vitest-dev/vitest · error · Error

Cannot use CDP because browser API write or exec operations…

Error message

Cannot use CDP because browser API write or exec operations are disabled. See https://vitest.dev/config/api.

What it means

assertCdpAllowed requires both allowExec and allowWrite on BOTH project.config.api and project.vitest.config.api to be true. These flags default to false when the API server is exposed to the network (api.host set), as a security measure. CDP can execute arbitrary page actions and write files, so it is gated behind both flags.

Solutions

1. Set api.allowExec and api.allowWrite to true explicitly if you trust the network boundary and need CDP.
2. Do not expose the API to a public network; bind to a loopback or LAN address instead.
3. If CDP is not needed, suppress the warning by acknowledging the disabled feature rather than enabling it.
4. Confirm both project-level and root-level api configs agree (both must allow).

Example fix

// before
export default defineConfig({ test: { api: { host: '0.0.0.0' } } }) // exposes API, CDP blocked
// after
export default defineConfig({ test: { api: { host: '127.0.0.1', allowExec: true, allowWrite: true } } })

function cdpIsAllowed(api: { allowExec?: boolean; allowWrite?: boolean }, rootApi: { allowExec?: boolean; allowWrite?: boolean }): boolean {
  return !!(api.allowExec && api.allowWrite && rootApi.allowExec && rootApi.allowWrite)
}

When it happens

Trigger: Running Vitest with --api.host (or api.host in config) so the API is exposed, which flips allowExec/allowWrite defaults to false, then attempting any CDP-based operation. Also fires if the user explicitly set allowExec/allowWrite to false.

Common situations: CI dashboards or shared machines exposing the Vitest API and then trying to use the browser devtools/CDP panel; setting api.host for monitoring and forgetting to opt back into write/exec; misreading the warning printed by resolveConfig.

Related errors

• Access denied to " ". See Vite config documentation for…
• Access denied to " ". See Vite config documentation for…
• Browser provider is not defined for the project
• Cannot modify file " ". File writing is disabled because…
• CDP is not supported by the provider

AI-assisted analysis of vitest-dev/vitest@1fa9837ec2 (2026-08-11). Data as JSON: /api/errors/12250d8cd47e40d8. Report an issue: GitHub.

Appendix: source

Thrown at packages/browser/src/node/rpc.ts:144

  function canWrite(project: TestProject) {
    return (
      project.config.api.allowWrite
      && project.vitest.config.api.allowWrite
    )
  }

  function isCdpAllowed(project: TestProject) {
    return (
      project.config.api.allowExec
      && project.vitest.config.api.allowExec
      && project.config.api.allowWrite
      && project.vitest.config.api.allowWrite
    )
  }

  function assertCdpAllowed(project: TestProject) {
    if (!isCdpAllowed(project)) {
      throw new Error(
        `Cannot use CDP because browser API write or exec operations are disabled. See https://vitest.dev/config/api.`,
      )
    }
  }

  function setupClient(
    project: TestProject,
    rpcId: string,
    ws: WebSocket,
    options: {
      sessionId: string
    },
  ) {
    const mockResolver = new ServerMockResolver(globalServer.vite, {
      moduleDirectories: project.config?.deps?.moduleDirectories,
    })
    const mocker = project.browser?.provider.mocker

View on GitHub (pinned to 1fa9837ec2)