Skip to main content
Glama

browsertap-mcp

English | 中文文档

Offline CI Python 3.10+ License: MIT

Usage guide · Troubleshooting · Security · Privacy · Contributing · Changelog

Browser automation for the Chrome, Edge, or Opera you already use. BTAP connects your MCP client to a browser extension, reusing your open tabs and logged-in profile. Your agent can read pages, fill forms, download attachments, and inspect network activity. Page input runs in the selected tab in the background by default, without moving your desktop cursor.

BTAP controls a real browser profile, not a disposable sandbox. Give it access only to accounts and data that the connected agent may use. First-time extension installation is manual; setup and security are below.

Start in 60 seconds

Claude Code and Codex: install the plugin. It includes the MCP server and caller Skills. Install uv first; dependency downloads and the manual browser step can take longer than a minute.

  1. Add BrowserTap to your agent. Choose your client:

    Claude Code:

    claude plugin marketplace add LinVireo/browsertap-mcp
    claude plugin install browsertap-mcp@browsertap

    Codex:

    codex plugin marketplace add LinVireo/browsertap-mcp
    codex plugin add browsertap-mcp@browsertap
  2. Load the browser extension manually. Open a new agent session and ask it to call get_setup_status for the extension_path. Open chrome://extensions, enable Developer mode, choose Load unpacked, and select that directory. Use edge://extensions or opera://extensions for those browsers.

  3. Start a browser task: "List my open tabs, then summarize the page I select without navigating or closing it."

Plugin setup and updates also covers browsertap doctor through the plugin's environment. For Cursor, Claude Desktop and other MCP clients, use the standard MCP installation below. Existing MCP configurations continue to work.

Related MCP server: chrome-mcp

Documentation by audience

Reader

Start here

Installing or using BTAP

This README, then the usage guide for workflows and boundaries.

Installing the Claude Code or Codex plugin

Plugin guide.

Diagnosing a local setup

Troubleshooting, with the output of browsertap doctor.

An agent calling BTAP tools

The client's live tool schemas and the optional caller skills.

A human or agent changing BTAP

Contributing; coding agents also read AGENTS.md.

The Tools section is the complete parameter reference for this source tree. For an installed release, use documentation from its matching tag; development checkouts can contain unreleased changes. Runtime capabilities come from the connected server, not from a different version of the README.

Key features

  • Read and inspect pages: simplified HTML/text, JavaScript, screenshots, and bounded network/console captures.

  • Interact in a background tab: page_click, page_type, page_press, and page_drag use trusted CDP input without moving the desktop cursor.

  • Fill embedded forms: locate, wait for, click, and type into controls in nested same-origin and cross-origin iframes.

  • Use the existing profile: authenticated downloads, cookies, storage, bookmarks, extensions, and temporary site-permission leases.

  • Control interruptions: explicit dialog policies, condition-based waiting, and operation handles for collecting delayed results without replaying an action.

  • Separate concurrent tasks: explicit browser/tab targets and owner-aware cleanup. Different tabs can run concurrently; shared-profile state is not isolated.

  • Connect multiple browsers: one bridge can serve Chrome, Edge, Opera, and multiple profiles. Browser-level operations can work without a page tab.

Common workflows

  • Read authenticated sites: summarize a selected page, extract a table, or follow links using your existing login.

  • Complete web forms: search, filter, and fill controls in ordinary pages, SPAs, and embedded frames.

  • Collect files and inspect pages: download reports, capture screenshots, and inspect network requests or console messages.

See the usage guide for step-by-step workflows and the tool reference for parameters.

BTAP exposes three capability layers so an agent can choose the narrowest interface that matches the task:

  • Page capability — DOM inspection, JavaScript, waiting, scrolling, screenshots, and page_* CDP input inside a named tab. This is the default path for ordinary web workflows and does not use the operating system mouse or keyboard.

  • Browser capability — the real Chromium profile and its browser-native surface: tabs, downloads, cookies, storage, permissions, bookmarks, extensions, service-worker messaging, and raw CDP. These operations can work without a foreground tab.

  • Desktop capability — explicit inspection and cancellation attempts for a foreground Windows standard file dialog owned by registered Chrome or Edge. Call inspect_native_file_dialog first, then use its short-lived ticket with cancel_native_file_dialog; both require desktop_opt_in=true and [desktop]. Other browser UI and unsupported native layouts remain outside this surface. The seven global OS input/screenshot tools removed in 0.5.0 remain removed.

resolve_leave_dialog remains a page-scoped, lab-only recovery workflow; its final Enter fallback is a restricted exception, not a general desktop surface. get_setup_status returns tool counts and capability groups in data.capability_registry. MCP tools/list supplies the actual tool schemas and explicit readOnlyHint, destructiveHint, idempotentHint, and openWorldHint for every tool. These describe all supported parameter paths: tools with optional script execution, buffer clearing, or file writes are not classified as read-only. get_setup_status can tighten an existing Windows token file's ACL and is also classified as state-changing. Annotations help hosts plan calls; they do not grant permission or replace BTAP's ownership and concurrency checks.

Every public tool now returns the btap.result.v1 envelope without renaming tools: successful operation data is in data, explicit legacy failure payloads remain in legacy, and error/error_code, retryable, target, and diagnostics provide stable machine-readable status. Failures also set MCP isError=true. Arrays, objects, HTML, and other large bodies are read from data or legacy; only small scalar operation fields are projected at the top level for compatibility. Use the envelope's retry verdict: an explicit retry_safe=false or possible execution overrides a connection error's usual retry hint.

Requirements

  • Python 3.10+

  • Chrome, Edge, or Opera

  • Linux, macOS, or Windows. The ordinary page, browser, and CDP tools do not require OS-level input. The lab-only resolve_leave_dialog fallback and the Windows native-file-dialog tools need a usable desktop session.

  • A running Chromium user session with the BrowserTap Bridge extension loaded.

  • Claude Code, or any other MCP client

Getting started

1. Install

Create a virtual environment and install the package. The optional desktop extra is needed for the lab-only physical fallback or explicit native-file-dialog tools:

Windows PowerShell

python -m venv .venv
.\.venv\Scripts\python.exe -m pip install browsertap-mcp
.\.venv\Scripts\browsertap.exe extension-path

Linux or macOS

python -m venv .venv
./.venv/bin/python -m pip install browsertap-mcp
./.venv/bin/browsertap extension-path

The core install (pip install browsertap-mcp) is sufficient for page, browser, and CDP tools. It omits pyautogui, mss, and pillow, which are used by the lab-only resolve_leave_dialog Enter fallback and its screen/input checks. The explicit Windows native-file-dialog tools also require [desktop].

To work on the project rather than only use it, install the checkout as editable instead. Same extras; the extension directory and the skills are then read straight out of the tree:

git clone https://github.com/LinVireo/browsertap-mcp.git
cd browsertap-mcp
python -m venv .venv
./.venv/bin/python -m pip install -e ".[dev,desktop]"
./.venv/bin/browsertap extension-path

2. Load the Chrome extension

This project ships an unpacked extension that has to be loaded once by hand.

browsertap extension-path

Open chrome://extensions, turn on Developer mode, click Load unpacked, and pick the directory that command printed. The loaded extension is listed as BrowserTap Bridge.

If you also use Edge or Opera, repeat the same steps at edge://extensions or opera://extensions with the same directory. The bridge tells the browsers apart automatically.

Then open a normal http:// or https:// page. A blank tab is not enough — content scripts cannot run on about:blank, so no session is established.

Connection status badge

The extension may show a small BTAP: checking, BTAP: connected, or BTAP: disconnected badge on pages. The badge is presentation-only: it reports the bridge connection state and does not display page content, cookies, tokens, or URLs. Open the extension popup and clear Show connection status on pages to hide it. Hiding the badge does not stop the bridge, keepalive, or automatic reconnect behavior.

The extension popup

The popup holds the badge toggle above and two buttons, both of which act on the tab you are looking at:

Control

What it does

Refresh

Lists that tab's cookies including their values, and including HttpOnly ones the page's own JavaScript cannot read. It is a debugging aid, so it deliberately shows what a document.cookie dump would hide.

Copy

Writes every listed cookie to the system clipboard as name=value lines.

Treat both as handling live credentials: anything that later reads your clipboard receives session cookies, and a screenshot of the popup captures them. See SECURITY.md for where this sits in the threat model.

3. Add the server to your client

Standard config works in most tools:

{
  "mcpServers": {
    "browsertap": {
      "type": "stdio",
      "command": "browsertap"
    }
  }
}

If you installed into a virtualenv, point command at the executable's absolute path instead — relying on PATH is the most common reason a client fails to start the server.

claude mcp add browsertap -- browsertap

Add --scope user to make it available across all projects. For a virtualenv install:

claude mcp add browsertap -- /absolute/path/to/.venv/bin/browsertap

On Windows PowerShell, use the absolute path to .venv\Scripts\browsertap.exe instead.

Verify with /mcp.

Follow the MCP install guide and use the standard config above. An example file is included at examples/claude-desktop-config.json.

Put the standard config in .cursor/mcp.json for one project, or ~/.cursor/mcp.json globally. An example file is included at examples/cursor-mcp.json.

code --add-mcp '{"name":"browsertap-mcp","command":"browsertap"}'

Or write it into .vscode/mcp.json by hand — note that VS Code's key is servers, not mcpServers.

Add to ~/.hermes/config.yaml:

mcp_servers:
  browsertap:
    command: browsertap
    timeout: 120
    connect_timeout: 60

browsertap print-hermes-config prints this snippet. An example file is included at examples/hermes-config.yaml. Verify with hermes mcp list.

Any MCP client that speaks stdio will work. Follow its own install guide and use the standard config above.

Your first prompt

Once the extension is loaded and a normal page is open, try:

What tabs do I have open? Read the current page and summarise it.

If tabs come back empty, run browsertap doctor.

For the least disruptive workflow, start with docs/USAGE.md: it explains which operations stay in a background tab, when foreground activation is needed, how the remaining physical fallback is gated, and when an image-capable model is useful.

Configuration

Environment variables

Variable

Default

Purpose

BROWSERTAP_BRIDGE_HOST

127.0.0.1

Bridge bind address.

BROWSERTAP_BRIDGE_PORT

18765

Integer from 1 through 65533. WebSocket uses this base, HTTP uses PORT+1, and the host lock uses PORT+2. Invalid values fail before network or spawn actions. The separate spawn.lock file prevents concurrent daemon starts. For a custom port, also configure the extension — see docs/TROUBLESHOOTING.md.

BROWSERTAP_STATE_DIR

~/.browsertap

Override the state directory. A nonempty relative path is anchored to the launching process's working directory before daemon spawn. Existing legacy-directory fallback remains available when no override is set.

BROWSERTAP_NO_SPAWN

unset

Set to 1 to stop the MCP server from auto-starting the bridge. Use it when you run the bridge yourself.

BROWSERTAP_BRIDGE_AUTH

enabled

Set to off only for an explicitly trusted local compatibility setup. By default BTAP authenticates /link with a persistent per-user token.

BROWSERTAP_BRIDGE_TOKEN_FILE

~/.browsertap/bridge-token

Override the shared token file location; relative paths use the launching process's working directory. Without this override, the token lives in the selected state directory. Editors do not need individual tokens.

BROWSERTAP_BRIDGE_TOKEN

unset

Legacy one-time migration source. If the token file does not exist, BTAP imports this value once; the file wins thereafter.

BROWSERTAP_PREFERRED_BROWSER

unset

chrome, edge, or opera. Which browser wins when several are connected and no tab is specified.

BROWSERTAP_MODE

lab

lab prioritizes uninterrupted automation and skips physical-input/site-allow elicitation; safe prompts for every such action. set_automation_profile changes only the current MCP process.

BROWSERTAP_ALLOW_UNSAFE_CDP

unset

Raw CDP blocks the high-risk methods listed in SECURITY.md. 1 permits them only in lab; safe retains the guard. Other allowed methods can still change page or profile state.

BROWSERTAP_LAB_NO_ELICIT

enabled

Lab skips elicitation by default. Set this to 0/false only when you want session-level lab approval prompts; the cross-process lock, quiet-input gate, foreground confirmation, and ownership checks always apply.

BROWSERTAP_AUTO_BEFOREUNLOAD_HOSTS

shell.,ttyd,code-server,jupyter,vscode-web

In lab, ordinary open_url accepts beforeunload on matching current hosts. intent_leave=false always preserves the page.

BROWSERTAP_WS_ALLOWED_ORIGINS

unset

Comma-separated exact extra origins for WebSocket and HTTP. The packaged extension ID is pinned by default, from its manifest key or unpacked path; separate copies need their own explicit Origin. HTTP token authentication still applies, including without Origin.

BROWSERTAP_WS_ALLOW_NO_ORIGIN

unset

Set to 1 only for a trusted non-browser local WebSocket client that cannot send Origin. The default rejects origin-less clients.

CLI

browsertap                      # run the MCP server (stdio)
browsertap --version            # print the installed package version
browsertap extension-path       # print the unpacked extension directory
browsertap skill-path           # print the directory holding the shipped agent skills
browsertap doctor               # diagnose the local setup, as JSON
browsertap bridge               # run the bridge in the foreground
browsertap bridge --restart     # restart the managed bridge; does not touch the browser
browsertap bridge --stop        # stop the exact managed bridge process
browsertap print-hermes-config  # print a Hermes config snippet

doctor reports the extension path, port state, and connected tab count. It also returns a structured verdict: cause is one of healthy, starting, ext_never_registered, sw_slept_or_dropped, registering, or bridge_unreachable, and advice is the matching one-line fix. starting means the bridge has just started and is waiting for the extension handshake; its action is wait_for_extension, so wait a few seconds and run doctor again. registering means the extension is connected but no normal http(s) content tab is ready.

When no extension runtime status is available after startup, the setup status is extension_unavailable with action: check_extension_connection. Check that BrowserTap Bridge is enabled in the intended browser and retry doctor. extension_status_available=false means compatibility is still unknown; missing runtime data alone does not request an extension Reload. Confirmed old bridge or MCP versions retain their own restart action, including during startup.

doctor prints JSON on stdout even for invalid configuration. An invalid base port reports status: "initialization_failed", action: "check_config", error and error_type before network or spawn actions. Imports, help/version and package-path commands remain usable. DNS/socket failures during later port probes preserve the available setup diagnosis and add port_probe_errors; an affected port's state is null. Exit status is 0 only for healthy or starting without probe errors. A malformed bridge diagnosis reports cause: "bridge_unreachable", ok: false and error_code: "malformed_diagnosis"; it does not establish that the bridge is an old build.

state_paths.token_file_status distinguishes missing, empty, ready, unreadable and invalid_encoding. token_file_error gives a safe reason; only ready content has a fingerprint. Existence fields are null when metadata cannot be read. Unknown default-directory metadata keeps the canonical path; legacy selection requires the default directory to be confirmed absent. Existing empty or unreadable files are not overwritten.

mcp_build_verdict and bridge_build_verdict compare each process's package-import source snapshot with disk: matches_tree, stale_process, or unverifiable. The snapshot includes package Python files and import-cached JavaScript used for result conversion, guarded execution, scoped dialogs and page inspection. Same-version edits still require the corresponding MCP or bridge restart. Missing assets or older identity schemas cannot prove a match. This source identity does not attest runtime monkeypatches, cached bytecode or arbitrary other assets; *_build_enforced=false is unknown.

BTAP creates ~/.browsertap/bridge-token on first use and every bridge/MCP process reads that same file. Closing browsers or editors does not rotate it. Removing the browser extension or reinstalling the Python package deliberately leaves the token file in place, so a reinstall continues to work. A full user-data purge may delete the whole ~/.browsertap directory only after all BTAP bridge processes have stopped; the next start then creates a new token.

Agent skills (optional)

The Claude Code and Codex plugins load these Skills automatically. This section is for clients configured through the standard MCP installation.

BTAP includes the primary workflow and recovery rules in MCP initialization instructions and tool descriptions. The same two packaged Markdown guides are also discoverable through MCP resources/list and readable with resources/read: browsertap://agent/workflow and browsertap://agent/recovery. A client can read them without installing Skills. Hosts decide when to load resources; the critical target, ownership and retry rules remain in the instructions and tool results.

browsertap skill-path           # e.g. .../site-packages/browsertap_mcp/skills

That directory contains:

Skill

What it is for

browsertap-default/SKILL.md

The calling contract: pick a target before acting, open your own tab for anything that mutates a page, close it in cleanup, and how to react to no_response / switched_session / bridge_error.

browsertap-bridge-recovery/SKILL.md

Recovery when the transport itself is down: which of the three components is stale, and the one restart or reload that fixes it.

These are instructions for an agent using BTAP, not for an agent editing BTAP's source. Coding rules and test commands belong in AGENTS.md and Contributing.

Point your client's skill manager at that directory rather than copying the files. A copy looks correct for as long as the contents happen to agree, then silently stops receiving updates when you upgrade the package. If you keep copies anyway, python -m scripts.check_tool_docs --check-installed-skills --skill-mirror DIR compares them against the shipped originals and names whichever one drifted.

Upgrade

Plugin users: follow plugin updates. The steps below apply to a Python package installation.

The marker below is maintained with this source tree. It is not proof that a development checkout has been published; compare the installed package with its release tag before using new tool signatures or the 0.5.0 migration notes.

Current release: unified Python package, bridge, and unpacked Chrome extension 0.5.4.

The three components load updates separately:

  1. Update the installed package with pip install -U browsertap-mcp (keep [desktop] if you use that extra), then restart its MCP session.

  2. Run browsertap doctor. If it requests restart_bridge, use browsertap bridge --restart to load the daemon's updated code.

  3. If it requests reload_extension, open chrome://extensions and press Reload on BrowserTap Bridge. Extension source changes require that manual step.

browsertap doctor reports which part is stale and names the one action that fixes it: reload_extension, restart_bridge, or restart_mcp_session. The other two will not help, so read the field rather than doing all three.

Uninstall

  1. Stop the managed daemon with browsertap bridge --stop.

  2. Open chrome://extensions (or the equivalent page in Edge/Opera) and remove the unpacked BrowserTap Bridge extension.

  3. Remove the browsertap entry from each MCP client's configuration.

  4. Run pip uninstall browsertap-mcp in the environment where it was installed. If you created a dedicated virtual environment, remove that specific environment after deactivating it.

  5. Optional full cleanup: after confirming every BTAP bridge is stopped, remove ~/.browsertap. This deletes the persistent bridge token and logs; the data is retained by default so reinstalling continues to work without reconfiguration.

How it works

Three layers:

  1. Chrome extension (MV3) — injected into real pages, reaches tabs, cookies, debugger, and management through Chrome APIs.

  2. BrowserBridge — a local daemon on 127.0.0.1:18765 (WebSocket) and :18766 (HTTP). It owns the extension connections, tracks sessions, and relays results. It runs detached from any MCP instance, and the MCP server starts it on demand with no console window. client_id identifies one connected browser/profile instance; session_id is its current composite clientId:tabId handle, not a permanent tab identity. Connected rows may also carry tab_identity. Several browsers and profiles coexist.

  3. MCP server — exposes the whole thing as MCP tools. Each agent's MCP process keeps its own selected target and tab ownership registry.

Two channels reach the browser: a per-tab session channel, and a direct channel to the extension's service worker. The second one is why some tools keep working when every tab is closed.

Behaviour you should know before driving it

Selecting a tab does not raise it. switch_tab defaults to activate=false: it only changes which tab later calls target. Nothing moves on screen until you call activate_tab, pass switch_tab(activate=true), or approve a physical-input action. Page reading, JS, and the page_* input tools all work on a background tab.

