camoufox-agent
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@camoufox-agentGo to news.ycombinator.com and list the top 10 headlines."
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
camoufox-agent
Fork de whit3rabbit/camoufox-mcp sobre el navegador oficial Camoufox (binario fijado por SHA-256, sin compilar Firefox). README original: docs/upstream-README.md.
Dos modos en un solo binario:
Comando | Qué hace |
| Servidor MCP por stdio (Claude Code, opencode, Hermes, OpenClaw, Codex, Cursor…) |
| HTTP: REST para apps web, MCP Streamable HTTP en |
| Ejecuta un flujo guardado una vez (para cron/launchd/Programador de tareas) |
| Credenciales para |
| Descarga del navegador / diagnóstico |
Instalación
Publicado en npm: camoufox-agent (Node >= 22).
npm i -g camoufox-agent
camoufox-agent fetch # descarga el navegador fijado por SHA-256 (Linux, macOS, Windows)
camoufox-agent doctor # verifica pines, navegador y un lanzamiento realSin instalar globalmente: npx -y camoufox-agent <comando> (la primera vez ejecute npx -y camoufox-agent fetch).
Registro en agentes
Agente | Comando / configuración |
Claude Code |
|
Codex |
|
opencode |
|
Hermes |
|
OpenClaw |
|
Por HTTP |
|
Si el agente no hereda su PATH, use la ruta absoluta del binario (which camoufox-agent).
Desde el código fuente
git clone https://github.com/Jul879n/camoufox-agent && cd camoufox-agent
npm install --include=optional && npm run build
npm link
camoufox-agent fetchRelated MCP server: CamoFox MCP
Novedades respecto al upstream
Sesiones sin límite de tiempo (
CAMOUFOX_MCP_SESSION_TTL_MSsin definir = nunca expiran).CAMOUFOX_MCP_MAX_SESSIONS(4 por defecto, máx. 64),CAMOUFOX_MCP_MAX_CONCURRENCY(4),CAMOUFOX_MCP_MAX_SEQUENCE_ACTIONS(100).Perfiles persistentes:
browse_session_start { profile }guarda cookies, localStorage e IndexedDB (browse_profiles_list,browse_profile_delete). El perfil fijaos/locale/proxy/window/fingerprint.Credenciales sin exponerlas: acción
fillSecret(CAMOUFOX_SECRET_<NOMBRE>osecrets.jsoncon chmod 600).Archivos: acciones
uploadydownloaddentro deCAMOUFOX_MCP_FILES_DIR(por defecto<HOME>/files).Extracción estructurada:
browse_extract(paginación,saveAsJSON/CSV enexports/).Flujos:
flow_save,flow_list,flow_run; login por script, extracción yschedule(cron de 5 campos).Humano en el loop: acciones
waitForHumanypromptCode; conserve, el usuario interviene desde/live.Acción
gotodentro de secuencias y sesiones.Diagnóstico para desarrollo:
browse_diagnose(urlosessionId): consola y errores no capturados con stack, red (tiempos, tamaños, fallos, caché, compresión), Web Vitals y navigation timing, estadísticas del DOM y una auditoría (SEO, accesibilidad, cabeceras de seguridad, cookies, contenido mixto).saveAsguarda el informe enexports/.browse_inspect: caja, estilos computados, reglas CSS aplicadas, visibilidad, desbordamiento y árbol de accesibilidad de un selector.emulationen cualquier tool:colorScheme,reducedMotion,timezoneId,geolocation,offline.browse_session_start { recordHar }(HAR al cerrar) ybrowse_session_trace(trace de Playwright en.zip).Límite: Camoufox es Firefox, sin CDP. No hay Lighthouse, performance traces de Chrome, heap snapshots ni cobertura; en Firefox faltan además CLS y long tasks (el informe los lista como no soportados).
Datos en CAMOUFOX_AGENT_HOME (por defecto ~/.camoufox-agent): profiles/, flows/, runs/, files/, secrets.json.
Servidor HTTP (serve)
CAMOUFOX_AGENT_TOKEN=secreto camoufox-agent serve --port 9420GET /health(sin auth) ·GET /api/tools·POST /api/tools/:nombre(mismo cuerpo que el input de la tool MCP; 400invalid_input, 404unknown_tool, 422 si la tool devuelve error).POST|GET|DELETE /mcp: MCP Streamable HTTP.GET /live?token=…: vista en vivo (capturas JPEG cada 700 ms, clics y teclado reenviados, pendientes «Listo»/código).GET /api/sessions,/api/sessions/:id/frame.jpg,POST /api/sessions/:id/input,GET /api/human,POST /api/human/:id,GET /api/flows/:nombre/runs.Auth:
CAMOUFOX_AGENT_TOKEN(obligatorio si--hostno es loopback). CORS:CAMOUFOX_AGENT_CORS_ORIGINS=https://app.ejemplo.cl.Otras:
CAMOUFOX_AGENT_HOST,CAMOUFOX_AGENT_PORT,CAMOUFOX_AGENT_HEADLESS(true|false|virtual).
Desde una app web, llame al servidor desde su backend; el token nunca debe llegar al navegador del cliente:
const res = await fetch("http://127.0.0.1:9420/api/tools/browse_extract", {
method: "POST",
headers: { Authorization: `Bearer ${process.env.CAMOUFOX_AGENT_TOKEN}`, "content-type": "application/json" },
body: JSON.stringify({ url: "https://quotes.toscrape.com", itemSelector: ".quote", fields: { author: { selector: ".author" } }, maxPages: 2 }),
});Automatizaciones agendadas
Con serve, cada flujo con schedule se ejecuta solo (protect: no se solapa consigo mismo). Sin servidor, programe camoufox-agent run <flujo>:
Linux:
*/30 * * * * camoufox-agent run mi-flujo >> ~/camoufox.log 2>&1macOS: plist de
launchdconProgramArguments=[/usr/local/bin/camoufox-agent, run, mi-flujo]yStartInterval.Windows:
schtasks /create /tn camoufox-mi-flujo /sc daily /st 08:00 /tr "camoufox-agent run mi-flujo"
Docker Compose
CAMOUFOX_AGENT_TOKEN=secreto docker compose up -d --build
curl -s 127.0.0.1:9420/healthLos datos quedan en ./data (el contenedor corre con uid 1001: chown 1001 data en Linux).
Pruebas
npm run lint && npm run test:unit
for s in upload profile extract; do node scripts/mcp-smoke.mjs $s; done
CAMOUFOX_SECRET_HEROKU_PASS='SuperSecretPassword!' node scripts/mcp-smoke.mjs secret
CAMOUFOX_SECRET_HEROKU_PASS='SuperSecretPassword!' node scripts/mcp-smoke.mjs flowLos escenarios usan un sitio local (tests/fixtures/site.mjs) con CAMOUFOX_MCP_ALLOWED_PRIVATE_HOSTS=localhost.
Available Tools
26 toolsbrowseCRead-only
Navigate once and return bounded page content.
| Name | Required | Description | Default |
|---|---|---|---|
| os | No | Optional OS to spoof. Can be 'windows', 'macos', or 'linux'. If not specified, will rotate between all OS types. | |
| url | Yes | The URL to navigate to and retrieve content from. Use this tool when users ask to visit, check, search, navigate, browse, fetch, or scrape websites. Must be a fully qualified URL (e.g., 'https://example.com'). | |
| args | No | Additional browser command-line arguments to pass to the browser. Rejected unless CAMOUFOX_MCP_ALLOW_UNSAFE_OPTIONS=1; denied args are always rejected. | |
| geoip | No | Automatically detect geolocation based on IP address. | |
| proxy | No | Proxy configuration for routing browser traffic through an HTTP(S) proxy. Proxy servers are checked against the same local-network URL policy as page requests. | |
| locale | No | Browser locale (e.g., 'en-US', 'fr-FR'). | |
| window | No | Set fixed window size [width, height] instead of random generation. An empty array [] is accepted and treated as if the window parameter was not specified. | |
| timeout | No | Timeout in milliseconds for page load (5-300 seconds). | |
| headless | No | Run browser in headless mode. Auto-detects best mode for environment if not specified. | |
| humanize | No | Enable realistic cursor movements and human-like behavior for better stealth and anti-detection. | |
| maxChars | No | Maximum text or HTML characters to return. | |
| selector | No | Optional CSS selector to limit extraction to one matching element. | |
| viewport | No | Custom viewport dimensions. | |
| emulation | No | Context emulation for diagnosing how the page behaves under other conditions. | |
| outputMode | No | Response content mode. Defaults to visible text. Use 'html' only when raw HTML is explicitly needed. | text |
| screenshot | No | Capture a screenshot/image of the page after loading. | |
| block_webgl | No | Block WebGL to prevent fingerprinting and tracking. | |
| block_images | No | Block all images for faster loading, reduced bandwidth, and lightweight browsing. | |
| block_webrtc | No | Block WebRTC entirely for enhanced privacy and stealth. | |
| disable_coop | No | Disable Cross-Origin-Opener-Policy for sites that require it. | |
| enable_cache | No | Cache pages, requests, etc. Uses more memory but improves performance when revisiting pages. | |
| waitStrategy | No | Wait strategy for page load. Defaults to 'domcontentloaded'. 'load' waits for all resources, 'networkidle' waits for network activity to finish. | domcontentloaded |
| captchaPolicy | No | Challenge handling policy. 'detect' reports signals, 'pause' returns state for human action, 'fail' returns an error, 'attempt' returns enhanced challenge metadata, interactive elements, a bounded screenshot, and a suggested strategy. When CAPTCHA_AUTONOMOUS=true, responses are marked for LLM-assisted handling and include provider-specific challengePlaybook context when known. | |
| exclude_addons | No | List of default addons to exclude (e.g., ['ublock_origin']). Rejected unless CAMOUFOX_MCP_ALLOW_UNSAFE_OPTIONS=1. | |
| includeConsole | No | Include bounded page console diagnostics in the JSON response. | |
| includeNetwork | No | Include bounded network diagnostics in the JSON response. | |
| stealthProfile | No | Convenience profile for common Camoufox browser settings. Explicit options override profile values. | normal |
| screenshotOptions | No | Optional screenshot capture settings. Used only when screenshot is true. | |
| firefox_user_prefs | No | Custom Firefox user preferences to set. Rejected unless CAMOUFOX_MCP_ALLOW_UNSAFE_OPTIONS=1; denied prefs are always rejected. |
Output Schema
| Name | Required | Description |
|---|---|---|
| url | Yes | |
| html | No | |
| text | No | |
| title | No | |
| status | No | |
| message | No | |
| maxChars | Yes | |
| selector | No | |
| truncated | Yes | |
| outputMode | Yes | |
| screenshot | No | |
| contentType | No | |
| diagnostics | No | |
| challengeType | No | |
| selectorFound | No | |
| captchaIframes | No | |
| captchaDetected | No | |
| challengeSignals | No | |
| challengeHandling | No | |
| challengePlaybook | No | |
| challengeProvider | No | |
| suggestedStrategy | No | |
| requiresUserAction | No | |
| interactiveElements | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, destructiveHint=false, openWorldHint, and idempotentHint=false, so the safety profile is covered. The description adds only the word 'bounded', which gestures at maxChars truncation but does not explain it, nor does it mention timeout behavior, CAPTCHA handling, or that navigation is non-idempotent and may return different content each call.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler or repetition, which is structurally clean. It is arguably too terse for a 29-parameter tool, but that is an underspecification problem scored elsewhere, not a conciseness failure.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
All output detail is legitimately offloaded to the output schema, but this tool has 29 parameters, nested objects, session siblings, and stealth/fingerprinting behavior with no explanation of defaults, tradeoffs, or when to reach for the session variants. One sentence is not complete enough for a tool of this complexity, even with a rich schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% across all 29 parameters, including enums, defaults, and constraints, so the schema does the heavy lifting. Per the baseline rule this scores 3; the description adds no parameter semantics beyond the single word 'bounded' pointing at maxChars, and nothing about the required url beyond what the schema states.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The verb 'navigate' and object 'page content' are specific enough to identify a one-shot fetch-and-return tool, and 'once' hints at the contrast with session-based siblings. However, it never names what distinguishes it from browse_session_navigate, browse_extract, or browse_snapshot, so an agent must infer positioning from the sibling list alone.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use, when-not-to-use, or alternative tool is mentioned in the description. The 'once' wording weakly implies 'use this for a single page instead of a persistent session', but that is inference, not guidance. The fact that the schema's url field carries the actual use-case routing text means the description itself abdicates this dimension.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browse_consoleBRead-only
Navigate once and return bounded console diagnostics.
