[Bug]: MCP HTTP clients can terminate the server through /killkillkill

Version

1.63.0-next (microsoft/playwright main at commit 2cc9f3ee7fdd82feb87edb7f24af77442bdc10e2)

The route is also present in the Playwright 1.62.0 source.

Steps to reproduce

Source reference:

https://github.com/microsoft/playwright/blob/2cc9f3ee7fdd82feb87edb7f24af77442bdc10e2/packages/playwright-core/src/tools/utils/mcp/http.ts

No application code is required to reproduce this.

1. Start the MCP server in HTTP mode:

npx -y @playwright/mcp@latest --port 8931 --headless

1. Wait for the server to report that it’s listening on port 8931.

2. From another process, send:

curl -i \
  -X POST \
  -H 'x-pw-mcp-kill: 1' \
  http://localhost:8931/killkillkill

1. Observe that the request returns 200 with Killing process and the MCP server enters its SIGINT shutdown path.

The caller doesn’t need to be the process that started the MCP server. Any programmatic HTTP client that can reach an allowed host can send the same fixed header.

Expected behavior

An ordinary MCP HTTP client shouldn’t be able to terminate the server process.

Graceful shutdown should remain available to the process that started the server or to an authorized process supervisor, without exposing process-lifecycle control through the normal HTTP API.

Actual behavior

The MCP HTTP server exposes:

POST /killkillkill
x-pw-mcp-kill: 1

A matching request returns 200, emits SIGINT inside the server process, and starts graceful shutdown.

The header is a fixed public value. It reduces the CSRF risk, but it doesn’t authenticate the caller or show that the caller owns the process.

Additional context

The endpoint was introduced in https://github.com/microsoft/playwright/pull/37484 so Playwright’s HTTP and SSE lifecycle tests could exercise graceful SIGINT shutdown on Windows. On Windows, child.kill('SIGTERM') terminates the process without running the same graceful shutdown handlers.

It originally shipped as an unauthenticated GET endpoint. https://github.com/microsoft/playwright/pull/40551 later changed it to POST with the fixed x-pw-mcp-kill: 1 header to reduce cross-origin request forgery exposure.

At the current source, the route appears in the MCP HTTP implementation and is called by the http transport browser sigint test. I couldn’t find a documented workflow that presents it as an agent-management or remote-administration API.

A possible replacement is to let the spawning test parent request graceful shutdown through the child stdin pipe it already owns:

• install the listener only in HTTP test mode;
• translate parent stdin EOF into the existing SIGINT cleanup path;
• leave MCP stdio input ownership unchanged;
• keep normal operating-system termination available to process owners and supervisors.

I’ve prepared an implementation and tests for this approach. The full MCP HTTP test file, build, and focused lint checks pass on Ubuntu 24.04, macOS 15, and Windows Server 2025.

Environment

System:
  OS: Ubuntu 24.04.4 LTS
  CPU: x64 GitHub-hosted runner
Binaries:
  Node: 22.23.1
  npm: 10.9.8
npmPackages:
  playwright: 1.63.0-next