Method / identity / privacy

A page receipt is only half the story.

FormStage is an independent software project at seedcorn.foundation. It is not a charitable foundation, an education organization, Google, Chrome DevTools or the MCP project. No earlier organization’s identity, endorsements or activity are claimed.

What we measured

On 15 October 2026 we ran the unmodified published chrome-devtools-mcp@1.11.0 server over stdio JSON-RPC against an owned synthetic fixture in isolated Chrome for Testing 156.0.8078.4 on macOS ARM64. The runner obtained actual accessibility-tree UIDs, called native input tools and then read the fixture’s values and events.

The nine observations include both normal controls and a counterexample to a reported Tab-focus effect. They are not a compatibility certification or a test of every input type, browser, operating system or MCP client.

What the hosted page records

• Focus, keyboard, before-input, input, change, click and submit events within the synthetic specimen.
• Current field values, selected-file name and size, event order and intercepted submit count. File contents are not read.
• Up to 500 recent event records and 2,000 characters per field. The total counter can exceed the retained-event count. Reset or reload discards the session.

The web page cannot know the client’s tool name, arguments, response, model reasoning or server version. It therefore labels its downloads as page-only observations. Browser-generated event trust is not proof of human action or MCP origin.

Privacy and export

The playground keeps observations in memory. It does not send entered values to an analysis endpoint, store them in cookies or browser storage, or read local file contents. Selecting a file exposes its name and size to this page; use the provided synthetic text sample.

The default JSON download omits field text, keyboard values, event data and filenames. It retains lengths, event types, fixed target IDs, sizes and counters. An explicit checkbox includes text and names in your local download. The on-screen drawer displays your entered text, so inspect it before sharing a screenshot.

Cloudflare serves the site and may process ordinary HTTP access data. Product links redirect to WebTraceCheck or CleanTempMail with referral tags; those products have their own data practices. No visitor analytics script or payment integration is included here.

Native kit boundaries

The kit uses a separately supplied Chrome for Testing executable and an isolated profile, not your everyday browser profile. Installation contacts npm; execution uses an owned loopback fixture with telemetry disabled. Results are written to local files. Machine paths are shortened in the saved result, but you should review a report before sharing it.

The historical reference is fixed at 1.11.0. An upstream correction should change the observation. See the reproduction instructions to compare another installed version without assuming an old bug must remain.

Primary sources

• Chrome DevTools MCP 1.11.0 release.
• Failed type_text after mutation, issue #3184, and proposed validation fix #3185.
• Input and upload action effects, issue #3180.
• Pinned input implementation and official input tests.

The upstream project already has an extensive native test suite. FormStage adds a small public specimen, dated observations and a portable reproduction kit. It does not replace the official tests or MCP Inspector.

For a correction, email support@cleantempmail.com with the page and version. Do not include private account values or verification links.