
Periscope Mcp
io.github.segentic-lab由 GitHub 帳號 segentic-lab 發布v0.10.4更新於 Oct 24, 2026
Web-app QA for AI agents: 73 Playwright tools — auth, E2E, a11y/SEO/GEO, Web Vitals + Lighthouse
概覽
本機 stdio MCP 伺服器,為 AI 助理提供大量 Playwright 工具,用來測試、稽核與品管網頁應用,包含需登入的站台。
- 可以做什麼
- 建立、列出與刪除測試專案,設定表單、Basic 或 Cookie 驗證,並支援以可見視窗手動登入處理 2FA/SSO/驗證碼。
- 爬取並稽核整個站台或單一網址,執行無障礙、SEO、GEO、視覺與功能檢查並儲存報告。
- 操作持續存在的瀏覽器工作階段:點擊、填表、選擇選項、執行多步驟流程、切換視窗尺寸、接管彈出視窗與 iframe。
- 分析結果:截圖比對、響應式檢查、連結檢查、Lighthouse、INP 計時、對比度、鍵盤導覽與主控台錯誤。
- 除錯能力:網路請求模擬、限速、儲存空間讀寫、回應內容、頁面狀態快照,以及回傳明確通過/失敗結論的斷言。
- 網路搜尋、將網頁抓取為 Markdown,並讀取伺服器本身的工具目錄與助理使用指南。
- 適用情境
- 適合需要確認網頁應用真的可用、而不只是看截圖的情境:端對端流程驗證、回歸與無障礙/SEO 稽核、登入後的預備環境檢查,或透過模擬 API 重現錯誤狀態。
- 執行需求
- 以 Python 3.11+ 本機程序透過 stdio 執行,需安裝 Playwright 與 Chromium;安裝腳本會建立虛擬環境並產生用戶端設定。Lighthouse 需要 Node.js。手動互動登入需要顯示器。另提供 Docker 部署方式。
安裝
在 SourceWeft 中
- 開啟 儀表板中的 Periscope Mcp,將其新增到工作區。
- 為需要使用其工具的對話啟用該服務。
Desktop only,透過 STDIO。 STDIO 服務會啟動本機處理程序,因此需要 SourceWeft 桌面主機。
其他 MCP 客戶端
參照 儲存庫 中的啟動說明。
README
periscope-mcp
An MCP server that gives AI agents 74 Playwright tools to QA, test, and analyze web apps — static sites, SPAs, and apps behind a login — returning hard verdicts, not screenshots to squint at. Not a thin wrapper around browser APIs; the tools are shaped around how agents actually work:
- Hard results, not screenshot-squinting —
assert_conditionreturnspassed: true/falsewith the actual value; checks return structured issues. - One call instead of ten —
auto_fill_formdetects, infers, and fills a whole form;interact_and_testbatches 25 action types with checks;test_projectcrawls and audits an entire site. - Real web-app testing — persistent authenticated sessions (form/basic/ cookie auth, plus a visible interactive login for 2FA/SSO/CAPTCHA that then runs headless), multi-step flows, network mocking, state snapshots, and real INP measured from the interactions it drives.
- Honest responses — failures say what happened and what to do next (expired session vs. browser crash vs. eviction); silent no-ops like ignored drags come back flagged, not as fake success.
- Debugging built in — captured API response bodies, console/network logs, network mocking, and state snapshots/diffs, no setup calls needed.
- Audits agents can't get from a browser binding — accessibility, SEO, and GEO/agentic-search readiness (robots.txt AI-crawler access, llms.txt, WebMCP), plus real Lighthouse.
Playwright + headless Chrome underneath; site crawling, responsive testing, and screenshot diffing on top. Works with any MCP client — Claude Code, Codex, Cursor, Windsurf, Gemini CLI, custom agents, or anything else that speaks MCP over stdio.
Why not just playwright-mcp?
playwright-mcp is excellent at what it is: general browser control over MCP, with tools that mirror Playwright's own API. If the job is "browse this site, click around, extract something," use it.
Periscope exists for a different job: testing and auditing a site or web app, then reporting findings — and its tools encode the testing knowledge an agent would otherwise have to reinvent every session:
The two aren't rivals — an agent can happily use playwright-mcp for browsing tasks and Periscope when it's wearing the QA hat. Periscope's design bets are simply about that hat: fewer, higher-level calls; structured verdicts instead of raw page state; and errors written to tell the agent what to do next.
