Audit candidate: ChromeDevTools/chrome-devtools-mcp

[xiaolai]

source: 'alan@repo-scout (claudepot-office relay)'
repo: 'ChromeDevTools/chrome-devtools-mcp'
discovered_at: '2026-05-24T13:11:59.714552+00:00'
stars_24h: 41
stars_7d_avg: 18.86
forks_24h: 2
releases_24h: 0
unique_actors: 175
last_event_at: '2026-05-24T10:22:12+00:00'
artifact_count: 8
stars_total: 41476
description: 'Chrome DevTools for coding agents'

Repo: https://github.com/ChromeDevTools/chrome-devtools-mcp

Velocity-signal candidate from BigQuery githubarchive.day (WatchEvent / ForkEvent / ReleaseEvent in the last 24h, vs 7-day baseline). Filtered through the Claude-Code keyword regex, GH artifact probe (8 artifacts), and NLPM-registry dedupe.

Relay script: claudepot-office/scripts/nlpm_relay.py.
Design note: claudepot-office/dev-docs/2026-05-19-nlpm-relay-design.md.

[github-actions]

Audit Complete: ChromeDevTools/chrome-devtools-mcp

NL Score: 94/100 | Security: CLEAR | Artifacts: 7 | Strategy: single

NLPM Audit: ChromeDevTools/chrome-devtools-mcp

Date: 2026-04-06 | Artifacts: 7 | Strategy: single
NL Score: 94/100
Security: CLEAR
Bugs: 0 | Quality Issues: 3 | Security Findings: 3

NL Score Summary

File	Type	Score	Top Issue
.claude-plugin/plugin.json	plugin-manifest	92	Uses @latest unpinned version in MCP server args
skills/a11y-debugging/SKILL.md	skill	93	"standard" used vaguely in troubleshooting section
skills/memory-leak-debugging/SKILL.md	skill	93	Minor: "extremely large" is imprecise
skills/troubleshooting/SKILL.md	skill	93	Clean; minor imprecision in step descriptions
skills/chrome-devtools/SKILL.md	skill	94	No material issues
skills/chrome-devtools-cli/SKILL.md	skill	95	No material issues
skills/debug-optimize-lcp/SKILL.md	skill	96	Exemplary specificity; concrete metrics throughout

Security Scan

Severity	Count
Critical	0
High	0
Medium	1
Low	2

Execution Surface Inventory

Surface	Files
Hooks	0
Scripts (JS)	scripts/eslint_rules/enforce-zod-schema-rule.js, scripts/eslint_rules/no-direct-third-party-imports-rule.js, scripts/eslint_rules/local-plugin.js, scripts/eslint_rules/check-license-rule.js
MCP configs	.claude-plugin/plugin.json (mcpServers declaration)
Package manifests	package.json

Security Findings

#	Severity	File	Line	Pattern	Description
1	Medium	package.json	27	SEC-postinstall-script	prepare script runs node --experimental-strip-types scripts/prepare.ts automatically on npm install and npm publish, executing arbitrary TypeScript before the build is inspected
2	Low	.claude-plugin/plugin.json	9	SEC-unpinned-semver	MCP server configured to run chrome-devtools-mcp@latest via npx; version floats on every MCP client restart, creating supply-chain risk
3	Low	package.json	49–83	SEC-unpinned-semver	Most devDependencies use ^ semver ranges (e.g., "@eslint/js": "^9.35.0"), allowing automatic minor/patch updates on each npm install

Bugs (PR-worthy)

#	File	Issue	Impact
—	—	No bugs found	All required frontmatter present; all internal references verified on disk

Security Fixes (PR-worthy, Medium/Low only)

#	File	Issue	Suggested Fix
1	package.json	prepare script runs implicitly on install	Rename to prepack or add inline comment; document what it does in README so contributors understand the side-effect
2	.claude-plugin/plugin.json	chrome-devtools-mcp@latest is unpinned	Pin to a specific release, e.g., chrome-devtools-mcp@1.0.1, and update alongside package.json version bumps

---

Full report: https://github.com/xiaolai/nlpm-for-claude/blob/main/auditor/audits/ChromeDevTools-chrome-devtools-mcp.md

2 bug(s) found. To submit fix PRs to the target repo, add the contribute-approved label to this issue.

[github-actions]

Exemplar published

Score 94/100 — added as a teaching artifact at auditor/exemplars/ChromeDevTools-chrome-devtools-mcp.md.

Rules from skills/nlpm/rules/ can now cite this repo as a positive real-world example.

View exemplar

[xiaolai]

Contribute run: ChromeDevTools/chrome-devtools-mcp

Outcome: No PRs opened — all findings dropped after independent verification.

Bugs (PR-worthy)

Audit found 0 bugs. Nothing to fix.