One coordinate space, inside the tab. page_click/page_drag take viewport coordinates inside one tab and are dispatched through CDP — no cursor movement, no window focus, foreground_changed: false in the reply. There is no desktop-coordinate tool to confuse them with any more: the ones that took physical screen pixels were removed in 0.5.0.

Two pixel units, and the screenshot does not use the one you click with. Viewport coordinates are CSS pixels — the space getBoundingClientRect reports. A page screenshot comes back in device pixels, which is CSS × devicePixelRatio, so at 125% display scaling a point read off the picture is 25% too large for page_click; capture_page_screenshot reports image_width/image_height and pixel_space: "device" so the factor is visible instead of assumed. Reading a point off a picture is the one path with no hit test — prefer a scan_page selector, which is checked against the page before anything is dispatched.

Automation profiles. With BROWSERTAP_MODE unset, BTAP defaults to lab with BROWSERTAP_LAB_NO_ELICIT=1 semantics. Lab permits site allow and the restricted leave-dialog fallback without elicitation; safe prompts for each site allow and refuses the physical Enter fallback. Neither profile is a confirmation prompt for every browser action. Ownership and target checks still apply, and the physical path keeps its OS lock, quiet-input gate and on_screen check. input_quiet.enforced says whether comparable input markers were available.

Raw CDP. get_automation_profile.raw_cdp_policy reports guarded or allow_unsafe. Single commands and entire batches are checked before dispatch; use dedicated tools for tab closure, cookies, permissions and user-agent changes. The guard covers common destructive methods, while allowed JavaScript/CDP can still change a page. The complete policy and explicit lab override are in SECURITY.md.

Dialogs are explicit. execute_js(dialog_policy=...), open_url(beforeunload=...), and handle_dialog(action=...) take dismiss (default), accept, or manual. The global default still preserves the page; only an explicit accept or lab's configured shell/IDE host heuristic leaves automatically. handle_dialog answers within three seconds or reports no_dialog/an explicit error. resolve_leave_dialog tries protocol accept twice and uses physical Enter only as a final, lab-approved fallback.

The extension route for execute_js prepares the current injectable frames for accept/dismiss before running the caller and restores temporary helpers on completion or expiry. The Python CDP fallback for an older command router covers only its current evaluation context. New documents do not inherit either scope. Preparation shares the command deadline; a caller's CSP-like error or an uncertain result never justifies replaying it.

Permissions use temporary leases. set_site_permission covers one origin for 60–600 seconds, records the prior setting, and attempts restoration on expiry/reset/service-worker restart. safe prompts for every allow; default lab applies it without elicitation. Unsupported restoration is retained as manual_recovery with the prior setting and recovery guidance, and automatic retries stop. Correct the cause before an explicit reset_site_permissions retry. Unsupported initial grants return unsupported or requires_user_action.

Challenges stay in your browser. A Cloudflare Turnstile or similar widget is handled in the same connected tab, by page_click, with a bounded number of attempts. When the challenge has not moved, the result is challenge_stalled and BTAP stops so you can finish it yourself in that same tab. BTAP never launches Playwright, a headless browser, or a separate automation profile as a fallback — the whole point is your real, logged-in session.

Changed tools need a reload. Tool schemas and descriptions are read once when your client starts the MCP server; after upgrading, restart the MCP session or your client, or you will keep calling the old signatures. Extension changes need a manual reload at chrome://extensionschrome.runtime.reload() restarts the service worker without re-reading the files from disk.

Tab ownership in concurrent tasks

Classify every tab before using it. A U (user) tab existed in the first list_tabs snapshot; do not close it or navigate it by default. An A (agent) tab is created by this task's open_new_tab; save its session_id, generation, and owner_id, pass that explicit session to every operation, and call close_tabs(..., owner_id=...) in cleanup. A B (borrowed) tab is a temporarily used U tab; record its original_url and never close it. Restore a URL changed by this task only after confirming the same tab lifecycle still exists and the user has not since navigated it elsewhere.

Decision order: run list_tabs; borrow an existing match only for read-only/light work; open an A tab for searches, filters, sorting, pagination, scrolling, expand/collapse, navigation, forms, or other actions that change the page view or state; open an A tab when no match exists; finally close only A tabs. Never register the initial tab snapshot as owned, close a U/B tab, omit the explicit target for state changes, reuse an old native tab id, omit generation-aware cleanup, or leak an A tab.

For parallel agents, use a separate A tab per agent and explicit session_id on each call. Different tabs can run concurrently both within one MCP process and across independent MCP processes. Each process has its own default tab; agents sharing a process also share that default, so switch_tab is not an agent identity. Each call snapshots its target, and an explicitly targeted call does not change another call's target or the process default.

A cooperative target lock covers each complete MCP call and its internal browser roundtrips. A competing call to the same tab returns target_busy. The bridge also records reservations for dispatched commands: wait=false and some timeout paths retain the reservation pending a definitive browser result, a confirmed tab lifecycle end, or the bounded retention expiry described below. Claim an execute_js result with get_execute_js_result from the same MCP session; do not replay a script whose result is pending. Direct /link and Python driver calls receive the bridge's per-command reservation, but need an MCP command scope for the lock across multiple browser roundtrips.

A script deadline, debugger timeout or detach can leave JavaScript running. Dispatched exec_timeout replies retain the same bounded reservation as other uncertain outcomes: status=in_progress, operation_status=outcome_unknown, and reservation_held=true. After that retention window, the receipt stays unknown and retry_safe=false. Neither a failed receipt nor an expired reservation proves execution stopped; avoid replay or conflicting work in that tab while the outcome is uncertain. Manual dialogs keep their reservation, and only the originating MCP session can call handle_dialog. Handling a dialog does not prove the script finished: when the extension cannot return its final result, the operation remains outcome_unknown. The caller can close its own tab with close_tabs(..., owner_id=...) to end that lifecycle.

Console and network capture mutations belong to the MCP session that started them. Another session cannot restart, stop, or clear that capture (capture_busy); ordinary page operations and non-clearing console reads remain available. After the owning MCP process has exited, another session can reclaim its capture. Process exit alone does not cancel page JavaScript or release a pending target; the tab owner can close its own tab to recover. Agents sharing one MCP process share this ownership too. These guards do not make a multi-step workflow atomic or isolate cookies/storage shared by a profile.

Structured statuses and recovery fields

Read ok and error_code first; operation statuses remain in data/legacy and as small top-level compatibility fields. Failures set MCP isError=true:

status / error_code

Meaning

ok / success

Completed and verified as far as the protocol allows.

redirected

Navigation landed on a different URL than requested (login wall, SSO, canonical rewrite).

navigated

An execute_js script navigated the page, so its return value is genuinely gone; landed_url says where it went.

blocked_by_dialog

A JavaScript dialog is open and waiting for handle_dialog.

blocked_by_beforeunload

Navigation was cancelled to keep the page; re-issue with beforeunload="accept" to leave.

dialog_handle_failed

A dialog was seen but answering it failed; the tab may still be blocked.

navigation_failed / navigation_timeout

open_url did not complete within its timeout, or the browser reported an error.

triggered with type="download"

open_url was replaced by a browser download. ERR_ABORTED can be normal only when CDP also reports isDownload=true; use download_file for completion and the local path.

requires_user_action

The action needs user intervention; approval failures include reason (elicitation_unsupported, declined, timeout, cancelled, or error) and do not execute the action.

raw_cdp_blocked

A raw method bypasses a protected state/ownership path. No command was dispatched; use a dedicated tool or resolve the operator configuration instead of retrying unchanged.

busy

Another BTAP process holds the physical-input lock, or the tab already has a pending manual execution. Returned immediately, never queued.

target_busy

This tab is reserved by another call or a still-pending browser command. Check delivery_state and retry_safe; a call involving multiple tabs may have completed earlier steps.

capture_busy

Another MCP session owns this console/network capture. Its owner must stop it before another session can restart, stop, or clear it.

ambiguous_browser

Several browser/profile instances match and no unique browser was selected. Use list_tabs, then pass the chosen full session_id (or client_id where supported).

input_activity_detected

You used the mouse or keyboard during the post-approval quiet window, so no physical input was sent.

activation_failed

The target tab could not be confirmed on screen, so no physical input was sent.

unsupported

The browser or extension API cannot provide this (e.g. clipboard permission leases).

challenge_stalled

A browser challenge made no progress within the attempt bound; hand the tab back to the user.

no_response

The script did not reach the tab or timed out — do not blindly retry anything with side effects.

not_found

The selector matched nothing; no input was dispatched.

bridge_error

A bridge call failed. It may appear as error_code or a diagnostic field rather than the top-level status; run list_tabs/doctor before retrying.

switched_session

Supplemental field indicating that only an implicit dead default was replaced with another live tab. Verify the new target before continuing; explicitly directed dead sessions are never substituted.

For delivery failures, only delivery_state="undelivered" proves the operation was not sent; retry_safe=false still prevents replay. sent_unconfirmed means its ACK or HTTP response is missing, so it must not trigger an automatic replay. Treat delivered_no_result, navigated, and unknown delivery as potentially executed; recover by operation ID when one is available and inspect the page before deciding the next action.

Complete JSON results

Large JS values and strings containing unpaired UTF-16 code units are returned through result_file. When result_file_encoding="json", first parse the path field once as JSON; otherwise use the path directly. Then read that file as UTF-8 JSON and verify result_bytes and result_sha256 against its bytes. The path encoding is separate from the file contents. result_file_scope identifies those contents:

Scope

JSON contents

js-value

The complete converted JavaScript value; its inline value is null.

envelope

The complete original v1 tool envelope.

mcp-call-result

The complete native MCP result after normal envelope adaptation, including original content and metadata.

JS descriptors are in data, or in legacy.late_result for a late reply. Unrepresentable strings elsewhere in a tool result use the latter two scopes and retain a valid structured decision header with the original ok, isError and retry verdicts. result_content_externalized / result_meta_externalized identify native content or metadata moved into the archive.

If the file cannot be written, parse result_json once as JSON; result_json_scope uses the same scope names. This explicit inline fallback can exceed the usual size limit and keeps the original operation receipt. For envelope/MCP scopes it is at the header root, with a result_json_ref in data/legacy. result_file_error.message_json is a JSON-encoded I/O message. An error field marked message_encoding="json" or code_encoding="json" (also error_code_encoding) must likewise be parsed once. These representations preserve the original UTF-16 values; export failure never permits replay.

Disclaimers

This server exposes your real browser profile to the connected MCP client, including logged-in sessions. Its scope is browser automation, with only the restricted physical leave-dialog fallback described below.

  • One physical-input path is left after 0.5.0: resolve_leave_dialog's Enter fallback, lab only, and only after two protocol-level attempts fail. It is real OS-level input rather than a synthetic page event, so it lands on whatever is on screen; safe refuses to send it at all. The page_* tools carry none of this exposure.

  • Page content is untrusted input. A page your agent reads can attempt prompt injection, and the tools available make that consequential.

  • This is not a security boundary. See MCP Security Best Practices.

  • Avoid pointing it at sensitive accounts you would not want an MCP client to see, and prefer not to run it on shared or production machines.

The extension requests broad permissions because the feature set requires them: cookies, tabs, debugger, scripting, alarms, storage, contentSettings, declarativeNetRequest, management, bookmarks, downloads, and <all_urls>. declarativeNetRequest temporarily removes CSP response headers only from the tab executing an eval-based command. The rule is session-scoped, reference-counted, and removed in cleanup; it is not a browser-wide persistent CSP override. See Security for the full permission and loopback threat model.

Tools

Most tools accept an optional session_id to target one specific tab; omitting it uses this MCP process's current target. Pass it explicitly for state changes. client_id distinguishes connected browser/profile instances; session_id is a composite handle such as chrome_a1b2c3:456. Pass returned handles verbatim. With multiple instances connected and no browser selected, routing returns ambiguous_browser. Select a full session_id from list_tabs with switch_tab, or supply it to the operation; open_new_tab also accepts client_id. browser="chrome" alone is insufficient when multiple Chrome profiles match. If Chrome reports an evidence-backed replacement for the same tab, BTAP returns rebound_from, replacement_session_id, and tab_identity; otherwise an explicit stale handle is refused. Tools marked no tab needed use the extension's service worker and work with zero tabs, but still need a unique browser/profile selection.

  • get_setup_status — report package_version, bridge_version, extension_version, protocol_version, connection state, ports, tabs, and the required recovery action. A missing bridge listener is started automatically when spawning is enabled; restart_bridge_required=true means a bridge that is still running must be replaced with browsertap bridge --restart. reload_extension_required=true identifies the unpacked-extension platform limit and requires a manual Reload; a version number that differs on its own no longer sets it, because Chrome parses manifest.json at load time and never re-parses it without a Reload, so a release bump would otherwise demand a click whose only effect is on that number. restart_mcp_session_required=true is the opposite direction: a component is newer than the running server, so the stale build is this process and only restarting the MCP session or client clears it — the other two flags stay false, because a restart or reload would report the same mismatch again. extension_build_stamp is the stronger signal and answers the question the four version fields cannot: it is a hash of the extension sources compiled into background.js, reported by the worker actually running, so comparing it to expected_extension_build_stamp (a fresh hash of the directory) is decisive in both directions where version equality was measured wrong twice. Read the answer from extension_build_verdict: matches_tree (the worker is running this code), stale_worker (it is not -- Reload), stamp_not_regenerated (an extension file was edited without running python -m scripts.extension_stamp --write, so the comparison proves nothing either way) or unverifiable (the extension predates the stamp, or the directory could not be read -- see extension_build_error). extension_build_enforced=false means no comparison happened, so treat it as unknown rather than as a pass. Answers while another tool is still running; default_session_id is this request's snapshot of the MCP process default and default_session_settled=true because another call's temporary target is isolated. No parameters. extension_status_available=false means the extension has not supplied runtime status: starting asks to wait_for_extension, and extension_unavailable asks to check_extension_connection. Missing status alone does not request a Reload. Compatibility checks, including legacy replies missing required fields, apply once runtime status is available. On Windows, inspecting an existing token file can tighten its ACL to the current user. The token-file state check itself does not create a missing file; get_setup_status may still create one during bridge startup or authentication initialization.

  • get_automation_profile — inspect whether the current MCP process uses lab or safe.

  • set_automation_profile — switch the current MCP process between lab|safe; the override is not persisted and does not reload the extension.

    • mode (string): lab or safe

  • list_tabs — list connected tabs under data.tabs, including their full session handles and browser fields. Answers while another tool is still running; default_session_id is this request's snapshot of the MCP process default and default_session_settled=true. Parallel agents should still pass an explicit target. No parameters. A timed-out inventory releases that read's bridge reservation. Pending mutations keep their reservations; a release does not establish whether another operation happened.

  • list_all_tabs(no tab needed) list every open tab, including chrome-extension:// pages that list_tabs hides. Those never become sessions, so they have no session id; drive them with cdp_command(tab_id=...).

    • session_id (string, optional): which browser/profile to ask.

  • switch_tab — set this MCP process's target tab for later calls. A url_pattern must match exactly one tab; if several match, select one with its full session_id. A browser filter matching multiple profiles also requires an explicit session_id. It does not raise the tab or focus the browser: activate defaults to false. Pass activate=true, or call activate_tab, when you need the tab in front.

    • session_id (string, optional), url_pattern (string, optional): substring match, browser (string, optional): chrome, edge, or opera, activate (boolean, optional): default false.

  • activate_tab — bring a tab to the foreground and focus its window. This is the explicit way to raise a tab, and the only one that does not involve approving physical input. Check on_screen in the reply: BTAP first asks Windows to restore a minimised browser, but on_screen=false means visibility still could not be confirmed and screen-coordinate input must not be sent.

    • session_id (string, optional)

  • open_url — navigate the current tab. Global behavior remains dismiss; lab automatically accepts beforeunload on configured shell/IDE hosts. If the extension's navigate route is unavailable on a heavy SPA, BTAP falls back to Page.navigate. A CDP result with isDownload=true returns {type:"download",status:"triggered"} instead of only navigation_failed; the accompanying ERR_ABORTED is normal for that download navigation.

    • url (string), session_id (string, optional), timeout (number, optional): default 15, beforeunload (string, optional): default dismiss, intent_leave (boolean, optional): false forces page preservation

  • download_file — download an HTTP(S) URL through Chrome's native download manager, using that browser profile's cookies and authenticated session. It waits by default and returns status="completed" plus a verified absolute path; interrupted downloads return failed, while a timeout or wait=false returns in_progress with download_id. An explicit session_id must still be live and is never replaced with another profile. Use this for attachments instead of page fetch.

    • url (string), filename (string, optional): relative download name, directory (string, optional): arbitrary absolute destination directory; creates parents, wait (boolean, optional): default true; directory requires true, timeout (number, optional): default 60 seconds, maximum 1800, session_id (string, optional): selects the browser profile, overwrite (boolean, optional): default false; an existing final destination raises an error unless explicitly true. If a directory download times out, directory_applied=false: the move is no longer tracked and Chrome may finish into its default download directory.

  • open_new_tab — open a background tab in this MCP process's selected browser/profile, unless session_id or client_id selects another. Creates a unique operation_id and waits a bounded time for exact session/generation registration; pass active=true for foreground work. Returns {operation_id,tab_id,session_id,generation,ready,owned,opener,owner_id,load_status}. The extension deduplicates by operation id. Ownership requires a completed record with exact client_id+tab_id+generation, even when ready=false; ready only reports immediate availability for session tools. Before create dispatch, registry uncertainty returns status="unknown",may_have_created=false,retry_safe=true; after dispatch, uncertainty returns may_have_created=true,retry_safe=false. With may_have_created=false,retry_safe=true, resolve the reported failure and retry without operation_id. To recover a dispatched create with retry_safe=false, pass the same operation_id, returned client_id, and owner_id: recovery reads the durable record without replaying tabs/create. A failed recovery probe preserves that uncertainty and owner capability. If the initial recovery probe finds no record, reconciliation.resume_required=false directs the caller to list_tabs() and inspection of that browser instead of another recovery call. Missing records, matching URLs, or unchanged tab counts cannot prove non-creation or ownership; keep the outcome unknown unless exact identity and task ownership resolve it. Keep owner_id for cleanup of registered task-owned tabs with their exact session/generation. Use this native API for reliable new tabs; page window.open() or anchor clicks may be blocked without a user gesture.

    • url (string), timeout (number, optional): default 15, active (boolean, optional): default false, session_id (optional browser/profile selector), owner_id (optional capability to group several tabs under one task owner), operation_id (optional recovery handle), client_id (optional browser/profile client selector for creation or recovery)

    • A pending create left by a worker restart becomes terminal unknown. Bounded record retention also keeps a replay guard for retired operation IDs; a refused old ID does not prove non-creation. Follow reconciliation.resume_required=false with inspection of that browser, preserving unknown outcomes and exact ownership evidence.

    • A failed status probe may return reconciliation.bridge_operation. Its wire operation_id can be queried with get_execute_js_result in the same MCP session; the outer creation operation_id still belongs to open_new_tab recovery. The probe's reservation_held=false does not prove an earlier create was absent or safe to replay.

  • close_tabs(no tab needed) accept native numeric tab ids or full client:tabId session ids, including chrome-extension:// tabs. The default only_if_agent_owned=true requires the owner_id returned by open_new_tab and verifies the current lifecycle generation before closing, so pre-existing user tabs and another agent's tabs are refused. If the user already closed an owned tab, cleanup returns status=already_gone, closed_by=user without reusing its native id. An actual owned close returns closed_by=agent; an explicit unowned/operator override returns closed_by=none so it is not counted as task-owned cleanup. If already_gone is returned but a page with the same work is still visible, call list_all_tabs and verify URL/title before deciding whether a new session/generation should be closed; BTAP never auto-transfers ownership by URL. A Chrome tabs.onReplaced identity mapping is safe and also migrates the ownership claim. Set only_if_agent_owned=false only when the operator explicitly asked to close an unowned/user tab.

