v0.4.2 — claude.ai sign-in, clearer hosted endpoint, free and open source

Assembled from v0.4.2 by .github/workflows/release.yml: the hashes, the signer and the commit list below come from that run. To change the prose, edit release-notes/v0.4.2.md — not this body.

• claude.ai connectors can sign in. A token-protected HTTP bridge is now
  also a small OAuth 2.1 server (discovery, dynamic client registration,
  authorization code with PKCE, refresh tokens), so claude.ai custom
  connectors connect by typing the access key on a sign-in page. It keeps no
  state; changing PW_MCP_HTTP_TOKEN signs every client out. The plain bearer
  token still works.
• Clearer hosted endpoint. On a serverless deployment, which has no
  browser, browser tools now say so and point to the local install instead of
  suggesting an install that cannot work there, and audit-accessibility no
  longer fails to find axe-core.
• init --client accepts the flag more than once
  (--client gemini --client codex), as well as a comma separated list.
• Free and open source, stated plainly in the README: MIT, no account or
  API key, no telemetry, free dependencies, and a Deploy with Vercel button
  to host your own bridge.

Assets

asset	sha256	what it is
playwright-e2e-mcp-0.4.2.mcpb	2e9abe0ee45dae1323c1974b82223600410ebb9bf655f7060600fb6dbc2ad29a	the bundle — npm ci && npm run mcpb on this tag rebuilds these exact bytes
playwright-e2e-mcp-0.4.2.tgz	5dbc8c7cde36be23de6d4e435b45d4492850f153f763bd9bc469e28fb9960c8f	the npm tarball npm pack writes from this tag
playwright-e2e-mcp-0.4.2-skill.zip	7b9bb232ade6349ead246dcc4ff49e719b772bfad683954270820bd9712727f1	the Agent Skill package, built by npm run skill:zip
playwright-e2e-mcp-0.4.2.mcpb.sha256	2e07452c00cb3dc37328c921bbea5160e0ec98d03e23fc53867d70d058d83008	the bundle’s hash, and the lockfile hash it was built from

SHA256SUMS.txt carries those hashes:

sha256sum -c SHA256SUMS.txt

Reproducing the bundle

git clone https://github.com/xsignon-secure/E2E && cd E2E
git checkout v0.4.2
npm ci && npm run mcpb
sha256sum playwright-e2e-mcp-0.4.2.mcpb
# 2e9abe0ee45dae1323c1974b82223600410ebb9bf655f7060600fb6dbc2ad29a

Or in one command, from a checkout of the tag: npm run release:verify -- v0.4.2.

This release is unsigned: no signing key was configured for it, so there is no .signed.mcpb and no certificate to check it against.

Commits

4 commits from v0.4.1 to v0.4.2

• 6c95e06 Release 0.4.2: claude.ai sign-in, clearer hosted endpoint, free and open source
• c771522 README: state plainly that it is free and open source
• bb7e556 Recheck fixes: hosted endpoint messages, init --client, docs
• 7125ff2 Hosted endpoint: OAuth sign-in for claude.ai connectors

v0.4.1 — new logo and a plain-language README

Assembled from v0.4.1 by .github/workflows/release.yml: the hashes, the signer and the commit list below come from that run. To change the prose, edit release-notes/v0.4.1.md — not this body.

The README now opens with the new logo and a simple explanation of what the
server and skill are and what they do, so the npm page matches the GitHub one.
The outdated M8ven badge, which pointed at the old repository, is removed. No
change to the server, the CLI, the tools or the skill's guidance; install pins
in the docs now point at v0.4.1.