Security Fixes verified

Finding	Verdict	Reason
SEC-postinstall-script (package.json line 27)	Dropped	prepare script patches incompatible node_modules entries after install — intentional design. Renaming to prepack would break the dev workflow.
SEC-unpinned-semver (.claude-plugin/plugin.json line 9)	Dropped	All three plugin manifests (.claude-plugin/, .cursor-plugin/, .github/plugin/) consistently use chrome-devtools-mcp@latest. Deliberate choice by maintainers so users always run the latest release without needing to update plugin configs.

No PRs to report.

[xiaolai]

PRs opened for ChromeDevTools/chrome-devtools-mcp

1 PR opened (1 security finding verified; 1 dropped):

• fix: pin npx version in plugin.json to avoid supply-chain drift
  • Fixes SEC-unpinned-semver: .claude-plugin/plugin.json was running npx chrome-devtools-mcp@latest, floating on every restart. Pinned to 1.0.1 (current release).

Dropped finding: SEC-postinstall-script (prepare script in package.json) — the script patches conflicting TypeScript declarations in node_modules after install. Renaming to prepack would break the development workflow (contributors who npm install would get TS errors). Adding documentation is a quality/convention issue, not a bug. Dropped per operating principles.

[xiaolai]

ChromeDevTools/chrome-devtools-mcp — contribute run 2026-05-25

Bugs: None found in audit — no bug PRs to open.

Security Fixes evaluated: 2

#	Finding	Disposition
1	.claude-plugin/plugin.json: chrome-devtools-mcp@latest unpinned (SEC-unpinned-semver)	Already covered by PR #2118 (opened in prior run) — no new PR created
2	package.json: prepare script runs on npm install (SEC-postinstall-script)	Dropped — renaming prepare → prepack would break developer workflow: the script patches node_modules post-install, which is required before tsc succeeds. A documentation-only alternative doesn't demonstrate a concrete, fixable mechanical bug.

No new PRs opened this run.

Existing PR: ChromeDevTools/chrome-devtools-mcp#2118

[xiaolai]

ChromeDevTools/chrome-devtools-mcp — contribute run 2026-05-25 (re-run)

Bugs: None found in audit — no bug PRs to open.

Security Fixes evaluated: 2

#	Finding	Disposition
1	.claude-plugin/plugin.json: chrome-devtools-mcp@latest unpinned (SEC-unpinned-semver)	Already covered by PR #2118 (opened in prior run) — no new PR created
2	package.json: prepare script runs on npm install (SEC-postinstall-script)	Dropped — the script patches conflicting TypeScript type declarations in node_modules post-install; this is required for tsc to succeed. Renaming prepare → prepack would break the developer workflow. Documentation-only alternative is not a mechanical bug fix.

No new PRs opened this run.

Existing open PR: ChromeDevTools/chrome-devtools-mcp#2118

[xiaolai]

ChromeDevTools/chrome-devtools-mcp — contribute run (2026-05-25)

Audit: 0 bugs, 2 medium/low security findings.

Outcome: No new PRs opened this run.

Finding disposition

Finding	Status
SEC-unpinned-semver — .claude-plugin/plugin.json	Already covered by open PR #2118 (pinning chrome-devtools-mcp@latest → 1.0.1)
SEC-postinstall-script — package.json prepare script	Dropped — scripts/prepare.ts is an intentional post-install patch that fixes TypeScript type conflicts from dependencies (removes conflicting HTMLElementEventMap declarations from @paulirish/trace_engine). Renaming to prepack would break the dev workflow since contributors need it to run after npm install. Deliberate authorial choice; no PR opened.

[xiaolai]

Contribution run complete — no new PRs opened.

Existing PR (from prior run): ChromeDevTools/chrome-devtools-mcp#2118 — pins chrome-devtools-mcp@latest to 1.0.1 in .claude-plugin/plugin.json (SEC-unpinned-semver, Low).

Remaining finding dropped (SEC-postinstall-script, Medium — prepare script in package.json):

The prepare script runs node --experimental-strip-types scripts/prepare.ts on npm install. Inspection of scripts/prepare.ts shows it performs necessary post-install node_modules patching: removes conflicting files from chrome-devtools-frontend and patches a TypeScript declaration conflict in @paulirish/trace_engine that would otherwise break the build. The script is intentional; renaming to prepack would break contributor workflow. Finding dropped per operating principle: the authors know their domain; only mechanical breakage ships.

No bugs were found in the original audit. Nothing further to action.

[xiaolai]

ChromeDevTools/chrome-devtools-mcp — contribute run 2026-05-26

Audit: 0 bugs found; 2 security findings (Medium/Low).

Findings disposition:

• SEC-unpinned-semver (Low) — .claude-plugin/plugin.json line 9: chrome-devtools-mcp@latest → already addressed by PR #2118 (opened in prior run, still open).

• SEC-postinstall-script (Medium) — package.json line 27: prepare script. Dropped: scripts/prepare.ts performs intentional post-install node_modules patching (removes conflicting chrome-devtools-frontend files, patches TypeScript declaration conflict). Renaming to prepack would break contributor npm ci workflow. Not mechanical breakage — deliberate authorial choice.

No new PRs opened this run. Existing PR: ChromeDevTools/chrome-devtools-mcp#2118