feat(mcp): support wildcard port in allowedOrigins and blockedOrigins

[saarya-cyera]

Summary

Add support for wildcard port syntax like http://localhost:* in the network.allowedOrigins and network.blockedOrigins config options. This allows restricting browser requests to a specific protocol and hostname while accepting any port number.

Fixes microsoft/playwright-mcp#1337

Changes

• packages/playwright/src/mcp/browser/context.ts: Update originOrHostGlob() to detect wildcard port patterns and generate the correct glob pattern
• packages/playwright/src/mcp/config.d.ts: Document supported origin formats in JSDoc
• tests/mcp/request-blocking.spec.ts: Add 4 tests for wildcard port functionality

Problem

Previously, patterns like http://localhost:* would fail to parse as a valid URL, causing the code to fall through to legacy host-only mode and generate an invalid glob pattern like *://http://localhost:*/** which never matches anything.

Solution

Detect wildcard port patterns with regex before attempting URL parsing:

const wildcardPortMatch = originOrHost.match(/^(https?):\/\/([^/:]+):\*$/);
if (wildcardPortMatch) {
  const [, protocol, hostname] = wildcardPortMatch;
  return `${protocol}://${hostname}:*/**`;
}

Input	Previous Output	New Output
http://localhost:*	*://http://localhost:*/** ❌	http://localhost:*/** ✅
https://example.com:*	*://https://example.com:*/** ❌	https://example.com:*/** ✅
http://localhost:8000	http://localhost:8000/**	(unchanged)
localhost	*://localhost/**	(unchanged)

Use Case

This is useful when you want to:

• Allow only HTTP (not HTTPS) traffic to localhost
• Allow localhost on any port while blocking other hosts
• Have more granular control over protocol while keeping port flexibility

[saarya-cyera]

@microsoft-github-policy-service agree company="Cyera"

[saarya-cyera]

@yury-s thanks for the review! I fixed the comments and need another review to merge - would you have a minute to circle back to this? Thanks!

[github-actions]

Test results for "MCP"

4 failed
❌ [chrome] › mcp/cli.spec.ts:496 › session › session-delete named session @mcp-ubuntu-latest
❌ [chrome] › mcp/cli.spec.ts:386 › devtools › video-start-stop @mcp-macos-15
❌ [chromium] › mcp/cli.spec.ts:298 › save as › screenshot --filename @mcp-macos-15
❌ [chromium] › mcp/cli.spec.ts:386 › devtools › video-start-stop @mcp-macos-15

3650 passed, 129 skipped

---

Merge workflow run.

[saarya-cyera]

Thanks @yury-s !