Assets

asset	sha256	what it is
playwright-e2e-mcp-0.4.1.mcpb	6c917a8d7897a60f88bda2f21e19cd3020249626b4179af46e98a77ac766bc62	the bundle — npm ci && npm run mcpb on this tag rebuilds these exact bytes
playwright-e2e-mcp-0.4.1.tgz	542c35880585404841d73041449b83308bf9d6f85d821582f75960afb700bca7	the npm tarball npm pack writes from this tag
playwright-e2e-mcp-0.4.1-skill.zip	a354f669dbb2df110d5e2d5d7cfb3408349324f7916d2f61f6c6d26985819c78	the Agent Skill package, built by npm run skill:zip
playwright-e2e-mcp-0.4.1.mcpb.sha256	121e1685e322f8a1b2f9981e6b45fea4cc09d751e14c5df4e79c623cec3045d0	the bundle’s hash, and the lockfile hash it was built from

SHA256SUMS.txt carries those hashes:

sha256sum -c SHA256SUMS.txt

Reproducing the bundle

git clone https://github.com/xsignon-secure/E2E && cd E2E
git checkout v0.4.1
npm ci && npm run mcpb
sha256sum playwright-e2e-mcp-0.4.1.mcpb
# 6c917a8d7897a60f88bda2f21e19cd3020249626b4179af46e98a77ac766bc62

Or in one command, from a checkout of the tag: npm run release:verify -- v0.4.1.

This release is unsigned: no signing key was configured for it, so there is no .signed.mcpb and no certificate to check it against.

Commits

4 commits from v0.4.0 to v0.4.1

• 519e4b6 Release 0.4.1: new README on npm, drop stale M8ven badge
• 0b0ff27 README: plain-language intro, new logo
• 8a57e24 Add a 400x400 logo for directory listings
• 705ee64 Landing page: twelve tools behind the token, not eleven

v0.4.0 — accessibility audits, test-order diagnosis, root-cause grouping

Assembled from v0.4.0 by .github/workflows/release.yml: the hashes, the signer and the commit list below come from that run. To change the prose, edit release-notes/v0.4.0.md — not this body.

This release adds what a market review of E2E testing MCP servers and agent
skills showed was still missing: accessibility checks that work behind a login,
a way to catch tests that depend on test order, failures grouped by cause, and
a skill that teaches how to write tests, not only how to call the tools.

New

• audit-accessibility (tool 12). Runs axe-core against WCAG 2.2 A/AA (or
  wcag2a … best-practice, all) on any page. It takes the same
  storageState, headers and actions as inspect-page, so signed-in pages
  and open dialogs can be audited. Violations come back worst first, with WCAG
  criteria, a help link and the offending elements as verified Playwright
  locators, and the result ends with an @axe-core/playwright check to paste
  into the spec. axe-core is bundled and evaluated in the page, so a
  Content-Security-Policy does not block it. It is part of the inspect profile.
• diagnose-flaky order: true (Playwright 1.64+). Runs the target spec
  files in random orders with one worker (--shuffle, --fully-parallel),
  replays a failing order, and reads each test as order dependent, flaky
  regardless of order, or failing in every order. For an order-dependent test
  it names the test it relies on or is broken by, and prints the
  --shuffle=<seed> command that reproduces it. PW_MCP_SHUFFLE_SEEDS replays
  given orders.
• Root-cause grouping in run-test. Failures with the same kind and first
  error line are shown once, with the other tests listed under them, and the
  result opens with the number of distinct causes. get-failure indexes are
  unchanged. The ci command and the GitHub Action report inherit it.
• Skill: references/writing-tests.md. Locators, web-first waiting,
  signing in with a setup project, data isolation, network and clock mocking,
  structure, config, a flake-pattern table and a review checklist. SKILL.md now
  covers accessibility audits and test-order diagnosis.

Changed

• Twelve tools; all definitions cost about 5.5k tokens of context, the core
  profile about 2.2k.
• New runtime dependency: axe-core (MPL-2.0), about 0.7 MB added to the
  .mcpb bundle.

Assets

asset	sha256	what it is
playwright-e2e-mcp-0.4.0.mcpb	d8ca6d93e7a3c421321dfb4b37cb64a50e16573b7467aadeda5be7a1452a7f74	the bundle — npm ci && npm run mcpb on this tag rebuilds these exact bytes
playwright-e2e-mcp-0.4.0.tgz	5285e22fa15d93253f2fd8b27d9d4eac4211166869227c2936fd957611b37f21	the npm tarball npm pack writes from this tag
playwright-e2e-mcp-0.4.0-skill.zip	0b955f3f54e4424cb752dbfb28287e09377665c33ab47a8d1118e950cd5595e9	the Agent Skill package, built by npm run skill:zip
playwright-e2e-mcp-0.4.0.mcpb.sha256	68af08df6ba8ebcca1ac6f0038f77f5e3f5d6e53936737d71bd58b5b37aad103	the bundle’s hash, and the lockfile hash it was built from

