← Home

@metamask/client-mcp-core

npm Repository Homepage

HTTP daemon and CLI for agent-driven browser extension testing with Playwright

7
Versions
(MIT OR Apache-2.0)
License
No
Install Scripts
Attested
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation (unverified) npm registry signatures gitHead linked

Maintainers

kumavisfrederikboldingmetamaskbotgudahttmrtenmcmirenaugtur

Keywords

playwrightllmvisual-testingbrowser-extensioncli

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
dependencies unvetted-dep:@metamask/device-mcp AI (dependencies): First-party MetaMask package, not third-party unvetted code. ai
maintainer-change maintainer-added AI (maintainer-change): Known MetaMask org maintainers, consistent with CI provenance improvement. ai

Versions (showing 7 of 7)

Version Deps Published
0.6.0 4 / 34
0.5.0 3 / 34
0.4.0 3 / 34
0.3.0 3 / 34
0.2.0 3 / 34
0.1.1 2 / 33
0.1.0 2 / 33

v0.6.0

2 findings
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

INFO Publisher changed: metamaskbot → GitHub Actions (on 2026-07-27, now via trusted publisher with provenance) provenance

This version was published by a different npm account (GitHub Actions) than the most recent previously approved version (metamaskbot) on 2026-07-27, but it carries Sigstore provenance attestation. This means the package moved to a trusted publisher (CI/CD with OIDC, e.g. GitHub Actions) — a supply-chain integrity improvement, not a compromise, since a stolen npm token cannot forge provenance bound to the source repository. Recorded as INFO for audit trail.