Semantic Hints Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Semantic Hints Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A small local stdio MCP server that exposes compact semantic observations from a UI annotated with data-agent-* hints.
It is a companion to the official Playwright MCP, not a replacement. It only reads semantics; all browser actions (click, type, navigate) stay in Playwright MCP. The intended split:
semantic_snapshot → a compact map of hinted elements (~2–3× smaller than aPlaywright ARIA snapshot of the same page).
id, e.g. checkout.submit.[data-agent-id='checkout.submit'].semantic_observe → the current value/state of one hinted element.The semantic-hints MCP uses the Playwright library directly. It does not call the Playwright MCP internally.
However, the semantic-hints MCP and the official Playwright MCP must observe/control the same browser state during an experiment. Avoid accidentally creating two unrelated browser sessions where:
That would invalidate the workflow.
Semantic-hints MCP must not silently launch a separate browser by default.
chromium --remote-debugging-port=9222(or the equivalent using your locally installed Chrome/Chromium binary).
supported by the installed version/config.
chromium.connectOverCDP("http://127.0.0.1:9222")URL is provided, it may open/navigate a page. If no page exists and no URL is provided, it returns a clear error asking for a URL or active page.
| Variable | Default | Purpose |
|---|---|---|
SEMANTIC_HINTS_CDP_URL | http://127.0.0.1:9222 | CDP endpoint of the shared Chromium to attach to. |
SEMANTIC_HINTS_TARGET_URL | (unset) | Optional default app URL, opened when a tool is called with no url. |
SEMANTIC_HINTS_LAUNCH_BROWSER | false | If true, may launch a private browser when the CDP connection fails. |
SEMANTIC_HINTS_HEADLESS | true | Headless mode for the standalone-launch fallback only. |
Behavior:
SEMANTIC_HINTS_CDP_URL is reachable, connect over CDP (the normal mode).SEMANTIC_HINTS_LAUNCH_BROWSER is false, **failclearly with setup instructions** — never silently launch.
SEMANTIC_HINTS_LAUNCH_BROWSER is true, the server may launch its own browser,but every tool response then carries a warning field making clear this is a standalone session that may not share state with the Playwright MCP.
The normal research workflow should use the shared CDP browser mode.
semantic_snapshotReturns hinted elements grouped into regions, actions, inputs, observables, navigation, other, plus counts, url, and screen.
{
"url": "http://localhost:8082/products", // optional: navigate first; else read current page
"scope": "products.filters", // optional: data-agent-id or CSS selector subtree
"includeHidden": false // optional: include hidden elements (default false)
}Per element (fields included only when present): id, role, name, action, state, target, controls, observes, value (inputs/observables only), enabled (interactive only), visible. Never returns HTML, class names, or DOM subtrees.
semantic_observe{ "id": "cart.total" }Resolves [data-agent-id="<id>"] and returns its compact current state. Returns a clear error if zero or multiple elements match.
cd semantic-hints-mcp
npm install
npx playwright install chromium # one-time browser download
npm run buildSee Configuration above for the environment variables.
From this folder, after npm run build:
claude mcp add semantic-hints \
--env SEMANTIC_HINTS_CDP_URL=http://127.0.0.1:9222 \
--env SEMANTIC_HINTS_TARGET_URL=http://localhost:8080 \
-- node "$(pwd)/dist/index.js"Or add it to .mcp.json / your Claude Code config manually:
{
"mcpServers": {
"semantic-hints": {
"command": "node",
"args": ["/absolute/path/to/semantic-hints-mcp/dist/index.js"],
"env": {
"SEMANTIC_HINTS_CDP_URL": "http://127.0.0.1:9222",
"SEMANTIC_HINTS_TARGET_URL": "http://localhost:8080"
}
}
}
}(For development without a build step, use "command": "npx", "args": ["tsx", "/abs/path/src/index.ts"].)
Expected Claude Code workflow:
npm run dev # → http://localhost:8080 for the annotated WebTestBench app chromium --remote-debugging-port=9222SEMANTIC_HINTS_CDP_URL=http://127.0.0.1:9222 semantic_snapshot({ "url": "http://localhost:8080" }) browser_click({ "target": "[data-agent-id='checkout.submit']" }) semantic_observe({ "id": "cart.total" })The click (step 5) and observe (step 6) must operate on the same browser page/session — which is exactly what the shared CDP browser guarantees.
npm testVitest loads test/fixture.html in headless Chromium and checks: grouped compact output, hidden-element handling, scope, observable/input value reads, missing & duplicate-ID errors, and that output contains no raw HTML/DOM.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.