| Name | Required | Description | Default |
|---|---|---|---|
| os | No | Optional OS to spoof. Can be 'windows', 'macos', or 'linux'. If not specified, will rotate between all OS types. | |
| url | Yes | The URL to navigate to. Must be a fully qualified http or https URL. | |
| args | No | Additional browser command-line arguments to pass to the browser. Rejected unless CAMOUFOX_MCP_ALLOW_UNSAFE_OPTIONS=1; denied args are always rejected. | |
| geoip | No | Automatically detect geolocation based on IP address. | |
| proxy | No | Proxy configuration for routing browser traffic through an HTTP(S) proxy. Proxy servers are checked against the same local-network URL policy as page requests. | |
| locale | No | Browser locale (e.g., 'en-US', 'fr-FR'). | |
| window | No | Set fixed window size [width, height] instead of random generation. An empty array [] is accepted and treated as if the window parameter was not specified. | |
| timeout | No | Timeout in milliseconds for page load (5-300 seconds). | |
| headless | No | Run browser in headless mode. Auto-detects best mode for environment if not specified. | |
| humanize | No | Enable realistic cursor movements and human-like behavior for better stealth and anti-detection. | |
| viewport | No | Custom viewport dimensions. | |
| emulation | No | Context emulation for diagnosing how the page behaves under other conditions. | |
| block_webgl | No | Block WebGL to prevent fingerprinting and tracking. | |
| block_images | No | Block all images for faster loading, reduced bandwidth, and lightweight browsing. | |
| block_webrtc | No | Block WebRTC entirely for enhanced privacy and stealth. | |
| disable_coop | No | Disable Cross-Origin-Opener-Policy for sites that require it. | |
| enable_cache | No | Cache pages, requests, etc. Uses more memory but improves performance when revisiting pages. | |
| waitStrategy | No | Wait strategy for page load. Defaults to 'domcontentloaded'. 'load' waits for all resources, 'networkidle' waits for network activity to finish. | domcontentloaded |
| captchaPolicy | No | Challenge handling policy. 'detect' reports signals, 'pause' returns state for human action, 'fail' returns an error, 'attempt' returns enhanced challenge metadata, interactive elements, a bounded screenshot, and a suggested strategy. When CAPTCHA_AUTONOMOUS=true, responses are marked for LLM-assisted handling and include provider-specific challengePlaybook context when known. | |
| exclude_addons | No | List of default addons to exclude (e.g., ['ublock_origin']). Rejected unless CAMOUFOX_MCP_ALLOW_UNSAFE_OPTIONS=1. | |
| includeConsole | No | Include bounded page console diagnostics in the JSON response. | |
| includeNetwork | No | Include bounded network diagnostics in the JSON response. | |
| stealthProfile | No | Convenience profile for common Camoufox browser settings. Explicit options override profile values. | normal |
| firefox_user_prefs | No | Custom Firefox user preferences to set. Rejected unless CAMOUFOX_MCP_ALLOW_UNSAFE_OPTIONS=1; denied prefs are always rejected. |
Output Schema
| Name | Required | Description |
|---|---|---|
| url | Yes | |
| title | No | |
| status | No | |
| console | Yes | |
| message | No | |
| network | No | |
| contentType | No | |
| challengeType | No | |
| captchaIframes | No | |
| captchaDetected | No | |
| challengeSignals | No | |
| consoleTruncated | No | |
| challengeHandling | No | |
| challengePlaybook | No | |
| challengeProvider | No | |
| suggestedStrategy | No | |
| requiresUserAction | No | |
| interactiveElements | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, openWorldHint=true, and destructiveHint=false, so the description need not repeat safety basics. It adds 'once' and 'bounded console diagnostics', but omits meaningful behavior around CAPTCHA policy, unsafe-option environment gating, proxy policy, and what 'bounded' actually caps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The definition is one front-loaded sentence with no filler. It may be terse for a 24-parameter tool, but the dimension measures conciseness and every word contributes.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
A rich schema, output schema, and annotations reduce what the description must carry. Still, for a complex open-world navigation tool with 24 options and many close siblings, one sentence is minimum viable and leaves selection and behavioral context thin.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all 24 parameters are already documented in the schema. The description adds no parameter-specific meaning; baseline 3 applies for high coverage with no extra parameter guidance.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a clear verb and resource ('Navigate') plus output scope ('bounded console diagnostics'), and 'once' hints at single-shot behavior versus session-based siblings. It does not explicitly name alternatives, so sibling differentiation is implicit.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use or when-not-to-use guidance, and no mention of alternatives such as browse_session_navigate or browse_diagnose. An agent must infer from the name and schema that this is for one-off console diagnostics rather than persistent browsing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browse_diagnoseA
Developer diagnostics for a page or session: console and uncaught errors with stacks, network timings/sizes/failures/caching, Web Vitals and navigation timing, DOM stats, and an audit (SEO, accessibility, security headers, cookies, mixed content). Supports emulation (color scheme, timezone, geolocation, offline). Firefox has no Lighthouse/CDP profiling.
| Name | Required | Description | Default |
|---|---|---|---|
| os | No | Optional OS to spoof. Can be 'windows', 'macos', or 'linux'. If not specified, will rotate between all OS types. | |
| url | No | URL to diagnose (one-shot). Provide exactly one of url or sessionId. | |
| args | No | Additional browser command-line arguments to pass to the browser. Rejected unless CAMOUFOX_MCP_ALLOW_UNSAFE_OPTIONS=1; denied args are always rejected. | |
| geoip | No | Automatically detect geolocation based on IP address. | |
| proxy | No | Proxy configuration for routing browser traffic through an HTTP(S) proxy. Proxy servers are checked against the same local-network URL policy as page requests. | |
| locale | No | Browser locale (e.g., 'en-US', 'fr-FR'). | |
| reload | No | Sessions only: clear collected data and reload the page first for a clean measurement. | |
| saveAs | No | Also save the full report to CAMOUFOX_MCP_FILES_DIR/exports/<saveAs>. | |
| window | No | Set fixed window size [width, height] instead of random generation. An empty array [] is accepted and treated as if the window parameter was not specified. | |
| timeout | No | Timeout in milliseconds for page load (5-300 seconds). | |
| headless | No | Run browser in headless mode. Auto-detects best mode for environment if not specified. | |
| humanize | No | Enable realistic cursor movements and human-like behavior for better stealth and anti-detection. | |
| sections | No | Defaults to all: console (logs + uncaught errors), network (timings, sizes, failures), perf (navigation timing, Web Vitals, DOM stats), audit (SEO, a11y, security headers, cookies, mixed content). | |
| settleMs | No | Extra time after load for vitals and late requests. | |
| viewport | No | Custom viewport dimensions. | |
| emulation | No | Context emulation for diagnosing how the page behaves under other conditions. | |
| sessionId | No | Existing session. Data covers everything since the session started (or since the last reload:true). | |
| maxEntries | No | Max console/network entries returned per list. | |
| block_webgl | No | Block WebGL to prevent fingerprinting and tracking. | |
| block_images | No | Block all images for faster loading, reduced bandwidth, and lightweight browsing. | |
| block_webrtc | No | Block WebRTC entirely for enhanced privacy and stealth. | |
| disable_coop | No | Disable Cross-Origin-Opener-Policy for sites that require it. | |
| enable_cache | No | Cache pages, requests, etc. Uses more memory but improves performance when revisiting pages. | |
| waitStrategy | No | Wait strategy for page load. Defaults to 'domcontentloaded'. 'load' waits for all resources, 'networkidle' waits for network activity to finish. | domcontentloaded |
| captchaPolicy | No | Challenge handling policy. 'detect' reports signals, 'pause' returns state for human action, 'fail' returns an error, 'attempt' returns enhanced challenge metadata, interactive elements, a bounded screenshot, and a suggested strategy. When CAPTCHA_AUTONOMOUS=true, responses are marked for LLM-assisted handling and include provider-specific challengePlaybook context when known. | |
| exclude_addons | No | List of default addons to exclude (e.g., ['ublock_origin']). Rejected unless CAMOUFOX_MCP_ALLOW_UNSAFE_OPTIONS=1. | |
| includeConsole | No | Include bounded page console diagnostics in the JSON response. | |
| includeNetwork | No | Include bounded network diagnostics in the JSON response. | |
| stealthProfile | No | Convenience profile for common Camoufox browser settings. Explicit options override profile values. | normal |
| firefox_user_prefs | No | Custom Firefox user preferences to set. Rejected unless CAMOUFOX_MCP_ALLOW_UNSAFE_OPTIONS=1; denied prefs are always rejected. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare openWorldHint=true and destructiveHint=false/readOnlyHint=false, so the description's job is to add context — and it does, by disclosing the exact diagnostic payloads, that emulation conditions can be applied, and the Firefox profiling limitation, which is a real capability boundary an agent would otherwise discover only by failing. It does not mention the saveAs side effect or that a one-shot url spins up a browser, which keeps it from a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the payload inventory that an agent most needs to decide relevance, followed by capability and constraint notes. The comma-separated enumerations are dense but each item is load-bearing; no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists and the schema fully documents all 30 parameters, so the description needn't restate return values or option syntax. It covers scope (page vs session), payload contents, and one platform limitation — enough for correct invocation, with only the write/side-effect profile (saveAs, browser launch) left implicit.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% across 30 parameters, so the schema already documents url/sessionId exclusivity, sections, emulation, and timeout. The description reinforces the sections category and emulation capability but adds no format or constraint detail beyond the schema — the baseline 3 for a fully documented schema is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Names a specific resource (page or session diagnostics) and enumerates exactly what it collects: console/uncaught errors with stacks, network timings/sizes/failures/caching, Web Vitals, DOM stats, and a four-part audit. The 'page or session' framing distinguishes it from the pure session tools, but no sibling (browse_console, browse_network_summary, browse_inspect) is named, so the differentiation is inferred rather than stated.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied by the section list (use this when you want a combined console+network+perf+audit report) and by 'Firefox has no Lighthouse/CDP profiling', which warns about a browser-dependent limitation. There is no explicit when-to-use-this-vs-browse_console/browse_network_summary guidance and no exclusions or prerequisites, so an agent must infer routing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browse_extractA
Extract repeated items (rows/cards) into structured JSON, optionally paginating and saving to JSON/CSV under CAMOUFOX_MCP_FILES_DIR/exports. Use url (one-shot) or sessionId.
