Skip to content

feat: support allowedUrlPattern & blockedUrlPattern Options#2037

Merged
nattallius merged 15 commits into
mainfrom
add-blocklist-and-allowlist-options
Jun 8, 2026
Merged

feat: support allowedUrlPattern & blockedUrlPattern Options#2037
nattallius merged 15 commits into
mainfrom
add-blocklist-and-allowlist-options

Conversation

@nattallius

@nattallius nattallius commented May 11, 2026

Copy link
Copy Markdown
Contributor

Support for Network Blocklists and Allowlists (--blocked-url-pattern & --allowed-url-pattern arguments)

This PR adds support for CLI options to restrict network access in the browser session via URL patterns.

Key Features & How It Works

  • Pattern Matching: Utilizes the URLPattern Standard for pattern matching.
  • Target Detachment: Silently detaches from targets (pages/tabs) whose URLs match blocked patterns (or do not match allowed patterns) upon connection.
  • Runtime Blocking: Prevents navigations and blocks runtime requests (such as fetch/XHR and subresources) if they violate the pattern rules.
  • Mutual Exclusivity: --blocked-url-pattern and --allowed-url-pattern conflict with each other and cannot be configured simultaneously.
  • Browser Requirements:
    • --allowed-url-pattern: Requires Chrome 149+.
    • --blocked-url-pattern: Works on Chrome versions older than 149, but Chrome 149+ is highly recommended.

Important Limitations & Side Effects

  • Network Emulation/Throttling Conflict: Network throttling is disabled when a network blocklist/allowlist is configured, to avoid conflicting with Puppeteer's underlying blocking mechanisms.
    • Using the emulate tool to modify networkConditions (e.g. setting to Offline) will throw an error: Network throttling is not supported when network blocking (allowlist/blocklist) is configured.
    • Other emulation settings (e.g., cpuThrottlingRate, geolocation, viewport) are unaffected and remain fully functional.

Configuration Examples

1. Blocking specific domains or endpoints (Blocklist)

Add the --blocked-url-pattern options to the args list in your MCP settings file:

{
  "mcpServers": {
    "chrome-devtools": {
      "command": "npx",
      "args": [
        "chrome-devtools-mcp@latest",
        "--blocked-url-pattern=*://*.blocked-example.com/*",
        "--blocked-url-pattern=*://*.another-blocked-example.com/*"
      ]
    }
  }
}

2. Restricting access to authorized domains (Allowlist)

Add the --allowed-url-pattern options to restrict the browser to permitted hosts (requires Chrome 149+):

{
  "mcpServers": {
    "chrome-devtools": {
      "command": "npx",
      "args": [
        "chrome-devtools-mcp@latest",
        "--allowed-url-pattern=https://*.allowed-example.com/*",
        "--allowed-url-pattern=https://*.another-allowed-example.com/*"
      ]
    }
  }
}

@nattallius nattallius requested a review from OrKoN May 11, 2026 19:10
@nattallius nattallius force-pushed the add-blocklist-and-allowlist-options branch from b5eca0f to 788efce Compare May 11, 2026 19:16
Comment thread src/bin/chrome-devtools-mcp-cli-options.ts Outdated
Comment thread src/bin/chrome-devtools-mcp-cli-options.ts Outdated
Comment thread src/bin/chrome-devtools-mcp-cli-options.ts
@nattallius nattallius force-pushed the add-blocklist-and-allowlist-options branch from f537e11 to 998d4be Compare May 18, 2026 11:04
Comment thread tests/security_policies.test.ts Outdated
Comment thread tests/network_blocking.test.ts Outdated
@nattallius nattallius force-pushed the add-blocklist-and-allowlist-options branch from 703ef62 to eab8536 Compare May 18, 2026 12:36
Comment thread tests/network_blocking.test.ts Outdated
@nattallius nattallius changed the title feat: Implement url allowlist and blocklist feat: Support allowedUrlPattern & blockedUrlPattern Options May 18, 2026
@OrKoN OrKoN force-pushed the add-blocklist-and-allowlist-options branch from b90f3a7 to 57c0f95 Compare May 19, 2026 09:41
@nattallius nattallius changed the title feat: Support allowedUrlPattern & blockedUrlPattern Options feat: support allowedUrlPattern & blockedUrlPattern Options May 19, 2026
@nattallius nattallius force-pushed the add-blocklist-and-allowlist-options branch from 57c0f95 to 6f1034f Compare June 2, 2026 07:33

@Lightning00Blade Lightning00Blade left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM with some small comment and questions.