SHA256SUMS.txt carries those hashes:

sha256sum -c SHA256SUMS.txt

Reproducing the bundle

git clone https://github.com/xsignon-secure/E2E && cd E2E
git checkout v0.4.0
npm ci && npm run mcpb
sha256sum playwright-e2e-mcp-0.4.0.mcpb
# d8ca6d93e7a3c421321dfb4b37cb64a50e16573b7467aadeda5be7a1452a7f74

Or in one command, from a checkout of the tag: npm run release:verify -- v0.4.0.

This release is unsigned: no signing key was configured for it, so there is no .signed.mcpb and no certificate to check it against.

Commits

9 commits from v0.3.2 to v0.4.0

• c5cbaf1 Release 0.4.0: accessibility audits, test-order diagnosis, root-cause grouping
• 0c5af18 Bump github/codeql-action init and analyze to 4.39.0 together (#14)
• 7ab6b49 Fix code-scanning and Dependabot alerts
• 980b563 Bump actions/checkout from 6.1.0 to 7.0.1 (#12)
• 2e729d6 Bump actions/setup-node from 6.5.0 to 7.1.0 (#10)
• 6360eac Bump actions/upload-artifact from 4.6.2 to 7.0.2 (#6)
• 834c20a Bump zod from 4.6.5 to 4.6.7 (#8)
• eeb3f00 Name node in tsconfig types for TypeScript 7
• dd57cbb Bump the dev-dependencies group across 1 directory with 3 updates

What's Changed

• Bump zod from 4.6.5 to 4.6.7 by @dependabot[bot] in #8
• Bump actions/upload-artifact from 4.6.2 to 7.0.2 by @dependabot[bot] in #6
• Bump actions/setup-node from 6.5.0 to 7.1.0 by @dependabot[bot] in #10
• Bump actions/checkout from 6.1.0 to 7.0.1 by @dependabot[bot] in #12
• Bump github/codeql-action init and analyze to 4.39.0 together by @xsignon-secure in #14
• Fix code-scanning and Dependabot alerts by @xsignon-secure in #15
• Bump the dev-dependencies group across 1 directory with 3 updates by @dependabot[bot] in #7
• Release 0.4.0: accessibility audits, test-order diagnosis, root-cause grouping by @xsignon-secure in #16

New Contributors

• @dependabot[bot] made their first contribution in #8

Full Changelog: v0.3.2...v0.4.0

v0.3.2 — GitHub Marketplace listing for the Action

Assembled from v0.3.2 by .github/workflows/release.yml: the hashes, the signer and the commit list below come from that run. To change the prose, edit release-notes/v0.3.2.md — not this body.

The Action's description in action.yml is now under the Marketplace's
125-character limit, so the Playwright E2E diagnosis Action can be published
to the GitHub Marketplace from this release. No change to the server, the CLI
or the skill; 0.3.1's init command and install routes are unchanged.

Assets

asset	sha256	what it is
playwright-e2e-mcp-0.3.2.mcpb	f8a23d1d0de40e042f1f78a168547599cda82161f55cc5b5a0fbf8488c109edf	the bundle — npm ci && npm run mcpb on this tag rebuilds these exact bytes
playwright-e2e-mcp-0.3.2.tgz	c39b577dba80986a50c5552a257ae9069fc00c756d49374c9b88e068d623cb27	the npm tarball npm pack writes from this tag
playwright-e2e-mcp-0.3.2-skill.zip	c42306fecbff1ff3b78175c07f395d2ef099360bae8ff0c6ceaa2f761e6d83f8	the Agent Skill package, built by npm run skill:zip
playwright-e2e-mcp-0.3.2.mcpb.sha256	9fbb0cd6daea0c5de28777e739eff7e30e94a5b2e4347ba53649905ffc0e1fb1	the bundle’s hash, and the lockfile hash it was built from

SHA256SUMS.txt carries those hashes:

sha256sum -c SHA256SUMS.txt

Reproducing the bundle

git clone https://github.com/xsignon-secure/E2E && cd E2E
git checkout v0.3.2
npm ci && npm run mcpb
sha256sum playwright-e2e-mcp-0.3.2.mcpb
# f8a23d1d0de40e042f1f78a168547599cda82161f55cc5b5a0fbf8488c109edf

Or in one command, from a checkout of the tag: npm run release:verify -- v0.3.2.