| Name | Required | Description | Default |
|---|---|---|---|
| os | No | Optional OS to spoof. Can be 'windows', 'macos', or 'linux'. If not specified, will rotate between all OS types. | |
| url | No | URL to extract from (one-shot). Provide exactly one of url or sessionId. | |
| args | No | Additional browser command-line arguments to pass to the browser. Rejected unless CAMOUFOX_MCP_ALLOW_UNSAFE_OPTIONS=1; denied args are always rejected. | |
| geoip | No | Automatically detect geolocation based on IP address. | |
| proxy | No | Proxy configuration for routing browser traffic through an HTTP(S) proxy. Proxy servers are checked against the same local-network URL policy as page requests. | |
| fields | Yes | Output columns: name -> how to read it from each item. | |
| locale | No | Browser locale (e.g., 'en-US', 'fr-FR'). | |
| saveAs | No | Save all rows to CAMOUFOX_MCP_FILES_DIR/exports/<saveAs> (.json or .csv). | |
| window | No | Set fixed window size [width, height] instead of random generation. An empty array [] is accepted and treated as if the window parameter was not specified. | |
| timeout | No | Timeout in milliseconds for page load (5-300 seconds). | |
| headless | No | Run browser in headless mode. Auto-detects best mode for environment if not specified. | |
| humanize | No | Enable realistic cursor movements and human-like behavior for better stealth and anti-detection. | |
| maxChars | No | Maximum JSON characters of rows returned inline (when not saving). | |
| maxItems | No | ||
| maxPages | No | ||
| viewport | No | Custom viewport dimensions. | |
| emulation | No | Context emulation for diagnosing how the page behaves under other conditions. | |
| sessionId | No | Existing session to extract from, at its current page. Provide exactly one of url or sessionId. | |
| block_webgl | No | Block WebGL to prevent fingerprinting and tracking. | |
| block_images | No | Block all images for faster loading, reduced bandwidth, and lightweight browsing. | |
| block_webrtc | No | Block WebRTC entirely for enhanced privacy and stealth. | |
| disable_coop | No | Disable Cross-Origin-Opener-Policy for sites that require it. | |
| enable_cache | No | Cache pages, requests, etc. Uses more memory but improves performance when revisiting pages. | |
| itemSelector | Yes | CSS selector of each repeated item (row/card). | |
| nextSelector | No | CSS selector of the 'next page' control; clicked until maxPages. | |
| waitStrategy | No | Wait strategy for page load. Defaults to 'domcontentloaded'. 'load' waits for all resources, 'networkidle' waits for network activity to finish. | domcontentloaded |
| captchaPolicy | No | Challenge handling policy. 'detect' reports signals, 'pause' returns state for human action, 'fail' returns an error, 'attempt' returns enhanced challenge metadata, interactive elements, a bounded screenshot, and a suggested strategy. When CAPTCHA_AUTONOMOUS=true, responses are marked for LLM-assisted handling and include provider-specific challengePlaybook context when known. | |
| exclude_addons | No | List of default addons to exclude (e.g., ['ublock_origin']). Rejected unless CAMOUFOX_MCP_ALLOW_UNSAFE_OPTIONS=1. | |
| includeConsole | No | Include bounded page console diagnostics in the JSON response. | |
| includeNetwork | No | Include bounded network diagnostics in the JSON response. | |
| stealthProfile | No | Convenience profile for common Camoufox browser settings. Explicit options override profile values. | normal |
| firefox_user_prefs | No | Custom Firefox user preferences to set. Rejected unless CAMOUFOX_MCP_ALLOW_UNSAFE_OPTIONS=1; denied prefs are always rejected. |
Output Schema
| Name | Required | Description |
|---|---|---|
| url | Yes | |
| rows | Yes | |
| count | Yes | |
| pages | Yes | |
| savedPath | No | |
| sessionId | No | |
| rowsTruncated | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotations already declare readOnlyHint=false, openWorldHint=true, idempotentHint=false, and destructiveHint=false, so the safety profile is largely covered. The description adds useful context that extraction can paginate and optionally save JSON/CSV under CAMOUFOX_MCP_FILES_DIR/exports. It does not add deeper behavioral details such as return shape, pagination limits, or permission requirements beyond what the schema provides.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is brief and front-loaded: it states the core action first, then the optional pagination/saving behavior, then the url versus sessionId rule. Every sentence contributes directly to selecting and invoking the tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the rich input schema and the presence of an output schema, the description covers the essential invocation context: item extraction into structured JSON, optional pagination, optional file saving, and the url/sessionId source choice. It is slightly terse for a 32-parameter tool, but the schema already documents the remaining parameters in detail.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 94%, so nearly all parameter meaning is already supplied by the schema. The description only implies itemSelector and fields through the phrase 'repeated items (rows/cards) into structured JSON' and states the url/sessionId choice, but adds no syntax or mapping details beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: extracting repeated items (rows/cards) into structured JSON. It also mentions pagination and saving to JSON/CSV, making the tool's purpose clear. However, it does not explicitly differentiate this tool from sibling extraction/inspection tools such as browse_snapshot or browse_inspect.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives one usage rule: use url for a one-shot extraction or sessionId for an existing session. It does not explain when to choose browse_extract versus alternatives like browse_find, browse_snapshot, or browse_inspect, nor does it state exclusions or prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browse_findBRead-only
Navigate once, search visible text, and return bounded context matches.
| Name | Required | Description | Default |
|---|---|---|---|
| os | No | Optional OS to spoof. Can be 'windows', 'macos', or 'linux'. If not specified, will rotate between all OS types. | |
| url | Yes | The URL to navigate to. Must be a fully qualified http or https URL. | |
| args | No | Additional browser command-line arguments to pass to the browser. Rejected unless CAMOUFOX_MCP_ALLOW_UNSAFE_OPTIONS=1; denied args are always rejected. | |
| geoip | No | Automatically detect geolocation based on IP address. | |
| proxy | No | Proxy configuration for routing browser traffic through an HTTP(S) proxy. Proxy servers are checked against the same local-network URL policy as page requests. | |
| query | Yes | Visible text to search for on the page. | |
| locale | No | Browser locale (e.g., 'en-US', 'fr-FR'). | |
| window | No | Set fixed window size [width, height] instead of random generation. An empty array [] is accepted and treated as if the window parameter was not specified. | |
| timeout | No | Timeout in milliseconds for page load (5-300 seconds). | |
| headless | No | Run browser in headless mode. Auto-detects best mode for environment if not specified. | |
| humanize | No | Enable realistic cursor movements and human-like behavior for better stealth and anti-detection. | |
| selector | No | Optional CSS selector to limit extraction to one matching element. | |
| viewport | No | Custom viewport dimensions. | |
| emulation | No | Context emulation for diagnosing how the page behaves under other conditions. | |
| maxMatches | No | Maximum matches to return. | |
| block_webgl | No | Block WebGL to prevent fingerprinting and tracking. | |
| block_images | No | Block all images for faster loading, reduced bandwidth, and lightweight browsing. | |
| block_webrtc | No | Block WebRTC entirely for enhanced privacy and stealth. | |
| contextChars | No | Characters of surrounding visible text to return per match. | |
| disable_coop | No | Disable Cross-Origin-Opener-Policy for sites that require it. | |
| enable_cache | No | Cache pages, requests, etc. Uses more memory but improves performance when revisiting pages. | |
| waitStrategy | No | Wait strategy for page load. Defaults to 'domcontentloaded'. 'load' waits for all resources, 'networkidle' waits for network activity to finish. | domcontentloaded |
| captchaPolicy | No | Challenge handling policy. 'detect' reports signals, 'pause' returns state for human action, 'fail' returns an error, 'attempt' returns enhanced challenge metadata, interactive elements, a bounded screenshot, and a suggested strategy. When CAPTCHA_AUTONOMOUS=true, responses are marked for LLM-assisted handling and include provider-specific challengePlaybook context when known. | |
| exclude_addons | No | List of default addons to exclude (e.g., ['ublock_origin']). Rejected unless CAMOUFOX_MCP_ALLOW_UNSAFE_OPTIONS=1. | |
| includeConsole | No | Include bounded page console diagnostics in the JSON response. | |
| includeNetwork | No | Include bounded network diagnostics in the JSON response. | |
| stealthProfile | No | Convenience profile for common Camoufox browser settings. Explicit options override profile values. | normal |
| firefox_user_prefs | No | Custom Firefox user preferences to set. Rejected unless CAMOUFOX_MCP_ALLOW_UNSAFE_OPTIONS=1; denied prefs are always rejected. |
Output Schema
| Name | Required | Description |
|---|---|---|
| url | Yes | |
| query | Yes | |
| title | No | |
| status | No | |
| matches | Yes | |
| message | No | |
| selector | No | |
| truncated | Yes | |
| maxMatches | Yes | |
| contentType | No | |
| diagnostics | No | |
| contextChars | Yes | |
| challengeType | No | |
| selectorFound | Yes | |
| captchaIframes | No | |
| captchaDetected | No | |
| challengeSignals | No | |
| challengeHandling | No | |
| challengePlaybook | No | |
| challengeProvider | No | |
| suggestedStrategy | No | |
| requiresUserAction | No | |
| interactiveElements | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, destructiveHint=false, openWorldHint=true, and idempotentHint=false, so the safety profile is clear. The description adds that matches are 'bounded' and navigation is a single pass, but it does not disclose important behavioral details such as CAPTCHA handling, wait strategies, stealth profiles, or what happens on navigation failure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no wasted words. It is efficiently structured, though for a tool with 28 parameters it may be too terse to be maximally helpful.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is complex, with 28 parameters, nested objects, and multiple behavioral knobs, but it has an output schema and rich annotations. The description covers the core action but omits context about CAPTCHA policy, stealth profiles, blocking options, and timeout behavior, leaving it only minimally adequate for such a broad tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so every one of the 28 parameters is documented in the schema itself. The description adds no parameter-specific meaning beyond the general idea of searching visible text and returning bounded context, so the baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific compound action: navigate once, search visible text, and return bounded context matches. This clearly separates it from pure extraction or session-based tools, though it does not name any sibling alternative to differentiate against explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'Navigate once' implies a one-shot workflow, which hints at when to use it versus persistent session tools, but there is no explicit guidance on when not to use it or which siblings to prefer for extraction, snapshots, or repeated navigation.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browse_formsCRead-only
Navigate once and return form fields and submit controls.
| Name | Required | Description | Default |
|---|---|---|---|
| os | No | Optional OS to spoof. Can be 'windows', 'macos', or 'linux'. If not specified, will rotate between all OS types. | |
| url | Yes | The URL to navigate to. Must be a fully qualified http or https URL. | |
| args | No | Additional browser command-line arguments to pass to the browser. Rejected unless CAMOUFOX_MCP_ALLOW_UNSAFE_OPTIONS=1; denied args are always rejected. | |
| geoip | No | Automatically detect geolocation based on IP address. | |
| proxy | No | Proxy configuration for routing browser traffic through an HTTP(S) proxy. Proxy servers are checked against the same local-network URL policy as page requests. | |
| locale | No | Browser locale (e.g., 'en-US', 'fr-FR'). | |
| window | No | Set fixed window size [width, height] instead of random generation. An empty array [] is accepted and treated as if the window parameter was not specified. | |
| timeout | No | Timeout in milliseconds for page load (5-300 seconds). | |
| headless | No | Run browser in headless mode. Auto-detects best mode for environment if not specified. | |
| humanize | No | Enable realistic cursor movements and human-like behavior for better stealth and anti-detection. | |
| maxForms | No | Maximum forms to return. | |
| selector | No | Optional CSS selector to limit extraction to one matching element. | |
| viewport | No | Custom viewport dimensions. | |
| emulation | No | Context emulation for diagnosing how the page behaves under other conditions. | |
| maxFields | No | Maximum fields to return across all forms. | |
| block_webgl | No | Block WebGL to prevent fingerprinting and tracking. | |
| block_images | No | Block all images for faster loading, reduced bandwidth, and lightweight browsing. | |
| block_webrtc | No | Block WebRTC entirely for enhanced privacy and stealth. | |
| disable_coop | No | Disable Cross-Origin-Opener-Policy for sites that require it. | |
| enable_cache | No | Cache pages, requests, etc. Uses more memory but improves performance when revisiting pages. | |
| waitStrategy | No | Wait strategy for page load. Defaults to 'domcontentloaded'. 'load' waits for all resources, 'networkidle' waits for network activity to finish. | domcontentloaded |
| captchaPolicy | No | Challenge handling policy. 'detect' reports signals, 'pause' returns state for human action, 'fail' returns an error, 'attempt' returns enhanced challenge metadata, interactive elements, a bounded screenshot, and a suggested strategy. When CAPTCHA_AUTONOMOUS=true, responses are marked for LLM-assisted handling and include provider-specific challengePlaybook context when known. | |
| exclude_addons | No | List of default addons to exclude (e.g., ['ublock_origin']). Rejected unless CAMOUFOX_MCP_ALLOW_UNSAFE_OPTIONS=1. | |
| includeConsole | No | Include bounded page console diagnostics in the JSON response. | |
| includeNetwork | No | Include bounded network diagnostics in the JSON response. | |
| stealthProfile | No | Convenience profile for common Camoufox browser settings. Explicit options override profile values. | normal |
| firefox_user_prefs | No | Custom Firefox user preferences to set. Rejected unless CAMOUFOX_MCP_ALLOW_UNSAFE_OPTIONS=1; denied prefs are always rejected. |
Output Schema
| Name | Required | Description |
|---|---|---|
| url | Yes | |
| forms | Yes | |
| title | No | |
| status | No | |
| message | No | |
| maxForms | Yes | |
| selector | No | |
| maxFields | Yes | |
| truncated | Yes | |
| contentType | No | |
| diagnostics | No | |
| challengeType | No | |
| selectorFound | Yes | |
| captchaIframes | No | |
| captchaDetected | No | |
| challengeSignals | No | |
| challengeHandling | No | |
| challengePlaybook | No | |
| challengeProvider | No | |
| suggestedStrategy | No | |
| requiresUserAction | No | |
| interactiveElements | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, openWorldHint=true, and destructiveHint=false, so the safety profile is covered. The phrase 'Navigate once' adds modest value by implying a one-shot navigation rather than a persistent session, distinguishing it slightly from browse_session_start. But nothing is said about browser lifecycle, CAPTCHA behavior, or timeout defaults despite 27 parameters that control those behaviors.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler. It is efficient, though the extreme brevity leaves the definition under-specified for a tool with this many options.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 27-parameter, nested-object tool with an output schema, one sentence is thin. The description never explains the form-extraction scope (maxForms, maxFields, selector), the relationship to the session-based siblings, or the CAPTCHA policy implications, all of which affect correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, with detailed per-parameter descriptions including defaults, enums, and constraints, so the schema carries the full burden. The description adds no parameter meaning beyond the schema, which is the expected baseline when coverage is this high.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a verb ('Navigate') and a specific output resource ('form fields and submit controls'), so the core action is understandable. However, it offers no differentiation from close siblings like browse, browse_snapshot, browse_extract, or browse_inspect, all of which plausibly also navigate and return page content.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to prefer this over browse or browse_snapshot, no mention of prerequisites, and no exclusions. The agent must infer from the name alone that this is the form-specific extraction path.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browse_inspectARead-only
Inspect one element like DevTools: box model, computed styles, matched CSS rules, attributes, visibility, overflow, accessibility tree.
