WebRun Browser Automation

Answer guardrail prompt

guardrail_response

Destructive

Respond to a guardrail trigger when the browser agent needs human input (credentials, clarification, approval). The response is handed to the live agent, which continues acting on it.

Input Schema

Name	Required	Description
`askId`	No	The question's askId (from get_task_status), when known: refused if that question is no longer waiting.
`files`	No	Optional file IDs to attach: ids returned by POST /files/upload, or any file already in one of the user's environment catalogs (GET /environments/:id/files). Max 5 files.
`newState`	No	How to continue: 'resume' (default) provides the requested input and continues the task; 'deny' declines the request (response text optional).
`response`	No	Your response/instructions to the agent. Required when newState is 'resume'.
`decisions`	No	For an approval question (one listing numbered drafts): a decision per draft number. Without it, response must be in the fixed format 1 send · 2 edit: "new text" · 3 skip.
`sessionId`	Yes	Session ID

Output Schema

Name	Required	Description
`taskId`	No
`message`	No	What happened and what to do next (poll get_task_status)
`success`	Yes
`sessionId`	No

Schema Changelog

Changes observed during successful MCP inspections.

Changed2 schema fields changedOct 30, 2026

addedInput schema / properties / askId

Added value: +{
+  "description": "The question's askId (from get_task_status), when known: refused if that question is no longer waiting.",
+  "type": "string"
+}

addedInput schema / properties / decisions

Added value: +{
+  "description": "For an approval question (one listing numbered drafts): a decision per draft number. Without it, response must be in the fixed format 1 send · 2 edit: \"new text\" · 3 skip.",
+  "items": {
+    "properties": {
+      "body": {
+        "description": "The new text, for edit",
+        "type": "string"
+      },
+      "decision": {
+        "enum": [
+          "send",
+          "edit",
+          "skip"
+        ],
+        "type": "string"
+      },
+      "n": {
+        "type": "integer"
+      }
+    },
+    "required": [
+      "n",
+      "decision"
+    ],
+    "type": "object"
+  },
+  "type": "array"
+}

Changed1 schema field changedSep 6, 2026

changedInput schema / properties / files / description

Previous value: -"Optional file IDs to attach (from /files/upload). Max 5 files."New value: +"Optional file IDs to attach: ids returned by POST /files/upload, or any file already in one of the user's environment catalogs (GET /environments/:id/files). Max 5 files."

Changed1 schema field changedAug 8, 2026

changedOutput schema / (root)

Previous value: -nullNew value: +{
+  "additionalProperties": true,
+  "properties": {
+    "message": {
+      "description": "What happened and what to do next (poll get_task_status)",
+      "type": "string"
+    },
+    "sessionId": {
+      "type": "string"
+    },
+    "success": {
+      "type": "boolean"
+    },
+    "taskId": {
+      "type": [
+        "string",
+        "null"
+      ]
+    }
+  },
+  "required": [
+    "success"
+  ],
+  "type": "object"
+}

First observedAug 8, 2026

TDQS

A4/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With destructiveHint=true and idempotentHint=false already declared, the description adds the key consequence: the response is handed to the live agent, which continues acting on it. That tells the agent its text has real downstream effect on a running session. It does not elaborate on what makes the call destructive or what a stale askId means, which the schema handles instead.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, zero waste, with the trigger condition front-loaded and the consequence second. Nothing is padded or repeated from the schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Output schema exists, so return values need no explanation, and the schema covers all six parameters thoroughly. The description supplies the trigger and the downstream effect, which is most of what an agent needs before calling a destructive, open-world tool. Only the relationship to adjacent tools (get_task_status, send_task) is left implicit.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so every parameter is already documented in detail, including askId, newState, response, decisions, and files. The description only adds the parenthetical input types (credentials, clarification, approval), which is marginal beyond the schema. Baseline 3 is correct.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Respond to a guardrail trigger') plus the concrete situation that produces it (browser agent needs credentials, clarification, or approval). An agent can distinguish it from generic task tools, though it never names a sibling such as send_task or resume_agent to sharpen the boundary.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives a clear triggering condition ('when the browser agent needs human input') and lists the three input types that qualify. It does not state when not to use it or explicitly route to alternatives, so it stops short of full when/when-not guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All WebRun Browser Automation tools Inspect

Try in Browser

Let your AI agent see the webWeb-to-screenshot MCP for Claude, Cursor and Codex. No cookie banners. Free to start.snap-render.comAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources

Need Help?