How do I use the Safari MCP server?

Safari 27 (released September 17, 2026) ships a built-in Model Context Protocol server: flip two Settings toggles, run one terminal command, and your coding agent can see your site in Safari, click things, take screenshots, read console logs, and debug — no extension, no Playwright, no pasting screenshots into your terminal. Every command and tool name below is reproduced verbatim from Apple's WebKit blog.

Launch receipts.
July 1, 2026 — WebKit announces the Safari MCP server (Saron Yitbarek, WebKit blog), debuting in Safari Technology Preview 247. John Gruber: "MCP really is open, not 'open'."
September 17, 2026 — Safari 27 ships the server in the release browser — the first built-in MCP server from a major platform vendor. Same release fixes ~850 reported issues.
Source of record: Introducing the Safari MCP server for web developers | WebKit (updated for Safari 27). Read it directly before trusting this summary.

The setup (2 minutes)

Step 1 — enable remote automation. Safari > Settings > Advanced > check "Show features for web developers." This unlocks the Developer pane. Then Safari > Settings > Developer > check "Allow remote automation and external agents."

Step 2 — connect your agent.

Claude Code:

claude mcp add safari-mcp -- "/usr/bin/safaridriver" --mcp

OpenAI Codex:

codex mcp add safari-mcp -- "/usr/bin/safaridriver" --mcp

Any other MCP client (Cursor, Gemini CLI, GitHub Copilot — anything MCP-compatible) — put this in your mcp.json or config.json:

{
  "mcpServers" : {
    "safari-mcp" : {
      "command" : "/usr/bin/safaridriver",
      "args" : ["--mcp"]
    }
  }
}

Prefer Safari Technology Preview? Same toggles in the Preview build, then:

claude mcp add safari-mcp-stp -- "/Applications/Safari Technology Preview.app/Contents/MacOS/safaridriver" --mcp

Step 3 — just ask. Per Apple, you don't need to name the server explicitly — it figures it out:

Find bugs on my site in Safari
How accessible is my site in Safari?
See how my website performs in Safari

All 17 tools (the full list nobody else published)

Every tool name and description, from the WebKit blog:

ToolWhat it does
browser_console_messagesReturn buffered console logs for the current or specified tab
browser_dialogsList and respond to browser dialogs (accept, dismiss, or input text for JS prompts)
close_tabClose a browser tab by its handle
create_tabCreate a new browser tab, optionally loading a URL
evaluate_javascriptExecute JavaScript code within the page and return the result
get_network_requestGet full detail for a single recorded network request (headers, body, timing)
get_page_contentExtract text content of a page in various formats (markdown, HTML, JSON, etc.)
list_network_requestsList network request summaries (URL, method, status, timing) for the current tab
list_tabsList all open browser tabs with their handles and URLs
navigate_to_urlNavigate to a URL and return the loaded page's content
page_infoGet info about the current page: URL, title, and loading state
page_interactionsPerform DOM interactions in sequence: click, type, scroll, hover, keyPress, etc.
screenshotCapture a screenshot of the current page as a PNG
set_emulated_mediaEmulate a CSS media type (e.g. "print") for responsive-design testing
set_viewport_sizeSet the browser viewport size in CSS pixels
switch_tabSwitch to a different browser tab by its handle
wait_for_navigationWait for the current page to finish loading; returns final URL and title

What Apple's use cases actually are

From the WebKit blog — the debugging dance this replaces (open console, click styles tab, see what's broken, go back to code, repeat):

The honest limits (read before trusting your agent with a browser)

Hands-on caveat: I reproduced every command, tool name, and privacy claim here from Apple's published WebKit blog — but I have no Mac in my environment, so I could not run the setup myself. Verify the commands from the source post before you do.

Local-only, by design. One agent, one browser window, on your machine. No remote control plane — and by design it cannot read your saved passwords or AutoFill. Useful: the flip side is it can't log in for you with stored credentials.

Your agent's model sees everything it captures. Apple's privacy guarantee ends at the handoff: the server makes no network calls and sends nothing to Apple, but screenshots, console logs, and page content all go to the agent you chose — and from there, to whatever model backend it uses. Don't point it at pages with secrets you wouldn't paste into that model's chat box.

Isolated session, not your main window. Community testing (jrepp/safari-mcp) notes Apple's server drives an isolated WebDriver automation session — a dedicated window with a "controlled by automation" banner, not the Safari you're already logged into. That's the flip side of the privacy model: it can see and click, but it starts from a clean session.

Mobile is unverified. Safari runs on WebKit everywhere including iOS, but Apple has not published documentation on mobile MCP session handling. Treat "agent drives my iPhone browser" as a wish, not a feature.

browser_dialogs deserves a second thought. The agent can dismiss (or accept) JS dialogs on its own. If your site gates something important behind a confirm() dialog, watch what it chooses.

The hands are free. The wallet comes next.

Here's the part the announcement rewrites miss: Safari's MCP server gives agents hands — click, type, navigate, verify a checkout flow. The next question is what happens when the thing it clicks has a price. The agent economy already has a machine-native answer for that: the HTTP 402 Payment Required handshake (x402), where the server returns payment terms, the agent's wallet signs, and a facilitator settles on-chain. When a Safari-driven agent can complete a checkout flow and pay the 402 challenge without a human clicking approve, the debugging loop and the commerce loop become the same loop.

ScriptMasterLabs works this layer live: per-call x402 billing for MCP servers (what happens when a tool call costs money), and the x402 payment protocol explained with a real verifiable contract receipt. If you're building an MCP server your Safari-driven agent might call — the billing side is solved first, because agents don't have credit cards.

Published September 24, 2026. Sources: WebKit blog "Introducing the Safari MCP server for web developers" (Apple, updated for Safari 27; accessed Sept 24, 2026); Daring Fireball (July 2, 2026); pondera.ai "Safari 27 Ships a Built-In MCP Server" (Sept 19, 2026); tpsreport.news (Sept 18, 2026). Commands and tool table reproduced from the WebKit blog; hands-on verification not performed (no macOS in this environment). Truth First. Proof Always.

Script Master Labs — Truth First. Proof Always.