| Name | Required | Description | Default |
|---|---|---|---|
| os | No | Optional OS to spoof. Can be 'windows', 'macos', or 'linux'. If not specified, will rotate between all OS types. | |
| url | No | URL to inspect (one-shot). Provide exactly one of url or sessionId. | |
| args | No | Additional browser command-line arguments to pass to the browser. Rejected unless CAMOUFOX_MCP_ALLOW_UNSAFE_OPTIONS=1; denied args are always rejected. | |
| frame | No | CSS selector of an iframe. The action's selector is resolved inside this iframe. | |
| geoip | No | Automatically detect geolocation based on IP address. | |
| proxy | No | Proxy configuration for routing browser traffic through an HTTP(S) proxy. Proxy servers are checked against the same local-network URL policy as page requests. | |
| locale | No | Browser locale (e.g., 'en-US', 'fr-FR'). | |
| window | No | Set fixed window size [width, height] instead of random generation. An empty array [] is accepted and treated as if the window parameter was not specified. | |
| timeout | No | Timeout in milliseconds for page load (5-300 seconds). | |
| headless | No | Run browser in headless mode. Auto-detects best mode for environment if not specified. | |
| humanize | No | Enable realistic cursor movements and human-like behavior for better stealth and anti-detection. | |
| maxRules | No | Max matched CSS rules to return. | |
| selector | Yes | CSS selector of the element to inspect (first match). | |
| viewport | No | Custom viewport dimensions. | |
| emulation | No | Context emulation for diagnosing how the page behaves under other conditions. | |
| sessionId | No | Existing session, inspected at its current page. | |
| properties | No | Computed style properties to return. Defaults to a layout/typography set. | |
| block_webgl | No | Block WebGL to prevent fingerprinting and tracking. | |
| block_images | No | Block all images for faster loading, reduced bandwidth, and lightweight browsing. | |
| block_webrtc | No | Block WebRTC entirely for enhanced privacy and stealth. | |
| disable_coop | No | Disable Cross-Origin-Opener-Policy for sites that require it. | |
| enable_cache | No | Cache pages, requests, etc. Uses more memory but improves performance when revisiting pages. | |
| waitStrategy | No | Wait strategy for page load. Defaults to 'domcontentloaded'. 'load' waits for all resources, 'networkidle' waits for network activity to finish. | domcontentloaded |
| captchaPolicy | No | Challenge handling policy. 'detect' reports signals, 'pause' returns state for human action, 'fail' returns an error, 'attempt' returns enhanced challenge metadata, interactive elements, a bounded screenshot, and a suggested strategy. When CAPTCHA_AUTONOMOUS=true, responses are marked for LLM-assisted handling and include provider-specific challengePlaybook context when known. | |
| exclude_addons | No | List of default addons to exclude (e.g., ['ublock_origin']). Rejected unless CAMOUFOX_MCP_ALLOW_UNSAFE_OPTIONS=1. | |
| includeConsole | No | Include bounded page console diagnostics in the JSON response. | |
| includeNetwork | No | Include bounded network diagnostics in the JSON response. | |
| stealthProfile | No | Convenience profile for common Camoufox browser settings. Explicit options override profile values. | normal |
| firefox_user_prefs | No | Custom Firefox user preferences to set. Rejected unless CAMOUFOX_MCP_ALLOW_UNSAFE_OPTIONS=1; denied prefs are always rejected. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, destructiveHint=false, openWorldHint=true, idempotentHint=false, so the safety profile is covered. The description adds the DevTools-equivalent mental model of what is inspected, but says nothing about the one-shot url vs existing sessionId modes, timeouts, or that a live page load occurs — the annotation bar is lower, so a 3 fits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with a tight enumeration and no filler. The DevTools analogy earns its place by compressing a lot of expectation into three words; the list is long but each item is a distinct output category.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 29 parameters, a full output schema, and 100% schema coverage, the description needs only to establish scope and return shape, which it does. The remaining gaps (url vs sessionId one-shot semantics, target page selection) are handled by the schema and annotations rather than the prose.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% across all 29 parameters, so the schema carries the semantics. The description only loosely maps to a few of them ('matched CSS rules' → maxRules, 'computed styles' → properties) and adds no syntax or format guidance beyond what the schema already states.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('inspect') and resource ('one element') and enumerates exactly what comes back: box model, computed styles, matched CSS rules, attributes, visibility, overflow, accessibility tree. The 'one element' scoping implicitly separates it from page-level siblings like browse_snapshot or browse_outline, but no sibling is named explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied by the DevTools analogy and the 'one element' phrasing. There is no explicit when-to-use statement, no exclusion, and no pointer to browse_snapshot, browse_extract, or browse_find as the alternative for broader or different extraction.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browse_linksBRead-only
Navigate once and return only visible navigable links.
| Name | Required | Description | Default |
|---|---|---|---|
| os | No | Optional OS to spoof. Can be 'windows', 'macos', or 'linux'. If not specified, will rotate between all OS types. | |
| url | Yes | The URL to navigate to. Must be a fully qualified http or https URL. | |
| args | No | Additional browser command-line arguments to pass to the browser. Rejected unless CAMOUFOX_MCP_ALLOW_UNSAFE_OPTIONS=1; denied args are always rejected. | |
| geoip | No | Automatically detect geolocation based on IP address. | |
| proxy | No | Proxy configuration for routing browser traffic through an HTTP(S) proxy. Proxy servers are checked against the same local-network URL policy as page requests. | |
| locale | No | Browser locale (e.g., 'en-US', 'fr-FR'). | |
| window | No | Set fixed window size [width, height] instead of random generation. An empty array [] is accepted and treated as if the window parameter was not specified. | |
| timeout | No | Timeout in milliseconds for page load (5-300 seconds). | |
| headless | No | Run browser in headless mode. Auto-detects best mode for environment if not specified. | |
| humanize | No | Enable realistic cursor movements and human-like behavior for better stealth and anti-detection. | |
| maxLinks | No | Maximum links to return. | |
| selector | No | Optional CSS selector to limit extraction to one matching element. | |
| viewport | No | Custom viewport dimensions. | |
| emulation | No | Context emulation for diagnosing how the page behaves under other conditions. | |
| block_webgl | No | Block WebGL to prevent fingerprinting and tracking. | |
| block_images | No | Block all images for faster loading, reduced bandwidth, and lightweight browsing. | |
| block_webrtc | No | Block WebRTC entirely for enhanced privacy and stealth. | |
| disable_coop | No | Disable Cross-Origin-Opener-Policy for sites that require it. | |
| enable_cache | No | Cache pages, requests, etc. Uses more memory but improves performance when revisiting pages. | |
| waitStrategy | No | Wait strategy for page load. Defaults to 'domcontentloaded'. 'load' waits for all resources, 'networkidle' waits for network activity to finish. | domcontentloaded |
| captchaPolicy | No | Challenge handling policy. 'detect' reports signals, 'pause' returns state for human action, 'fail' returns an error, 'attempt' returns enhanced challenge metadata, interactive elements, a bounded screenshot, and a suggested strategy. When CAPTCHA_AUTONOMOUS=true, responses are marked for LLM-assisted handling and include provider-specific challengePlaybook context when known. | |
| exclude_addons | No | List of default addons to exclude (e.g., ['ublock_origin']). Rejected unless CAMOUFOX_MCP_ALLOW_UNSAFE_OPTIONS=1. | |
| includeConsole | No | Include bounded page console diagnostics in the JSON response. | |
| includeNetwork | No | Include bounded network diagnostics in the JSON response. | |
| stealthProfile | No | Convenience profile for common Camoufox browser settings. Explicit options override profile values. | normal |
| firefox_user_prefs | No | Custom Firefox user preferences to set. Rejected unless CAMOUFOX_MCP_ALLOW_UNSAFE_OPTIONS=1; denied prefs are always rejected. |
Output Schema
| Name | Required | Description |
|---|---|---|
| url | Yes | |
| links | Yes | |
| title | No | |
| status | No | |
| message | No | |
| maxLinks | Yes | |
| selector | No | |
| truncated | Yes | |
| contentType | No | |
| diagnostics | No | |
| challengeType | No | |
| selectorFound | Yes | |
| captchaIframes | No | |
| captchaDetected | No | |
| challengeSignals | No | |
| challengeHandling | No | |
| challengePlaybook | No | |
| challengeProvider | No | |
| suggestedStrategy | No | |
| requiresUserAction | No | |
| interactiveElements | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so safety is covered. The description adds useful filtering semantics—'visible' and 'navigable'—and 'once' suggests no persisted session, but it omits pagination behavior, whether links are deduplicated or absolutized, and what happens if the page load fails.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
It is a single front-loaded sentence with zero waste, and the most important constraint (visible navigable links only) appears immediately. It does not pad or bury the purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained, and annotations cover safety. However, for a 26-parameter browser navigation tool with complex stealth/proxy/environment options, a one-sentence description leaves meaningful behavioral gaps around session lifecycle, link filtering, and failure handling.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the detailed 26-parameter schema already does the heavy lifting. The description adds no parameter-specific meaning—nothing about maxLinks, selector, waitStrategy, or whether stealth/proxy settings affect the returned links—so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb+resource: navigate and return visible navigable links. It implies a one-shot action unlike session tools, but never names a sibling or explicitly distinguishes itself from browse, browse_extract, or browse_snapshot.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no explicit when-to-use or when-not-to-use guidance and no alternative tool is mentioned. An agent must infer that this is for link discovery rather than for page inspection, extraction of other content, or persistent sessions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browse_network_summaryCRead-only
Navigate once and return a bounded network diagnostic summary.
| Name | Required | Description | Default |
|---|---|---|---|
| os | No | Optional OS to spoof. Can be 'windows', 'macos', or 'linux'. If not specified, will rotate between all OS types. | |
| url | Yes | The URL to navigate to. Must be a fully qualified http or https URL. | |
| args | No | Additional browser command-line arguments to pass to the browser. Rejected unless CAMOUFOX_MCP_ALLOW_UNSAFE_OPTIONS=1; denied args are always rejected. | |
| geoip | No | Automatically detect geolocation based on IP address. | |
| proxy | No | Proxy configuration for routing browser traffic through an HTTP(S) proxy. Proxy servers are checked against the same local-network URL policy as page requests. | |
| locale | No | Browser locale (e.g., 'en-US', 'fr-FR'). | |
| window | No | Set fixed window size [width, height] instead of random generation. An empty array [] is accepted and treated as if the window parameter was not specified. | |
| timeout | No | Timeout in milliseconds for page load (5-300 seconds). | |
| headless | No | Run browser in headless mode. Auto-detects best mode for environment if not specified. | |
| humanize | No | Enable realistic cursor movements and human-like behavior for better stealth and anti-detection. | |
| viewport | No | Custom viewport dimensions. | |
| emulation | No | Context emulation for diagnosing how the page behaves under other conditions. | |
| block_webgl | No | Block WebGL to prevent fingerprinting and tracking. | |
| maxFailures | No | Maximum failed requests to include in the summary. | |
| block_images | No | Block all images for faster loading, reduced bandwidth, and lightweight browsing. | |
| block_webrtc | No | Block WebRTC entirely for enhanced privacy and stealth. | |
| disable_coop | No | Disable Cross-Origin-Opener-Policy for sites that require it. | |
| enable_cache | No | Cache pages, requests, etc. Uses more memory but improves performance when revisiting pages. | |
| waitStrategy | No | Wait strategy for page load. Defaults to 'domcontentloaded'. 'load' waits for all resources, 'networkidle' waits for network activity to finish. | domcontentloaded |
| captchaPolicy | No | Challenge handling policy. 'detect' reports signals, 'pause' returns state for human action, 'fail' returns an error, 'attempt' returns enhanced challenge metadata, interactive elements, a bounded screenshot, and a suggested strategy. When CAPTCHA_AUTONOMOUS=true, responses are marked for LLM-assisted handling and include provider-specific challengePlaybook context when known. | |
| exclude_addons | No | List of default addons to exclude (e.g., ['ublock_origin']). Rejected unless CAMOUFOX_MCP_ALLOW_UNSAFE_OPTIONS=1. | |
| includeConsole | No | Include bounded page console diagnostics in the JSON response. | |
| includeNetwork | No | Include bounded network diagnostics in the JSON response. | |
| stealthProfile | No | Convenience profile for common Camoufox browser settings. Explicit options override profile values. | normal |
| firefox_user_prefs | No | Custom Firefox user preferences to set. Rejected unless CAMOUFOX_MCP_ALLOW_UNSAFE_OPTIONS=1; denied prefs are always rejected. |
Output Schema
| Name | Required | Description |
|---|---|---|
| url | Yes | |
| title | No | |
| failed | Yes | |
| status | No | |
| blocked | Yes | |
| message | No | |
| requests | Yes | |
| truncated | Yes | |
| contentType | No | |
| topFailures | Yes | |
| statusCounts | Yes | |
| challengeType | No | |
| captchaIframes | No | |
| captchaDetected | No | |
| challengeSignals | No | |
| challengeHandling | No | |
| challengePlaybook | No | |
| challengeProvider | No | |
| suggestedStrategy | No | |
| requiresUserAction | No | |
| resourceTypeCounts | Yes | |
| interactiveElements | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly, non-destructive, open-world and non-idempotent, so safety is covered elsewhere. The description adds only the word 'bounded' and no insight into the heavyweight behaviors exposed by its 25 parameters (proxy routing, stealth profile, captcha policy, emulation, timeouts), which is a real gap for a tool with this many behavioral knobs.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler, and the navigation-plus-summary shape is stated immediately. It is efficient, though arguably under-specified rather than wasteful.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 25-parameter tool with an output schema and rich annotations, a one-sentence description leaves too much implicit: how the summary is shaped, why the stealth/proxy/captcha options matter here, and how it relates to the diagnostic and session siblings. The output schema excuses return-value detail, but not the missing routing context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and every parameter, including nested proxy/emulation fields and enums, is documented inline, so the schema carries the semantics. The description adds nothing about parameters, but the baseline of 3 applies when the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Navigate once') plus a distinct output ('bounded network diagnostic summary'), which separates it from a plain browse/snapshot tool. It does not, however, name or contrast with the closest siblings such as browse_diagnose or browse_session_navigate, so the agent must infer the boundary.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use, when-not-to-use, or alternative guidance is given. 'Navigate once' mildly implies a one-shot, no-session workflow, but nothing tells the agent when to pick this over browse_diagnose, browse_inspect or browse_session_navigate.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browse_outlineCRead-only
Navigate once and return page headings and landmarks.