This release is unsigned: no signing key was configured for it, so there is no .signed.mcpb and no certificate to check it against.

Commits

2 commits from v0.3.1 to v0.3.2

• eec5625 Shorten the Action description for the GitHub Marketplace (0.3.2) (#13)
• 37df703 Add community health files and Dependabot config (#5)

v0.3.1 — any AI agent can install it

Assembled from v0.3.1 by .github/workflows/release.yml: the hashes, the signer and the commit list below come from that run. To change the prose, edit release-notes/v0.3.1.md — not this body.

One command: init

npx -y playwright-e2e-mcp init

Run from a project root, it finds the clients the project uses (Claude Code,
Cursor, VS Code, Gemini CLI, Codex) and merges a playwright-e2e server entry
into each one's project config, keeping every other server and setting. It also
copies the agent skill into .agents/skills/ and, for Claude Code,
.claude/skills/. Running it again changes nothing; a config that isn't valid
JSON is reported and left untouched. --client all|cursor,vscode…,
--tools=core, --no-skill and --dry-run are available, and windsurf
writes its user-level config. The npm package now ships the skill for this.

Install guide written for agents

llms-install.md walks an agent through prerequisites, install and a check
that the tools answer. Point any coding agent at it:

Install the playwright-e2e-mcp server and skill by following
https://raw.githubusercontent.com/xsignon-secure/E2E/main/llms-install.md

llms.txt indexes the install routes and docs for agents that look for it.

Native installers

• Claude Code plugin (server + skill): /plugin marketplace add xsignon-secure/E2E,
  then /plugin install playwright-e2e-mcp@xsignon-secure.
• Gemini CLI extension: gemini extensions install https://github.com/xsignon-secure/E2E.
• Skill only, any agent: npx skills add xsignon-secure/E2E.

The README also gets one-click install buttons for Cursor, VS Code and Claude
Desktop.

Assets

asset	sha256	what it is
playwright-e2e-mcp-0.3.1.mcpb	c5514710854484d28becf766a631e2a76049b5a0a2b9a06a958fbb8f49d0ffa6	the bundle — npm ci && npm run mcpb on this tag rebuilds these exact bytes
playwright-e2e-mcp-0.3.1.tgz	576bc57a4f10b57b16898839d1f557da0c0578c6eaffe9a8badc42f4e3cf7014	the npm tarball npm pack writes from this tag
playwright-e2e-mcp-0.3.1-skill.zip	c42306fecbff1ff3b78175c07f395d2ef099360bae8ff0c6ceaa2f761e6d83f8	the Agent Skill package, built by npm run skill:zip
playwright-e2e-mcp-0.3.1.mcpb.sha256	4903f3709633bf8990477de089f1dcca882fad2a1a8f3fd8889789e92da62379	the bundle’s hash, and the lockfile hash it was built from

SHA256SUMS.txt carries those hashes:

sha256sum -c SHA256SUMS.txt

Reproducing the bundle

git clone https://github.com/xsignon-secure/E2E && cd E2E
git checkout v0.3.1
npm ci && npm run mcpb
sha256sum playwright-e2e-mcp-0.3.1.mcpb
# c5514710854484d28becf766a631e2a76049b5a0a2b9a06a958fbb8f49d0ffa6

Or in one command, from a checkout of the tag: npm run release:verify -- v0.3.1.

This release is unsigned: no signing key was configured for it, so there is no .signed.mcpb and no certificate to check it against.

Commits

2 commits from v0.3.0 to v0.3.1

• deed3b0 Let any AI agent install the server and skill (0.3.1) (#4)
• 849cebb README: one-click install buttons for Cursor, VS Code and Claude Desktop (#3)

v0.3.0 — per-test flaky verdicts, a CI command and lighter tool lists

Assembled from v0.3.0 by .github/workflows/release.yml: the hashes, the signer and the commit list below come from that run. To change the prose, edit release-notes/v0.3.0.md — not this body.

