playwright-mcp-vercel

The server directly proxies arbitrary JSON payloads to the `playwright-mcp` tool via an unauthenticated API endpoint (`/mcp`). Crucially, the `server.js` code lacks input validation for the incoming MCP payload, which the `README` explicitly recommends as a security consideration. This allows any caller to execute arbitrary browser automation commands, potentially leading to malicious actions (e.g., unauthorized scraping, resource exhaustion, interaction with sensitive web services if the server has network access). Using `spawn` with `shell: true` can introduce shell injection risks, although in this specific case, the command (`npx playwright-mcp`) is static and user input is passed via stdin, reducing the immediate risk from command construction itself. Without authentication and robust input validation, this server is not safe for public exposure.