Comment thread scripts/test.mjs Outdated
Comment thread src/McpContext.ts Outdated
Comment thread tests/browser.test.ts Outdated
Comment thread tests/browser.test.ts Outdated
Comment thread tests/cli.test.ts
Comment thread tests/network_blocking.test.ts
Comment thread tests/network_blocking.test.ts Outdated
Comment thread tests/network_blocking.test.ts Outdated
@ChromeDevTools ChromeDevTools deleted a comment from ranieleda-ui Jun 3, 2026
@nattallius nattallius force-pushed the add-blocklist-and-allowlist-options branch from 67c356d to e08b421 Compare June 3, 2026 16:54
@nattallius nattallius force-pushed the add-blocklist-and-allowlist-options branch from 5f342b5 to 86eeb4f Compare June 5, 2026 13:51
@nattallius nattallius enabled auto-merge June 5, 2026 14:33
@nattallius nattallius added this pull request to the merge queue Jun 8, 2026
Merged via the queue into main with commit 02b4492 Jun 8, 2026
53 of 61 checks passed
@nattallius nattallius deleted the add-blocklist-and-allowlist-options branch June 8, 2026 09:28
pull Bot pushed a commit to CrazyForks/chrome-devtools-mcp that referenced this pull request Jun 8, 2026
🤖 I have created a release *beep* *boop*
---


##
[1.2.0](ChromeDevTools/chrome-devtools-mcp@chrome-devtools-mcp-v1.1.1...chrome-devtools-mcp-v1.2.0)
(2026-06-08)


### 🎉 Features

* add experimental TOON support for structured content output
([ChromeDevTools#2042](ChromeDevTools#2042))
([aa33bff](ChromeDevTools@aa33bff))
* Adds close_heapsnapshot MCP tool
([ChromeDevTools#2174](ChromeDevTools#2174))
([8713b93](ChromeDevTools@8713b93))
* Handle multiple providers of third-party developer tools
([ChromeDevTools#2168](ChromeDevTools#2168))
([30d59a7](ChromeDevTools@30d59a7))
* implement extension service worker logs
([ChromeDevTools#1915](ChromeDevTools#1915))
([29e3898](ChromeDevTools@29e3898))
* memory debugging tools
([ChromeDevTools#2169](ChromeDevTools#2169))
([0217397](ChromeDevTools@0217397))
* support allowedUrlPattern & blockedUrlPattern Options
([ChromeDevTools#2037](ChromeDevTools#2037))
([02b4492](ChromeDevTools@02b4492))


### 🛠️ Fixes

* Cursor plugin homepage setting field
([ChromeDevTools#2173](ChromeDevTools#2173))
([8971890](ChromeDevTools@8971890))


### 📄 Documentation

* **skill:** guide agent to prompt for --categoryExtensions
([ChromeDevTools#2189](ChromeDevTools#2189))
([8b458f7](ChromeDevTools@8b458f7))


### ⚡ Performance

* lighthouse file saves to run concurrently
([ChromeDevTools#2178](ChromeDevTools#2178))
([f90f863](ChromeDevTools@f90f863))


### 🏗️ Refactor

* change type of logger
([ChromeDevTools#2165](ChromeDevTools#2165))
([bf0574d](ChromeDevTools@bf0574d))
* use validate files on the tool level
([ChromeDevTools#2152](ChromeDevTools#2152))
([2e039c0](ChromeDevTools@2e039c0)),
closes
[ChromeDevTools#2150](ChromeDevTools#2150)

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants