Phishing pages
Identify deceptive sites designed to trick agents or users into unsafe actions.
PhiShark Playwright MCP
A security-aware browser layer for AI agents
Bring PhiShark protection to Playwright-based AI agents. Detect risky destinations, warn on suspicious pages, and block serious threats while preserving familiar browser automation.
Built on Microsoft Playwright MCPApache-2.0Node.js 22+Chromium · Firefox · WebKitPublic npm package
Protection for the web risks AI agents face
PhiShark helps agents recognize and avoid common threats without requiring teams to build a browser-security product of their own.
Credential theft
Detect pages that attempt to collect passwords, account details, or other sensitive information.
Brand impersonation
Flag pages that imitate trusted companies, services, or login experiences.
Suspicious redirects
Help agents avoid deceptive journeys that lead to risky or unexpected destinations.
Prompt-injection risk
Add defense-in-depth protection against web content that tries to manipulate an AI agent.
Emerging threats
Assess suspicious pages even when they are new or absent from traditional reputation lists.
Automatic high-risk blocking
Safer autonomous browsing
Explainable security feedback
Practical protection without rebuilding your browser stack
Adopt safer browsing through a public package that works with the Playwright ecosystem developers already know.
Automatic protection
Reduce manual review by applying security decisions during everyday agent browsing.
Actionable outcomes
Give agents and developers clear warnings or blocks instead of unexplained security scores.
Broad threat coverage
Cover phishing, credential theft, brand impersonation, suspicious redirects, and prompt-injection risk.
Familiar developer experience
Keep the Playwright-based workflows and browser automation patterns your team already uses.
Open-source confidence
Review the public project, Apache-2.0 license, release history, and package provenance.
Multi-browser support
Use the product with Chromium, Firefox, and WebKit-based automation workflows.
More confidence for every agent browsing session
Turn web-risk intelligence into practical protection for autonomous and assisted browser workflows.
Let agents explore more of the public web with an additional phishing and page-risk protection layer.
Warn about suspicious pages and stop serious threats before they can derail an agent workflow.
Provide understandable security feedback that developers can use in logs, reviews, and agent responses.
Start from a public npm package and standard MCP configuration instead of building from scratch.
Add it to an MCP client in minutes
Run the public package with npx and pass the PhiShark API key through the MCP process environment.
A PhiShark public API key is required. Keep the key in environment configuration—never in tool arguments or source code.
Run with npx
npx -y @phishark/playwright-mcp@latestStandard MCP configuration
{
"mcpServers": {
"phishark-playwright": {
"command": "npx",
"args": ["-y", "@phishark/playwright-mcp@latest"],
"env": {
"PHISHARK_API_KEY": "<your-api-key>"
}
}
}
}Security with honest boundaries
Defense in depth, not a magic sandbox
PhiShark adds protection against common web threats while preserving the browser automation capabilities developers expect.
PhiShark Playwright MCP is not a malware sandbox or an absolute prompt-injection security boundary. Use it alongside normal endpoint, identity, network, and approval controls.
- Helps identify phishing, credential theft, brand impersonation, suspicious redirects, and prompt-injection risk.
- Can warn the agent about suspicious pages and block serious threats.
- Supports common Playwright browsers and developer workflows.
- Provides an additional protection layer without claiming perfect detection.