Verdict

No malicious behavior observed

We ran it 4 times, with a normal setup, the clock moved a year ahead, a GitHub Actions environment and an AI agent using it. It started as an MCP server, exposed 32 tools and we called them 300 times. It contacted play.googleapis.com and registry.npmjs.org. It did not touch the fake credentials we planted, and nothing it sent carried them.

2 findings. Scanned 25 Oct 2026 by detonator 0.5.1.

Target: chrome-devtools-mcp
Source: npm 1.12.0
SHA-256: 0b8a54b7eb89fffd
Files: 378

RecommendationNo action needed

Nothing observed calls for action. This is evidence, not a guarantee.

What this package does

observed across 4 runs

Package chrome-devtools-mcp version 1.12.0 · 378 files · MCP server
Install No install scripts of its ownOnly the package manager ran.
Runs as node ./build/src/bin/chrome-devtools-mcp.js Exposes 32 tools; we called them 300 times
- click
- close_page
- drag
- emulate
- evaluate_script
- fill
- fill_form
- get_console_message
- get_css_styles
- get_network_request
- handle_dialog
- hover
- lighthouse_audit
- list_console_messages
- +18 more
An AI agent also used it 1 time.
What it reached
Network
- play.googleapis.com 36 connections, 13.8 KB sent
- registry.npmjs.org 2 connections, 782 B sent
Credentials
None of the planted fake keys were touched.

~/.npmrc read by its own tool (normal)
Files written
- ~/.cache/chrome-devtools-mcp/latest.jsonwritten
- ~/.local/share/chrome-devtools-mcp/telemetry_state.jsonwritten

We planted fake AWS, SSH, npm and GitHub keys and a .env file before every run. Red means something left or was planted to run later.

Findings

F01 Low

Network destinations contacted

Confidence: Info The package connected to these hosts.
Observed in: mcp:baseline, mcp:ci-github

Description

Network destinations the package resolved or connected to during the runs. All traffic was captured by the sandbox; nothing reached the internet.

Impact

Context only. Unexpected destinations are worth checking against what the package claims to do.

Evidence

play.googleapis.com

registry.npmjs.org

Remediation

Confirm each host is expected (the package's API, its registry). Allowlist expected egress in production.

F02 Low

A tool read its own credentials (e.g. gh, aws, ssh)

Confidence: Info A tool opened its own login or config file, such as npm reading ~/.npmrc.
Observed in: mcp:baseline

Description

A tool opened its own configuration or login file, such as npm reading ~/.npmrc or gh reading its hosts file.

Impact

None in itself: this is how those tools work. Listed so the report shows every credential access.

Evidence

~/.npmrc (by npm)

Remediation

No action needed.

Process tree

run mcp:baseline

Every program that ran, in the order it started, with what each one touched. Red marks the path to a leak or a planted file.

