Safari 27 puts a local MCP server in the browser

Safari 27 ships a local MCP server built into the browser, per 9to5Mac's coverage of the WebKit blog. This closes a gap for anyone building agent-driven browser automation. The agent now sees the same DOM, cookies, and session state you see, instead of a synthetic copy running in a separate headless Chromium.

Any MCP client, Claude Code or Codex among them, gets the DOM, network requests, screenshots, and console output from a real Safari session. It runs entirely on your machine, behind a toggle in Safari's developer settings. No browser vendor has done this before. Chrome has DevTools Protocol, a debugging interface automation tools reverse-engineered into a control plane. Apple is shipping the agent interface as a supported product feature, complete with its own settings toggle.

Microsoft released playwright-mcp v0.0.82 on September 18, detailed in its release notes on GitHub. The update promotes tools a page registers through the WebMCP API into the agent's tool list, carrying the page's schema and following the active tab. The notes say plainly: tool names, descriptions, schemas, and results all come from the page and should be treated as untrusted input. --no-webmcp opts out.

A page you navigate to can now put entries in your agent's tool list, with descriptions your model reads as instructions. That's a form of prompt injection, with its own schema and a vendor-blessed delivery path. I'd turn on the Safari developer toggle, because reading a real, logged-in DOM kills a whole class of headless-only bugs. But decide your policy on page-declared tools before you need one. Mine is off by default, allowlisted per origin.