| Name | Required | Description | Default |
|---|---|---|---|
| os | No | Optional OS to spoof. Can be 'windows', 'macos', or 'linux'. If not specified, will rotate between all OS types. | |
| url | Yes | The URL to navigate to. Must be a fully qualified http or https URL. | |
| args | No | Additional browser command-line arguments to pass to the browser. Rejected unless CAMOUFOX_MCP_ALLOW_UNSAFE_OPTIONS=1; denied args are always rejected. | |
| geoip | No | Automatically detect geolocation based on IP address. | |
| proxy | No | Proxy configuration for routing browser traffic through an HTTP(S) proxy. Proxy servers are checked against the same local-network URL policy as page requests. | |
| locale | No | Browser locale (e.g., 'en-US', 'fr-FR'). | |
| window | No | Set fixed window size [width, height] instead of random generation. An empty array [] is accepted and treated as if the window parameter was not specified. | |
| timeout | No | Timeout in milliseconds for page load (5-300 seconds). | |
| headless | No | Run browser in headless mode. Auto-detects best mode for environment if not specified. | |
| humanize | No | Enable realistic cursor movements and human-like behavior for better stealth and anti-detection. | |
| maxItems | No | Maximum headings and landmarks to return. | |
| selector | No | Optional CSS selector to limit extraction to one matching element. | |
| viewport | No | Custom viewport dimensions. | |
| emulation | No | Context emulation for diagnosing how the page behaves under other conditions. | |
| block_webgl | No | Block WebGL to prevent fingerprinting and tracking. | |
| block_images | No | Block all images for faster loading, reduced bandwidth, and lightweight browsing. | |
| block_webrtc | No | Block WebRTC entirely for enhanced privacy and stealth. | |
| disable_coop | No | Disable Cross-Origin-Opener-Policy for sites that require it. | |
| enable_cache | No | Cache pages, requests, etc. Uses more memory but improves performance when revisiting pages. | |
| waitStrategy | No | Wait strategy for page load. Defaults to 'domcontentloaded'. 'load' waits for all resources, 'networkidle' waits for network activity to finish. | domcontentloaded |
| captchaPolicy | No | Challenge handling policy. 'detect' reports signals, 'pause' returns state for human action, 'fail' returns an error, 'attempt' returns enhanced challenge metadata, interactive elements, a bounded screenshot, and a suggested strategy. When CAPTCHA_AUTONOMOUS=true, responses are marked for LLM-assisted handling and include provider-specific challengePlaybook context when known. | |
| exclude_addons | No | List of default addons to exclude (e.g., ['ublock_origin']). Rejected unless CAMOUFOX_MCP_ALLOW_UNSAFE_OPTIONS=1. | |
| includeConsole | No | Include bounded page console diagnostics in the JSON response. | |
| includeNetwork | No | Include bounded network diagnostics in the JSON response. | |
| stealthProfile | No | Convenience profile for common Camoufox browser settings. Explicit options override profile values. | normal |
| firefox_user_prefs | No | Custom Firefox user preferences to set. Rejected unless CAMOUFOX_MCP_ALLOW_UNSAFE_OPTIONS=1; denied prefs are always rejected. |
Output Schema
| Name | Required | Description |
|---|---|---|
| url | Yes | |
| title | No | |
| status | No | |
| message | No | |
| headings | Yes | |
| maxItems | Yes | |
| selector | No | |
| landmarks | Yes | |
| truncated | Yes | |
| contentType | No | |
| description | No | |
| diagnostics | No | |
| challengeType | No | |
| selectorFound | Yes | |
| captchaIframes | No | |
| captchaDetected | No | |
| challengeSignals | No | |
| challengeHandling | No | |
| challengePlaybook | No | |
| challengeProvider | No | |
| suggestedStrategy | No | |
| requiresUserAction | No | |
| interactiveElements | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, destructiveHint=false, and openWorldHint=true, so safety is covered. The description adds nothing beyond that: it never mentions the CAPTCHA policy behavior, stealth/anti-detection defaults, the environment-variable gates on args/firefox_user_prefs, or that navigation may be subject to timeout and wait-strategy semantics.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One sentence, front-loaded with the verb, and zero filler. It is efficient but arguably undersized for a tool exposing 26 configuration parameters; a single sentence cannot carry the necessary scoping.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is highly complex (26 params, nested emulation/proxy/viewport objects, stealth and challenge-handling options) with an output schema that relieves the need to describe returns. A one-line description leaves an agent unaware of the stealth, proxy, emulation, and CAPTCHA-handling capabilities entirely, which is a substantial completeness gap for this complexity level.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all 26 parameters are documented in the schema and baseline is 3. The description's mention of 'headings and landmarks' loosely maps to maxItems/selector but adds no format, ordering, or selection semantics beyond what the schema already states.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and outcome: 'Navigate once and return page headings and landmarks.' An agent can tell it is a one-shot navigation plus outline extraction. It does not, however, distinguish itself from close siblings such as browse_snapshot, browse_inspect, or browse_extract, which likely return overlapping structural data.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'Navigate once' weakly implies a one-off alternative to the session-based siblings (browse_session_start / browse_session_navigate), but no explicit when-to-use, when-not-to-use, or named alternative is given. An agent choosing among ~25 browse_* tools gets almost no routing signal.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browse_profile_deleteBDestructiveIdempotent
Delete a named browser profile and its saved logins.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Profile name to delete (must not be in use). |
Output Schema
| Name | Required | Description |
|---|---|---|
| name | Yes | |
| deleted | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true, idempotentHint=true and readOnlyHint=false, so the safety profile is covered structurally. The description adds genuinely useful scope information beyond that — that saved logins are destroyed along with the profile. It does not state irreversibility, whether an in-use profile causes an error, or required permissions, leaving meaningful behavioral gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One short sentence with zero filler, front-loaded with the destructive verb and the affected resource. Nothing padded or restated.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Output schema and annotations carry the return-value and safety burden, and the description adds the scope of data loss, which is the key fact for a destructive tool. It could still note irreversibility or the in-use failure mode, but it is close to sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and the single 'name' parameter is fully documented, including the 'must not be in use' precondition and the naming pattern. The description only repeats 'named', adding nothing beyond the schema, which is the expected baseline here.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Delete a named browser profile') plus the collateral effect ('its saved logins'), so an agent can distinguish it from browse_profiles_list immediately. It stops short of naming the sibling alternative explicitly, but the action is unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this versus browse_profiles_list, no prerequisites such as confirming the profile is not currently in use, and no note about whether confirmation should be obtained first. The agent gets an action but no routing context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browse_profiles_listARead-onlyIdempotent
List named persistent browser profiles.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| profiles | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, destructiveHint=false and openWorldHint=false, so the safety profile is fully covered by structured data. The description adds only the qualifiers 'named' and 'persistent', which help characterise what is being listed but say nothing beyond that. With an output schema present, the lack of return-value detail is acceptable.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler, and the distinguishing qualifiers sit immediately after the resource. It is terse to the point of being slightly under-specified rather than padded, which keeps it at 4 rather than 5.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This is a simple, zero-parameter, read-only list tool with an output schema and full annotation coverage, so the description does not need to carry much. It states what is returned at a high level and nothing essential for correct invocation is missing; only an explicit ordering or scope note would push it higher.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so there is no parameter semantics to explain and the baseline is 4. The description correctly mentions no arguments, which is consistent with the empty schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a clear verb (list) and resource (named persistent browser profiles), which is enough to distinguish it from destructive siblings like browse_profile_delete and from session tools like browse_session_start. It stops short of explicitly disambiguating itself from those siblings, so it lands just below the top mark.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied: an agent can infer this is the discovery step before browse_profile_delete or browse_session_start. There is no explicit when-to-use, no stated prerequisites, and no named alternative, so it is the minimum viable level.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browse_screenshotCRead-only
Navigate once and capture a bounded screenshot.
| Name | Required | Description | Default |
|---|---|---|---|
| os | No | Optional OS to spoof. Can be 'windows', 'macos', or 'linux'. If not specified, will rotate between all OS types. | |
| url | Yes | The URL to navigate to. Must be a fully qualified http or https URL. | |
| args | No | Additional browser command-line arguments to pass to the browser. Rejected unless CAMOUFOX_MCP_ALLOW_UNSAFE_OPTIONS=1; denied args are always rejected. | |
| type | No | Screenshot image type. | png |
| geoip | No | Automatically detect geolocation based on IP address. | |
| proxy | No | Proxy configuration for routing browser traffic through an HTTP(S) proxy. Proxy servers are checked against the same local-network URL policy as page requests. | |
| locale | No | Browser locale (e.g., 'en-US', 'fr-FR'). | |
| window | No | Set fixed window size [width, height] instead of random generation. An empty array [] is accepted and treated as if the window parameter was not specified. | |
| quality | No | JPEG quality from 1-100. Ignored for PNG. | |
| timeout | No | Timeout in milliseconds for page load (5-300 seconds). | |
| fullPage | No | Capture the full page instead of only the viewport. | |
| headless | No | Run browser in headless mode. Auto-detects best mode for environment if not specified. | |
| humanize | No | Enable realistic cursor movements and human-like behavior for better stealth and anti-detection. | |
| selector | No | Optional CSS selector for element-only screenshots. | |
| viewport | No | Custom viewport dimensions. | |
| emulation | No | Context emulation for diagnosing how the page behaves under other conditions. | |
| block_webgl | No | Block WebGL to prevent fingerprinting and tracking. | |
| block_images | No | Block all images for faster loading, reduced bandwidth, and lightweight browsing. | |
| block_webrtc | No | Block WebRTC entirely for enhanced privacy and stealth. | |
| disable_coop | No | Disable Cross-Origin-Opener-Policy for sites that require it. | |
| enable_cache | No | Cache pages, requests, etc. Uses more memory but improves performance when revisiting pages. | |
| waitStrategy | No | Wait strategy for page load. Defaults to 'domcontentloaded'. 'load' waits for all resources, 'networkidle' waits for network activity to finish. | domcontentloaded |
| captchaPolicy | No | Challenge handling policy. 'detect' reports signals, 'pause' returns state for human action, 'fail' returns an error, 'attempt' returns enhanced challenge metadata, interactive elements, a bounded screenshot, and a suggested strategy. When CAPTCHA_AUTONOMOUS=true, responses are marked for LLM-assisted handling and include provider-specific challengePlaybook context when known. | |
| exclude_addons | No | List of default addons to exclude (e.g., ['ublock_origin']). Rejected unless CAMOUFOX_MCP_ALLOW_UNSAFE_OPTIONS=1. | |
| includeConsole | No | Include bounded page console diagnostics in the JSON response. | |
| includeNetwork | No | Include bounded network diagnostics in the JSON response. | |
| stealthProfile | No | Convenience profile for common Camoufox browser settings. Explicit options override profile values. | normal |
| firefox_user_prefs | No | Custom Firefox user preferences to set. Rejected unless CAMOUFOX_MCP_ALLOW_UNSAFE_OPTIONS=1; denied prefs are always rejected. |
Output Schema
| Name | Required | Description |
|---|---|---|
| url | Yes | |
| title | No | |
| status | No | |
| message | No | |
| screenshot | Yes | |
| contentType | No | |
| challengeType | No | |
| captchaIframes | No | |
| captchaDetected | No | |
| challengeSignals | No | |
| challengeHandling | No | |
| challengePlaybook | No | |
| challengeProvider | No | |
| suggestedStrategy | No | |
| requiresUserAction | No | |
| interactiveElements | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, openWorldHint=true, idempotentHint=false, and destructiveHint=false, so the safety profile is covered. The description contributes only the vague term 'bounded', which is never defined, and the 'navigate once' hint that implies no reusable session is created. It says nothing about CAPTCHA handling, stealth defaults, or blocking behavior that materially change what comes back.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One short, front-loaded sentence with zero filler. It is efficient, though the terseness is arguably under-specification rather than disciplined concision given the size of the surface it fronts.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool exposes 28 parameters including proxy, emulation, stealth profiles, blocking flags, and CAPTCHA policy, plus an output schema. A single eight-word sentence leaves no guidance on how the many behavioral levers interact, what 'bounded' means for screenshot size, or how this differs from the other screenshot-capable siblings.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and every one of the 28 parameters is documented in-schema, including the enum values, defaults, and the CAMOUFOX_MCP_ALLOW_UNSAFE_OPTIONS gate on args and exclude_addons. The description adds no parameter guidance at all, which is acceptable at full coverage but leaves it at the baseline.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
It names a specific verb and resource (navigate + capture screenshot) and adds the qualifier 'once', hinting at a single-shot versus session-based flow. But the sibling set is crowded with near-identical names (browse, browse_snapshot, browse_session_snapshot, browse_session_navigate) and the description does nothing to explain which is which, so an agent cannot route on the description alone.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no statement of when to use this versus browse_snapshot or the browse_session_* family, no prerequisites, and no exclusion criteria. 'Once' is the only usage hint and it is never made explicit as 'use this for a one-off capture that does not need a persistent session'.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browse_sequenceB
Navigate once, run bounded selector actions, then return final state.