    • tab_id, session_id (optional browser constraint), owner_id (required by the safe default), only_if_agent_owned (boolean, default true)

  • scan_page — read the page as simplified HTML or text. Returns links mapping each #rN ref in the content to its absolute URL, and offscreen + hint when content was left outside the viewport. A background tab may report viewport height zero; ordinary DOM/text/API work still continues there, and only visual/layout fidelity requires explicit activate_tab. When the page can be probed, render_state/content_ready distinguish real content from a loading, hydrating, or shell-only SPA; retry or use wait_for before treating an empty shell as final content. cutlist (on by default) collapses long repeated lists and reports a CSS selector for each container it collapsed, derived from that container's own structure. The built-in scan does not write page attributes, ids, or window globals. Optional extra_js runs caller code and can modify the page or send requests.

    • session_id (string, optional), text_only (boolean, optional): default false, cutlist (boolean, optional): default true; collapse repetitive lists, maxchars (integer, optional): default 35000, instruction (string, optional), extra_js (string, optional), timeout (number, optional): default 15, frame (array, optional): non-empty path of CSS strings or structured frame locators, max_targets (integer, optional): default 80, range 0200 observation.targets adds current locators, control names, editability, rectangles and recommended_tool with a reason. Pass a returned locator unchanged as the page_click / page_type selector; re-observe after page changes. observation.frames lists uninspected child documents: pass an entry's frame back to scan_page to inspect it, including cross-origin/OOPIF frames. Open shadow roots are included; this is a bounded DOM observation, not a complete accessibility tree. max_targets caps controls and frame entries together, separately from the content budget; 0 disables enumeration and truncated=true means more targets or DOM nodes remain uninspected. Rectangles use the observed document's viewport CSS pixels and are not hit-tested. verify_coordinate_target recommends a screenshot to verify a canvas or zero-size target, not an automatic coordinate click. Disabled, inert and readonly controls have no recommended input tool; native selects report select_existing_option. Only top-document file inputs outside shadow roots recommend upload_files, using selector=locator.css; frame/shadow file uploads report unsupported. Frame scans reject extra_js and omit the parent's readiness probe; top-document extra_js preserves its execution semantics and reports target metadata unavailable. The optional built-in readiness probe releases its tab reservation on timeout. Missing render fields mean readiness is unknown; use wait_for for the intended control.

  • wait_for — wait until a condition holds, then return. Use this instead of polling scan_page, which re-serializes the whole DOM each time. The server schedules short synchronous page checks under one deadline, avoiding background-page timer throttling. Exactly one condition is required. selector accepts legacy CSS or the structured locator object described under background page input. Caller-provided js is evaluated repeatedly and can have side effects; use a read-only predicate. A timeout with operation_id retains a pending check. Timed-out selector/text/URL probes can release the tab without discarding that receipt: reservation_held=false permits another command, and get_execute_js_result in the same MCP session can collect the delayed reply. Caller-provided js stays reserved. When reservation_held is true or unknown, keep querying the original operation until it settles or releases its reservation. A pending probe is never replayed.

    • selector (string/object, optional): CSS or structured locator, text (string, optional): substring of body text, url_pattern (string, optional): regex on the URL, js (string, optional): expression to become truthy, gone (boolean, optional): wait for the condition to stop holding; default false, timeout (number, optional): default 15, session_id (string, optional)

  • wait_for_url — wait for navigation to settle: blocks until the tab URL matches url_pattern (regex, or plain substring — both are tried) and, unless wait_ready=false, document.readyState is complete; then returns final url, title and ready_state. Use after a click or open_url that navigates; wait_for(url_pattern=...) only checks the URL and can return while the new document is still blank. Uses the same bounded synchronous checks and receipt recovery as wait_for. A pending probe with reservation_held=false no longer blocks the tab; its delayed reply remains available through get_execute_js_result in the same MCP session.

    • url_pattern (string): regex or substring to match against the URL, timeout (number, optional): default 15, wait_ready (boolean, optional): require readyState === 'complete', default true, session_id (string, optional)

  • scroll_page — scroll and report the new position, so a long page can be read in passes.

    • to (string, optional): default bottom; also accepts top, a pixel offset, or a CSS selector to bring into view, session_id (string, optional), timeout (number, optional): default 15

  • execute_js — run JavaScript in the page and return the result. timeout is one end-to-end deadline covering dialog-policy setup, monitor snapshots, delivery/retry, navigation inspection, and cleanup; an explicit session_id is forwarded through every one of those roundtrips instead of relying on the process default. Set wait=false for a genuinely long task: once the extension acknowledges delivery, BTAP returns status="in_progress" plus an operation_id; claim the result with get_execute_js_result instead of replaying the script. dialog_policy="manual" is intentionally unavailable in background mode. When a script navigates the page, status is navigated (not success) with landed_url; the script's return value is genuinely lost in that case and is reported as such rather than substituted. dialog_policy decides what happens if the script opens alert/confirm/prompt: dismiss (default) and accept answer it and report it under dialogs, while manual pauses a synchronous script with the native dialog still open and returns blocked_by_dialog — call handle_dialog to release it. A tab already holding a manual pause returns busy immediately. Use wait_for/wait_for_url instead of delayed setTimeout or sleep Promises when waiting for page state. When the JSON-encoded js_return exceeds the 24 KiB UTF-8 inline limit, BTAP writes the complete value to a private temporary JSON file and returns result_file, result_bytes, result_sha256, and result_format instead of a truncated inline value.

    • A Cannot access contents of the page error must be classified before retrying: if the script attempted window.open or navigation, use open_new_tab (Chrome may block it without a user gesture); if injection into the current tab is forbidden, choose a normal scriptable http/https tab or the supported CDP route. Do not treat the message as proof that reading the current page failed.

    • timeout does not cancel dispatched JavaScript. See Troubleshooting for timeout recovery and frame-preparation errors.

    • script (string), session_id (string, optional), no_monitor (boolean, optional): default false, timeout (number, optional): default 15, dialog_policy (string, optional): dismiss (default), accept, or manual, wait (boolean, optional): default true

    • All routes use the same result conversion: undefined and non-finite numbers become null; BigInt/symbol become strings; DOM, Error and function values become readable representations. Cycles and depth 6 have markers; iterables keep up to 200 items plus a truncation marker. A result_file preserves the complete converted value, including those markers.

    • Once user code starts, a script error does not trigger a second execution. Use an explicit return in a complex async body, preferably (async () => { /* work */ return value; })(). Ambiguous bodies may complete with null; await(expr) can parse as a call to an ordinary function named await, so use the async IIFE when that distinction matters.

    • Unpaired UTF-16 values or keys use the same file export at any size, with result_file_scope="js-value". If writing fails, result_json preserves the complete value with result_json_scope="js-value"; see Complete JSON results for decoding and receipt semantics.

  • get_execute_js_result — read or briefly wait for an operation_id, from the same MCP session that submitted it. Accepts handles from execute_js and other timed-out bridge commands. Querying never replays the operation. A completed result can be read repeatedly, including after a lost query response; pending, unknown/expired, and foreign handles return explicit statuses or errors. After reservation expiry, the first valid late terminal reply is retained as late_result (success and data), with late_reply_age in seconds. The original unknown receipt and retry_safe=false remain; the late reply neither restores the reservation nor renews retention. Results are retained for up to 10 minutes, with at most 512 completed operation records; capacity pressure can evict them earlier. A missing result does not prove the operation was never executed. Large successful values use the same lossless result_file metadata as execute_js; for a late value, that metadata is inside late_result and its data becomes null. Accepts the nested reconciliation.bridge_operation.operation_id from a failed open_new_tab status probe. A known read-only wait, inventory or creation-status probe may release its reservation on timeout while retaining its receipt. Check reservation_held; it describes that probe, not the outcome of the tab creation.

    • operation_id (string), timeout (number, optional): default 0, range 0120

  • handle_dialog — inspect or answer a dialog left open on a tab. action="manual" reports it without choosing (blocked_by_dialog, or no_dialog if nothing is open); accept/dismiss answer it and release any paused execute_js or open_url. prompt_text supplies the text for an accepted prompt.

    • action (string), prompt_text (string, optional), session_id (string, optional), timeout (number, optional): default 3, capped at three seconds

  • resolve_leave_dialog — for an already-open shell/ttyd/IDE leave prompt: two protocol accepts, then physical Enter only when lab permits it.

    • session_id (string, optional)

  • upload_files — set files on a file input, which JavaScript cannot do (input.files is read-only). Runs as one CDP batch so the DOM node ids stay valid across the sequence.

    • selector (string): the <input type=file>, paths (string or array of strings): absolute local paths, session_id (string, optional), timeout (number, optional): default 30

  • get_cookies — read cookies for a page.

    • session_id (string, optional), tab_id (integer, optional)

  • set_cookies — write cookies into the real browser profile. Takes one cookie object or a list (JSON text is accepted): name is required, plus optional value/url/domain/path/expires (Unix seconds)/httpOnly/secure/sameSite. Uses CDP Network.setCookie, so HttpOnly and cross-path cookies work; falls back to document.cookie only when CDP is unavailable, and then reports which cookies could not carry HttpOnly. Cookies with neither url nor domain are scoped to the current page.

    • cookies (string or list or dict), session_id (string, optional), tab_id (integer, optional), timeout (number, optional): default 20

  • delete_cookies — delete a cookie by name. Uses CDP Network.deleteCookies, falling back to expiring it via document.cookie. Scope with domain/path, or url to target one site.

    • name (string), domain (string, optional), path (string, optional), url (string, optional), session_id (string, optional), tab_id (integer, optional), timeout (number, optional): default 20

  • storage_get — read localStorage or sessionStorage. Omit key to page with offset/max_items/max_bytes; returns next_offset and truncated. The default timeout is 30s and a failed call does not close the MCP session.

    • key (string, optional), area (string, optional): local (default) or session, session_id (string, optional), timeout (number, optional): default 30, offset (integer, optional), max_items (integer, optional), max_bytes (integer, optional)

  • storage_set — write one localStorage/sessionStorage value (non-string values are JSON-encoded first). Verifies by read-back, so a quota-full or privacy-mode failure is reported instead of silently lost.

    • key (string), value (string), area (string, optional): local (default) or session, session_id (string, optional), timeout (number, optional): default 30

Role locators exclude hidden, aria-hidden, and inert controls, including inactive forms retained by SPAs. A visible disabled control can satisfy a query; CSS queries retain DOM-presence semantics. Multiple visible role matches still return ambiguous.

page_click, page_type, and wait_for accept nested same-origin and cross-origin iframe paths, including frames in a separate renderer (OOPIF):

control = {"frame": ["#outer", "#inner"], "css": "#control"}
wait_for(selector=control, session_id=session_id)
page_type("example", selector=control, clear=True, session_id=session_id)
page_click(selector={"frame": ["#outer", "#inner"], "role": "button", "name": "Search"}, session_id=session_id)

Each call binds the actual frame documents and elements. Navigation or replacement after binding returns stale_frame; a later, independent call can locate the new document. Check input_dispatched before recovery: a partial sequence or unknown result must not be replayed. An iframe wait with an outstanding operation_id can retain its reservation; collect that result first. Old extension builds return stale_extension with next_action=reload_extension.

Trusted CDP input events delivered to one named tab. They do not activate the tab, focus its window, or move the desktop cursor — every reply carries foreground_changed: false and input_mode: "cdp". All coordinates are viewport CSS pixels (relative to the top-left of the page area, the space getBoundingClientRect reports), never desktop pixels and never the device pixels capture_page_screenshot returns.

Pass session_id explicitly: the call holds that target in its own context without changing this MCP process's default. A stale handle without evidence of a same-tab replacement is refused. Another MCP call using the same tab can return target_busy; see the concurrent-task boundaries above.

selector remains backward-compatible with CSS strings and also accepts a locator object with exactly one primary key: css, role (optional name), text, or label. Inside a locator object, selector is a compatibility alias for css. exact applies to role/name or text matching; frame walks iframe locators across origin and renderer boundaries; shadow walks open Shadow DOM hosts. A click-only frame-relative point can use {"frame": [...], "x": 20, "y": 30}; its CSS coordinates in the final frame's viewport are converted to top-document coordinates before dispatch. Zero matches return not_found, multiple matches return ambiguous, and closed shadow roots remain inaccessible. Framed clicks refuse non-identity transforms, zoom or perspective on the frame or its ancestors with unsupported_frame_transform; query/type paths remain available.

  • page_click — click a CSS/structured selector or viewport coordinates. Exactly one targeting mode: either selector, or both x and y. With a selector, each omitted offset axis uses the element centre; a supplied offset_x or offset_y is measured from the element's top-left corner. {"frame": [...], "x": 20, "y": 30} names a point in the final iframe, converted to top-document CSS coordinates. Point mode is not hit-tested. Missing, ambiguous, non-interactable, closed-shadow, and unsupported transformed-frame targets dispatch no input. Selector mode checks the element and every parent frame for obstruction before dispatch: an overlay returns obscured with occluded_by, and an off-screen point returns outside_viewport. Top-document targets can be scrolled into view (scrolled_into_view); framed clicks do not scroll automatically. A verified click carries hit_verified: true. Screenshot coordinates are device pixels: divide by devicePixelRatio before using them as CSS coordinates. Challenge replies keep the bounded challenge_detected/attempts/challenge_stalled behavior.

    • selector (string/object, optional), x (number, optional), y (number, optional), offset_x (number, optional), offset_y (number, optional), button (string, optional): default left, clicks (integer, optional): default 1, session_id (string, optional), timeout (number, optional): default 15

  • page_type — insert text into a CSS/structured-locator field, or into whatever already has focus when selector is omitted. Xterm.js containers/descendants retarget to .xterm-helper-textarea. Missing, ambiguous, read-only, or otherwise unusable targets return a structured status without dispatching text or keys; invalid legacy CSS returns status="invalid_selector" instead of a raw SyntaxError. Successful and failed target resolution includes a redacted active_element descriptor and focus_confirmed when focus was attempted, so omitted-selector input is auditable. clear=true selects the existing value first; submit_key sends one key afterwards.

    • text (string), selector (string/object, optional), clear (boolean, optional): default false, submit_key (string, optional), session_id (string, optional), timeout (number, optional): default 15

  • page_press — press a key or a comma-separated modifier chord in the tab, e.g. enter or ctrl,shift,k.

    • keys_csv (string), session_id (string, optional), timeout (number, optional): default 15

  • page_drag — drag between two viewport points as one uninterrupted event sequence.

    • x1 (number), y1 (number), x2 (number), y2 (number), duration (number, optional): default 0.3, button (string, optional): default left, session_id (string, optional), timeout (number, optional): default 15

Temporary, origin-scoped permission leases backed by chrome.contentSettings. Every lease records the prior setting and attempts restoration on expiry, explicit reset, and a service-worker or browser restart. Unsupported restoration retains manual_recovery with the prior setting and stops automatic retries.

  • set_site_permission — set one permission for one origin, for 60–600 seconds. Supported: notifications, geolocation (or location), camera, microphone. setting is allow, block, or ask. In safe, every allow requires approval; default lab applies it without elicitation (BROWSERTAP_LAB_NO_ELICIT=1 semantics). Declining returns requires_user_action and changes nothing. clipboard returns unsupported, because its exact prior state cannot be restored. Omit origin to use the target tab's current origin; only http/https origins are accepted. If an established lease loses restoration support, manual_recovery retains its prior setting and recovery guidance and stops automatic retries.

    • permission (string), setting (string): allow, block, or ask, origin (string, optional): defaults to the tab's origin, duration_seconds (integer, optional): 60–600, default 300, session_id (string, optional)

  • reset_site_permissions — attempt to restore matching leases now, including manual_recovery records. Omit both origin and permission to reset every lease on that browser. Unsupported restoration preserves the prior setting and recovery guidance and stops automatic retries; resolve the cause before another explicit reset.

    • origin (string, optional), permission (string, optional), session_id (string, optional)

  • cdp_command — send one CDP command to the selected tab or explicit debuggee. Listed high-risk methods return raw_cdp_blocked before dispatch; params must be a JSON object. Other allowed methods can still change page or profile state. See the raw CDP policy above.

    • method (string): e.g. Page.navigate, params_json (string, optional): JSON object as text, session_id (string, optional), tab_id (integer/string, optional), extension_id (string, optional), target_id (string, optional), timeout (number, optional): default 20

  • cdp_batch — send a batch; batch_json must be a JSON object with cmd: "batch" and a commands array of cdp, tabs, or cookies objects. The whole batch passes the raw CDP policy before its first member runs; nested/unknown commands are rejected.

    • batch_json (string), session_id (string, optional)

  • debugger_targets(no tab needed) list every CDP-attachable target, including service workers and extension background pages that list_tabs never shows.

    • session_id (string, optional)

  • save_pdf — bounded Page.printToPDF; validates PDF bytes and atomically writes save_path. save_path is relative and resolves under ~/Downloads/browsertap; an absolute path or a .. escape is rejected with ValueError. A timeout forcibly releases its debugger lease.

    • save_path (string), session_id (string, optional), landscape (boolean, optional): default false, print_background (boolean, optional): default true, prefer_css_page_size (boolean, optional): default true, scale (number, optional): default 1.0, range 0.12.0, page_ranges (string, optional), timeout (number, optional): default 30

On driving other extensions: Chrome refuses cross-extension debugging at attach time, and all three addressing forms (tab_id, extension_id, target_id) are rejected alike unless Chrome was started with --silent-debugger-extension-api. These parameters are for this extension's own targets and for diagnosis.

  • extension_path — absolute path of the unpacked extension, for manual install. No parameters.

  • list_extensions(no tab needed) installed extensions with id, name, enabled state, type, and version.

    • session_id (string, optional)

  • set_extension_enabled(no tab needed) enable or disable an installed extension. Chrome exposes no API to install one, so this only toggles what is already there.

    • extension_id (string), enabled (boolean), session_id (string, optional)

  • uninstall_extension(no tab needed) request removal of another extension. Confirmation defaults on; set it off only for an explicitly selected disposable/test extension. Chrome can refuse either setting because a user gesture is required; changing the flag does not supply that gesture. BTAP cannot uninstall itself through its active response channel.

    • extension_id (string), show_confirm_dialog (boolean, optional): default true, session_id (string, optional)

  • get_bookmarks(no tab needed) read the bookmark tree.

    • session_id (string, optional)

  • create_bookmark(no tab needed) create a bookmark or folder.

    • title (string), url (string, optional): omit to create a folder, parent_id (string, optional), session_id (string, optional)

  • remove_bookmark(no tab needed) atomically save the target subtree under bookmark-backups in the local state directory, then remove the bookmark or folder. Returns backup_path and backup_sha256; backup failure prevents deletion. The managed backup subdirectory must be an ordinary directory, not a symlink or reparse point. Limits: 16 MiB per file, 100 files and 64 MiB total; backups older than 30 days or over capacity are removed on the next backup. A lost deletion receipt keeps the backup evidence but requires inspecting the bookmark tree before retrying.

    • bookmark_id (string), recursive (boolean, optional): default false, session_id (string, optional)

  • call_extension(no tab needed) send JSON to another enabled extension; the target must allow BTAP via externally_connectable.

    • extension_id (string), message_json (string): JSON payload as text, session_id (string, optional)

  • network_capture_start — start collecting bounded request/response records and optional bodies. Defaults: 500-entry ring and 256 KiB per body.

