Chrome DevTools MCP 1.9.0 adds a --workspace option for filesystem roots and widens --no-javascript-evaluation to navigations and init scripts

ChromeDevTools/chrome-devtools-mcp released v1.9.0 on 2026-09-08, grouping several safety and configuration controls under one release. The CLI's --allow-unrestricted-paths flag, which when set disables the default restriction that otherwise confines file-writing tools to the OS temp directory, now defaults to true specifically for the CLI entry point (PR #2618), where it previously defaulted to false as it still does for other invocation modes. The same release cycle deprecated that flag in favor of a new --workspace option (PR #2605): an array-typed setting, aliased from filesystemRoot, described in the code as "a directory that filesystem tools are allowed to access," which "may be specified more than once." The deprecation notice on --allow-unrestricted-paths points callers to --workspace=/ as the replacement for unrestricted access.

The release also introduces --no-javascript-evaluation (PR #2627), which defaults its underlying option to enabled and, when passed, disables the evaluate_script and slim evaluate tools. Before the release shipped, PR #2638 extended the same flag's scope: with it set, the initScript parameter of navigate_page is turned off and navigation to javascript:, data:, or vbscript: URLs is disallowed, not just the evaluation tools. A separate new flag, --no-source-maps (PR #2628), disables source maps in DevTools.

The server is cataloged. None of these five changes carries a GitHub security advisory; they shipped as ordinary feature and configuration additions in the v1.9.0 release notes.