Do I have to change my agent's tools or rewrite its prompts?

No. Agents connect to the proxy over MCP and get the same tools with the same names and the same schemas as the stock server, so nothing in your prompt or tool set has to change. The only tool-surface additions are two small tools of its own: browser_set_goal for the pruning goal and browser_jev_status for mode, budget consumption, call and cost stats and tool policy.

What happens if I forget the API key, or the key is wrong?

You get pure passthrough, which is the documented no-key path rather than an error state. Same tools, same behaviour as the stock server, so adopting the proxy costs you nothing until you add the one environment variable. The trade is that a broken key and no key look the same from the agent's side.

Can a hostile page still prompt-inject my coding agent?

That is the layer the proxy exists for. Text in page content that tries to redirect the model is detected and masked before it reaches the agent's context, and the agent never talks to Jev directly, so it never sees the raw untrusted text in the first place. The reasoning is that page content cannot prompt its way past a filter it never sees.

How much will the judgment layer cost me per session, and what happens when I hit the cap?

There is a session spend cap that defaults to one US dollar, and the agent can override it. Exceeding it does not fail the session: the proxy drops to passthrough and emits a one-time warning note, so browser work keeps going unjudged. Call and cost statistics are available through the status tool, and verdicts are cached by content hash so re-visits are free.

How do I install the proxy and configure an agent?

It needs Node.js 20+ and a Playwright chromium. Clone the repo, run npm install, then point your agent's MCP config at node cli.js with --jev-mode=all and a TYPESAFE_API_KEY in the env block.

What do the two added tools do?

browser_set_goal sets the session goal used for snapshot pruning, and browser_jev_status reports mode, budget consumption, call and cost stats, and tool policy.

What is the default session spend cap?

The Jev budget is 1.0 USD by default via --jev-budget-usd. Once exceeded, the proxy passes through and adds a one-time warning note.

CommunityJev Demos & Experiments

Jev Playwright MCP

An MCP stdio proxy in front of the official Playwright MCP server that triages page state, masks prompt injection, trims oversized page dumps by goal and risk-gates actions, exposing the same tools and schemas.

See highlights

Open github.com

Stars: 2
Language: TypeScript
License: MIT
Published by: Community
Author: krw82
Last verified: Oct 2026

krw82/jev-playwright-mcp

User repository on GitHub

View on GitHub

Jev-augmented Playwright MCP proxy — page-state triage, prompt-injection shielding, goal-based snapshot pruning, risky-action gating. Drop-in wrapper around @playwright/mcp for any coding agent.

Forks: 1
Last pushed: Updated Sep 2026

Repo stats from the GitHub API, cached Oct 2026.

About this project

A Jev-augmented proxy for the official Playwright MCP server. Any coding agent — Claude Code, Codex CLI, Cursor, Windsurf, VS Code, Zed, Gemini CLI — connects to this proxy over MCP and gets the same tools, same names, same schemas as stock Playwright MCP, plus a judgment layer that runs silently inside the proxy:

Quoted from the project's README. Read the full README.

Tagscommunity jevbest catalog-import awesomejev

Works forJev for Classification Jev for Tool calling

Used inJev for Software & DevTools

Languages: TypeScript

Highlights

Agents see the same tools, names and schemas as stock Playwright MCP; the only additions are browser_set_goal and browser_jev_status.
Every response is classified as login_wall, captcha, error, rate_limited, paywall and similar, with a one-line hint attached.
Injection text is masked inside the proxy before it reaches the agent, so page content cannot prompt past a filter it never sees.
Without TYPESAFE_API_KEY the proxy degrades to pure passthrough, which makes it safe to adopt before deciding whether you want the judgment layer.

Watch out

Adopting the proxy means living with a pinned upstream: it installs a specific Playwright MCP version, and an upstream upgrade changes the ground truth underneath the triage classes and the risk gate, so those classifications need rechecking after a bump. The judgment layer adds latency and cost per browser call, and exceeding the spend cap silently drops to passthrough with a one-time warning rather than failing loudly. Config errors are forgiving in a way worth knowing about: invalid numbers or an invalid mode fall back to that setting's default with a one-line stderr warning, so a typo'd threshold does not stop startup but does quietly change behaviour. The default HTTP budget is one US dollar per session, injection spans are masked at 0.5 and above, regions below 0.35 relevance collapse to one line when a goal is set, and a destructive verdict at 0.6 or above blocks the call. Copy reviewed against the repository README on 2026-10-04, not from running it.

Questions about this entry

Short answers drawn from the linked project or page.

More Jev resources like this

jevarena

Next.js spectator demo in which two independent Jev agents drive separate Snake browsers through same-origin iframes, clicking indexed direction buttons only, with each board state streamed to a server-only endpoint that returns the chosen target.