    • session_id (string, optional), include_bodies (boolean, optional): default true, max_entries (integer, optional): default 500, range 10–2000, max_body_bytes (integer, optional): default 262144, range 1024–2097152, body_timeout (number, optional): default 5, range 0.1–10 seconds, timeout (number, optional): default 10

  • network_capture_stop — return the current capture and release its debugger lease; always call it in cleanup. Returned records can be filtered without changing capture bounds or cleanup. url_pattern is compiled by the browser as a JavaScript RegExp; invalid patterns return a structured error and leave the capture running for retry.

    • session_id (string, optional), url_pattern (string, optional): JavaScript RegExp, resource_type (string, optional), status_min/status_max (integer, optional): 100–599, include_response_bodies (boolean, optional): default true, timeout (number, optional): default 10

  • console_capture_start — start collecting console.* and uncaught exceptions.

    • session_id (string, optional), max_entries (integer, optional): default 500, range 10–5000, timeout (number, optional): default 10

  • get_console_messages — page through or clear the current console buffer. filter='user' retains page MAIN/default-context output and excludes isolated extension/content-script contexts; empty/all preserves the complete buffer.

    • session_id (string, optional), offset (integer, optional): default 0, max_items (integer, optional): default 200, clear (boolean, optional): default false, filter (string, optional): user or all, timeout (number, optional): default 10

  • console_capture_stop — return the remaining console messages and release its debugger lease.

    • session_id (string, optional), timeout (number, optional): default 10

  • capture_page_screenshot — page capture via CDP with viewport, full_page, or explicit clip modes. PNG, JPEG, and WebP are supported; quality is valid only for JPEG/WebP. Returns text metadata plus attached MCP image content; save_path only adds a disk copy, and it is relative — it resolves under ~/Downloads/browsertap, with absolute paths and .. escapes rejected. Base64 is omitted unless explicitly requested. The metadata names its own units: image_width/image_height parsed from the returned bytes and pixel_space: "device" (CSS × devicePixelRatio), so a point read off the picture is not fed straight to page_click. A header it cannot parse reports null dimensions plus a dimensions_note rather than a guess — size is the byte count, not a dimension.

    • session_id (string, optional), tab_id (integer, optional), format (string, optional): default png, full_page (boolean, optional): default false, clip (object, optional): x,y,width,height, optional scale, quality (integer, optional): 0–100 for JPEG/WebP, save_path (string, optional), return_base64 (boolean, optional): default false, timeout (number, optional): default 20

  • inspect_native_file_dialog — inspect the current foreground Windows standard Shell file dialog owned by a registered Chrome or Edge process. Requires [desktop]. Checks owner/process identity, native controls, visibility and Cancel hit targets, then installs a temporary lifetime marker and returns a 15-second ticket. This has a temporary marker side effect and does not activate a window. Unsupported platforms, portable/unregistered browsers, cross-process owners and unrecognized layouts are refused.

    • desktop_opt_in (boolean, optional): default false; must be true to inspect.

  • cancel_native_file_dialog — consume a fresh inspection ticket and send one bounded message to that dialog's Cancel button. Requires [desktop] and the current safe/lab physical-approval policy. Rechecks the cross-process lease, observed Windows quiet-input state, held keys/buttons, identity, foreground and hit targets. Returns status="success", cancelled=true only after observing the original window gone. Uncertain delivery or closure returns unknown, retry_safe=false; inspect state before another action. Each opted-in attempt consumes the ticket, including refusals. Both tools report desktop, on_screen and input_quiet diagnostics.

    • ticket (string, required), desktop_opt_in (boolean, optional): default false; must be true to cancel.

For uploads, use upload_files with the page's file input. Native cancellation is an explicit recovery attempt for an already-open supported dialog. Live verification did not obtain a valid ticket for a real Chrome dialog with a cross-process owner, so successful automatic cancellation remains unverified. Do not open a chooser solely to test recovery. Closing its tab may leave the dialog open, and a user's manual closure is not an automated success. safe requires approval; default lab skips elicitation but still requires opt-in. Tickets expire, are limited to eight per MCP process, and clean up their own markers on consumption, expiry, eviction or orderly shutdown. These checks are not an atomic desktop transaction. See native-dialog design.

mouse_move, mouse_click, mouse_drag, type_text, hotkey, pointer_info and capture_desktop_screenshot no longer exist. They drove the whole desktop rather than one tab, so they acted on whatever happened to be on screen. What to call instead:

Removed

Use

mouse_click

page_click

mouse_move

not needed — page_click positions itself

mouse_drag

page_drag

type_text

page_type

hotkey

page_press

pointer_info

execute_js to read element geometry

capture_desktop_screenshot

capture_page_screenshot

A failing page_* call is a targeting problem, not a reason to look for a screen-coordinate fallback — re-read the page with scan_page and fix the locator. Browser chrome, extension popups and OS dialogs are outside page-level input. The explicit native-file-dialog tools above cover only the documented Windows inspection/cancellation boundary.

One global-key fallback survives: resolve_leave_dialog may send Enter after its two protocol attempts fail, in lab only; pure probe timeouts do not trigger it. safe returns requires_user_action without sending Enter. Lab skips elicitation by default; when lab approval prompts are enabled, a declined, cancelled or unavailable prompt also prevents input. The physical gate keeps its cross-process lock (contended → busy, returned immediately, never queued), a short quiet window (you touched the mouse or keyboard → input_activity_detected, nothing sent), then raise the target tab, then act. What that window can detect depends on the OS: only Windows exposes a last-input timestamp, and the pointer position is unavailable under Wayland, in a headless container, and on macOS without the accessibility permission. With no signal at all the window still elapses but has nothing to compare, so the result carries an input_quiet block naming the markers it sampled, with enforced: false when there were none — read a pass on such a machine as unverified rather than as an idle desktop. If the tab cannot be confirmed on screen the result is activation_failed and nothing is sent, so a minimised window produces an error rather than an Enter into the wrong place.

Troubleshooting

Run browsertap doctor first. For connection, version, dialog, permission, and physical-input recovery procedures, see the dedicated troubleshooting guide.

License

MIT — see LICENSE, which ships inside both the wheel and the sdist. Keep it if you fork or redistribute this.

BTAP is maintained by LinVireo, and the canonical public repository for this distribution is LinVireo/browsertap-mcp.

Available Tools

51 tools
activate_tabA
Destructive

Bring a tab to the foreground and focus its window. Use this explicitly after switch_tab when foreground work is required, or to re-raise a tab the user has since clicked away from.

ParametersJSON Schema
NameRequiredDescriptionDefault
session_idNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate readOnly=false, destructiveHint=true, and idempotent=false. The description adds useful context about foregrounding and focusing, but it does not explain why the operation is marked destructive or what side effects may occur beyond bringing the tab forward. No contradiction with annotations, but the description does not enrich the destructive behavior disclosure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two concise sentences, front-loads the core behavior, and adds usage guidance without any filler. Every clause earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the simple single-parameter tool and existing output schema, the behavioral description is reasonably complete for the operation itself. However, the complete lack of session_id documentation leaves a hole in the agent's ability to call the tool correctly in multi-session contexts.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% for the only parameter, session_id, and the description does not mention it at all. Since the description must compensate for the missing schema documentation, this is a significant gap: the agent receives no guidance on what session_id means or how to populate it.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states a specific action ('Bring a tab to the foreground and focus its window') and names the tool's relationship to switch_tab. It is easy to distinguish from the sibling switch_tab tool by reading the description alone.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly tells the agent when to use this tool: after switch_tab when foreground work is required, or to re-raise a tab the user has clicked away from. This provides concrete usage conditions and an implicit contrast with the switch_tab alternative.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

call_extensionA
Destructive

Send a JSON message from the BTAP extension service worker to another installed extension. The target must be enabled and list this BTAP extension in externally_connectable. Works with no tabs open.

ParametersJSON Schema
NameRequiredDescriptionDefault
session_idNo
extension_idYes
message_jsonYes

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate destructiveHint=true, readOnlyHint=false, and idempotentHint=false. The description adds useful context beyond annotations: the target must be enabled and configured for externally_connectable, and the operation works without any open tabs. It does not spell out side effects, but the output schema and annotations cover the safety profile.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two short sentences with no filler. It front-loads the core action, then supplies necessary prerequisite context without wasting words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a required call, the description provides the target extension, message content, and key prerequisites such as enabled status and externally_connectable configuration. The optional session_id parameter and failure behavior are not described, but the presence of an output schema reduces the burden on the description.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description compensates for extension_id and message_json by identifying the target as 'another installed extension' and the payload as a 'JSON message.' However, session_id is not explained at all, leaving an optional parameter without semantic guidance.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: 'Send a JSON message from the BTAP extension service worker to another installed extension.' It clearly distinguishes this from sibling tools like list_extensions or set_extension_enabled, which manage extension state rather than communicate with an extension.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit prerequisites for use: the target extension must be enabled and must list this BTAP extension in externally_connectable. It also notes that it 'Works with no tabs open,' providing clear context. It does not explicitly name an alternative or say when not to use it, though no direct sibling offers the same capability.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

cancel_native_file_dialogA
Destructive

Explicit desktop capability: cancel the Windows file dialog identified by a fresh inspect_native_file_dialog ticket. Requires desktop_opt_in=true and follows the current safe/lab physical-approval policy. Each opted-in attempt consumes its ticket. After the physical-input lease, enforced quiet gate, identity, foreground and Cancel hit checks, sends one bounded message to that Cancel control without activating a window. Reports cancelled only after observing the dialog HWND gone; uncertain delivery or closure is unknown with retry_safe=false. Inspect state before another action. Returns desktop, on_screen and input_quiet diagnostics; unsupported native layouts are refused. Approval failures expose reason in the result and diagnostics: elicitation_unsupported, declined, timeout, cancelled or error.

ParametersJSON Schema
NameRequiredDescriptionDefault
ticketYes
desktop_opt_inNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Despite annotations already marking the tool as destructive and non-idempotent, the description adds substantial behavioral detail: each attempt consumes its ticket, the action sends one bounded message without activating a window, cancellation is only reported after the HWND disappears, uncertain results are unknown with retry_safe=false, and failure reasons are enumerated.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense but front-loaded with the core capability and requirements. Most sentences add important operational detail, though a few clauses like "Explicit desktop capability" and the retry_safe phrasing add minor redundancy or ambiguity without much value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a destructive, non-idempotent desktop interaction tool, the description covers prerequisites, side effects, success criteria, failure modes, and post-action guidance. With an output schema present, it sufficiently covers what an agent needs to invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Even though schema description coverage is 0%, the description explains that ticket must come from a fresh inspect_native_file_dialog call and that desktop_opt_in=true is required and consumed per attempt. It does not fully elaborate the format of ticket or behavior when desktop_opt_in is false, but it gives meaningful guidance for both parameters.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: "cancel the Windows file dialog identified by a fresh inspect_native_file_dialog ticket." It clearly distinguishes this from siblings like inspect_native_file_dialog and handle_dialog by focusing on the cancel action and requiring a prior inspection ticket.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear context: it requires desktop_opt_in=true, follows a safe/lab physical-approval policy, and requires a fresh ticket from inspect_native_file_dialog. It stops short of naming alternative tools for other dialog actions, so it lacks explicit when-not-to-use guidance, but the usage context is strong.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

capture_page_screenshotA
Destructive

Capture a viewport, full-page, or clipped screenshot of a page/tab via CDP with optional JPEG/WebP quality. Returns text metadata plus an attached MCP image even when save_path is set; save_path only controls disk output. image_width/image_height are DEVICE pixels (CSS x devicePixelRatio), not the CSS pixels page_click takes, and size is the byte count. If the current model cannot consume images, it has not seen the pixels and must use scan_page, execute_js, a page-specific API, or OCR instead. Base64 is included only when return_base64=true.

ParametersJSON Schema
NameRequiredDescriptionDefault
clipNo
formatNopng
tab_idNo
qualityNo
timeoutNo
full_pageNo
save_pathNo
session_idNo
return_base64No

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds substantial behavior beyond the annotations: an attached MCP image is always returned, base64 is only present when requested, image dimensions are device rather than CSS pixels, and size means byte count. These are non-obvious and prevent incorrect interpretation. It does not contradict the destructiveHint annotation; the save_path write behavior is acknowledged.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Four dense sentences, front-loaded with the core action and modifiers, then essential caveats. Every sentence adds distinct value, with no filler or repetition. The only minor jargon is 'page-specific API,' but it is acceptable in context.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 9-parameter tool with no output schema, the description covers the most critical pitfalls: output side-channel behavior, disk-writing semantics, pixel units, and model-image limitations. It leaves tab/session selection and timeout semantics implicit, but these are partially supported by sibling tools and self-explanatory defaults.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description carries the burden for 9 parameters. It explains format/quality, full_page, clip, save_path, and return_base64, but leaves timeout, tab_id, and session_id semantics implicit. Some mentioned fields like image_width/image_height appear to describe return metadata rather than input parameters, so parameter coverage is partial.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Capture a viewport, full-page, or clipped screenshot of a page/tab via CDP.' It clearly enumerates the tool's modes and contrasts it with page_click on pixel semantics and with scan_page/execute_js on image-consumption limitations, so an agent can distinguish it from siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly states when not to rely on the result: if the model cannot consume images, it has not seen the pixels and must use scan_page, execute_js, a page-specific API, or OCR instead. It also clarifies that save_path only controls disk output and the MCP image is still returned, preventing a likely misuse.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

cdp_batchB
Destructive

Raw CDP batches can cause side effects across multiple targets or the entire browser profile. Pass the full JSON object with cmd='batch'; child targets may inherit or override top-level tabId. Policy checks complete for the whole batch before dispatch. Listed high-risk methods require mode=lab AND operator env BROWSERTAP_ALLOW_UNSAFE_CDP=1; safe always blocks them (raw_cdp_blocked, delivery_state=undelivered, retry_safe=false, retryable=false). Allowed CDP/JavaScript can still change pages or profile state. Inspect state after uncertain delivery before retrying a batch.

ParametersJSON Schema
NameRequiredDescriptionDefault
batch_jsonYes
session_idNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

B3.4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations already mark destructiveHint=true, but the description dramatically expands on this: side effects across multiple targets or the entire profile, child target tabId inheritance, whole-batch policy checks before dispatch, exact blocked response fields (raw_cdp_blocked, delivery_state=undelivered, retry_safe=false, retryable=false), and the need to inspect state before retrying. This is rich behavioral context that far exceeds what annotations convey, with no contradiction.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single dense paragraph that front-loads the critical side-effect warning and then details policy, delivery, and retry behavior. While not broken into sections, every sentence adds value. It is lengthy but appropriate given the tool's complexity and risk profile.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with destructive potential, the description thoroughly covers safety, policy enforcement, delivery states, and retry guidance. However, it omits parameter semantics (batch_json format, session_id purpose) and does not clarify the output schema's return values. Given the output schema exists, that may be acceptable, but the parameter gap makes the description incomplete for an agent attempting correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description carries full responsibility for explaining the parameters. It only mentions passing 'the full JSON object with cmd='batch'' for batch_json but does not elaborate on its structure, requirements, or format. session_id is entirely unaddressed. This is a significant gap for a tool with only two parameters.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose3/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description never explicitly states the tool's core action (e.g., 'Send a batch of CDP commands'). It opens with a warning about side effects and later mentions passing a JSON object with cmd='batch', which implies the purpose but leaves it to inference. It does distinguish itself from siblings by focusing on batch behavior, but the primary function is not stated directly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides substantial operational guidance: how to invoke (cmd='batch'), the lab-mode requirement for high-risk methods, and the safe-mode blocking behavior. However, it does not explicitly state when to choose this tool over alternatives like cdp_command (e.g., 'use this for multiple commands in one atomic batch') or when not to use it. The guidance is more about safety constraints than decision-making between tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

cdp_commandA
Destructive

Raw CDP can cause side effects in a tab, extension target or the entire browser profile. Choose session_id (client:tabId), tab_id (number or composite), extension_id or target_id deliberately. A cross-process iframe can use target_id from DOM.describeNode.frameId of its exact parent-page element; verify the frame origin and control before input. Listed high-risk methods are blocked before dispatch unless mode=lab AND operator env BROWSERTAP_ALLOW_UNSAFE_CDP=1; safe always blocks them (raw_cdp_blocked, delivery_state=undelivered, retry_safe=false, retryable=false). This guard prevents common destructive calls; allowed CDP/JavaScript can still change pages or profile state. Inspect state after uncertain delivery before retrying.

ParametersJSON Schema
NameRequiredDescriptionDefault
methodYes
tab_idNo
timeoutNo
target_idNo
session_idNo
params_jsonNo{}
extension_idNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A3.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description enriches the destructive/openWorld annotations with concrete guard behavior: high-risk methods are blocked unless mode=lab and BROWSERTAP_ALLOW_UNSAFE_CDP=1, with delivery_state=undelivered, retry_safe=false, and retryable=false. It also warns that even allowed CDP/JavaScript can mutate page or profile state and advises inspecting state after uncertain delivery. This goes well beyond the structured annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense but efficient: the side-effect warning is front-loaded, followed by target selection, the iframe caveat, and the guard behavior. Every sentence carries a distinct safety or targeting fact, though the paragraph is longer than strictly necessary.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a dangerous raw-CDP tool, the description covers target selection, cross-process iframe handling, blocked-method guardrails, and retry behavior, while the output schema covers return details. Minor gaps remain around what a 'composite' tab_id means and how to structure params_json.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description compensates partially by explaining the meanings of session_id, tab_id, extension_id, and target_id, and by explaining how to derive target_id for a cross-process iframe. It does not explain params_json formatting, timeout semantics, or valid method formats beyond the high-risk blocking note, so several parameters remain under-documented.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly centers on dispatching raw CDP commands to a target and warns about side effects, so an agent can infer the tool's purpose. However, it never states an explicit verb like 'sends a CDP command' and does not distinguish itself from the sibling cdp_batch or execute_js tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives meaningful targeting guidance: choose deliberately among session_id, tab_id, extension_id, and target_id, and use target_id from DOM.describeNode.frameId for cross-process iframes. It does not state when to prefer this tool over alternatives like execute_js, cdp_batch, or page_click, and it gives no explicit exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

close_tabsA
Destructive

Close one or more tabs by native tab id or composite session_id. Accepts a single identifier or a list; identifiers in one call must belong to the same browser. By default it closes only tabs created by this MCP task and requires the owner_id returned by open_new_tab; lifecycle generations are checked before removal. Set only_if_agent_owned=false only for an explicit operator request to close a user tab.

ParametersJSON Schema
NameRequiredDescriptionDefault
tab_idYes
owner_idNo
session_idNo
only_if_agent_ownedNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate destructive and non-idempotent behavior. The description adds crucial behavioral details: ownership checking (only closes agent-owned tabs by default), lifecycle generation checks before removal, and the need for owner_id. It also warns that bypassing the ownership flag requires explicit operator request, adding a safety dimension beyond the raw annotations. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise but dense, starting with the core purpose in the first sentence. It packs necessary constraints and flags without excessive verbosity. While it is longer than a one-liner, every sentence contributes critical information, making it efficient and well-structured.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (destructive, ownership logic, multiple identifier types, a flag), the description covers the main usage requirements and constraints. It explains the default behavior, the flag's usage, and the same-browser limitation. It doesn't describe return values, but the presence of an output schema shifts that responsibility. It doesn't detail failure modes, but that is not essential for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must fully compensate. It explains tab_id as native tab id or composite session_id, and notes it can be a single identifier or list. It explains owner_id is required by default and comes from open_new_tab. It explains only_if_agent_owned flag's purpose and default. It also clarifies that identifiers must belong to the same browser. Every parameter is given meaning beyond its schema type.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description explicitly states the verb and resource: 'Close one or more tabs'. It specifies the identifier types (native tab id or composite session_id) and that it can accept a single or list. This clearly distinguishes it from sibling tools like switch_tab or activate_tab, which perform different actions on tabs. The purpose is unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides usage context: it defaults to closing only agent-created tabs, requires owner_id from open_new_tab, and explicitly instructs when to set only_if_agent_owned=false (only for explicit operator request). It also notes that identifiers must belong to the same browser. It doesn't mention alternatives because no other close tool exists among siblings, but it clearly defines the intended use case and constraints.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

console_capture_startA
Destructive

Start a bounded Runtime console and exception capture on a real-browser tab without foregrounding it. Use get_console_messages while running and console_capture_stop when done, from this same MCP session. Another session's capture returns capture_busy; use a separate tab per agent.

