feat: add WebAuthn virtual authenticator tools by ed-lepedus-thenvoi · Pull Request #823 · ChromeDevTools/chrome-devtools-mcp

ed-lepedus-thenvoi · 2026-01-24T10:28:13Z

Adds 7 new tools exposing the Chrome DevTools Protocol WebAuthn domain for virtual authenticator testing:

Tool	Description
`webauthn_enable`	Enable virtual authenticator environment
`webauthn_add_authenticator`	Add CTAP2/U2F virtual authenticator
`webauthn_remove_authenticator`	Remove virtual authenticator
`webauthn_get_credentials`	List registered credentials
`webauthn_add_credential`	Pre-seed a credential
`webauthn_clear_credentials`	Clear all credentials
`webauthn_set_user_verified`	Toggle user verification state

Use Case

Enables automated testing of WebAuthn/passkey flows without physical security keys or platform authenticators (Touch ID, Windows Hello). Useful for:

E2E testing of passkey registration and authentication
CI/CD pipelines that need to test WebAuthn flows
Development workflows where hardware authenticators aren't available

Implementation

Uses Puppeteer's internal _client() API to access CDP session (same pattern as performance tools)
Follows existing tool patterns with defineTool() and Zod schemas
Includes user-friendly error messages for common failure modes
All 295 tests passing, linting clean

Testing

Verified E2E on webauthn.io - successfully completed passkey registration and authentication flows using virtual authenticator.

🤖 Generated with Claude Code

- Create src/tools/webauthn.ts with enableWebAuthn tool - Export from src/tools/tools.ts - Add basic test in tests/tools/webauthn.test.ts The tool currently does nothing - just returns success message. Next step: implement actual WebAuthn.enable CDP call. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

The webauthn_enable tool now actually calls the CDP WebAuthn.enable command, enabling the virtual authenticator environment. Test verifies this by successfully adding a virtual authenticator after calling the tool. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Implements the ability to add virtual authenticators with configurable: - protocol (u2f, ctap2) - transport (usb, nfc, ble, internal) - hasResidentKey (passkey support) - hasUserVerification - isUserVerified Returns the authenticatorId for use in subsequent operations. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

- Fix ESLint import/order for type imports in tools.ts - Apply Prettier formatting to webauthn files Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Added tools: - webauthn_remove_authenticator: Remove a virtual authenticator - webauthn_get_credentials: List credentials on an authenticator - webauthn_add_credential: Add a pre-seeded credential - webauthn_clear_credentials: Clear all credentials - webauthn_set_user_verified: Toggle user verification state All tools follow the established pattern using CDP WebAuthn domain. Tests verify each tool works correctly (except add_credential which requires complex key generation - verified schema only). Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

- Run npm run docs to regenerate tool reference - Update WEBAUTHN_IMPLEMENTATION.md with final status Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

- Add getCDPSession() helper to centralize CDP session access - Add handleWebAuthnError() for user-friendly error messages - Wrap all CDP calls in try/catch blocks - Add specific error handling for addCredential (userHandle, privateKey) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

google-cla · 2026-01-24T10:28:19Z

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

OrKoN

Thanks for the PR! We prefer not to include too much low level CDP code directly into the MCP server. Please use the existing WebAuthN model in the chrome-devtools-frontend dependency (third_party/devtools-frontend/src/front_end/core/sdk/WebAuthnModel.ts) (similar to how source map models are integrated). Alternatively, if the DevTools models do not satisfy the use case for some reason, we should consider adding higher level API into Puppeteer so that it is beneficial beyond the MCP server alone.

It would be great to also file an issue first to allow us to prioritize the feature and understand the use case to perhaps define an API that requires fewer tools.

OrKoN · 2026-01-24T13:34:07Z

+  - [`webauthn_add_authenticator`](#webauthn_add_authenticator)
+  - [`webauthn_add_credential`](#webauthn_add_credential)
+  - [`webauthn_clear_credentials`](#webauthn_clear_credentials)
+  - [`webauthn_enable`](#webauthn_enable)
+  - [`webauthn_get_credentials`](#webauthn_get_credentials)
+  - [`webauthn_remove_authenticator`](#webauthn_remove_authenticator)
+  - [`webauthn_set_user_verified`](#webauthn_set_user_verified)


It looks like we could use a single tool configure_webauthn to configure all of the WebAuthN virtual authenticator state (getting rid of dedicated commands). If WebAuthN is enabled, its status should be returned for all calls (in McpResponse) eliminating a need for get. If any CDP events can be emitted via the user actions on the page, the McpContext should accumulate them automatically and include them in the McpResponse automatically.

