Browser automation and testing: 5 MCP servers, scored

Playwright Tools for MCP.

The evidence: 38,155 GitHub stars · Apache-2.0 licence · has a security policy · last push Oct 8, 2026 · repo created Mar 2025 · no hygiene flags. (Maintenance 39/40 · security hygiene 35/35 · adoption 15/25)

npx -y @playwright/mcp

Before you install: It opens a visible browser window unless you pass --headless, and by default keeps a persistent profile on disk, so logins from earlier sessions stay. Use --isolated to keep the profile in memory. Its README says the --allowed-origins and --blocked-origins options are not a security boundary and do not affect redirects, and that Playwright MCP as a whole is not a security boundary.

Who should skip it: The README itself suggests Playwright's CLI with skills for coding agents because it uses fewer tokens; MCP fits exploratory, long-running browser sessions better. If you only need short, repeatable steps, start with the CLI.

Sources: Socketlist page · GitHub

MCP security scanner. CI-native testing, attack simulation, health scoring, and SARIF.

The evidence: 142 GitHub stars · MIT licence · has a security policy · last push Oct 14, 2026 · repo created Mar 2026 · no hygiene flags. (Maintenance 40/40 · security hygiene 35/35 · adoption 11/25)

npx -y @kryptosai/mcp-observatory

Before you install: It checks an MCP server you point it at: with no configured server it falls back to an included example, and a demo grade describes that example, not your server. Saving a snapshot to its hosted dashboard is a separate, optional step (the cloud upload command, which signs in with GitHub). Failed checks are findings to review, not proof of a vulnerability.

Who should skip it: If you only use other people's servers and never write or publish one, a scanner like this has little to do for you.

Sources: Socketlist page · GitHub

Load-test a URL, ping it by phase, ramp to find the capacity, compare runs: JSON reports, guardrails.

The evidence: 93 GitHub stars · MIT licence · has a security policy · last push Oct 13, 2026 · repo created Jan 2025 · no hygiene flags. (Maintenance 40/40 · security hygiene 35/35 · adoption 10/25)

uvx pepe-http mcp

Before you install: The MCP mode (pepe mcp) has guardrail options: --allow-host, --max-requests (default 10000), --max-rate (default 500 requests per second) and --max-concurrency (default 64). Start it with --allow-host set to your own domain; without it, the registry entry says a tool call may be pointed at any host.

Who should skip it: If you do not own the service you would test, or lack permission to load it. A load test against someone else's server can look like an attack.

Sources: Socketlist page · GitHub

MCP server for iOS and Android Mobile Development, Automation and Testing.

The evidence: 9,098 GitHub stars · Apache-2.0 licence · has a security policy · last push Oct 12, 2026 · repo created Mar 2025 · no hygiene flags. (Maintenance 34/40 · security hygiene 35/35 · adoption 15/25)

npx -y @mobilenext/mobile-mcp

Before you install: It needs a booted iOS simulator (Xcode), a running Android emulator or a USB-debugging Android device with adb, plus Node 20 or newer. By default it runs over stdio. If you start its HTTP mode with --listen, the server accepts unauthenticated connections unless you set MOBILEMCP_AUTH, and it logs a warning when you do not.

Who should skip it: If you do not build or test native iOS or Android apps.

Sources: Socketlist page · GitHub

Mock, record/replay, verify and chaos-test any HTTP, REST, gRPC or LLM dependency over MCP.

The evidence: 4,989 GitHub stars · Apache-2.0 licence · has a security policy · last push Oct 14, 2026 · repo created Feb 2013 · no hygiene flags. (Maintenance 40/40 · security hygiene 29/35 · adoption 15/25)

docker run --rm -p 1080:1080 mockserver/mockserver

Before you install: It is a Java service; the Docker image bundles its own runtime. Once it is running, its MCP endpoint is http://localhost:1080/mockserver/mcp. The command above is the README's Docker line without -d, so it stays in your terminal. Treat it as a development and testing tool and keep it off the public internet.

Who should skip it: If your tests do not call network services (HTTP, gRPC and so on) that you would want to fake.

Sources: Socketlist page · GitHub