ParametersJSON Schema
NameRequiredDescriptionDefault
timeoutNo
session_idNo
max_entriesNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds behavioral context beyond annotations: it does not foreground the tab, is bounded, and is session-specific. It also discloses the concurrency behavior (capture_busy). Annotations already declare destructiveHint=true, and the description does not contradict this; it supplements with operational details. However, it doesn't explicitly explain what side effects or resource consumption occur, but the added traits are valuable.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three concise sentences, front-loaded with the primary purpose, followed by usage instructions and a concurrency note. Every sentence adds essential information with no redundancy. It is efficiently structured and easy to scan.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the purpose, lifecycle, and concurrency, but it omits parameter semantics entirely. While an output schema exists (not shown), the parameters are undocumented in both schema and description, which is a significant gap for a tool with 3 optional parameters. It also doesn't mention prerequisites like having a tab open, though that's implied by 'real-browser tab'. Overall, it's adequate but not fully complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 3 parameters with no descriptions (schema coverage 0%), and the description fails to explain what timeout, session_id, or max_entries mean. The term 'bounded' hints at limits but doesn't tie it to the parameters. With zero schema descriptions, the description must compensate, but it does not, leaving the agent to guess parameter meanings.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Start'), the resource ('Runtime console and exception capture'), and the scope ('on a real-browser tab without foregrounding it'). It also introduces the 'bounded' qualifier, which distinguishes it from unbounded captures. The purpose is unambiguous and distinct from sibling tools like network_capture_start.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit lifecycle guidance: use get_console_messages while running and console_capture_stop when done, all within the same MCP session. It also warns about the capture_busy condition when another session is capturing and advises using a separate tab per agent. This clearly delineates when to use this tool and how to handle conflicts.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

console_capture_stopA
Destructive

Stop console capture on a real-browser tab, return the remaining bounded message buffer, and release its debugger lease. Only the MCP session that started the capture may stop it; another session gets capture_busy.

ParametersJSON Schema
NameRequiredDescriptionDefault
timeoutNo
session_idNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A3.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses the session ownership constraint and the error condition (capture_busy), adding value beyond annotations. It also mentions returning the buffer and releasing the lease, which are behavioral details. However, it doesn't state whether the buffer is cleared after retrieval or other side effects, but annotations already mark it destructive, so the description is sufficiently transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences with no redundant words. The core purpose is front-loaded, and the ownership condition is stated immediately after. Every sentence adds necessary context.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the main action and an important precondition, and an output schema exists to describe the return value. However, it omits any explanation of the two parameters, and it doesn't explicitly state that capture must already be active (though implied by 'stop'). The missing parameter semantics is a notable gap for a tool with 0% schema coverage.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, and the description provides no explanation of the timeout or session_id parameters. The mention of session ownership hints that session_id might identify the starting session, but it's not explicit. With zero parameter documentation in the schema, the description fails to compensate, leaving the agent to guess the meaning and usage of both parameters.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action: 'Stop console capture on a real-browser tab, return the remaining bounded message buffer, and release its debugger lease.' It names the specific resource (console capture) and the operation, distinguishing it from console_capture_start and get_console_messages by virtue of being the stop counterpart.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides a clear ownership precondition: 'Only the MCP session that started the capture may stop it; another session gets capture_busy.' This explicitly tells the agent when the tool can be used and what happens otherwise. It doesn't explicitly say 'use when you want to end capture,' but that is implied by the action verb.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

create_bookmarkA

Create a bookmark or folder. Supply url for a bookmark; omit url to create a folder. parent_id is optional and uses Chrome's default bookmark location when omitted.

ParametersJSON Schema
NameRequiredDescriptionDefault
urlNo
titleYes
parent_idNo
session_idNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate this is a mutating, non-idempotent operation, and the description adds meaningful behavioral detail beyond that: url presence switches the resource type between bookmark and folder, and parent_id falls back to Chrome's default location. This gives the agent useful operational expectations without contradicting the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short, front-loaded sentences cover the core behavior, the main conditional, and the default behavior. Every sentence earns its place and there is no filler or repetition of schema information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description is sufficient for the basic call paths: create a bookmark, create a folder, or choose a parent folder. The output schema covers return values, and annotations cover mutation and idempotency expectations. The only notable omission is session_id, whose purpose is not explained, so the description is not fully complete for all optional parameters.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must carry the parameter semantics. It explains url and parent_id well, including their conditional and default behavior, and title's required role is inferable from the schema. However, session_id is completely undocumented in both the schema and description, leaving a meaningful gap for a 4-parameter tool.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a clear action and resource ('Create a bookmark or folder') and immediately clarifies the core distinction: supply a URL for a bookmark, omit it for a folder. This is specific enough to clearly distinguish it from sibling tools like get_bookmarks and remove_bookmark.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit conditional guidance for the main decision the agent must make: whether to include url or omit it to create a folder. It also explains parent_id's default behavior. It does not name alternative tools or explicitly say when not to use this tool, but the create-versus-read/delete contrast with siblings is clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

debugger_targetsA
Read-onlyIdempotent

List every CDP-attachable target, including service workers and extension background pages that list_tabs never shows. Works with no tabs open.

ParametersJSON Schema
NameRequiredDescriptionDefault
session_idNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare the tool read-only, idempotent, open-world, and non-destructive. The description adds useful behavioral context about the scope of targets returned and the fact that it works without open tabs, which goes beyond the annotations and helps the agent predict behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two tight sentences with no filler. The core action and scope are front-loaded, and the contrast with list_tabs earns its place by adding useful differentiation.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple read-only list tool, the description covers the main use case, scope, and an important edge case (no tabs open), while an output schema exists so return values do not need explanation. The only clear gap is the undocumented optional session_id parameter.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, and the description does not mention the optional session_id parameter at all. Since the description bears the burden of explaining parameters when the schema does not, this is a significant gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('List') and a precise resource ('every CDP-attachable target'), and differentiates itself from list_tabs by explicitly naming service workers and extension background pages. This makes the tool's purpose unmistakable and distinguishes it from siblings without opening schemas.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear context: it is the tool to use when you need CDP targets beyond what list_tabs shows, and it works even with no tabs open. It does not explicitly discuss when not to use it or compare it to other siblings like list_all_tabs, but the intended usage is evident.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

delete_cookiesA
Destructive

Delete a cookie by name from the real browser profile. Scope defaults to the current page (url), or pass domain/path/url to target another scope. Uses CDP Network.deleteCookies, falling back to expiring it via document.cookie.

ParametersJSON Schema
NameRequiredDescriptionDefault
urlNo
nameYes
pathNo
domainNo
tab_idNo
timeoutNo
session_idNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate destructive behavior (destructiveHint: true), but the description adds valuable detail about the mechanism: 'Uses CDP Network.deleteCookies, falling back to expiring it via document.cookie.' It also clarifies it operates on the 'real browser profile,' implying a persistent effect. No contradictions with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, front-loaded with the primary action and scope, then adds the technical fallback. No fluff, every sentence earns its place. It is highly efficient and well-structured.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with 7 parameters and an output schema, the description covers the essential behavior: what it deletes, how it targets scope, and the underlying mechanism. It omits details on timeout, tab_id, and session_id, but those are likely generic across similar tools. Given the presence of an output schema, the return value is not explained but not critical. Overall, it is sufficiently complete for an agent to use correctly in most cases.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description must compensate. It explains the core parameter 'name' and the scope parameters (url, domain, path) in context. However, it does not mention timeout, tab_id, or session_id, which remain undocumented in both schema and description. Partial coverage but not complete.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Delete a cookie by name') and the resource ('from the real browser profile'), which is specific and actionable. It also mentions scope options (current page or domain/path/url), adding clarity without confusion. It does not explicitly differentiate from sibling tools like set_cookies or get_cookies, but the action itself is unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explains when to use it and how to adjust scope: 'Scope defaults to the current page (url), or pass domain/path/url to target another scope.' This gives clear conditions for parameter selection. It does not mention alternatives or when not to use it, but the scoping guidance is sufficient for most use cases.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

download_fileA
Destructive

Download an http(s) URL through the real browser's native download manager, so the current browser profile's cookies and authenticated session are used. Waits for completion by default and returns the final absolute local path. directory may be any absolute local directory; completed files are moved there without replacing an existing file unless overwrite=true. A directory timeout reports directory_applied=false because Chrome may finish in its default download directory. An explicit session_id must still be live and is never replaced with another profile. Use this for attachments instead of page fetch.

ParametersJSON Schema
NameRequiredDescriptionDefault
urlYes
waitNo
timeoutNo
filenameNo
directoryNo
overwriteNo
session_idNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses several non-obvious behaviors beyond the annotations: it waits by default, moves completed files into directory, avoids replacing existing files unless overwrite=true, falls back to Chrome's default download directory on timeout with directory_applied=false, and requires a live session_id. These are genuine behavioral disclosures, not just restatements of schema defaults.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense but not bloated, with the core purpose and usage guidance front-loaded. The sentence about the directory timeout reporting directory_applied=false is slightly awkward, but every sentence contributes useful information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given seven parameters and an output schema, the description covers the essential behavioral paths: download behavior, session/auth context, default waiting, directory fallback, overwrite policy, and recommended usage. The main gap is the absence of filename semantics and the exact behavior when wait=false, though the output schema can partially cover return structure.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description carries the full burden. It adds meaning for url, wait, timeout, directory, overwrite, and session_id, but it never explains the filename parameter or what happens when wait=false, so it doesn't fully compensate for the missing schema descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names the concrete action ('Download an http(s) URL through the real browser's native download manager'), the input, and the output (final absolute local path). It also distinguishes the tool from the page-fetch alternative, so an agent can tell exactly what this tool is for without inspecting siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly states when to prefer this tool: 'Use this for attachments instead of page fetch.' It additionally explains that the native download path uses the browser profile's cookies and authenticated session, which is the key context an agent needs to choose it over a raw fetch.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

execute_jsA
Destructive

Execute arbitrary JS, which can cause side effects, in session_id's browser tab under one total deadline. Pin an explicit session_id; fallbacks keep that target and never replay an already-started script. For complex async bodies use an explicit return in an async IIFE. accept/dismiss prepare current injectable frames on extension routes; the legacy CDP fallback covers only its current evaluation context. manual keeps native dialogs. wait=false returns operation_id after delivery acknowledgement; collect with get_execute_js_result in the same MCP session, without replay. partial/unknown results or an expired handle do not prove non-execution; inspect retry_safe before retrying. A dispatched exec_timeout retains an outcome_unknown reservation for the bounded recovery window; the deadline does not cancel page JS. Use wait_for/wait_for_url for page state instead of sleep Promises. Conversion on all routes: undefined/non-finite numbers become null; BigInt/symbol become strings; DOM/Error/functions become readable values; cycles/depth 6/iterables above 200 items have markers. JSON UTF-8 over 24 KiB or any unpaired UTF-16 uses a private JSON result_file with result_bytes, result_sha256, result_format and result_file_scope=js-value. result_file_encoding=json means JSON-decode the path once; otherwise use it directly. Parse the UTF-8 file once; it preserves the full converted value and markers. If file writing fails, parse the complete ASCII result_json once (result_json_scope=js-value); this fallback may exceed the inline limit and preserves original result/retry verdicts.

ParametersJSON Schema
NameRequiredDescriptionDefault
waitNo
scriptYes
timeoutNo
no_monitorNo
session_idNo
dialog_policyNodismiss

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Despite the annotations already declaring readOnlyHint=false and destructiveHint=true, the description adds a wealth of beyond-annotation disclosure: side effects, replay prevention, timeout semantics, result invalidation, retry conditions, and conversion/result-delivery behavior. It fully warns the agent about consequences such as non-cancellation of page JS on timeout and the outcome_unknown window.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single dense paragraph that packs many distinct concerns into a long run-on structure. It is genuinely rich and mostly every sentence earns its place, but the overwhelming length and lack of section breaks make it harder to scan and reduce cognitive load for an agent. Some details about result_file encoding and retries could be reorganized into bullet-like clauses.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

This is an extremely complex tool with six parameters, no schema descriptions, annotations that are broad, and an output schema that is declared but not available here. The description covers purpose, side effects, async behavior, result retrieval, timeout semantics, dialog policies, persistence of result output, fallback paths, and retry warnings. It is almost complete, yet it leaves 'no_monitor' undocumented and could benefit from explicitly naming each input parameter.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema descriptions are at 0% coverage, so the description must compensate. It adds semantic value to session_id, wait, timeout, dialog_policy, and the script body—e.g. wait=false returning an operation_id and the type of conversion behavior. However, it never mentions the parameter 'no_monitor' at all, and the timeout is only approached indirectly via 'deadline', leaving some meaning implicit.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The opening sentence—'Execute arbitrary JS, which can cause side effects, in session_id's browser tab under one total deadline'—names a specific verb, resource, and key constraint. It clearly distinguishes this tool from siblings like get_execute_js_result and cdp_command: this tool executes JavaScript in the browser context, not just commands or result retrieval.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It provides explicit guidance on when to use wait_for/wait_for_url instead of sleep Promises, and explains how to collect the result with get_execute_js_result when wait=false. It does not explicitly state when not to use execute_js as opposed to specific alternative tools like cdp_command, but the purpose and fallback rules are clear enough for most use cases.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

extension_pathA
Read-onlyIdempotent

Get absolute path to the unpacked Chrome extension directory for manual installation.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already establish readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the safety profile is fully covered. The description adds resource specificity but does not disclose additional behavioral details such as error conditions or whether the path is guaranteed to exist. There is no contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single, well-structured sentence with no filler. The key verb, resource, and purpose are immediately visible and front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple, zero-parameter, read-only getter with an output schema and safety annotations, the description is complete. It states what the tool returns and why it is used. Nothing essential is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters and 100% schema description coverage, so there is nothing for the description to add about arguments. The baseline of 4 applies because no parameter documentation burden exists.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Get') and resource ('absolute path to the unpacked Chrome extension directory'), and it states the purpose ('for manual installation'). This clearly distinguishes it from sibling tools like list_extensions, set_extension_enabled, and uninstall_extension, which perform different operations.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'for manual installation' provides clear context for when this tool is appropriate. It does not name alternatives or exclusions, but the zero-parameter read-only nature and highly specific resource make ambiguity unlikely.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_automation_profileA
Read-onlyIdempotent

Return the active safe/lab automation profile. Lab is the default and skips elicitation unless BROWSERTAP_LAB_NO_ELICIT is explicitly disabled; safe requires approval for every physical action and permission allow.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already provide readOnlyHint=true and idempotentHint=true, so the description correctly does not restate these. It adds valuable context by explaining that lab is the default and skips elicitation unless BROWSERTAP_LAB_NO_ELICIT is disabled, and that safe requires approval for every physical action. This goes beyond the annotation metadata.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, efficient sentence that front-loads the core purpose and then provides essential behavioral details. No filler or repetition—every clause earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a parameterless getter with an output schema present, the description covers all necessary information: what it returns and the meaning of the two profile modes. The agent has enough to call it correctly without additional documentation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so schema coverage is trivially 100%. Per the rubric, a 0-parameter tool receives a baseline of 4. The description adds no parameter information because none exists.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Return the active safe/lab automation profile.' It names the specific resource (automation profile) and distinguishes between two profile types, which is unambiguous and differentiates it from set_automation_profile and other sibling tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explains the behavioral differences between lab and safe profiles, which is useful context, but it does not explicitly state when to use this tool versus alternatives like set_automation_profile. Usage is implied by the name and purpose, but no direct when-to-use or exclusions are given.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_bookmarksA
Read-onlyIdempotent

Return the browser bookmark tree. Works with no tabs open.

ParametersJSON Schema
NameRequiredDescriptionDefault
session_idNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the safety profile is already covered. The description adds one behavioral fact beyond annotations ('Works with no tabs open'), but it does not explain session_id behavior or other runtime behavior, so the added transparency is minimal.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences, front-loaded with the core action and immediately followed by a relevant availability condition. There is no filler and every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with no required parameters, rich read-only annotations, and an output schema, the description gives enough context to call it correctly, including the no-tabs-needed condition. The only completeness gap is the undocumented session_id semantics, which is mitigated by it being optional with a null default.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The only parameter, session_id, has no schema description (schema_description_coverage is 0%) and the description never mentions it. Because coverage is low, the description needed to compensate, and it does not. The parameter is optional with a default null, so the harm is limited, but semantics are entirely unexplained.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb and resource ('Return the browser bookmark tree') and adds a scoping condition ('Works with no tabs open'). It is immediately distinguishable from siblings like create_bookmark and remove_bookmark because it clearly identifies the read operation and the bookmark resource, not tabs.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'Works with no tabs open' communicates a concrete context in which this tool can be used, distinguishing it from tab-oriented siblings (list_tabs, switch_tab, etc.). It does not name explicit alternatives or exclusions, but the use case is clear for a simple read-only bookmark query.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_console_messagesA
Destructive

Read a page of captured console messages and exceptions from a real-browser tab. Set clear=true to clear the full buffer after reading; only the capture's originating MCP session may clear it, otherwise capture_busy is returned. Non-clearing reads are shared. Set filter='user' to exclude extension service-worker / content-script logs and keep only the page's own main-world console output.

ParametersJSON Schema
NameRequiredDescriptionDefault
clearNo
filterNo
offsetNo
timeoutNo
max_itemsNo
session_idNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark this as potentially destructive, and the description adds crucial nuance: only clear=true clears the buffer, only the originating session may do so, other sessions get capture_busy, and non-clearing reads are shared. It also explains the exact effect of filter='user'. This is strong behavioral disclosure beyond the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three focused sentences: the first states the core purpose, and the next two add essential behavioral and filtering details. There is no filler, redundancy, or wasted structure, and the most important information is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the core operation, destructive-session semantics, sharing behavior, and filtering. An output schema exists, so return-shape documentation is unnecessary. However, because six parameters exist with zero schema coverage, leaving offset/timeout/max_items/session_id unexplained prevents the description from being fully complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description must compensate, but it only explains clear and filter. offset, timeout, max_items, and session_id are left entirely to inference from their names and defaults, and session_id in particular is ambiguous without explanation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Read'), a specific resource ('captured console messages and exceptions from a real-browser tab'), and clarifies the pagination concept ('a page'). This makes its role clear and distinguishes it from console-capture start/stop siblings and from execute_js.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The text strongly implies this tool is used after a console capture has been created by mentioning 'capture's originating MCP session', but it never explicitly says 'use after console_capture_start' or identifies situations where an alternative should be chosen. Parameter-level guidance is provided, but tool-selection guidance is only implicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_cookiesC
Read-onlyIdempotent

Get cookies for the current page or specified tab via the Chrome extension bridge.