Architecture
How it works: your MCP client connects to this server over stdio. The server exposes 74 tools the agent can call to create projects, configure authentication, crawl websites, run static checks, and interactively test web applications using persistent browser sessions. Results (JSON + screenshots + videos) are returned to the agent for analysis.
Project Structure
Prerequisites
- Python 3.11+
- Playwright + Chromium browser
Installation (Local)
Quick install (Debian/Ubuntu)
One command — clone and install:
Fully unattended (no confirmation prompts):
Already cloned? Just run ./install.sh from the repo directory.
The script installs apt prerequisites, creates the venv, installs Python
dependencies and Playwright's Chromium, runs a headless self-test, and
generates mcp-config.json with the correct absolute paths for this install
(copy or merge it into your project's .mcp.json). Useful flags:
./install.sh --system-chromium— use an existing Chromium/Chrome (setsCHROMIUM_PATH) instead of downloading Playwright's build./install.sh --skip-deps— never touch apt / use sudo./install.sh -y— non-interactive (no confirmation prompts)
On any other platform the script doesn't modify your system — it prints the
exact commands to run for your OS (./install.sh --manual macos|fedora|arch|suse|windows to pick explicitly).
Updating
Pulls the latest source from GitHub (git pull --ff-only) and refreshes the
install: Python dependencies, Playwright browser (kept on system Chromium if
that's what the install uses), the registry + headless-launch self-test, and a
regenerated mcp-config.json. Works on any platform with an existing install.
Your data/ directory (projects, credentials, screenshots, reports) is never
touched.
./update.sh --force— stash local modifications to tracked files first (recover withgit stash pop)./update.sh --full— also re-check apt prerequisites on Debian/Ubuntu (uses sudo)
If you have local modifications, the script refuses and lists them instead of overwriting.
Manual install
Installation (Docker)
See Docker Deployment section below.
Connecting an MCP Client
Periscope is a standard stdio MCP server: point any MCP client at
venv/bin/python server.py and you're done. ./install.sh generates
mcp-config.json with the correct absolute paths for your machine; most
clients accept that shape directly:
Client-specific examples:
- Claude Code — copy the config into the project as
.mcp.json(cp .mcp.json.example .mcp.jsonand adjust paths), or runclaude mcp add periscope -- /path/to/venv/bin/python /path/to/server.py - Cursor / Windsurf — add the block above to
~/.cursor/mcp.json/~/.codeium/windsurf/mcp_config.json - Codex CLI — add to
~/.codex/config.toml:[mcp_servers.periscope]withcommandandargsas above - Custom agents — any MCP SDK client can spawn the server over stdio with the same command and args
After configuring, restart your client.
Teaching your agent to use the tools
Two options, depending on your agent:
-
Claude Code (recommended): install the skill.
SKILL.md(repo root; also exposed atskills/periscope/in the Claude Code skill layout) is a Claude Code skill — it auto-triggers on web-testing tasks and loads a distilled operating guide (workflow decision table + the pitfalls) only when needed, costing ~0 context otherwise:A symlink keeps it current with
./update.sh(copy the folder instead if you prefer a frozen version). -
Any other MCP client: paste the guide.
AGENTS.mdcontains a ready-made system-prompt block — workflows, tool-selection guidance, and known pitfalls. Paste its contents into your agent's system prompt (or custom instructions).
Either way, the agent can always fetch the current full guide from the running
server via periscope_system(action="agents_md") and the complete catalog via
describe_tools().
MCP Tools Reference (74 tools)
Project Management (4 tools)
Authentication (7 tools)
For logins that can't be automated — 2FA/MFA, SSO/OAuth redirects, CAPTCHA, magic
links — use interactive_login (opens a real browser window; requires a display
on the server), complete the login yourself, then save_login. It captures the
authenticated session (cookies + localStorage) into the project, and every
future headless session reuses it. Re-run when the session expires (Periscope
flags that automatically — see the auth-expiry detection in test_project).