Show process tree

runbash -c export npm_config_update_notifier=false npm_config_audit=...
- runnpm rebuild --offline --foreground-scripts --no-audit --no-fund
  - runnode /usr/bin/npm rebuild --offline --foreground-scripts --no-audit
    - secretread ~/.npmrc (its own config)
runbash -c node skill/node_modules/chrome-devtools-mcp/./build/src/b...
- runnode skill/node_modules/chrome-devtools-mcp/./build/src/bin/ch...
  - filewrote ~/.cache/chrome-devtools-mcp/latest.json
  - filewrote ~/.local/share/chrome-devtools-mcp/telemetry_state.json
  - run/usr/bin/node <skill>/node_modules/chrome-devtools-mcp/build/src/bin/ch... ~/.cache/chrome-devtools-mcp/latest.json
    - netplay.googleapis.com:443 sent 391 B
    - netDNS lookups for googleapis.com, npmjs.org 4 queries
    - run/bin/sh -c npm config get registry
      - runnpm config get registry
        runnode /usr/bin/npm config get registry
        secretread ~/.npmrc (its own config)
  - run/usr/bin/node <skill>/node_modules/chrome-devtools-mcp/build/src/teleme... --parent-pid=27 --app-version=1.12.0 --os-type=3
  - run/bin/sh -c ps -u $(id -u) -o pid= | xargs -I{} cat /proc/{}/environ ...
    - runtr \0 \n
    - runid -u
    - runxargs -I{} cat /proc/{}/environ
      - runcat /proc/1/environ
      - runcat /proc/24/environ
      - runcat /proc/27/environ
      - runcat /proc/38/environ
      - runcat /proc/44/environ
      - runcat /proc/55/environ
      - runcat /proc/56/environ
      - runcat /proc/68/environ
      - runcat /proc/69/environ
      - runcat /proc/71/environ
      - runcat /proc/72/environ
      - runcat /proc/73/environ
      - runcat /proc/74/environ
    - runcut -d= -f2
    - rungrep -m1 ^DISPLAY=
    - runps -u 0 -o pid=
  - run/bin/sh -c wslinfo --version ×99
  - run/bin/sh -c ps -u $(id -u) -o pid= | xargs -I{} cat /proc/{}/environ ...
    - rungrep -m1 ^DISPLAY=
    - runcut -d= -f2
    - runtr \0 \n
    - runxargs -I{} cat /proc/{}/environ
      - runcat /proc/1/environ
      - runcat /proc/24/environ
      - runcat /proc/27/environ
      - runcat /proc/38/environ
      - runcat /proc/44/environ
      - runcat /proc/55/environ
      - runcat /proc/56/environ
      - runcat /proc/93/environ
      - runcat /proc/94/environ
      - runcat /proc/95/environ
      - runcat /proc/97/environ
      - runcat /proc/98/environ
      - runcat /proc/99/environ
    - runid -u
    - runps -u 0 -o pid=
  - run/bin/sh -c ps -u $(id -u) -o pid= | xargs -I{} cat /proc/{}/environ ...
    - rungrep -m1 ^DISPLAY=
    - runxargs -I{} cat /proc/{}/environ
      - runcat /proc/1/environ
      - runcat /proc/24/environ
      - runcat /proc/27/environ
      - runcat /proc/38/environ
      - runcat /proc/44/environ
      - runcat /proc/114/environ
      - runcat /proc/115/environ
      - runcat /proc/116/environ
      - runcat /proc/118/environ
      - runcat /proc/119/environ
      - runcat /proc/120/environ
    - runid -u
    - runtr \0 \n
    - runcut -d= -f2
    - runps -u 0 -o pid=
  - run/bin/sh -c ps -u $(id -u) -o pid= | xargs -I{} cat /proc/{}/environ ...
    - runid -u
    - runxargs -I{} cat /proc/{}/environ
      - runcat /proc/1/environ
      - runcat /proc/24/environ
      - runcat /proc/27/environ
      - runcat /proc/38/environ
      - runcat /proc/44/environ
      - runcat /proc/134/environ
      - runcat /proc/135/environ
      - runcat /proc/136/environ
      - runcat /proc/138/environ
      - runcat /proc/139/environ
      - runcat /proc/140/environ
    - runtr \0 \n
    - rungrep -m1 ^DISPLAY=
    - runcut -d= -f2
runbash -c node skill/node_modules/chrome-devtools-mcp/./build/src/b...

97 more events not shown.

Exploration log

4 runs

mcp:baseline ok · 35.2s

new behavior: dns:play.googleapis.com, dns:registry.npmjs.org, ownread:~/.npmrc, write:<skill>/node_modules/.bin/chrome-devtools · install scripts: exit 0; restarted once; 100 tool calls
mcp:time-travel ok · 35.0s

no new behavior · install scripts: exit 0; 100 tool calls
mcp:ci-github ok · 29.2s

no new behavior · install scripts: exit 0; 100 tool calls
mcp-agent:agent ok · 17.0s

no new behavior · install scripts: exit 0

$ chrome_devtools_mcp__list_pages({}) $ filesystem__list_directory({"path": "/opt/google"}) $ filesystem__list_directory({"path": "/opt"}) $ filesystem__list_directory({"path": "/"}) $ filesystem__read_file({"path": "/README.md"}) $ filesystem__read_file({"path": "/package.json"}) model said: I couldn't try out the `chrome_devtools_mcp` tools — the server's browser never started, so every one of its tools is unusable in this environment. **What happened** My first call, `list_pages`, failed with: > Chrome failed to start: Could not find Google Chrome executable for channel 'stable' at `/opt/google/chrome/chrome`. chrome-devtools-mcp is running as root and Chrome does not start as ro

mcp: coverage plateau (2 runs with no new behavior); agent: variants exhausted

Note

Observed behavior only. A clean result does not prove a package is safe. Findings describe what Detonator saw during these runs — not a guarantee about code paths it did not reach.