playwright-mcp-metabase — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited playwright-mcp-metabase (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A Playwright MCP server is configured in .mcp.json. Load the tool schemas first with ToolSearch: select:mcp__playwright__browser_navigate,mcp__playwright__browser_snapshot,mcp__playwright__browser_click,mcp__playwright__browser_fill,mcp__playwright__browser_type,mcp__playwright__browser_press_key,mcp__playwright__browser_hover,mcp__playwright__browser_take_screenshot,mcp__playwright__browser_close
If ToolSearch says "MCP servers still connecting," wait a few seconds and retry — the server takes a moment to start on first use.
browser_click, browser_fill, browser_type, etc. using refs from the snapshotWhen to take a separate `browser_snapshot` after acting:
When you do NOT need a separate snapshot after acting:
browser_take_screenshot shows the current state)Element refs go stale after every action. Use refs from the most recent snapshot or inline response — never from an earlier one.
Metabase uses Mantine UI components. Most interactions work with a plain browser_click. The hover-before-click pattern is only needed for specific component types.
Regular buttons, links, form inputs, checkboxes, tabs: Just browser_click them directly. No hover needed.
Buttons that open dropdown menus (e.g., "+ New", "..." action menus, filter type pickers): These use Mantine's <Menu> component which has a race condition with direct clicks. Hover before clicking these:
browser_hover on the buttonbrowser_click on the buttonHow to tell if a button opens a dropdown menu: it usually has a chevron/arrow icon, a "..." label, or is labeled as creating something new (like "+ New"). If unsure, try a direct click first — if it doesn't work, retry with hover.
Select and dropdown components (e.g., database picker, column picker): Mantine Select/MultiSelect are NOT native <select> elements. browser_select_option will NOT work. Instead:
browser_click on the input/triggerbrowser_click on the option you want (use refs from the inline response)You can also type into the input to filter options before clicking.
Modals and dialogs: To dismiss: browser_click the close/action button, or browser_press_key with Escape.
⚠️ Mantine `Escape`-inside-modal trap: Pressing Escape while focus is inside a Mantine popover/Select/MultiSelect that is itself nested in a modal closes the entire modal and discards every form field you've already filled. To dismiss just an open dropdown, prefer browser_click outside the dropdown (or click another field). Only press Escape when you actually want the whole modal gone.
Mantine portals + scoped snapshots: Mantine renders dropdowns, popovers, and tooltips into a portal at <body> level — they are NOT children of the [role=dialog] element. If you scope browser_snapshot to the modal, dropdown options will be missing. Take a full-page snapshot when interacting with portaled content.
browser_navigate to http://localhost:$MB_JETTY_PORT/auth/loginbrowser_snapshot → browser_fill email and password → browser_click sign-in buttonbrowser_snapshot to confirm you're logged inGet a session token via API and set it as a cookie — faster than filling the login form:
./bin/mage -bot-api-call /api/session --method POST --body '{"username":"<email>","password":"<password>"}'Extract the id from the response, then use browser_evaluate with script:
document.cookie = 'metabase.SESSION=<token>;path=/'Then browser_navigate to the target page. Use the credentials from ./bin/mage -bot-server-info.
http://localhost:$MB_JETTY_PORTbrowser_snapshot when needed~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.