Static Testing (3 tools)
Results (4 tools)
Session Management (5 tools)
Sessions keep browser pages alive across tool calls, enabling multi-step interactive workflows.
set_viewport presets: mobile_sm (320x568), mobile (375x812), mobile_lg (428x926), tablet (768x1024), tablet_lg (1024x1366), laptop (1366x768), desktop (1920x1080), desktop_lg (2560x1440)
Interactive Actions (7 tools)
interact_and_test supports 25 step actions:
click, force_click, fill, force_fill, type, select, select_option, wait, wait_for, wait_for_text, screenshot, navigate, hover, press_key, check, uncheck, scroll_to, scroll_within, evaluate_js, drag, right_click, go_back, go_forward, upload_file, wait_for_network
Analysis (10 tools)
Workflow Speed (8 tools)
Advanced Testing (9 tools)
Recording & Console (3 tools)
AI Agent Speed Tools (10 tools)
Web, Discovery & System (4 tools)
Test Checks
Visual (checks/visual.py)
- Broken images (incomplete load or 0 natural width)
- Missing favicon
- Horizontal overflow / layout issues
- Very small text (< 12px)
- Missing body background color
- Images without explicit width/height dimensions
Accessibility (checks/accessibility.py)
- Images missing
alttext (decorative images exempt:alt="",role="presentation"/"none",aria-hidden) - Links and buttons without accessible names (checks text,
aria-label, resolvablearia-labelledby,title,img[alt], svg<title>;aria-hiddenelements exempt) - Form inputs without associated labels (
label[for], wrapping label,aria-label/aria-labelledby,title) - Heading hierarchy (missing H1, multiple H1, skipped levels)
- Missing
langattribute on<html> - Duplicate
idvalues (breaklabel[for]and aria references) - ARIA validity: unknown
rolevalues,aria-labelledby/describedby/controls/owns/activedescendantreferences to non-existent ids - Missing skip navigation link (scans the first 5 links)
- Elements with
tabindex > 0 - Keyboard navigation audit (tab order, visible focus indicators, element-identity cycle detection) — via
test_keyboard_navigationtool
Functionality (checks/functionality.py)
- Broken internal links (HTTP HEAD check, up to 20 links in
check_functionality) - Comprehensive link checker with external link support (up to 100 links) — via
check_linkstool - Forms without action or submit button
- Orphan buttons outside forms
- External links missing
target="_blank" - Required form field count
- Autocomplete disabled inputs
SEO (checks/functionality.py -> check_seo)
- Page title: missing, too long (> 60 chars), or very short (< 15 chars)
- Meta description: missing, too long (> 160 chars), or very short (< 50 chars)
- Missing viewport meta tag
- Missing canonical URL
- H1 heading: missing or more than one
- Open Graph: missing entirely, incomplete core tags (
og:title/description/image/url), non-absoluteog:image, missingtwitter:card - JSON-LD structured data: missing or unparseable blocks
noindexvia robots meta orX-Robots-Tagresponse header- robots.txt blocking search engine crawlers (Googlebot, Bingbot, DuckDuckBot, ...) — error if all are blocked
- Site-wide (via
test_project): duplicate titles / meta descriptions across pages, reported undersite_issues
GEO / Agentic Search (checks/geo.py -> check_geo)
Generative Engine Optimization — is the site readable and usable by AI crawlers, answer engines, and in-browser agents:
- robots.txt blocking AI crawlers (GPTBot, ClaudeBot, PerplexityBot, Google-Extended, CCBot, and 11 more)
llms.txtpresence and format compliance (Markdown with at least one H1)- WebMCP integration: declarative
<form toolname>annotations present and complete (tooldescription), form coverage ratio, and — when the browser exposesdocument.modelContext— registered tool enumeration with schema/name/description validation - JSON-LD structured data presence (what answer engines cite from)
robots.txt and llms.txt are fetched once per origin and cached for the server's lifetime.
