[Bug]: MCP --allowed-origins with wildcard port (http://localhost:*) generates invalid glob pattern

[saarya-cyera]

Version

1.52.0 (latest)

Steps to reproduce

1. Start the Playwright MCP server with a wildcard port pattern:

npx @playwright/mcp@latest --allowed-origins "http://localhost:*"

2. Try to navigate to any localhost URL like http://localhost:8000

3. The request is blocked even though it should be allowed

Expected behavior

When using --allowed-origins "http://localhost:*", the browser should be able to navigate to any localhost URL regardless of port (e.g., http://localhost:3000, http://localhost:8080).

This pattern is useful when you want to:

• Allow only HTTP (not HTTPS) traffic to localhost
• Allow localhost on any port while blocking other hosts

Actual behavior

The pattern http://localhost:* generates an invalid glob pattern and requests are blocked.

Root cause analysis:

In packages/playwright/src/mcp/browser/context.ts, the originOrHostGlob function:

function originOrHostGlob(originOrHost: string) {
  try {
    const url = new URL(originOrHost);
    if (url.origin !== 'null')
      return `${url.origin}/**`;
  } catch {
  }
  // Support for legacy host-only mode.
  return `*://${originOrHost}/**`;
}

When http://localhost:* is passed:

1. new URL('http://localhost:*') throws because :* is not a valid port
2. The code falls through to legacy mode, returning *://http://localhost:*/**
3. This malformed pattern never matches any URL

Additional context

I have a fix ready in my fork: https://github.com/saarya-cyera/playwright/tree/fix/mcp-origin-wildcard-port

The fix detects wildcard port patterns with regex and generates the correct glob:

• Input: http://localhost:* → Output: http://localhost:*/**
• Input: https://example.com:* → Output: https://example.com:*/**

The PR includes:

• Fix in originOrHostGlob() function
• 4 new tests following existing conventions
• Documentation updates in config.d.ts

Environment

System:
  OS: macOS 15.2
  CPU: Apple M3 Max
Binaries:
  Node: 22.x
npmPackages:
  @playwright/mcp: latest