| Name | Required | Description | Default |
|---|---|---|---|
| os | No | Optional OS to spoof. Can be 'windows', 'macos', or 'linux'. If not specified, will rotate between all OS types. | |
| url | Yes | The URL to navigate to. Must be a fully qualified http or https URL. | |
| args | No | Additional browser command-line arguments to pass to the browser. Rejected unless CAMOUFOX_MCP_ALLOW_UNSAFE_OPTIONS=1; denied args are always rejected. | |
| geoip | No | Automatically detect geolocation based on IP address. | |
| proxy | No | Proxy configuration for routing browser traffic through an HTTP(S) proxy. Proxy servers are checked against the same local-network URL policy as page requests. | |
| locale | No | Browser locale (e.g., 'en-US', 'fr-FR'). | |
| window | No | Set fixed window size [width, height] instead of random generation. An empty array [] is accepted and treated as if the window parameter was not specified. | |
| actions | Yes | Bounded action sequence to run after navigation. | |
| timeout | No | Timeout in milliseconds for page load (5-300 seconds). | |
| headless | No | Run browser in headless mode. Auto-detects best mode for environment if not specified. | |
| humanize | No | Enable realistic cursor movements and human-like behavior for better stealth and anti-detection. | |
| maxChars | No | Maximum final text, HTML, snapshot, or evaluate-result characters to return. | |
| selector | No | Optional CSS selector to limit final content extraction to one matching element. | |
| viewport | No | Custom viewport dimensions. | |
| emulation | No | Context emulation for diagnosing how the page behaves under other conditions. | |
| outputMode | No | Final response content mode. | text |
| screenshot | No | Capture a screenshot/image after all actions finish. | |
| block_webgl | No | Block WebGL to prevent fingerprinting and tracking. | |
| maxElements | No | Maximum final snapshot elements to return. | |
| block_images | No | Block all images for faster loading, reduced bandwidth, and lightweight browsing. | |
| block_webrtc | No | Block WebRTC entirely for enhanced privacy and stealth. | |
| disable_coop | No | Disable Cross-Origin-Opener-Policy for sites that require it. | |
| enable_cache | No | Cache pages, requests, etc. Uses more memory but improves performance when revisiting pages. | |
| waitStrategy | No | Wait strategy for page load. Defaults to 'domcontentloaded'. 'load' waits for all resources, 'networkidle' waits for network activity to finish. | domcontentloaded |
| captchaPolicy | No | Challenge handling policy. 'detect' reports signals, 'pause' returns state for human action, 'fail' returns an error, 'attempt' returns enhanced challenge metadata, interactive elements, a bounded screenshot, and a suggested strategy. When CAPTCHA_AUTONOMOUS=true, responses are marked for LLM-assisted handling and include provider-specific challengePlaybook context when known. | |
| exclude_addons | No | List of default addons to exclude (e.g., ['ublock_origin']). Rejected unless CAMOUFOX_MCP_ALLOW_UNSAFE_OPTIONS=1. | |
| includeConsole | No | Include bounded page console diagnostics in the JSON response. | |
| includeNetwork | No | Include bounded network diagnostics in the JSON response. | |
| stealthProfile | No | Convenience profile for common Camoufox browser settings. Explicit options override profile values. | normal |
| screenshotOptions | No | Optional screenshot capture settings. Used only when screenshot is true. | |
| firefox_user_prefs | No | Custom Firefox user preferences to set. Rejected unless CAMOUFOX_MCP_ALLOW_UNSAFE_OPTIONS=1; denied prefs are always rejected. |
Output Schema
| Name | Required | Description |
|---|---|---|
| url | Yes | |
| html | No | |
| text | No | |
| title | No | |
| status | No | |
| actions | Yes | |
| message | No | |
| maxChars | Yes | |
| selector | No | |
| snapshot | No | |
| truncated | Yes | |
| outputMode | Yes | |
| screenshot | No | |
| contentType | No | |
| diagnostics | No | |
| challengeType | No | |
| initialStatus | No | |
| selectorFound | No | |
| captchaIframes | No | |
| captchaDetected | No | |
| challengeSignals | No | |
| challengeHandling | No | |
| challengePlaybook | No | |
| challengeProvider | No | |
| suggestedStrategy | No | |
| requiresUserAction | No | |
| interactiveElements | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare openWorld, non-idempotent, non-read-only, non-destructive, so the safety profile is covered. The description adds only the word 'bounded' as a hint at the 100-action cap. It says nothing about the single-use vs resumable session lifetime, side effects of click/fill/upload/download actions, or the human-in-the-loop and secret-handling capabilities that materially change how an agent should plan a call.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler; the sequence ordering is put first. Its brevity is close to excessive given the tool's surface area, but no sentence is wasted.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 31 parameters, deeply nested action variants, enums, an output schema, and a dense sibling set, one sentence leaves the critical decision information unstated: why this over 'browse' or 'browse_session_navigate', whether the session persists, and how failures mid-sequence are handled. Output shape is covered by the output schema, so that omission is acceptable; the rest is not.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% across all 31 parameters, including per-property docs for the oneOf action variants, so the schema carries the burden. The description adds no meaning beyond what is already documented, which is the baseline 3 case.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a recognisable three-phase behavior (navigate once, run bounded selector actions, return final state), which is more than a restatement of the name. However, it never distinguishes this from siblings like 'browse', 'browse_session_navigate', or 'browse_session_action', so an agent cannot tell which one to reach for.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use, when-not-to-use, or alternative named anywhere in the description, despite a crowded sibling set. The single implied hint ('navigate once') weakly suggests a one-shot session, but nothing is stated explicitly.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browse_session_actionC
Run one bounded action in an existing browser session.
| Name | Required | Description | Default |
|---|---|---|---|
| action | Yes | One bounded action to run in the existing session. | |
| maxChars | No | Maximum final visible text characters to return in snapshot. | |
| selector | No | Optional CSS selector to limit final snapshot. | |
| sessionId | Yes | Session ID returned by browse_session_start. | |
| maxElements | No | Maximum final snapshot elements to return. | |
| captchaPolicy | No | Challenge handling policy. 'detect' reports signals, 'pause' returns state for human action, 'fail' returns an error, 'attempt' returns enhanced challenge metadata, interactive elements, a bounded screenshot, and a suggested strategy. When CAPTCHA_AUTONOMOUS=true, responses are marked for LLM-assisted handling and include provider-specific challengePlaybook context when known. |
Output Schema
| Name | Required | Description |
|---|---|---|
| action | Yes | |
| message | No | |
| snapshot | Yes | |
| expiresAt | Yes | |
| sessionId | Yes | |
| challengeType | No | |
| captchaIframes | No | |
| captchaDetected | No | |
| challengeSignals | No | |
| challengeHandling | No | |
| challengePlaybook | No | |
| challengeProvider | No | |
| suggestedStrategy | No | |
| requiresUserAction | No | |
| interactiveElements | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already disclose that this is a mutating, open-world, non-idempotent, non-destructive operation. The description adds useful behavioral context by clarifying that exactly one bounded action runs per call and that the session must already exist, but it does not mention side effects of specific actions (e.g., uploads, downloads, waitForHuman, evaluate) or how the action interacts with page state.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single front-loaded sentence with zero filler. It is appropriately sized for a tool whose parameter semantics and return shape are fully documented in the schema and output schema.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity — six parameters and a large oneOf covering click, fill, upload, download, evaluate, waitForHuman, and more — the description is too thin to orient an agent. Although the schema and output schema are rich, the description does not explain what kind of actions are supported or why an agent would choose this tool over its many siblings, leaving a significant selection gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and the schema itself documents every parameter and each action variant in detail. The description adds no parameter-level meaning beyond the schema, so the baseline of 3 is appropriate when structured data carries the full semantic burden.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Run') and resource ('one bounded action in an existing browser session'), but 'action' is vague without naming the available action types. It does not distinguish this tool from siblings like browse_session_navigate, browse_sequence, or browse, so an agent cannot confidently choose it over alternatives from the description alone.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no explicit guidance on when to use this tool versus alternatives. The phrase 'existing browser session' implies it is called after browse_session_start, but it never names browse_session_navigate, browse_sequence, or any other sibling that might be more appropriate for navigation or multi-step flows.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browse_session_closeB
Close an existing browser session.
| Name | Required | Description | Default |
|---|---|---|---|
| sessionId | Yes | Session ID returned by browse_session_start. |
Output Schema
| Name | Required | Description |
|---|---|---|
| closed | Yes | |
| sessionId | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=false and idempotentHint=false, so the description's job is to add context like side effects or prerequisites. It only says 'close an existing session,' which adds minimal value beyond the tool name. It does not mention what happens if the session is already closed or whether any cleanup occurs.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, straightforward sentence that conveys the essential information without any superfluous content. It is optimally concise and easy to parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-parameter tool with an output schema present, the description is mostly complete. However, it could benefit from noting that closing a session is non-idempotent or that the session must be active, though the schema partially covers this. Given the low complexity, the description is adequate but not exhaustive.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema covers 100% of the parameter (sessionId) and describes it as 'Session ID returned by browse_session_start.' The description does not add any additional meaning to the parameter, so with high schema coverage the baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description "Close an existing browser session" uses a specific verb (close) and resource (browser session), clearly distinguishing it from sibling tools like browse_session_start (start) and browse_session_navigate (navigate). It precisely identifies the action without ambiguity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool, when not to, or what alternatives exist. It only states what the tool does, leaving the agent to infer that it should be used after a session is no longer needed. No exclusions or comparisons with siblings are given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browse_session_resumeA
Resume a paused session after human action and return current state.
