mcp-0.1.2.mcpb below and double-click it.

Verify downloads against SHA256SUMS.txt.

v0.1.1

Playwright E2E MCP 0.1.1

• MCP Registry: refreshed 96-char description Run, debug and inspect Playwright E2E tests from any AI agent: diagnostics, live DOM, selectors. (registry versions are immutable, so metadata ships as a new version)
• npm: npx -y playwright-e2e-mcp
• Hosted: https://playwright-e2e-mcp.vercel.app/api/mcp

Assets: .mcpb (double-click install for desktop clients) and .tgz (npm tarball).

v0.1.0 — E2E feedback loop for AI agents

First release: 8 MCP tools (run-test, get-failure with trace/network/console diagnostics, diagnose-flaky, compare-visual-state, generate-e2e-test, inspect-page, list-tests, validate-selector), MCP SDK v2 (2026-07-28 spec) with tool annotations, auto-retry/flaky reporting, --last-failed fast loop.

Verified: 70/70 unit tests on Linux/macOS/Windows × Node 20/24 in CI; 37/37 end-to-end checks against real Playwright 1.63.

Install without npm: npx -y github:trajectiq-ai/E2E

Desktop Extension (.mcpb)

Double-click playwright-e2e-mcp-0.1.0.mcpb to install into Claude Desktop (no Node config needed — the bundle ships its own production dependencies), or build it any time with npm run mcpb.