Flaky diagnosis that names the cause

diagnose-flaky now repeats the tests in one Playwright process
(--repeat-each) instead of one process per run, so the browser and workers
start once. On the integration fixture five repetitions of two tests took about
6 s instead of 7.5 s; suites with expensive setup save more. A small extra
reporter records every attempt, because Playwright's JSON report keeps only one
result per test.

The verdict is now per test: passes, failures, duration spread and first
error for each test, instead of one verdict for the whole run.

isolate: true adds a second pass. The tests are repeated fully parallel, then
the failing ones are repeated with one worker, and each is read as:

• fails only in parallel: shared state between tests (same account, DB rows,
  files, ports). The fix is data isolation, not retries.
• flaky even alone: a race inside the test or the app.
• fails alone too: a real bug.

separateProcesses: true keeps the old one-process-per-run behaviour for flakes
that depend on global setup or a cold start. Each repetition is still recorded
as its own run in the history, so analyze-history reads it as before.

CI without an agent

npx -y playwright-e2e-mcp ci runs the suite and writes one Markdown report
(run summary, suggest-fix diffs, flaky verdicts) to stdout, --output and the
GitHub job summary. Exit code 0 passed, 1 tests failed, 2 the run failed.

The repository is now also a GitHub Action, uses: xsignon-secure/E2E@v0.3.0,
which keeps one PR comment up to date when the run fails.

Smaller tool lists

--tools= (or PW_MCP_TOOLS) picks which tools the server exposes, by name or
profile: core, triage, inspect, author. All eleven tool definitions cost
about 5.2k tokens of context on every request; core (run, status, failure,
fix, flaky, list) costs about 2.4k.

Docker

A Dockerfile based on the Playwright 1.63 image runs the stdio server or the
ci command against a project mounted at /work. CI builds it and completes an
MCP handshake inside it.

New home: xsignon-secure/E2E

The project now lives at https://github.com/xsignon-secure/E2E. Releases publish
to the MCP Registry as io.github.xsignon-secure/E2E. The registry only
grants a namespace to the GitHub owner that publishes it. The old
io.github.trajectiq-ai/E2E entry stays at 0.2.2. The npm package name,
playwright-e2e-mcp, does not change.

Upgrading

Nothing to change. diagnose-flaky's response layout changed (a per-test table
replaces the per-run table, unless separateProcesses is set); anything parsing
that Markdown should read the new table. The agent skill is updated to 0.3.0.

Assets

asset	sha256	what it is
playwright-e2e-mcp-0.3.0.mcpb	0a38512557062a264e8d4d0b6b42be9123f99d184d0c36225f31d4faf6e47685	the bundle — npm ci && npm run mcpb on this tag rebuilds these exact bytes
playwright-e2e-mcp-0.3.0.tgz	b730afbc0a8c513c06d300d96f619c53665b7ef0da169d465614251ffb96cc7e	the npm tarball npm pack writes from this tag
playwright-e2e-mcp-0.3.0-skill.zip	c42306fecbff1ff3b78175c07f395d2ef099360bae8ff0c6ceaa2f761e6d83f8	the Agent Skill package, built by npm run skill:zip
playwright-e2e-mcp-0.3.0.mcpb.sha256	721c4f77800188763cd981d5f96c80d356b84d23f026b288643bccef9a09eda3	the bundle’s hash, and the lockfile hash it was built from

SHA256SUMS.txt carries those hashes:

sha256sum -c SHA256SUMS.txt

Reproducing the bundle

git clone https://github.com/xsignon-secure/E2E && cd E2E
git checkout v0.3.0
npm ci && npm run mcpb
sha256sum playwright-e2e-mcp-0.3.0.mcpb
# 0a38512557062a264e8d4d0b6b42be9123f99d184d0c36225f31d4faf6e47685

Or in one command, from a checkout of the tag: npm run release:verify -- v0.3.0.

This release is unsigned: no signing key was configured for it, so there is no .signed.mcpb and no certificate to check it against.