| Name | Required | Description | Default |
|---|---|---|---|
| timeout | No | Timeout in milliseconds for the resume wait. | |
| maxChars | No | Maximum visible text and ARIA snapshot characters to return. | |
| selector | No | Optional CSS selector to limit snapshot extraction. | |
| sessionId | Yes | Session ID returned by browse_session_start. | |
| maxElements | No | Maximum interactive elements to return. | |
| waitStrategy | No | Optional load state to wait for before reading the session. | |
| captchaPolicy | No | Challenge handling policy. 'detect' reports signals, 'pause' returns state for human action, 'fail' returns an error, 'attempt' returns enhanced challenge metadata, interactive elements, a bounded screenshot, and a suggested strategy. When CAPTCHA_AUTONOMOUS=true, responses are marked for LLM-assisted handling and include provider-specific challengePlaybook context when known. |
Output Schema
| Name | Required | Description |
|---|---|---|
| url | Yes | |
| text | Yes | |
| title | No | |
| status | No | |
| message | No | |
| elements | Yes | |
| maxChars | Yes | |
| selector | No | |
| expiresAt | Yes | |
| sessionId | Yes | |
| contentType | No | |
| diagnostics | No | |
| maxElements | Yes | |
| ariaSnapshot | No | |
| challengeType | No | |
| selectorFound | Yes | |
| textTruncated | Yes | |
| captchaIframes | No | |
| captchaDetected | No | |
| challengeSignals | No | |
| ariaSnapshotError | No | |
| challengeHandling | No | |
| challengePlaybook | No | |
| challengeProvider | No | |
| elementsTruncated | Yes | |
| suggestedStrategy | No | |
| requiresUserAction | No | |
| interactiveElements | No | |
| ariaSnapshotTruncated | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With annotations already declaring readOnlyHint=false, idempotentHint=false, openWorldHint=true, and destructiveHint=false, the description adds useful context that this happens after human action and returns current state. However, it does not explain the wait behavior, failure modes, or what resuming actually changes in the session.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence with no filler, and the key condition and outcome are front-loaded. Every phrase contributes to understanding when and why to call the tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers the trigger and outcome, while the rich input schema and output schema handle parameters and return values. It is complete enough for invocation, though it could say more about blocking semantics or what happens if the human action never occurs.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so every parameter including timeout, captchaPolicy, and waitStrategy is already documented in the schema. The description adds no parameter-level meaning beyond the structured fields, so baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: resume a paused session. It also scopes the action to after human action and states that current state is returned, making the purpose immediately clear.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives a clear usage condition: use when a session was paused and a human has acted. It does not name alternative tools such as browse_session_start or browse_session_action, nor does it state when not to use it, so it stops short of full routing guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browse_session_snapshotCRead-only
Read the current state of an existing browser session.
| Name | Required | Description | Default |
|---|---|---|---|
| maxChars | No | Maximum visible text and ARIA snapshot characters to return. | |
| selector | No | Optional CSS selector to limit snapshot extraction. | |
| sessionId | Yes | Session ID returned by browse_session_start. | |
| maxElements | No | Maximum interactive elements to return. | |
| captchaPolicy | No | Challenge handling policy. 'detect' reports signals, 'pause' returns state for human action, 'fail' returns an error, 'attempt' returns enhanced challenge metadata, interactive elements, a bounded screenshot, and a suggested strategy. When CAPTCHA_AUTONOMOUS=true, responses are marked for LLM-assisted handling and include provider-specific challengePlaybook context when known. |
Output Schema
| Name | Required | Description |
|---|---|---|
| url | Yes | |
| text | Yes | |
| title | No | |
| status | No | |
| message | No | |
| elements | Yes | |
| maxChars | Yes | |
| selector | No | |
| expiresAt | Yes | |
| sessionId | Yes | |
| contentType | No | |
| diagnostics | No | |
| maxElements | Yes | |
| ariaSnapshot | No | |
| challengeType | No | |
| selectorFound | Yes | |
| textTruncated | Yes | |
| captchaIframes | No | |
| captchaDetected | No | |
| challengeSignals | No | |
| ariaSnapshotError | No | |
| challengeHandling | No | |
| challengePlaybook | No | |
| challengeProvider | No | |
| elementsTruncated | Yes | |
| suggestedStrategy | No | |
| requiresUserAction | No | |
| interactiveElements | No | |
| ariaSnapshotTruncated | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, destructiveHint=false, and openWorldHint=true, so safety is covered. The description adds nothing beyond that - it doesn't say what a snapshot contains, whether it reflects live page state, or how the captchaPolicy affects the response, all of which are non-obvious for a page-state read.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with zero filler. It is efficient, though the terseness is achieved by omitting useful content rather than by tight writing.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists and the input schema is fully self-documenting, so return-value and parameter detail needn't be repeated. What is missing is the relational context: how this snapshot relates to browse_snapshot and when a session-scoped read is the right call.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and the CAPTCHA policy enum is fully documented inline, so the schema carries the parameter burden. The description adds no parameter meaning on top of it, which lands at the baseline 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The verb and resource are clear ('read state of an existing browser session'), which is more specific than a tautology. However, with siblings like browse_snapshot, browse_inspect, and browse_outline in the same family, the description gives no signal about how a session snapshot differs from a plain snapshot.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this versus browse_snapshot or browse_inspect, and no prerequisites are stated (e.g. that a session must first be started via browse_session_start). The agent must infer everything from the sessionId parameter name.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browse_session_startB
Start an isolated short-lived browser session.
| Name | Required | Description | Default |
|---|---|---|---|
| os | No | Optional OS to spoof. Can be 'windows', 'macos', or 'linux'. If not specified, will rotate between all OS types. | |
| args | No | Additional browser command-line arguments to pass to the browser. Rejected unless CAMOUFOX_MCP_ALLOW_UNSAFE_OPTIONS=1; denied args are always rejected. | |
| geoip | No | Automatically detect geolocation based on IP address. | |
| proxy | No | Proxy configuration for routing browser traffic through an HTTP(S) proxy. Proxy servers are checked against the same local-network URL policy as page requests. | |
| locale | No | Browser locale (e.g., 'en-US', 'fr-FR'). | |
| window | No | Set fixed window size [width, height] instead of random generation. An empty array [] is accepted and treated as if the window parameter was not specified. | |
| profile | No | Named persistent profile (cookies, localStorage, IndexedDB). Keeps logins between sessions; its os/locale/proxy/window/fingerprint override the input. | |
| timeout | No | Timeout in milliseconds for page load (5-300 seconds). | |
| headless | No | Run browser in headless mode. Auto-detects best mode for environment if not specified. | |
| humanize | No | Enable realistic cursor movements and human-like behavior for better stealth and anti-detection. | |
| viewport | No | Custom viewport dimensions. | |
| emulation | No | Context emulation for diagnosing how the page behaves under other conditions. | |
| recordHar | No | Record all network traffic to CAMOUFOX_MCP_FILES_DIR/exports/<name>.har, written when the session closes. | |
| block_webgl | No | Block WebGL to prevent fingerprinting and tracking. | |
| block_images | No | Block all images for faster loading, reduced bandwidth, and lightweight browsing. | |
| block_webrtc | No | Block WebRTC entirely for enhanced privacy and stealth. | |
| disable_coop | No | Disable Cross-Origin-Opener-Policy for sites that require it. | |
| enable_cache | No | Cache pages, requests, etc. Uses more memory but improves performance when revisiting pages. | |
| waitStrategy | No | Wait strategy for page load. Defaults to 'domcontentloaded'. 'load' waits for all resources, 'networkidle' waits for network activity to finish. | domcontentloaded |
| captchaPolicy | No | Challenge handling policy. 'detect' reports signals, 'pause' returns state for human action, 'fail' returns an error, 'attempt' returns enhanced challenge metadata, interactive elements, a bounded screenshot, and a suggested strategy. When CAPTCHA_AUTONOMOUS=true, responses are marked for LLM-assisted handling and include provider-specific challengePlaybook context when known. | |
| exclude_addons | No | List of default addons to exclude (e.g., ['ublock_origin']). Rejected unless CAMOUFOX_MCP_ALLOW_UNSAFE_OPTIONS=1. | |
| includeConsole | No | Include bounded page console diagnostics in the JSON response. | |
| includeNetwork | No | Include bounded network diagnostics in the JSON response. | |
| stealthProfile | No | Convenience profile for common Camoufox browser settings. Explicit options override profile values. | normal |
| firefox_user_prefs | No | Custom Firefox user preferences to set. Rejected unless CAMOUFOX_MCP_ALLOW_UNSAFE_OPTIONS=1; denied prefs are always rejected. |
Output Schema
| Name | Required | Description |
|---|---|---|
| browser | Yes | |
| expiresAt | Yes | |
| sessionId | Yes | |
| selectedOS | Yes | |
| headlessMode | Yes | |
| captchaPolicy | Yes | |
| stealthProfile | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover the safety profile: not read-only, open-world, non-idempotent, non-destructive. The description adds useful behavioral context with 'isolated' and 'short-lived,' implying sandboxing and finite lifetime, but omits lifecycle details such as session handles, resource limits, concurrency behavior, and whether explicit cleanup is required.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no wasted words. It is efficient, though arguably too terse for a tool with 25 configuration options and significant lifecycle implications.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a high-complexity 25-parameter session-start tool, the description is far too thin. Although the schema documents parameters and an output schema exists, the description should explain the session lifecycle, how the returned session is used by sibling tools, and the relevance of profiles and short-lived semantics. These gaps leave an agent with little operational context beyond the schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all 25 parameters are already fully documented in the schema. The description adds no parameter-specific meaning beyond the schema, which is acceptable at baseline 3 given complete schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: 'Start an isolated short-lived browser session.' An agent can tell this creates a browser session rather than navigating, inspecting, or extracting, though it does not explicitly distinguish itself from browse_session_resume or indicate that it is the entry point for later session tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides no when-to-use guidance, no prerequisites, and no alternatives. It does not say that this should be called before browse_session_navigate, that the resulting session should be closed with browse_session_close, or how profiles affect reuse.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browse_session_traceA
Start or stop a Playwright trace (screenshots, DOM snapshots, network) for a session and save it as a .zip under exports/.
| Name | Required | Description | Default |
|---|---|---|---|
| action | Yes | start: begin a Playwright trace (screenshots, DOM snapshots, network). stop: write it to exports/<saveAs>. | |
| saveAs | No | Required on stop. View with `npx playwright show-trace`. | |
| sessionId | Yes | Session ID returned by browse_session_start. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly=false, openWorld=true, idempotent=false, destructive=false; the description usefully adds that output lands as a .zip under exports/ and enumerates what the trace captures. It omits meaningful behavior: whether stop requires a prior start, what happens on double-start, and where errors surface — relevant given idempotentHint=false.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One sentence, front-loaded with the action and resource, with the artifact location trailing. No filler and no repetition of schema content.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With a full output schema, 100% parameter coverage, and safety annotations already present, the description only needs to establish purpose and destination, which it does. The remaining gap is lifecycle behavior (start-before-stop coupling), a minor omission for a 3-parameter tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents action enum semantics, the saveAs pattern/stop requirement, and sessionId provenance. The description adds no parameter detail beyond what the schema provides, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb pair (start/stop) and resource (Playwright trace) plus the artifact produced (.zip under exports/). It implicitly distinguishes the tool from browse_screenshot and browse_snapshot by naming the trace contents, but never explicitly contrasts with those siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied by 'for a session' and the start/stop action pairing, but there is no guidance on when to prefer a trace over browse_console, browse_network_summary, or browse_screenshot, and no stated prerequisites beyond the sessionId schema note.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browse_snapshotCRead-only
Navigate once and return visible text, ARIA snapshot, and interactive metadata.