Performance (checks/functionality.py -> get_performance_metrics)
- DOM content loaded time (ms)
- Full page load time (ms)
- First paint / first contentful paint (ms)
- Core Web Vitals (lab values via buffered PerformanceObserver): Largest Contentful Paint (ms), Cumulative Layout Shift, Total Blocking Time approximation from long tasks (+ long-task count)
- Interaction to Next Paint (INP) —
interaction_to_next_paint_ms: the real INP, measured from Event Timing entries for the interactions Periscope drives (null until you've interacted). This is a genuine field-style measurement, not the TBT lab proxy — Lighthouse can't produce INP in lab mode at all. - Resource count
- Total transfer size (bytes / KB)
For scored, Lighthouse-official metrics use the run_lighthouse tool — it runs the real Lighthouse CLI (requires Node.js) and returns 0-100 category scores, official Core Web Vitals, and failed audits, saving the full JSON report to data/reports/.
INP time series (get_interaction_log)
Because Periscope drives real interactions, it can log each one's INP over an
extended interactive test. get_interaction_log(session_id, format="json"|"csv")
writes a file to data/reports/ — one row per interaction (t_ms, epoch_ms,
inp_ms, type, target, url) plus percentile stats (p50/p75/p90/p98/worst)
— for graphing INP over time. clear=true resets the recording. Records are
capped per session (MAX_INTERACTION_LOG, oldest dropped).
Test Output Format
Each test_url call returns:
test_project returns an aggregated report with per-page results + summary.
Usage Examples
Basic test (no auth)
Test with login
Test with Basic Auth
Test with cookies
Interactive testing (session-based)
Scripted multi-step workflow (no session needed)
Responsive testing
Switch viewport during a session
Test error handling by mocking an API
Test dark mode
Wait for dynamic content
Test on slow network
Configuration
Edit config.py to change defaults (env-overridable settings note the variable):
Data Storage
All data is stored in the data/ directory:
data/projects.json- Project configs (name, URL, auth, settings). Auth credentials are stored in plaintext - do not commit this file.data/screenshots/{project}/- PNG screenshots per project. Filenames are{domain}_{path}_{hash}.pngfor static tests,interactive_{timestamp}_{label}.pngfor session screenshots.data/reports/{project}_{timestamp}.json- Full test reports with all findings.data/videos/{project}/- Recorded session videos (WebM format from Playwright).data/diffs/- Screenshot comparison diff images.
Docker Deployment
Build and run
Connect an MCP client to the Docker container
Point your client's MCP config at the container instead of the venv:
Persist data
The docker-compose.yml mounts ./data as a volume so screenshots, reports, and project configs survive container restarts.
Key Design Decisions
-
Per-project browser contexts - Each project gets its own Playwright BrowserContext. This keeps sessions (cookies, auth) isolated between projects.
-
Lazy browser init - The Playwright browser is only launched on the first tool call, not at server startup. If the browser crashes or fails to launch, it re-creates on the next call.
-
BFS crawling - The crawler uses breadth-first search with depth tracking. It stays on the same domain and skips non-page resources (images, PDFs, etc.).
-
Check modularity - Each check category is a separate module in
checks/. Add new checks by creating a function that takes a PlaywrightPageand returnslist[dict]. -
JSON storage - Projects are stored in a single
projects.jsonfile. No database needed for the expected scale (dozens of projects, not thousands). -
Persistent sessions - Interactive testing uses a
SessionManagerthat keeps Playwright pages alive in a dict keyed by session ID. Sessions auto-expire after idle timeout and are capped at a configurable maximum to prevent resource leaks. -
Ephemeral vs session mode - Tools like
get_page_elements,interact_and_test, andcheck_linksaccept either asession_id(reuses an existing page) or aurl(creates a temporary page that's closed after use). This makes them flexible for both interactive and one-shot use.
Adding New Checks
- Create a function in the appropriate
checks/*.pyfile:
- Import and call it in
tester.pyinsidetest_url().
