browser_evaluate
Execute JavaScript in browser consoles to test web applications for vulnerabilities during penetration testing.
Instructions
Execute JavaScript in the browser console
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| script | Yes | JavaScript code to execute |
Implementation Reference
- index.ts:721-762 (handler)Handler implementation for the browser_evaluate tool. Evaluates the provided JavaScript script in the browser page context using page.evaluate, temporarily overrides console methods to capture logs, executes the script with eval, restores console, and returns the result object containing execution result and captured logs, or an error message if execution fails.
case ToolName.BrowserEvaluate: try { const result = await page.evaluate((script) => { const logs: string[] = []; const originalConsole = { ...console }; ['log', 'info', 'warn', 'error'].forEach(method => { (console as any)[method] = (...args: any[]) => { logs.push(`[${method}] ${args.join(' ')}`); (originalConsole as any)[method](...args); }; }); try { const result = eval(script); Object.assign(console, originalConsole); return { result, logs }; } catch (error) { Object.assign(console, originalConsole); throw error; } }, args.script); return { content: [ { type: "text", text: `Execution result:\n${JSON.stringify(result.result, null, 2)}\n\nConsole output:\n${result.logs.join('\n')}`, }, ], isError: false, }; } catch (error) { return { content: [{ type: "text", text: `Script execution failed: ${(error as Error).message}`, }], isError: true, }; } - index.ts:155-165 (registration)Registration of the browser_evaluate tool in the TOOLS array, specifying its name, description, and input schema which requires a 'script' string parameter.
{ name: ToolName.BrowserEvaluate, description: "Execute JavaScript in the browser console", inputSchema: { type: "object", properties: { script: { type: "string", description: "JavaScript code to execute" }, }, required: ["script"], }, }, - index.ts:158-164 (schema)Input schema definition for the browser_evaluate tool, defining the expected arguments structure with a required 'script' property of type string.
inputSchema: { type: "object", properties: { script: { type: "string", description: "JavaScript code to execute" }, }, required: ["script"], }, - index.ts:32-35 (registration)Enum definition ToolName.BrowserEvaluate mapped to the tool name string 'browser_evaluate'.
BrowserEvaluate = "browser_evaluate", BrowserUrlReflectedXss = "broser_url_reflected_xss", BrowserUrlSqlInjection = "browser_url_sql_injection" }