| Name | Required | Description | Default |
|---|---|---|---|
| os | No | Optional OS to spoof. Can be 'windows', 'macos', or 'linux'. If not specified, will rotate between all OS types. | |
| url | Yes | The URL to navigate to. Must be a fully qualified http or https URL. | |
| args | No | Additional browser command-line arguments to pass to the browser. Rejected unless CAMOUFOX_MCP_ALLOW_UNSAFE_OPTIONS=1; denied args are always rejected. | |
| geoip | No | Automatically detect geolocation based on IP address. | |
| proxy | No | Proxy configuration for routing browser traffic through an HTTP(S) proxy. Proxy servers are checked against the same local-network URL policy as page requests. | |
| locale | No | Browser locale (e.g., 'en-US', 'fr-FR'). | |
| window | No | Set fixed window size [width, height] instead of random generation. An empty array [] is accepted and treated as if the window parameter was not specified. | |
| timeout | No | Timeout in milliseconds for page load (5-300 seconds). | |
| headless | No | Run browser in headless mode. Auto-detects best mode for environment if not specified. | |
| humanize | No | Enable realistic cursor movements and human-like behavior for better stealth and anti-detection. | |
| maxChars | No | Maximum visible text and ARIA snapshot characters to return. | |
| selector | No | Optional CSS selector to limit snapshot extraction to one matching element. | |
| viewport | No | Custom viewport dimensions. | |
| emulation | No | Context emulation for diagnosing how the page behaves under other conditions. | |
| block_webgl | No | Block WebGL to prevent fingerprinting and tracking. | |
| maxElements | No | Maximum interactive elements to return. | |
| block_images | No | Block all images for faster loading, reduced bandwidth, and lightweight browsing. | |
| block_webrtc | No | Block WebRTC entirely for enhanced privacy and stealth. | |
| disable_coop | No | Disable Cross-Origin-Opener-Policy for sites that require it. | |
| enable_cache | No | Cache pages, requests, etc. Uses more memory but improves performance when revisiting pages. | |
| waitStrategy | No | Wait strategy for page load. Defaults to 'domcontentloaded'. 'load' waits for all resources, 'networkidle' waits for network activity to finish. | domcontentloaded |
| captchaPolicy | No | Challenge handling policy. 'detect' reports signals, 'pause' returns state for human action, 'fail' returns an error, 'attempt' returns enhanced challenge metadata, interactive elements, a bounded screenshot, and a suggested strategy. When CAPTCHA_AUTONOMOUS=true, responses are marked for LLM-assisted handling and include provider-specific challengePlaybook context when known. | |
| exclude_addons | No | List of default addons to exclude (e.g., ['ublock_origin']). Rejected unless CAMOUFOX_MCP_ALLOW_UNSAFE_OPTIONS=1. | |
| includeConsole | No | Include bounded page console diagnostics in the JSON response. | |
| includeNetwork | No | Include bounded network diagnostics in the JSON response. | |
| stealthProfile | No | Convenience profile for common Camoufox browser settings. Explicit options override profile values. | normal |
| firefox_user_prefs | No | Custom Firefox user preferences to set. Rejected unless CAMOUFOX_MCP_ALLOW_UNSAFE_OPTIONS=1; denied prefs are always rejected. |
Output Schema
| Name | Required | Description |
|---|---|---|
| url | Yes | |
| text | Yes | |
| title | No | |
| status | No | |
| message | No | |
| elements | Yes | |
| maxChars | Yes | |
| selector | No | |
| contentType | No | |
| diagnostics | No | |
| maxElements | Yes | |
| ariaSnapshot | No | |
| challengeType | No | |
| selectorFound | Yes | |
| textTruncated | Yes | |
| captchaIframes | No | |
| captchaDetected | No | |
| challengeSignals | No | |
| ariaSnapshotError | No | |
| challengeHandling | No | |
| challengePlaybook | No | |
| challengeProvider | No | |
| elementsTruncated | Yes | |
| suggestedStrategy | No | |
| requiresUserAction | No | |
| interactiveElements | No | |
| ariaSnapshotTruncated | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly/openWorld/idempotent=false/non-destructive, and the description adds essentially nothing beyond listing return payloads. It omits the operationally important behaviors encoded in the schema — stealth/CAPTCHA policies, unsafe-option gating for args/user prefs, timeout defaults, and truncation limits — that an agent would want summarized when choosing this tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with zero filler; it is efficiently structured. It is arguably under-specified rather than too long, but no sentence is wasted.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a very complex tool (27 params, nested objects, output schema) sitting among several overlapping browsing siblings, one sentence is not enough to route an agent correctly. The output schema covers return values, but the description should still disambiguate scope from browse/browse_session_* and note the one-shot vs. session lifecycle.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all 27 parameters (including nested proxy, emulation, and viewport objects) are already documented in the schema. The description adds no parameter meaning beyond what is structured, which is the expected baseline here.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Navigate once') and enumerates the return artifacts (visible text, ARIA snapshot, interactive metadata), which is clearer than a bare name restatement. But it gives no signal distinguishing it from close siblings such as browse, browse_inspect, browse_session_navigate, and browse_session_snapshot.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to pick this over browse_inspect / browse_session_snapshot / browse, nor any prerequisites. The 'navigate once' phrasing hints at a one-shot vs. session-based split, but the agent must infer it from the sibling names alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
camoufox_statusARead-onlyIdempotent
Return server, browser, queue, session, and policy status without launching a page.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| browser | Yes | |
| version | Yes | |
| maxQueue | Yes | |
| platform | Yes | |
| browserPath | No | |
| maxSessions | Yes | |
| headlessMode | Yes | |
| sessionTtlMs | Yes | |
| activeBrowsers | Yes | |
| activeSessions | Yes | |
| maxConcurrency | Yes | |
| queuedRequests | Yes | |
| evaluateAllowed | Yes | |
| networkSecurity | Yes | |
| browserAvailable | Yes | |
| captchaAutonomous | Yes | |
| browserCompatibility | Yes | |
| unsafeOptionsAllowed | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, covering the safety profile. The description adds one genuinely useful behavioral trait — that no page is launched, so it is cheap and side-effect-free — but says nothing about cost, latency, or whether it requires a running server/session.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single short sentence front-loads the resource and its components, then closes with the key constraint. Every word earns its place and there is no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present, the description needn't enumerate return fields, and it correctly lists the status domains available. For a zero-param, read-only tool with annotations and an output schema, this is nearly complete; only the lack of usage guidance keeps it from a 5.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so there is nothing for the description to clarify beyond the schema. Baseline 4 applies: no param information is required and its absence is not a gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb (return) and resource (status), and enumerates exactly what statuses are covered: server, browser, queue, session, and policy. The clause 'without launching a page' cleanly separates it from the browse*/browse_session* siblings that do launch pages, so an agent can route without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'without launching a page' implies the usage context (a lightweight health/state check rather than an actual browse), but the description never states when to prefer this over alternatives or any preconditions. Usage is implied rather than explicitly guided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
flow_listARead-onlyIdempotent
List saved flows (scripted login/automation) with their schedule and last run.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| flows | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, destructiveHint=false, and openWorldHint=false. The description adds useful context by noting that results include schedule and last-run information, but it does not mention ordering, pagination, or any access constraints.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence that identifies the resource, clarifies what a 'flow' is, and lists the returned fields. Every phrase carries useful information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This is a simple zero-parameter list operation with an output schema and strong read-only annotations, so the description is largely complete. The main missing element is usage guidance relative to flow_run and flow_save, though that is already penalized separately.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so there is no parameter semantics gap to compensate for. The description correctly does not invent or discuss parameters, matching the empty input schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a clear verb-resource pair: 'List saved flows', and clarifies that flows are 'scripted login/automation'. It also states the returned fields ('schedule and last run'). It does not explicitly contrast with sibling flow_run or flow_save, so it stops short of full sibling differentiation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this tool versus alternatives such as flow_run or flow_save. The listing purpose is implied by the verb, but no conditions, prerequisites, or exclusions are stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
flow_runA
Run a saved flow now and return its result (also stored under runs/).
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Flow name (lowercase letters, digits, - and _). |
Output Schema
| Name | Required | Description |
|---|---|---|
| ok | Yes | |
| name | Yes | |
| error | No | |
| steps | Yes | |
| extract | No | |
| trigger | Yes | |
| sessionId | No | |
| startedAt | Yes | |
| durationMs | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=false, idempotentHint=false and openWorldHint=true, so safety is covered; the description adds genuinely new behavior: execution is immediate ("now"), it returns a result, and that result is persisted under runs/. It stops short of noting runtime/error behavior or side effects on the flow itself.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler; the verb, immediacy, return value and persistence side effect are all packed into one line.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be described, and annotations cover the risk profile. For a one-parameter execution tool the description supplies everything an agent needs to call it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Only one parameter, and schema coverage is 100% with a pattern and format note, so the schema carries the semantics. The description adds only the word "saved," which implies the name must reference an existing flow — marginal added value, baseline 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
A specific verb ("Run") plus resource ("a saved flow"), with the added scope note that it executes immediately and returns the result. It does not explicitly contrast with siblings flow_save/flow_list, though "saved flow" hints at the prerequisite artifact.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied by "saved flow" (a flow must exist first) but the description never states when to use this versus flow_save or flow_list, nor any preconditions or exclusions. An agent can infer intent but must guess at the boundary.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
flow_saveAIdempotent
Create or overwrite a saved flow: optional profile, startUrl, bounded actions, optional extract and cron schedule.
| Name | Required | Description | Default |
|---|---|---|---|
| flow | Yes | ||
| name | Yes | Flow name (lowercase letters, digits, - and _). |
Output Schema
| Name | Required | Description |
|---|---|---|
| name | Yes | |
| saved | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=false, idempotentHint=true and destructiveHint=false, and "create or overwrite" is consistent with that profile. The description adds useful scope detail (bounded actions, profile reuse, cron schedule) but never says what happens to an existing definition on overwrite or that the flow must exist elsewhere to be validated.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One front-loaded sentence with no filler, listing the salient components. It is efficiently sized, though the comma-list style trades precision for brevity on a schema this complex.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need no explanation, but the tool's input surface is enormous (15 action variants, nested extract config) and the description devotes a single clause to it. Key operational facts — the overwrite semantics, the 100-action cap, the name pattern, and whether the saved flow is runnable immediately — are left to the schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 50% at the top level, and the description enumerates the meaningful flow fields (profile, startUrl, actions, extract, schedule), which orients an agent inside a very large nested schema. It omits headless and timezone, and its flat phrasing ('optional profile') slightly obscures that these live under the nested flow object rather than as sibling top-level params.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a specific verb pair ("create or overwrite") and a clear resource ("saved flow"), which separates it from flow_run (execute) and flow_list (enumerate) in the sibling set. It stops short of naming those siblings explicitly, so differentiation relies on inference from the word "saved".
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied: the phrasing "saved flow" and "create or overwrite" hints that this persists a definition for later execution by flow_run. There is no explicit statement of when to prefer this over flow_run/flow_list, no preconditions, and no warning about overwriting an existing flow.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
26 tool updates
v0.2.0- First observed
browse - First observed
browse_console - First observed
browse_diagnose - First observed
browse_extract - First observed
browse_find - First observed
browse_forms - First observed
browse_inspect - First observed
browse_links - First observed
browse_network_summary - First observed
browse_outline - First observed
browse_profile_delete - First observed
browse_profiles_list - First observed
browse_screenshot - First observed
browse_sequence - First observed
browse_session_action - First observed
browse_session_close - First observed
browse_session_navigate - First observed
browse_session_resume - First observed
browse_session_snapshot - First observed
browse_session_start - First observed
browse_session_trace - First observed
browse_snapshot - First observed
camoufox_status - First observed
flow_list - First observed
flow_run - First observed
flow_save
TDQS
Scored across 26 tools
The 13 one-shot browse_* tools each return a different facet, but several overlap heavily: browse vs browse_snapshot vs browse_extract, browse_console vs browse_diagnose, and browse_network_summary vs browse_diagnose. The descriptions help, but an agent must carefully choose among many similar navigate-once variants.
Most tools follow a consistent browse_<facet> or browse_session_<action> pattern, and flow_* tools are coherent within their domain. Minor deviations exist, such as browse_profiles_list vs browse_profile_delete and the unprefixed camoufox_status.
At 26 tools, the surface is heavy and many one-shot browse variants could be consolidated behind a mode parameter. Each tool has a plausible purpose, but the count is borderline excessive for the apparent scope.
Core browser automation workflows are well covered: navigation, sessions, interaction, extraction, diagnostics, screenshots, profiles, and saved flows. Minor gaps remain, such as flow deletion, explicit profile creation, and session listing.
Maintenance
Related MCP Connectors
Stealth web browser for agents: search, fetch, click, download and type in persistent MCP sessions.
A real Chromium browser agents pay for per action in USDC via x402 — hosted MCP, free local stdio.
Official Browserless MCP server: browser automation, scraping, screenshots and PDFs for AI agents.
Browser agents and stealth cloud browsers for AI: run web tasks, fill forms, extract data.
Related MCP Servers
- AlicenseNot gradedqualityCmaintenanceEnables AI agents to automate a privacy-focused Firefox-based browser through MCP, with session and profile management, navigation, interaction, extraction, screenshots, JavaScript execution, tabs, downloads, and permission/URL validation.MIT
- AlicenseNot gradedqualityAmaintenanceGives MCP-compatible AI agents an anti-detection browser toolset for navigating, interacting with, searching, and extracting content from websites, plus downloads, multi-tab workflows, and persistent sessions with cookies and saved profiles. It enables reliable automation of the web without getting blocked by running against a separate Camoufox-based browser server.971 npmMIT
- AlicenseNot gradedqualityAmaintenanceExposes a 47-tool browser automation surface to MCP clients, enabling AI agents to navigate, interact with, observe, and extract content from web pages across multi-tab sessions. Runs on Camoufox-based anti-detection behavior so agents can automate sites that block conventional headless browsers, with session persistence, cookie import, and stdio or HTTP transport.971 npmMIT
- FlicenseNot gradedqualityAmaintenanceEnables AI agents and human operators to drive isolated, persistent browser profiles with their own cookies, fingerprints, and proxies. Exposes tools for profile lifecycle, navigation, clicking, typing, extraction, screenshots, JavaScript evaluation, tabs, cookies, and waits over a local MCP endpoint.-