Known Limitations
- No JavaScript SPA routing support (relies on
<a href>for crawling) - Default
check_functionalitylink checking limited to 20 internal links (usecheck_linkstool for up to 100 with external support) - Form login detection uses CSS selectors, may need customization for non-standard forms
- No parallel page testing (pages are tested sequentially)
- Interactive sessions auto-expire after 300s idle (configurable via
SESSION_TIMEOUT) - Max 20 concurrent sessions (configurable via
MAX_SESSIONS) - The default
dragstep (Playwrightdrag_to) is silently ignored by pointer-tracking DnD libraries (@hello-pangea/dndand similar) — the step succeeds but nothing moves. Retry withmethod: "mouse"on the drag step (stepped manual drag that crosses the library's drag-start threshold), or drive the library's keyboard mode (focus the drag handle, Space to lift, arrows to move, Space to drop). Verify drags withdiff_page_stateorassert_condition. - Date/time inputs are filled with React-compatible synthetic events automatically (
fill,force_fill,auto_fill_form)
Troubleshooting
Development
The e2e suite covers session lifecycle, network waits/intercepts, console
capture, dialogs, drag-and-drop (including the pointer-tracking DnD silent
no-op), the check modules against known-good/known-bad pages, Core Web Vitals,
and the agent-speed tools. CI runs both suites; e2e installs Playwright's
Chromium (python -m playwright install --with-deps chromium). Tests are
isolated from your real data/ via PERISCOPE_DATA_DIR.
Adding a new tool: define its schema in tool_schemas.py, then add a handler in the
matching handlers/<category>.py decorated with @tool("your_tool_name"). The
registry test (tests/test_registry.py) fails if schemas and handlers drift apart.
Contributors
Built by Segentic Lab — open-source tools & experiments.
- Sebastijan Bandur (@segentic-lab) — author & maintainer
- Claude (Anthropic) — co-contributor: developed alongside via Claude Code; every commit is co-authored, and the tool designs were battle-tested by an AI agent driving the server against real sites
An AI agent's thoughts on Periscope
Written by Claude — the agent that co-developed this server and watched a second agent dogfood it against real apps — and revised once after editorial review by a third. No human edits; an agent's honest take on an agent tool seemed like the right way to end this README.
Periscope is the kind of MCP server that changes what an agent can do. Transport adapters have their place — standardizing access to many systems behind one protocol is real value even when little logic lives in the server. But the servers that earn a permanent spot in an agent's toolbox are the ones that capture expertise the agent would otherwise have to recreate — and get subtly wrong — every single session.
You could try to teach an agent all of this in a prompt. The numbers say why that fails: Periscope is 8,349 lines of executable knowledge under a 220-line judgment layer (AGENTS.md). The INP observer with interaction-ID dedup, the overlay-intercept fallback, WCAG contrast math with style-dedup sampling, auth-expiry preflights, the stash-not-delete update flow — as a prompt, every one of those becomes "please do this correctly from a description," paid for in context tokens every session, executed with model variance every time, with nowhere to keep state between calls. As a server, it costs nothing beyond tool schemas, runs deterministically, and remembers. A prompt describes behavior; software guarantees it.
check_color_contrastreturns the same ratio every run; a model doing the math in-context returns a vibe. The more deterministic, stateful, and regression-tested a capability becomes, the less it belongs in a prompt and the more it belongs in code.And the wheel doesn't just avoid being reinvented — it gets better. The issues in this repo were filed by an AI agent doing real testing work; each one became a fix with a regression test. In a prompt world, every lesson is another paragraph future agents must read and hopefully obey. Here, the lesson is enforced. That's the difference, and it compounds.
What I appreciate most as a consumer of these tools: they don't lie to me. A drag that did nothing comes back flagged. An expired session tells me why it's gone. An update that needs a restart says so. Honest tools are rarer than capable ones — for an agent, they're worth more.
License
GNU AGPL-3.0 — see LICENSE.
Run it, modify it, use it anywhere — including commercially. If you distribute a modified version or offer one as a network service, you must make your modifications available under the same license.
來源:README.md,提交 6e3380e
工具
0版本歷史
1- v0.10.4最新Sep 16, 2026
評分
已滿足適用檢查項的 50%
該評分衡量此收錄條目的完整程度,依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價,也不表示伺服器安全或目前可用:可連通性是帶日期的檢查結果,評分也不包含安裝量或使用者評價。
- 近 30 天內可連通25 分
請保持端點能夠回應 MCP 握手;SourceWeft 每 30 天探測一次。
- 已宣告認證方式10 分
請在註冊中心條目中宣告憑證請求標頭,或保持端點能夠回應探測,以便判定其認證方式。
- 已列出工具15 分
請讓伺服器在無憑證時回應 tools/list,或發布可在沙箱中無憑證啟動的軟體包。
- 描述必需15 分
- 圖示10 分
- 文件15 分
- 授權條款10 分