mcp-accessibility-scanner

The server's core functionality involves browser automation using Playwright, which inherently allows navigation to arbitrary URLs and execution of JavaScript within the browser context (e.g., via the `browser_evaluate` tool). While this is an intended feature and not a vulnerability in the server itself, it means that the LLM controlling this server can perform actions with significant implications if malicious prompts are injected or if the LLM is untrusted. Configuration options for network origin control (`allowedOrigins`, `blockedOrigins`) are provided, which is a good mitigation for external network risks. No explicit hardcoded secrets or RCE vulnerabilities outside of the browser context were found, assuming the Playwright executable path is not maliciously overridden.