Commits

61 commits up to v0.3.0

• 0ce8063 Leave the hosted endpoint out of the xsignon-secure registry entry
• 8841a7d Move repository, registry namespace and metadata to xsignon-secure/E2E
• 7ca6bbc Release 0.3.0: per-test flaky verdicts, ci command and Action, tool profiles
• c2b6f5e Assemble a release from its tag instead of by hand (#16)
• e0aa909 Fail clearly when a tag predates the skill packaging tooling (#15)
• 4bd5ad1 Publish the skill package as a release asset (#14)
• 2d19545 Generate the marketplace package folder from skill/ (#13)
• 9def12d Build the agent skill package from skill/ and fail on drift (#12)
• ca02067 Sync the agent skill with the tools 0.2.2 ships (#11)
• a62ae58 Report evidence, not a failure sentence, when a check passes
• 6e78851 Release 0.2.2
• edad2bf Stop echoing the key path in signing errors
• 4139982 Sign the bundle and verify published releases in CI
• 5134095 Release 0.2.1
• 7e3fd6b Fail CI when the bundle hashes differently per platform
• 0182bec Make the .mcpb reproducible and check it with a real MCP client
• c22ebc9 Escape backslashes before pipes in Markdown table cells
• 511c36b Release 0.2.0
• 0524401 Diagnose and fix failing tests with verified locators
• d0c3b79 Package the MCP server as an Agent Skill
• 1414adb Update README.md
• b7bac82 Update README.md
• eac7d60 Release 0.1.4
• 66e6bda Stop the registry publish from skipping a version that never shipped
• e8d47e5 Release 0.1.3
• 7658953 Document the hosted endpoint's real auth mode and take the last patch bump
• 6cd1cf7 Gate the .mcpb bundle on a real launch and close the last audit gaps
• 73a7254 Refresh the demo screenshot and stop pointing installers at a dead deploy token
• 88a7c3c Fix re-audit findings: flag values, restricted HTTP mode, symlink writes
• 5e3223b Look env names up case-insensitively so the scrub test passes on Windows
• f8d4252 Ignore the .mcpb checksum sidecar the bundle step now writes
• aa8e7dd Close the remaining medium and low audit findings
• 32d7d3a Add an SSRF guard to the URL tools
• df3ca36 Harden the sandbox, generated specs and HTTP bridge
• 612d081 Shorten the registry description to fit the schema's 100-char limit
• 8b0cc7b Release 0.1.1 so the improved server.json description reaches the MCP Registry
• 1715866 Add a Demo section with screenshots built from real captured MCP output
• 8953d9f Advertise the npm install route now that playwright-e2e-mcp is published
• e0bc839 Add npm registry metadata to package.json ahead of publishing
• 32ce0f0 Retire the Actions Vercel deploy job now that Vercel's Git integration deploys on push
• 7e77083 Bound the MCP Registry publish job with a timeout like the rest of the workflows
• f02cf0e Bound every CI and deploy job with a timeout so a stuck runner can't hang forever
• 76aed16 Make the server easier to find and stop the registry publish from failing
• cec64e4 Deploy the hosted endpoint only after CI passes on main
• 8eb6d82 Document the Codex timeouts that break a cold start of this server
• 90c708b Serve the MCP server over Streamable HTTP for remote-only clients
• 91f3198 Prompt for the project root when installing the .mcpb extension
• e7525e1 Ship a project-scoped .agents/mcp.json so Freebuff checkouts get the server
• 7b3a543 Launch the bundle server via ${__dirname}, not a relative path
• fa69056 Declare manifest_version in the .mcpb manifest
• 179d064 Fix .mcpb entries: manifest.json must sit at the archive root
• 2113dfe Document one-click Claude Desktop install and more client setups
• 058760a Add npm run mcpb to build a self-contained .mcpb distribution bundle
• f6c2d18 Make registry publishing idempotent and resilient to registry 5xx
• a0ee86b Document the MCP Registry listing and fix broken npm-name install docs
• 8c09043 Publish to the official MCP Registry from CI via GitHub OIDC
• bef9eed Add live MCP integration suite (npm run e2e) and fix testDir-relative failure paths
• 494857e Add CI and release badges to README
• bc296dc Support installation straight from GitHub
• 50eb1bd Initial commit
• 6b6a309 Initial commit: Playwright E2E feedback-loop MCP server