MCP & browser agents Updated Nov 2026 · v1.9 · Saves 3.5 hrs · Intermediate

The safe 5-server MCP config for browser QA, read-only SQL, and Git

Wire Chrome DevTools, read-only Postgres, scoped filesystem, and GitHub search into Claude Desktop or local coding agents without exposing production write credentials.

ARCHITECTURE PIPELINE

Why default setups fall short

Most tutorials tell you to paste root database URLs and unrestricted shell servers straight into claude_desktop_config.json. One hallucinated migration later, your staging tables are gone. This guide sets up a hardened 5-server Model Context Protocol stack that gives your agent full live browser inspection and SQL diagnostics with zero destructive permissions.

Prerequisites before starting

Node.js 20+ installed locally
Claude Desktop, Cursor, or any MCP-compatible agent client
Google Chrome or Chromium for live DevTools inspection

Step-by-step implementation

STEP 01

1. Create a strictly read-only database role with a 5-second timeout

Never pass your application's primary DATABASE_URL to an MCP server. Create a dedicated PostgreSQL role limited to SELECT with statement_timeout set to 5000ms so an unindexed join cannot lock production.

CREATE ROLE mcp_reader WITH LOGIN PASSWORD 'strong_random_secret';
GRANT CONNECT ON DATABASE app_prod TO mcp_reader;
GRANT USAGE ON SCHEMA public TO mcp_reader;
GRANT SELECT ON ALL TABLES IN SCHEMA public TO mcp_reader;
ALTER ROLE mcp_reader SET statement_timeout = '5000';

STEP 02

2. Pin exact package versions in claude_desktop_config.json

Avoid floating @latest tags on npx MCP invocations—both for cold-start speed and supply-chain safety. Pin verified versions and scope the filesystem server exclusively to your active project directory.

{
  "mcpServers": {
    "chrome-devtools": {
      "command": "npx",
      "args": ["[email protected]", "--headless=false"]
    }
  }
}

STEP 03

3. Automate end-to-end visual and console verification

Pair Chrome DevTools MCP with a verification checklist skill so your agent checks network 4xx/5xx responses, console uncaught errors, and mobile 375px overflow automatically after every edit.