ParametersJSON Schema
NameRequiredDescriptionDefault
tab_idNo
session_idNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

C2.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the safety profile is covered structurally. The description adds useful scope context ('current page or specified tab') and the extension-bridge mechanism, but it does not disclose what cookie set is returned, whether domain filtering applies, or how session_id affects behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

It is a single, front-loaded sentence with no wasted words. The main cost is under-specification, which is already penalized in other dimensions rather than in structure.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has two optional parameters and an output schema, but session_id remains entirely opaque and no guidance is given about precedence if both tab_id and session_id are supplied. Because one of the two parameters is unexplained and no usage context is provided, the definition is not complete enough for reliable invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the prose needed to explain both parameters. 'Specified tab' partially conveys tab_id, and 'current page' hints at the null-tab default, but session_id is never mentioned or explained. The description compensates for one parameter, not the other.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names the resource ('cookies'), the scope ('current page or specified tab'), and the mechanism ('Chrome extension bridge'), so an agent can tell it is a read operation distinct from set_cookies/delete_cookies. It does not explicitly reference a sibling tool or formalize what 'current page' means, so it stops short of perfect differentiation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is given about when to use this tool versus its siblings set_cookies, delete_cookies, or other cookie-related tools. The description implies it should be used when cookie values are needed, but it never states alternatives, exclusions, or prerequisite conditions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_execute_js_resultA

Read or wait for an operation_id from execute_js or another timed-out bridge command, including open_new_tab's nested reconciliation.bridge_operation.operation_id. The outer tab-creation ID uses open_new_tab recovery. Call from the submitting MCP session; this tool never replays operations. timeout is 0-120 seconds. Completed results are repeatable for up to 10 minutes and 512 records, with earlier capacity eviction. Unknown/expired does not prove non-execution. After reservation expiry, the first valid terminal reply is late_result (success,data), with late_reply_age in seconds; unknown and retry_safe=false remain. Late replies neither renew retention nor reserve targets again. Known read-only wait, inventory and creation-status probes can release on timeout; reservation_held describes that probe, not a prior mutation. Large or unpaired-UTF-16 values use execute_js result_file metadata or fallback result_json, with scope=js-value. Late descriptors are inside late_result with data=null. JSON-decode the path only when result_file_encoding=json, then parse the UTF-8 file or result_json once as JSON. Export failure preserves the complete value and original retry verdict.

ParametersJSON Schema
NameRequiredDescriptionDefault
timeoutNo
operation_idYes

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With readOnlyHint=false, openWorldHint=true, and no idempotency guarantee, the description must carry the behavioral burden, and it delivers extensively: timeout bounds (0-120 seconds), retention limits (10 minutes, 512 records, capacity eviction), unknown/expired semantics, late_result with late_reply_age, reservation/release behavior, and encoding rules. None of this contradicts the annotations; the reservation language actually explains why the tool is not purely read-only.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The text is a single unbroken ~200-word wall of dense, multi-clause sentences filled with jargon ('reservation_held describes that probe, not a prior mutation'). It is properly front-loaded — the purpose leads — and every sentence carries real facts, but the lack of any structural breaks makes the critical guidance costly for an agent to parse.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's high complexity (async reservations, retries, late results, unpaired-UTF-16 handling, export failure) and the presence of an output schema, the description covers nearly everything an agent needs: when to call, timeout range, retention, retry semantics, late-result structure, and decode instructions. What keeps it from a 5 is pure structure, not missing information.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It adds a concrete meaning to timeout ('timeout is 0-120 seconds') and clarifies that operation_id originates from execute_js or bridge commands, including the nested-vs-outer distinction. It doesn't state the operation_id format, but for a zero-coverage schema this is solid compensation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The opening phrase names a specific verb-resource pair — 'Read or wait for an operation_id' — and scopes it to execute_js or other timed-out bridge commands, which separates it from the sibling list at a glance. It even carves out the nested open_new_tab reconciliation case, so an agent knows exactly what this tool is for.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is explicit routing guidance: 'Call from the submitting MCP session' plus the exclusion 'The outer tab-creation ID uses open_new_tab recovery,' which tells the agent when not to use this tool and names the alternative. It doesn't enumerate all other alternatives, but it does resolve the two most likely confusion points (execute_js results and open_new_tab nested vs. outer IDs).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_setup_statusA
Idempotent

Return component versions, stale-build actions, extension path, bridge ports, and connection status for setup/diagnostics. extension_build_verdict answers whether the browser worker is running this code (matches_tree / stale_worker), or says why it cannot tell (stamp_not_regenerated / unverifiable); it is decisive where version equality is not. extension_build_enforced=false means no comparison happened, so treat it as unknown rather than as a pass. extension_status_available=false means no runtime status was obtained: starting asks to wait_for_extension, then extension_unavailable asks to check_extension_connection; missing status alone never requests a reload. mcp_build_verdict and bridge_build_verdict compare each process's package-import Python and imported JavaScript source snapshot with expected_python_source_identity on disk: matches_tree, stale_process, or unverifiable. Same-version source changes require restart_mcp_session or restart_bridge; *_build_enforced=false is unknown. state_paths distinguishes missing/empty/ready/unreadable/invalid_encoding token files without exposing token content; unreadable metadata has unknown existence. On Windows, inspecting an existing token file may tighten its ACL to the current user. Bridge startup or authentication initialization may create a missing token file. A malformed remote diagnosis reports bridge_unreachable with malformed_diagnosis, not evidence of an old build. Answers while another tool is still running; default_session_id is isolated from other calls' temporary targets. capability_registry reports declared/registered tool counts, completeness and page/browser/desktop groups. Each tool's MCP annotations describe its potential effects.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Discloses significant non-obvious behavior beyond annotations: possible Windows ACL tightening, token file creation during bridge startup/auth initialization, answering while another tool is still running, session isolation, and malformed remote diagnosis handling. These complement and align with the annotations rather than contradicting them.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core purpose and each sentence adds diagnostic nuance, but it is extremely dense and runs as one long paragraph. It could be tightened with bullet-style grouping, though it stays on-topic and avoids filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the output schema already exists and there are no input parameters, the description is remarkably complete: it covers every verdict family, special false/unknown values, side effects, concurrency behavior, and even Windows-specific behavior. An agent has enough context to invoke and interpret this tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters and the input schema is empty, so there are no parameter semantics to document. Schema description coverage is 100% and the no-parameter baseline of 4 applies; the description correctly spends no effort on parameters.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Return component versions, stale-build actions, extension path, bridge ports, and connection status for setup/diagnostics.' It enumerates concrete output categories and clearly frames the tool as a setup/diagnostics status tool, distinguishing it from sibling tools like extension_path or get_automation_profile.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear context for when to rely on its results and maps diagnostic verdicts to follow-up actions: 'wait_for_extension', 'check_extension_connection', 'restart_mcp_session', and 'restart_bridge'. It does not explicitly name sibling alternatives or when-not conditions, but the action mappings effectively convey usage guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

handle_dialogB
Destructive

Inspect or handle a JavaScript dialog on the requested real-browser tab. action is dismiss, accept, or manual; manual reports the dialog without choosing.

ParametersJSON Schema
NameRequiredDescriptionDefault
actionYes
timeoutNo
session_idNo
prompt_textNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

B3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds value by explaining that 'manual' reports the dialog without choosing, which clarifies one non-destructive behavior. However, it does not elaborate on the effects of dismiss or accept (e.g., losing unsaved changes, clicking OK/Cancel), and it does not explain the role of timeout or session_id. Since the annotations already declare destructiveHint=true, the description doesn't contradict them but doesn't add much beyond that.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise: two sentences that state the purpose and list the action options. There is no wasted text, and the core information is front-loaded. This is an efficient use of words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has four parameters, one required, and an output schema, but the description does not cover essential context. It omits the meaning of timeout (likely how long to wait for the dialog), session_id (which tab), and prompt_text (input for prompt dialogs). It also doesn't explain what happens after the action (e.g., return value or page behavior). For a tool that can destructively handle dialogs, this is under-specified.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description must explain the parameters. It only explains 'action' by listing valid values (dismiss, accept, manual). The other three parameters (timeout, session_id, prompt_text) are not described at all, leaving the agent without necessary information to use them correctly. The description partially compensates for the lack of schema documentation but is insufficient.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies the tool's function: inspecting or handling a JavaScript dialog on a real-browser tab. It specifies the resource (JavaScript dialog) and the action (handle/inspect), and lists the valid action values. However, it does not explicitly differentiate from the sibling tool resolve_leave_dialog, which might also handle a specific type of dialog.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives such as resolve_leave_dialog or other dialog-related tools. It does not state when to use dismiss versus accept versus manual, nor does it mention prerequisites like whether a dialog must already be present. The usage context is implied but not explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

inspect_native_file_dialogA

Explicit desktop capability: inspect the current foreground Windows native file dialog owned by a registered Chrome or Edge process. Requires desktop_opt_in=true and the desktop extra. Verifies the OS owner/process identity, standard Shell file controls and visible Cancel button, then installs a temporary per-ticket window identity marker. Returns a 15-second ticket for cancel_native_file_dialog plus desktop/on_screen/input_quiet diagnostics. This inspection has a temporary marker side effect; it does not activate a window. Use page/CDP tools for ordinary pages. Unsupported or unverifiable native layouts are refused.

ParametersJSON Schema
NameRequiredDescriptionDefault
desktop_opt_inNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description goes well beyond the sparse annotations by disclosing the 'temporary per-ticket window identity marker' side effect, clarifying that it 'does not activate a window,' and describing refusal behavior. It also explains the verification steps and the 15-second ticket produced for cancel_native_file_dialog. This adds meaningful behavioral context the annotations do not provide.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense but every sentence adds value: scope, prerequisites, verification behavior, side effect, returned ticket, and routing advice. It is front-loaded with the core capability and avoids repetition or filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's moderate complexity, the description covers prerequisites, exact behavior, side effects, non-activation, refusal cases, and the link to cancel_native_file_dialog. The presence of an output schema means return-value details need not be fully spelled out in the description, and the remaining guidance is complete enough for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description carries the full burden and fully compensates by explicitly saying it 'Requires desktop_opt_in=true.' It also ties the boolean parameter to a concrete precondition, which is more useful than the schema's bare default.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: 'inspect the current foreground Windows native file dialog owned by a registered Chrome or Edge process.' It also distinguishes itself from ordinary-page tools by noting 'Use page/CDP tools for ordinary pages' and refers to its companion sibling cancel_native_file_dialog.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly states the required precondition 'desktop_opt_in=true and the desktop extra' and gives a clear routing rule: 'Use page/CDP tools for ordinary pages.' It also notes that unsupported or unverifiable native layouts are refused, which helps an agent decide when not to attempt the tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_all_tabsA
Read-onlyIdempotent

List every open tab, including chrome-extension:// pages that list_tabs hides. Those never become sessions (content scripts can't run there), so they have no session id — drive them with cdp_command(tab_id=...) instead. Works with no tabs open.

ParametersJSON Schema
NameRequiredDescriptionDefault
session_idNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover readOnlyHint, openWorldHint, idempotentHint, and destructiveHint. The description adds meaningful behavioral context: chrome-extension pages cannot become sessions, have no session id, and require cdp_command. It also notes the tool works with no tabs open, covering an edge case beyond annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences, each carrying distinct information: the listing scope, the chrome-extension caveat, and the empty state. The key differentiator is front-loaded and there is no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the read-only nature, strong annotations, and an output schema, the description covers the key behavioral distinctions and edge case. The only minor gap is the unexplained session_id parameter, but it is optional and not central to using the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0% and the description doesn't explain the optional session_id parameter. However, the parameter is optional and defaulted to null, making it less critical. Still, the description adds no semantic meaning for the parameter, so baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states a specific verb and resource: 'List every open tab', and immediately differentiates from sibling list_tabs by noting it includes chrome-extension:// pages that list_tabs hides. This lets an agent distinguish the tools without inspecting schemas.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly names list_tabs as the alternative and explains the distinguishing condition: chrome-extension pages. It also provides actionable routing guidance by telling the agent to drive those tabs with cdp_command(tab_id=...) since they have no session id.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_extensionsA
Read-onlyIdempotent

List installed browser extensions (id, name, enabled, type, version). Works with no tabs open.

ParametersJSON Schema
NameRequiredDescriptionDefault
session_idNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the safety profile is known. The description adds value by noting the tool works with no tabs open and by specifying the output fields, which is genuinely useful behavioral context beyond the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single efficient sentence plus a compact field list. Every element earns its place, with the most important verb and resource front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

This is a low-complexity read-only listing tool with an output schema and strong annotations. The description communicates the purpose, the returned fields, the 'no tabs needed' precondition, and the safety profile is already covered by annotations, so nothing essential is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, and the description does not mention session_id at all. The only parameter is an optional nullable string with a null default, so the schema carries almost no semantic information. The description's listing of output fields does not compensate for the absence of parameter guidance.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a clear verb and resource: listing installed browser extensions, and even enumerates the returned fields (id, name, enabled, type, version). This distinguishes it from sibling tools like call_extension, set_extension_enabled, or extension_path, which operate on extensions rather than listing them.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'Works with no tabs open' provides a useful context that this operation does not require an active tab, which helps differentiate it from tab-dependent tools. However, it does not explicitly state when to prefer this over siblings or mention any alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_tabsA
Read-onlyIdempotent

List connected tabs across all connected browsers; each tab has a browser field (chrome/edge/opera) and a session id to pass verbatim. Answers while another tool is still running. The default_session_id snapshot is isolated from other calls' temporary targets. Pass session_id explicitly when agents share one MCP process. A timed-out inventory releases only that read's bridge reservation; pending mutations keep their reservations.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.3/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description goes well beyond the readOnly/idempotent annotations by disclosing concurrency behavior, snapshot isolation of the default session, and the bridge-reservation semantics on timeout versus pending mutations. This is exactly the kind of non-obvious behavior an agent needs to invoke the tool safely.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the primary purpose and then compacts several distinct behavioral facts into tight sentences with no filler. Each sentence adds new information about scope, concurrency, session handling, or reservation semantics.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description is thorough for a tool with no input parameters and an output schema, covering concurrency and session isolation. The main gap is that it never clarifies how list_tabs differs from the sibling list_all_tabs, and the session_id instructions assume context the schema does not expose.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With zero parameters and 100% schema coverage, the baseline is 4. The description adds relevant session_id context even though it is not a schema property, which is helpful for understanding the tool's operating model, though it slightly muddles the fact that no input parameters are accepted.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb and resource: 'List connected tabs across all connected browsers' and states the key output fields (browser, session id). It is clear at a glance, but it does not explicitly differentiate itself from the closely named sibling list_all_tabs, so the agent must infer the distinction.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives concrete operational context: it can answer while another tool is running, and it instructs agents to pass session_id explicitly when sharing one MCP process. It does not, however, state when to prefer this tool over list_all_tabs or other sibling alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

network_capture_startA
Destructive

Start bounded CDP Network capture on a real-browser tab. Captures requests, responses, and optionally response bodies without foregrounding the tab. Call network_capture_stop from this same MCP session to return the buffer and release the debugger lease. Another session's capture returns capture_busy; use a separate tab per agent.

ParametersJSON Schema
NameRequiredDescriptionDefault
timeoutNo
session_idNo
max_entriesNo
body_timeoutNo
include_bodiesNo
max_body_bytesNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.3/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations, the description discloses several important behaviors: the capture is bounded, it does not foreground the tab, it acquires a debugger lease that must be released via network_capture_stop, and another session's capture will return capture_busy. This is exactly the practical behavioral context an agent needs.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three tight sentences with no filler. It front-loads the action and output, then immediately provides the critical stop-and-concurrency instructions. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema existsbool and all parameters are optional with defaults, so the default invocation path is well covered. The main gap is parameter-level detail for custom capture limits and session_id, but the description supplies the most important lifecycle and concurrency context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, and the description only vaguely addresses parameters: 'optionally response bodies' hints at include_bodies alert and 'bounded' hints at limits. It does not explain timeout, session_id, max_entries, body_timeout, or max_body_bytes, so the agent must rely on parameter names and defaults.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies the verb ('Start'), the resource ('CDP Network capture'), and the target context ('real-browser tab'). It also states exactly what is captured ('requests, responses, and optionally response bodies'), making it easy to distinguish from network_capture_stop and console_capture_start.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit lifecycle guidance: call network_capture_stop from the same session to retrieve the buffer and release the debugger lease. It also warns about concurrent sessions returning capture_busy and directs the agent to use a separate tab per agent. It does not contrast this with related tools like console_capture_start, but the operational context is strong.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

network_capture_stopA
Destructive

Stop Network capture on a real-browser tab, optionally filter returned records by URL, resource type, HTTP status range, or response-body inclusion, and release its debugger lease. url_pattern uses the browser's JavaScript RegExp syntax and invalid patterns return a structured error. Only the MCP session that started the capture may stop it; another session gets capture_busy.

ParametersJSON Schema
NameRequiredDescriptionDefault
timeoutNo
session_idNo
status_maxNo
status_minNo
url_patternNo
resource_typeNo
include_response_bodiesNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds behavior beyond the annotations by disclosing the release of the debugger lease, the structured error for invalid RegExp, and the capture_busy outcome for unauthorized sessions. These are specific behavioral traits not present in readOnlyHint, openWorldHint, or destructiveHint, and they do not contradict the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences, each carrying essential information: the core action and filter options, the RegExp syntax and error behavior, and the session ownership constraint. It is front-loaded with the primary purpose and contains no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present, the description does not need to cover return values. It covers ownership, error cases, and the filtering dimensions, but it leaves timeout and session_id unexplained. Given the 7-parameter schema with zero descriptions, this is a small but notable gap, so the description is not fully complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It does explain that optional filtering can be done by URL, resource type, HTTP status range, and response-body inclusion, and it defines the url_pattern syntax and error behavior. However, it does not explain timeout or session_id, and it does not map the filter categories to the exact parameter names, leaving some parameter meaning unresolved.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description states a specific verb and resource ('Stop Network capture') and adds that it releases the debugger lease. It is clearly distinguished from the sibling network_capture_start and console_capture_stop by name and action, so an agent can identify what this tool does.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives clear context for use by describing that only the session that started the capture may stop it and that another session gets capture_busy. It does not explicitly mention when to prefer this over alternatives like console_capture_stop, but the 'stop network capture' action and ownership rule make usage conditions clear. No explicit exclusions of siblings, so not a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

open_new_tabA
Destructive

Create one background browser tab, deduplicated by operation_id. Uses this MCP task's selected browser; select one with switch_tab or session_id/client_id when several are connected. Pass active=true for foreground work. Save owner_id for cleanup; ownership requires a completed record with exact client_id, tab_id and generation. Before dispatch, an unresolved probe returns unknown, may_have_created=false. When retry_safe=true, resolve its cause and retry with no operation_id. After uncertain dispatch, may_have_created=true,retry_safe=false: pass the returned operation_id, client_id and owner_id to this tool to read the same creation record without replaying. Failed recovery preserves uncertainty and ownership. A failed probe's separate reconciliation.bridge_operation.operation_id can be read with get_execute_js_result; its reservation_held=false does not prove non-creation or permit replay. After worker restart pending creates become terminal unknown; retired IDs retain replay guards. If reconciliation.resume_required=false, including initial not_found, follow its list_tabs() inspection guidance and stop repeating recovery. Matching URLs, unchanged tab counts, missing records and retired IDs prove neither non-creation nor ownership.