OrKoN · 2026-01-24T13:34:27Z

+- **[Emulation](#emulation)** (9 tools)
  - [`emulate`](#emulate)
  - [`resize_page`](#resize_page)
+  - [`webauthn_add_authenticator`](#webauthn_add_authenticator)


we probably want a dedicated category for WebAuthN with a separate CLI flag to control it.

OrKoN · 2026-02-18T13:02:03Z

Closing the PR as stale. Please file a feature request so that we can prioritize providing WebAuthn tools.

ed-lepedus-thenvoi · 2026-02-19T09:53:02Z

Hey, sorry for the radio silence on this, been heads-down on a myriad things.

The upshot is that I've gone all-in on webauthn-only auth for all my projects going forward. I built my own lightweight IdP (wildcard.id), and even when I'm not using it, I prefer to have webauthn because it completely bypasses the need for me to collect any PII, so I don't have to worry about GDPR compliance etc.

The whole thing works beautifully, except for it completely killing end-to-end validation workflows where I have claude drive Chrome through the devtools MCP and pretend to be a user.

I'm not precious about how it's achieved, and I'm willing to put in the legwork to make this happen, but I really need webauthn not to be an invisible wall that stops automation in its place.

What do I need to do to get this functionality over the line?

OrKoN · 2026-02-19T09:58:56Z

@ed-lepedus-thenvoi let's start by filling a feature request in this repo? Then we can discuss the tool set and whether it needs to be behind a flag (I would save we only need a single tool called configure_webauthn and it can be off by default, requiring a CLI flag). Then instead of re-implementing the CDP client we should re-use the client available in the DevTools frontend (or alternatively we can add a Puppeteer API for this). Let's continue discussion on a feature request.

ed-lepedus-thenvoi · 2026-02-20T09:47:08Z

@OrKoN submitted the feature request as #1004 from my personal account

ed-lepedus-thenvoi and others added 8 commits January 24, 2026 09:10

style: fix import order and formatting

248f408

- Fix ESLint import/order for type imports in tools.ts - Apply Prettier formatting to webauthn files Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

docs: update tool reference and implementation notes

5b6939e

- Run npm run docs to regenerate tool reference - Update WEBAUTHN_IMPLEMENTATION.md with final status Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

docs: add error handling section to implementation notes

6f43b95

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

chore: remove internal implementation notes

ba7e900

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

OrKoN requested changes Jan 24, 2026

View reviewed changes

OrKoN reviewed Jan 24, 2026

View reviewed changes

OrKoN closed this Feb 18, 2026

elepedus mentioned this pull request Feb 20, 2026

WebAuthn support #1004

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: add WebAuthn virtual authenticator tools#823

feat: add WebAuthn virtual authenticator tools#823
ed-lepedus-thenvoi wants to merge 9 commits intoChromeDevTools:mainfrom
ed-lepedus-thenvoi:feat/webauthn-support

ed-lepedus-thenvoi commented Jan 24, 2026

Uh oh!

google-cla Bot commented Jan 24, 2026

Uh oh!

OrKoN left a comment

Uh oh!

OrKoN Jan 24, 2026 •

edited

Loading

Uh oh!

OrKoN Jan 24, 2026

Uh oh!

OrKoN commented Feb 18, 2026

Uh oh!

ed-lepedus-thenvoi commented Feb 19, 2026

Uh oh!

OrKoN commented Feb 19, 2026

Uh oh!

ed-lepedus-thenvoi commented Feb 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

ed-lepedus-thenvoi commented Jan 24, 2026

Use Case

Implementation

Testing

Uh oh!

google-cla Bot commented Jan 24, 2026

Uh oh!

OrKoN left a comment

Choose a reason for hiding this comment

Uh oh!

OrKoN Jan 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

OrKoN Jan 24, 2026

Choose a reason for hiding this comment

Uh oh!

OrKoN commented Feb 18, 2026

Uh oh!

ed-lepedus-thenvoi commented Feb 19, 2026

Uh oh!

OrKoN commented Feb 19, 2026

Uh oh!

ed-lepedus-thenvoi commented Feb 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

OrKoN Jan 24, 2026 •

edited

Loading