ParametersJSON Schema
NameRequiredDescriptionDefault
urlYes
activeNo
timeoutNo
owner_idNo
client_idNo
session_idNo
operation_idNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

While annotations already mark this as non-read-only, non-idempotent, open-world, and destructive, the description goes far beyond them with detailed side-effect and recovery behavior: probe uncertainty, retry_safe semantics, ownership requirements, worker-restart terminal states, and reconciliation resumption. No contradiction with annotations is present.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The first sentence is well front-loaded, but the remainder is a dense, semicolon-heavy paragraph mixing several distinct recovery concepts. Every sentence adds information, but poor structural grouping makes it harder for an agent to parse under pressure.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with this much recovery and deduplication complexity, the description is remarkably complete: it covers probe uncertainty, retry rules, ownership, failed recovery, worker restart, reconciliation guidance, and invalid evidence. Since an output schema exists, omitting return-value details is acceptable.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must carry parameter meaning. It does explain operation_id, active, owner_id, client_id, and session_id in context. However, timeout is not addressed, and URL only receives implicit treatment, leaving a small semantic gap for a tool with seven parameters.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description opens with a specific verb and resource: 'Create one background browser tab, deduplicated by operation_id.' This immediately distinguishes it from related tools like list_tabs or switch_tab, and the deduplication qualifier adds a precise scope.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives concrete usage instructions: use the MCP task's selected browser, select another via switch_tab or session_id/client_id when needed, pass active=true for foreground work, and save owner_id for cleanup. However, it does not explicitly contrast with alternatives such as open_url or say when not to use this tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

open_urlA
Destructive

Navigate the current real-browser tab through CDP without raising its window. beforeunload defaults to dismiss, except lab mode auto-accepts configured shell/IDE hosts. Use accept to leave explicitly, manual to inspect, or intent_leave=false to force the conservative dismiss behavior even on a lab auto host.

ParametersJSON Schema
NameRequiredDescriptionDefault
urlYes
timeoutNo
session_idNo
beforeunloadNodismiss
intent_leaveNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds meaningful behavior beyond the annotations: it navigates without raising the window, handles beforeunload with a default of dismiss, auto-accepts in lab mode for configured hosts, and explains how to override with 'accept', 'manual', or 'intent_leave=false'. This is substantial, non-contradictory context that an agent needs to predict side effects and page-unload behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two focused sentences place the core purpose first and then dive into the most nuanced behavioral mode. The beforeunload clause is dense but earns its place by clarifying a confusing default. Slight loss of a point because the phrasing is telegraphic and an agent might need to re-read the lab-auto-host clause.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The core behavior and beforeunload modes are well covered, and the presence of an output schema means return value detail is unnecessary. But with 5 parameters, 0% schema coverage, and no mention of timeout or session_id, the definition is not fully complete. The description gives enough for successful navigation but leaves parameter semantics partially depend, on the schema defaults.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has no property descriptions (0% coverage), so the description carries the burden for parameter meaning. It clearly explains beforeunload and intent_leave semantics, and url/tab are evident from the purpose. However, it leaves timeout and session_id completely unexplained, so the agent still lacks the full parameter semantics for a 5-parameter schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Navigate the current real-browser tab through CDP without raising its window.' This clearly distinguishes the tool from siblings like open_new_tab (new tab), cdp_command (raw CDP), and activate_tab (focus/window behavior). The 'current real-browser tab' wording makes the scope unambiguous and the mechanism CDP-specific.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for the current tab versus opening a new one, but it never explicitly says 'use open_new_tab for new tabs' or provides exclusions. It does give rich guidance for the beforeunload parameter (accept, manual, intent_leave=false), which is useful, but lacks explicit when-to-use vs. sibling tools. The phrase 'without raising its window' hints at current-tab navigation but does not name an alternative.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

page_clickA
Destructive

Click a CSS/structured locator or viewport coordinates in a specific real browser tab using background CDP input. Coordinates are viewport-relative CSS pixels (the space getBoundingClientRect reports), NOT the device pixels capture_page_screenshot returns -- on a scaled display divide a screenshot pixel by devicePixelRatio first. Ambiguous or unreachable targets dispatch nothing; the tab is not activated and the desktop cursor does not move. Selector offsets are measured from the element's top-left corner; an omitted axis uses the element centre. In selector mode, duplicate CSS/structured matches are reduced to visible, interactable candidates so hidden modal templates do not win, then the point is hit-tested before anything is dispatched: an element below the fold is scrolled into view, and a point owned by another element returns status 'obscured' (with occluded_by) or 'outside_viewport' having clicked nothing. Coordinate mode is not hit-tested -- coordinates name a pixel, not an element. A selector click crossing a non-identity CSS-transformed iframe returns status 'unsupported_frame_transform' without dispatch; query/type paths remain available. A structured selector may use {'selector': '#pay', 'frame': [...]} as a CSS alias, or {'frame': [...], 'x': 20, 'y': 30} to click a point inside the final same-origin or cross-origin frame; frame-point mode is not hit-tested. Nested frame locators also support OOPIFs. Framed clicks do not scroll automatically and check every parent for obstruction. A binding invalidated during the call returns stale_frame; inspect input_dispatched before recovery and never replay partial or unknown input.

ParametersJSON Schema
NameRequiredDescriptionDefault
xNo
yNo
buttonNoleft
clicksNo
timeoutNo
offset_xNo
offset_yNo
selectorNo
session_idNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Even with destructiveHint=true in annotations, the description adds substantial behavioral detail well beyond annotations: background CDP dispatch, no tab activation, no desktop cursor movement, none dispatched for ambiguous/unreachable targets, hit-testing, scrolling, obscured/outside_viewport, unsupported_frame_transform, stale_frame, and input_dispatched guidance. This is far beyond the annotation metadata.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long but dense and logically organized, front-loading the core purpose and critical coordinate caveat before mode-specific details. Every sentence adds distinct information, though headings or bullet structure could improve scannability. It is appropriately detailed for the tool's complexity, not padded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 9-parameter tool with a long tail of edge cases, the description is remarkably complete: it covers coordinate conversion, selectors, offsets, frame and OOPIF behavior, hit-testing, statuses, scrolling, and stale-frame recovery with a warning to inspect input_dispatched. Since an output schema exists, return-value details are not required from the description.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description carries most of the semantic burden, and it delivers for key parameters: x/y as viewport CSS pixels requiring devicePixelRatio conversion, selector object forms as CSS aliases or frame-point mode, and offset_x/y measured from top-left with omitted axis centered. It does not explain button, clicks, timeout, or session_id, so it is not fully complete for every parameter.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The opening sentence states a specific verb and resource: "Click a CSS/structured locator or viewport coordinates in a specific real browser tab using background CDP input." It clearly identifies two input modes, distinguishes itself from screenshot coordinate semantics by referencing capture_page_screenshot, and separates click behavior from type/press siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context for when to use coordinate mode versus selector mode, including explicit differences like "Coordinate mode is not hit-tested -- coordinates name a pixel, not an element." It also references fallback "query/type paths" in the transformed-iframe case, though it does not systematically enumerate sibling alternatives for all scenarios.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

page_dragA
Destructive

Drag between viewport coordinates in a specific tab using one background CDP input sequence, without activating the tab or moving the desktop cursor. Both endpoints are viewport-relative CSS pixels, like page_click's coordinate mode, and neither is hit-tested.

ParametersJSON Schema
NameRequiredDescriptionDefault
x1Yes
x2Yes
y1Yes
y2Yes
buttonNoleft
timeoutNo
durationNo
session_idNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds meaningful behavioral detail beyond the annotations: it uses one CDP input sequence, runs in the background, never activates the tab, never moves the desktop cursor, and performs no hit-testing on either endpoint. These are exactly the side-effect traits an agent needs to know. The description is consistent with the annotations, including the destructiveHint and readOnlyHint flags.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two concise sentences with no filler. The primary action and tab context are front-loaded, and the coordinate semantics and behavioral caveats come immediately after. Every clause adds information an agent can act on.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a drag tool with a relatively small parameter set, the description covers the core behavior, coordinate semantics, background execution, and hit-testing behavior. An output schema exists, so a return-value explanation is unnecessary. The main gap is that optional parameters like duration and button receive no context, though their defaults and intuitive names reduce the risk.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema itself has 0% parameter description coverage, so the description must compensate. It does clarify the four required coordinate parameters by stating that both endpoints are viewport-relative CSS pixels and are not hit-tested. However, it says nothing about the optional button, duration, timeout, or session_id parameters, leaving those to be inferred from defaults or names.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states a specific action: drag between viewport coordinates in a specific tab. It also distinguishes itself from related tools by noting it runs as a background CDP input sequence, does not activate the tab, and does not move the desktop cursor. This gives an agent enough to separate page_drag from page_click, page_type, and similar input tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear behavioral context that implies when to use this tool: use it for viewport-relative drags that should happen in the background without tab activation or desktop-cursor movement. It even references page_click's coordinate mode as a point of comparison. It does not explicitly state when not to use it or name an alternative beyond the implicit page_click analogy, so it stops just short of full guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

page_pressA
Destructive

Press a key or comma-delimited modifier chord in a specific tab using background CDP input, without activating the tab.

ParametersJSON Schema
NameRequiredDescriptionDefault
timeoutNo
keys_csvYes
session_idNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds useful behavioral context beyond the annotations, especially the key fact that input is delivered via background CDP and does not activate the tab. The annotations already indicate destructive potential and non-read-only status, and the description does not contradict them.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, tightly packed sentence that front-loads the action and includes only essential qualifiers. No filler or redundant restatement of the tool name.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the core invocation details for a simple tool, and the presence of an output schema plus annotations fills in return and safety information. Minor ambiguity remains around the exact key-chord syntax and the optional session_id behavior, but the description is largely complete for correct use.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description adds meaning to keys_csv by explaining that it accepts a key or comma-delimited modifier chord. It is less explicit about timeout and session_id, but those parameter names are reasonably self-explanatory and the description's clarification is valuable beyond the bare schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Press a key or comma-delimited modifier chord'), the target ('in a specific tab'), the mechanism ('background CDP input'), and a distinguishing behavior ('without activating the tab'). This makes it easy to tell apart from siblings like page_click and page_type.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description clearly communicates when to use this tool: for keyboard input in a background tab without activating it. It does not explicitly mention alternatives or say when not to use it, but the context is clear enough for an agent to select it over page_type or page_click.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

page_typeA
Destructive

Insert text into the focused element or a CSS/structured-locator field in a specific tab using background CDP input; xterm containers automatically retarget their helper textarea. Optionally clear and submit a key. Missing, ambiguous, or unusable targets dispatch nothing. CSS/structured matches are reduced to visible, interactable candidates so hidden templates do not win; the resulting input event is trusted in the page. The result includes active_element and focus_confirmed so omitted-selector input is auditable. Nested frame locators support same-origin, cross-origin and OOPIF targets. A call retains the selected document and element, then checks the focus chain before each input. Navigation or replacement returns stale_frame; inspect input_dispatched and do not replay partial or unknown input. A new independent call can locate the new document.

ParametersJSON Schema
NameRequiredDescriptionDefault
textYes
clearNo
timeoutNo
selectorNo
session_idNo
submit_keyNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A3.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations declare destructiveHint=true, and the description expands on this with concrete behaviors: optional clear/submit, retargeting for xterm, reduction to visible interactable candidates, trusted input events, focus_confirmed output, stale_frame on navigation, and replay warnings. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness2/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is verbose, with several long sentences packed with edge cases and implementation details. It is front-loaded with the core action, but the subsequent sentences could be trimmed or grouped. Overly detailed for a quick scan.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Behaviorally it covers many scenarios (missing targets, stale frames, retargeting, auditable output), and an output schema exists so return values are handled. However, it fails to explain the timeout and session_id parameters, which are part of the input schema, leaving agents to guess their semantics. This gap prevents full completeness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It indirectly covers text, clear, submit_key, and selector behavior, but timeout and session_id are not explained at all. Even for the covered parameters, details like accepted formats or defaults are omitted.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('Insert text') with a clear resource ('focused element or CSS/structured-locator field') and distinguishes it from siblings like page_click and page_press. The purpose is unambiguous and the technical mechanism (background CDP input) adds specificity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides context about when it applies (focused element, selector, xterm retargeting) and conditions like missing/ambiguous targets dispatching nothing. However, it does not explicitly name alternatives or exclusion criteria, such as 'use page_press for key-only input' or 'use execute_js for complex scripting'.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

remove_bookmarkA
Destructive

Remove a bookmark by id. Set recursive=true only for a folder whose full subtree should be removed. First saves the complete subtree to an atomic local JSON backup; nothing is removed if the snapshot or backup fails. The managed backup subdirectory must not be a symlink or reparse point. Returns backup_path even if the deletion outcome is unknown. Backups stay in the state directory for up to 30 days, 100 files or 64 MiB; each subtree is limited to 16 MiB. The snapshot and browser removal are separate operations, so concurrent edits by the user are not transactional.

ParametersJSON Schema
NameRequiredDescriptionDefault
recursiveNo
session_idNo
bookmark_idYes

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.1/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already flag destructiveHint=true, but the description adds substantial behavioral detail: atomic JSON backup, failure semantics ('nothing is removed if the snapshot or backup fails'), backup directory constraints (not a symlink/reparse point), return behavior even when outcome unknown, retention policy (30 days / 100 files / 64 MiB), per-subtree limit, and non-transactional concurrency note. All this goes beyond the annotations and is highly valuable for an agent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core action, then packs essential caveats into a compact paragraph. Every sentence adds information (backup, failure behavior, limits, concurrency). Slightly long but justified given the complexity. No fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (backup, recursive folders, failure handling, output), the description covers the key aspects: what happens on failure, return value expectations, backup lifecycle, and non-transactional nature. It does not explain session_id usage, and the output schema is present but not elaborated, yet the description mentions backup_path so the return contract is clear. Overall sufficient for an agent to call it safely.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It explains recursive clearly ('full subtree should be removed'), and bookmark_id is self-explanatory from the name and usage. However, session_id is not mentioned at all – its semantics remain unexplained. This partial coverage nets a 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description starts with 'Remove a bookmark by id' – a clear verb+object. It distinguishes itself from create_bookmark and get_bookmarks by explicitly naming the resource (bookmark) and the operation (remove). The recursive flag is explained as an option for folders, so the purpose is precise.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides guidance on when to set recursive=true ('only for a folder whose full subtree should be removed'), which helps decide parameter usage. However, it does not contrast with siblings like get_bookmarks or create_bookmark – no explicit 'use this when' or 'instead of' statement. The reader must infer that removal is the intent.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

reset_site_permissionsA
Destructive

Attempt to restore matching temporary site-permission leases now, including manual_recovery records. Omit origin and permission to reset every lease for the selected browser; origin accepts only http/https. Unsupported restoration preserves the prior setting and recovery guidance as manual_recovery and stops automatic retries. Resolve that cause before another explicit reset.

ParametersJSON Schema
NameRequiredDescriptionDefault
originNo
permissionNo
session_idNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare destructiveHint=true, readOnlyHint=false, idempotentHint=false. The description adds valuable context: it attempts restoration, handles manual_recovery records, and on unsupported restoration it preserves prior settings and stops automatic retries. This goes beyond the annotations and explains side effects and failure behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded with the main action ('Attempt to restore matching temporary site-permission leases now'). Each sentence adds distinct information: scope, parameter constraints, failure behavior, and guidance. Slightly dense but no wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has an output schema and annotations, the description covers the key behavioral aspects: what it resets, how to scope it, and what happens on unsupported restoration. The only gap is session_id semantics, but overall the description is sufficient for an agent to invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It explains the semantics of 'origin' and 'permission' (omitting both resets all leases; origin only http/https), but it doesn't explain 'session_id' at all. The description adds meaning for two of three parameters, but the third remains undocumented.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('reset') and resource ('temporary site-permission leases'), and clarifies scope ('for the selected browser'). It distinguishes from siblings by mentioning 'manual_recovery records' and 'automatic retries', which are not present in sibling names like set_site_permission. However, it doesn't explicitly name a sibling alternative, so it's clear but not fully differentiated.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit conditions: 'Omit origin and permission to reset every lease for the selected browser; origin accepts only http/https.' It also explains when not to use it: 'Unsupported restoration preserves the prior setting... stops automatic retries. Resolve that cause before another explicit reset.' This is clear context, though it doesn't name alternative tools explicitly.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

resolve_leave_dialogA
Destructive

Resolve an intended beforeunload leave in one bounded workflow: protocol accept twice, return immediately when no dialog exists, then use a lab-only foreground Enter fallback after the normal physical-input approval gate only when protocol handling actually fails. Approval failures expose reason in the result and diagnostics: elicitation_unsupported, declined, timeout, cancelled or error.

ParametersJSON Schema
NameRequiredDescriptionDefault
session_idNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate destructiveHint=true, and the description adds substantial behavioral detail: the two-step accept protocol, the early return when no dialog exists, the lab-only fallback condition (only when protocol handling fails), and the exposed failure reasons (elicitation_unsupported, declined, timeout, cancelled, error). This goes well beyond the annotations and gives the agent a clear model of the tool's actions and outcomes.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, information-dense sentence that front-loads the purpose and then details the workflow and failure modes. While complex, it avoids redundancy and every clause adds meaningful information. It is structured logically and not overly verbose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the output schema exists (so return values are covered) and the annotations declare destructiveHint, the description provides sufficient context for an agent to understand when to call the tool and what it does. It covers the main workflow, edge cases (no dialog, fallback), and failure reasons. It does not mention prerequisites like page state or session validity, but these are likely not essential for a bounded workflow. The description is nearly complete for its complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has a single optional parameter, session_id, with default null, and the description does not mention it at all. Schema coverage is 0%, so the description does not compensate. However, since the parameter is optional and may be ignorable, the gap is less severe, but it is still a missing explanation for a parameter that could affect behavior.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies the tool as resolving an intended beforeunload leave, with a specific workflow: accept protocol twice, return when no dialog exists, and use a fallback Enter key after approval gate fails. It names the exact failure modes and distinguishes itself from generic dialog handling by specifying the beforeunload context, making the purpose unambiguous even without referencing siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies the tool is for beforeunload dialogs and describes when it returns immediately (no dialog) but does not explicitly state when to use this tool versus alternatives like handle_dialog. It lacks an explicit exclusion or comparison, so an agent must infer the intended use from the beforeunload context. This is adequate but not explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

save_pdfA
Destructive

Print a real-browser tab to a validated PDF file through bounded CDP. save_path is RELATIVE and resolves under ~/Downloads/browsertap; an absolute path or a '..' escape is refused. The file is written atomically only after valid non-empty PDF bytes are returned; a CDP timeout invalidates and detaches the debugger lease.

ParametersJSON Schema
NameRequiredDescriptionDefault
scaleNo
timeoutNo
landscapeNo
save_pathYes
session_idNo
page_rangesNo
print_backgroundNo
prefer_css_page_sizeNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.1/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Adds substantial behavior beyond annotations: atomic write only after valid non-empty PDF bytes, CDP timeout invalidation, debugger lease detachment, and path validation. These details are not present in the annotations and meaningfully inform the agent of failure modes and write safety.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences with purpose front-loaded and zero fluff. Every clause adds operational value (what it does, path restrictions, atomicity/timeout behavior).

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite having an output schema, the tool has 8 parameters and the description leaves pivotal call semantics unexplained: how the tab is selected (session_id), the format of page_ranges, and the meaning of print options. The description covers path and timeout safety but is not complete enough for reliable invocation without external knowledge.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With schema description coverage at 0%, the description must compensate for parameter meaning. It only explains save_path (relative path rules) and indirectly timeout (CDP timeout invalidates). Parameters like scale, landscape, page_ranges, print_background, prefer_css_page_size, and session_id are left to name-based inference, which is insufficient at this coverage level.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('Print'), resource ('real-browser tab'), and output ('validated PDF file') via 'bounded CDP'. The specificity distinguishes it from siblings like capture_page_screenshot or download_file, even without naming them.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides clear context for when to use (print a tab to PDF) and adds essential path constraints (relative under ~/Downloads/browsertap, refusal of absolute and '..' paths). Does not explicitly name alternatives or exclusions, so not a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

scan_pageA
Destructive

Read the current page as simplified HTML/text, preserving login state from the real browser. cutlist collapses long repeated lists and reports a CSS selector for each container it collapsed, derived from that container's own structure. The built-in scan does not write page attributes, ids, or window globals. Optional extra_js runs caller code and can modify the page or send requests. Background tabs may report viewport height zero; ordinary DOM/text/API work still works there, and only visual/layout fidelity requires explicit activate_tab. The result also includes render_state/content_ready when the page can be probed: shell_only or hydrating means the SPA has not produced reliable content yet; retry scan_page or wait_for before treating an empty result as a real empty page. A timed-out built-in readiness probe releases its tab reservation; missing render fields mean readiness is unknown. observation adds current control locators, editability, recommended_tool and reasons; pass a locator unchanged as page_click/page_type selector. Its frames list gives frame paths for another scan_page call, including cross-origin/OOPIF documents. Frame scans are explicit and do not accept extra_js. Top-document extra_js preserves its existing execution semantics and omits actionable metadata. Locators are observations, not persistent refs: re-scan after page changes. verify_coordinate_target means inspect a screenshot before choosing viewport CSS coordinates; it is not an automatic click. upload_files is recommended only for top-document file inputs outside shadow roots; use locator.css as its string selector. Frame/shadow file inputs report no supported upload. max_targets caps controls and frame entries together (0 disables them, maximum 200); truncated=true means more targets or DOM nodes remain uninspected. maxchars caps content separately. Defaults: cutlist=true, maxchars=35000, max_targets=80, timeout=15 seconds.

ParametersJSON Schema
NameRequiredDescriptionDefault
frameNo
cutlistNo
timeoutNo
extra_jsNo
maxcharsNo
text_onlyNo
session_idNo
instructionNo
max_targetsNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description goes far beyond the minimal annotations (readOnlyHint false, destructiveHint true). It discloses that the built-in scan does not write page attributes, ids, or window globals, that extra_js can modify the page or send requests, that background tabs may report zero viewport height, that render_state indicates SPA readiness, and that timeout releases the tab reservation. This rich behavioral disclosure directly complements the annotations and adds substantial value.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long but information-dense, with the core purpose front-loaded. Every sentence adds operational detail (cutlist, frame handling, render_state, locators, upload_files, caps). While it could be slightly tightened (e.g., combining related caveats), the complexity of the tool justifies the length, and there is no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (9 parameters, no required fields, open-world behavior, and an output schema), the description covers a remarkable breadth: it explains render_state readiness, observation locators, frame paths, timeout behavior, max_targets truncation, and edge cases like shadow-root file inputs. It also cross-references sibling tools (wait_for, page_click, page_type) implicitly, making it self-sufficient for an agent to call correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description is the only source for parameter meaning. It explains cutlist, maxchars, max_targets, timeout defaults, extra_js execution semantics, frame handling, and max_targets caps. However, it does not explicitly address text_only, session_id, or instruction, leaving their purpose implicit. Still, it covers the majority of parameters with meaningful semantics.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a clear, specific verb-resource statement: 'Read the current page as simplified HTML/text, preserving login state from the real browser.' It distinguishes itself from siblings by detailing unique capabilities (cutlist, observation, frame handling) and does not confuse with other page-reading tools like capture_page_screenshot or execute_js.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides strong contextual guidance: it advises retrying scan_page or using wait_for before treating an empty result as real, notes that frame scans don't accept extra_js, and clarifies that upload_files is only recommended for top-document inputs. However, it does not explicitly name alternative tools (e.g., execute_js) and the conditions that would select them, so it falls short of fully explicit when-to-use-vs-alternatives guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

scroll_pageA
Destructive

Scroll the page and report the new position. scan_page omits anything past ±5000px from the current scroll offset, so on a long page: scan, then scroll, then scan again. Pass to='bottom'/'top', a pixel offset, or a CSS selector to bring into view. Defaults: to='bottom', timeout=15 seconds.

ParametersJSON Schema
NameRequiredDescriptionDefault
toNobottom
timeoutNo
session_idNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations include destructiveHint: true, and the description aligns by implying the scroll changes the page state and temporarily affects the viewport. The description also discloses that it reports the new position, which is useful behavior. It doesn't delve into side effects like triggering scroll events or lazy loading, but that's not required given the annotation. The description adds value by explaining the scan_page interaction and the default behavior, which annotations don't cover.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and well-structured. The first sentence states the core function (scroll and report position). The second sentence provides the critical usage note about scan_page's limitation, which is essential for correct usage. The third sentence lists the target options and defaults. There is no fluff; every sentence provides necessary information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description is complete for the complexity level. It covers the action, the interaction with a sibling, parameter semantics, and defaults. An output schema exists, so return value details are not needed. The tool has only 3 parameters, all optional, and the description sufficiently explains them. No critical information is missing for an agent to invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must carry the meaning. It does so by explaining the 'to' parameter's allowed values ('bottom', 'top', pixel offset, CSS selector) and the timeout default (15 seconds). The session_id parameter is not described, but it's a common context parameter, and the lack of specific meaning is acceptable given the description's focus. Overall, the description compensates well for the schema's sparse documentation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: scroll the page and report the new position. It also differentiates itself from sibling scan_page by explaining the 5000px limitation and the need to alternate scan and scroll on long pages. The mention of specific target types adds further clarity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly explains when to use this tool versus scan_page: on long pages, one should scan, scroll, then scan again. It also provides clear guidance on how to specify the scroll target ('bottom', 'top', pixel offset, or CSS selector) and mentions the default timeout. This gives the agent precise usage instructions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

set_automation_profileA
DestructiveIdempotent

Set the safe or lab automation profile for this MCP process. This does not persist or reload the extension; BROWSERTAP_MODE controls the next process.

ParametersJSON Schema
NameRequiredDescriptionDefault
modeYes

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses non-obvious behavior beyond what annotations provide: the change is session-only ('does not persist or reload the extension') and BROWSERTAP_MODE takes over on the next process. This complements the idempotentHint and destructiveHint annotations without contradicting them.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tight sentences with no filler: the first front-loads the action and resource, the second delivers the critical caveats about persistence and BROWSERTAP_MODE. Every clause earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a one-parameter, session-scoped mutation with an output schema, the description covers purpose, scope, persistence, and the alternative mechanism. The main remaining gap is not explaining the behavioral differences between the 'safe' and 'lab' profiles, which matters given the destructiveHint annotation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the schema exposes only a bare 'mode' string, yet the description reveals the two intended values ('safe or lab'). It carries the parameter documentation burden, though the exact string format and validation behavior are left unspecified.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Set') with a clear resource ('the safe or lab automation profile') and scopes it to 'this MCP process.' It states the two available mode values, which cleanly differentiates it from the sibling get_automation_profile.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description clarifies that the effect is limited to the current process and does not persist or reload the extension, and that BROWSERTAP_MODE governs the next process. This gives an agent a clear boundary for when this tool applies, though it stops short of explicitly recommending an alternative tool for persistent configuration.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

set_cookiesA
Destructive

Write cookies into the real browser profile. Takes one cookie object or a list (JSON text is accepted): name is required, plus optional value/url/domain/path/expires (Unix seconds)/httpOnly/secure/sameSite. Uses CDP Network.setCookie so HttpOnly and cross-path cookies work; falls back to document.cookie only if CDP is unavailable, and then says which cookies could not carry HttpOnly. Cookies with neither url nor domain are scoped to the current page.

ParametersJSON Schema
NameRequiredDescriptionDefault
tab_idNo
cookiesYes
timeoutNo
session_idNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate readOnlyHint=false and destructiveHint=true, so the description's 'write' is consistent. It adds value by disclosing the CDP-first approach with fallback to document.cookie, noting that HttpOnly cannot be carried in fallback, and explaining scoping of cookies without url/domain. This is behavioral detail beyond the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the purpose, then efficiently packs format details, fallback behavior, and scoping rules. Every sentence contributes meaningful information without redundancy, making it dense but readable.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (4 params, output schema exists) the description covers the main functionality well: accepted formats, required field, fallback, and scoping. It does not mention overwrite behavior or error cases, but the output schema handles return values, and the provided details are sufficient for a typical agent to call it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description must compensate. It thoroughly explains the 'cookies' parameter (formats, required name, optional fields, expiry units), which is the core. However, it does not explain tab_id, timeout, or session_id, which are left to inference from their names and defaults. This partial compensation is adequate for the primary parameter but incomplete for the others.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb ('Write') and resource ('cookies') with the target context ('real browser profile'), and lists the accepted formats and required field. This unambiguously distinguishes it from sibling cookie tools like get_cookies and delete_cookies, which are obvious from their names.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use the tool (when you need to write cookies) but does not explicitly mention alternatives or exclusion criteria. It does not say 'use this instead of get_cookies for reading' or provide any conditional guidance, so an agent must infer usage from the verb alone.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

set_extension_enabledA
Destructive

Enable or disable an installed extension by id. Chrome exposes no API to INSTALL an extension, so this only toggles ones already present; use list_extensions for ids. The BTAP bridge refuses to disable itself -- nothing would be left to re-enable it -- so ask a human to press Reload on chrome://extensions to pick up a new build.

ParametersJSON Schema
NameRequiredDescriptionDefault
enabledYes
session_idNo
extension_idYes

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.3/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark destructiveHint=true, but the description adds critical behavioral detail: the tool cannot install, only toggles existing ones, and the bridge refuses to disable itself, requiring a human to reload. This goes beyond the annotation to explain consequences and a recovery step, without contradicting any annotation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences with no filler, front-loading the core purpose. The second sentence is long and packs a caveat plus a workaround, but it remains readable and every clause earns its place. Slightly verbose but efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

It covers purpose, usage, and important behavioral caveats, and the presence of an output schema likely covers return values. However, it leaves session_id completely unexplained, which is a gap given the lack of schema descriptions. For a destructive tool, it does not mention permissions or errors, but the main missing piece is parameter semantics.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description must compensate for all parameters. It only implies extension_id via 'by id' and mentions list_extensions, but never explicitly explains the 'enabled' boolean or the 'session_id' parameter. The schema titles ('Enabled', 'Extension Id') provide minimal help, but the description adds no semantic detail beyond that.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states a specific verb (enable/disable) with a resource (installed extension) and method (by id). It also distinguishes itself from installation, which is not possible, and explicitly names list_extensions for ids. This fully differentiates it from any sibling.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It provides explicit when-to-use context: toggling existing extensions only, not installing. It names the alternative (list_extensions) for obtaining ids, and gives a clear exclusion: the BTAP bridge cannot be disabled, with a workaround. This is thorough and actionable.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

set_site_permissionA
Destructive

Temporarily set an origin-scoped browser site permission for 60-600 seconds. Only http/https origins and notifications, geolocation/location, camera or microphone are supported; clipboard returns unsupported because its prior state cannot be restored. safe asks on every allow; lab skips prompts by default and restores session approval only when BROWSERTAP_LAB_NO_ELICIT is explicitly disabled. Leases attempt to restore their prior setting. requires_user_action.reason distinguishes elicitation_unsupported, declined, timeout, cancelled and error; an unsuccessful approval never sends a permission grant. If restoration becomes unsupported, manual_recovery retains that setting and recovery guidance without automatic retries; an explicit reset can retry after the cause is resolved.

ParametersJSON Schema
NameRequiredDescriptionDefault
originNo
settingYes
permissionYes
session_idNo
duration_secondsNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.2/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark the operation as destructive and non-idempotent, and the description adds substantial context: restoration attempts, mode-dependent prompt behavior, requires_user_action.reason values, no grant on unsuccessful approval, and manual_recovery semantics. No contradiction with annotations exists.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The first sentence front-loads the core purpose, and later sentences provide useful edge-case details not inferable from schema or annotations. The paragraph is dense and a bit run-on, but every sentence contributes meaningful behavioral information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a destructive, non-idempotent operation with no parameter descriptions in the schema, the description covers supported inputs, failure reasons, and recovery semantics well. However, the required 'setting' parameter and 'session_id' remain undefined, so an agent cannot fully construct a valid call from the description alone.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description must explain parameters itself. It clarifies origin (http/https only), permission (supported list, clipboard exception), and duration_seconds (60-600). However, the required 'setting' parameter is never given its possible values, and 'session_id' is left unexplained, so parameter meaning is only partially compensated.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The opening sentence states a specific verb (set), resource (browser site permission), scope (origin), and time bound (60-600 seconds). It also clearly distinguishes this temporary, lease-like operation from the sibling reset_site_permissions tool.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives concrete eligibility rules: only http/https origins and a specific set of permissions are supported; clipboard is explicitly excluded. It also describes safe vs. lab mode behavior and mentions reset as the recovery path, providing clear context for when this tool applies, though it does not name a direct alternative for permanent permission removal.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

storage_getA
Read-onlyIdempotent

Read localStorage or sessionStorage. Give a key for one value, or omit it to dump every key (values are truncated past ~20k chars and truncated is reported). area='local' (default) or 'session'.

ParametersJSON Schema
NameRequiredDescriptionDefault
keyNo
areaNolocal
offsetNo
timeoutNo
max_bytesNo
max_itemsNo
session_idNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, and non-destructive behavior. The description adds meaningful context: omission of key triggers a full dump, values are truncated past ~20k chars, and truncation is reported. It doesn't cover offset or max_items pagination, but core behavior is clear.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences with no filler; the primary usage decision is front-loaded. Every sentence contributes either to operation, parameter behavior, or defaults.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers the main read/dump path and truncation reporting well, but an agent is left guessing about offset, max_items, and timeout behavior when dealing with large storage or pagination. The output schema mitigates return-value ambiguity, but parameter behavior is incomplete for a tool with this many knobs.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It adds real meaning for key, area, and indirectly max_bytes via the truncation threshold, but leaves offset, timeout, max_items, and session_id without explanation. This is a partial but not complete compensation for a 7-parameter tool.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific read operation against localStorage or sessionStorage, and clearly differentiates from its write sibling storage_set. The per-key vs dump-all behavior is explicit, leaving no ambiguity about what the tool does.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides concrete usage instructions: give a key for one value or omit it to dump all keys, and choose local or session area. It doesn't explicitly contrast with storage_set, but the read/write distinction is obvious from the verb and sibling name.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

storage_setA
Destructive

Write one key into localStorage or sessionStorage and read it back to confirm. area='local' (default) or 'session'. Values are strings; non-string values are JSON-encoded first.

ParametersJSON Schema
NameRequiredDescriptionDefault
keyYes
areaNolocal
valueYes
timeoutNo
session_idNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark destructiveHint=true and idempotentHint=false; the description aligns by describing a write/overwrite operation. It adds useful context beyond annotations by disclosing the read-back confirmation and the JSON-encoding behavior for values. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tight sentences place the core action first and add only essential detail. Every phrase contributes meaning, and there is no filler or repetition of schema/annotation content.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Core usage is covered well: write, storage area, value handling, and confirmation. However, with five parameters and no schema descriptions, the omission of timeout and session_id semantics leaves an agent guessing for advanced calls. The output schema helps, but the description alone is only minimally complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It explains area values/default and value coercion, but does not explain key, timeout, or session_id. The claim that non-string values are JSON-encoded also sits awkwardly with the schema requiring value as a string.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific action ('Write one key'), the target resource ('localStorage or sessionStorage'), and an explicit confirmation step. It is immediately distinguishable from the reading sibling storage_get and makes the tool's purpose unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives clear context for when to use the tool: when persisting a single key to browser storage, with area selection and defaults explained. It does not explicitly name storage_get as the alternative or state conditions for avoiding this tool, but the write-focused framing makes the intended use clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

switch_tabA
Destructive

Set the target tab for later calls by session id, URL substring, or browser name ('chrome'/'edge'/'opera') without focusing the browser. A URL substring must match exactly one tab; pass its full session_id when several tabs match. Use activate=true or activate_tab when foreground work is required.

ParametersJSON Schema
NameRequiredDescriptionDefault
browserNo
activateNo
session_idNo
url_patternNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description reveals a key behavioral trait—'without focusing the browser'—which goes beyond the annotations. It also explains that the operation sets state for later calls. While the annotations include destructiveHint: true, the description does not address any destructive aspects, but it does not contradict the annotation either. It adds useful context about side effects (state change) and the alternative for foreground work.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences long, with the primary purpose stated first, followed by the ambiguity rule and a pointer to alternatives. Every sentence adds value, and there is no redundancy. It is well-structured and front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (four optional parameters) and the existence of an output schema, the description provides all necessary context for correct invocation. It covers selection methods, ambiguity resolution, and when to use alternative tools, leaving no critical gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With schema description coverage at 0%, the description must fully explain parameter usage. It does so by mapping each parameter: browser name to the browser parameter, url_pattern to 'URL substring', session_id to the explicit instruction for ambiguous matches, and activate to the boolean flag. This is complete and actionable for an agent.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's action: setting the target tab for later calls, and specifies the selection criteria (session id, URL substring, browser name). It also distinguishes itself from activate_tab by noting that it does not focus the browser, making its purpose unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly instructs when to use this tool versus alternatives: 'Use activate=true or activate_tab when foreground work is required.' It also provides guidance for ambiguous matches, directing the user to pass the full session_id when multiple tabs match a URL substring.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

uninstall_extensionA
Destructive

Uninstall another installed extension by id. show_confirm_dialog defaults to true; set it false only for an explicitly selected disposable/test extension. The BTAP bridge cannot uninstall itself through its active connection.

ParametersJSON Schema
NameRequiredDescriptionDefault
session_idNo
extension_idYes
show_confirm_dialogNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate destructiveness, but the description adds meaningful behavioral nuance: the BTAP bridge cannot uninstall itself, and the confirm dialog has a conditional recommendation. This goes beyond the structured hints without contradicting them.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences with no filler. The core action is front-loaded, and the caveats are compact and directly relevant to safe invocation.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the core call, safety caveats, and a self-imposed limitation. Given that an output schema exists and annotations provide the destructive/open-world context, the description is nearly complete; only session_id semantics are missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description must compensate. It explains extension_id and show_confirm_dialog semantics well, but session_id is left entirely unexplained. Partial compensation, with a clear gap for one parameter.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description gives a specific verb ('Uninstall'), a specific resource ('another installed extension'), and the key identifier ('by id'). It clearly distinguishes this from sibling tools like set_extension_enabled and list_extensions.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides direct usage guidance: show_confirm_dialog should only be false for an explicitly selected disposable/test extension, and the tool cannot uninstall itself through the active bridge. It does not explicitly contrast with disabling an extension, but the context is clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

upload_filesA
Destructive

Set files on a file input, which JS cannot do (input.files is read-only). Give a CSS selector for the and absolute local paths. Runs as a single CDP batch so the DOM node ids stay valid across the sequence.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathsYes
timeoutNo
selectorYes
session_idNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark this as destructive and non-read-only. The description adds a valuable behavioral detail: the operation runs as a single CDP batch to keep DOM node IDs valid, which is beyond what annotations convey. No contradiction is present.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences with no filler. The purpose is front-loaded, and the behavioral note is concise. Every clause earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists to cover return values, and annotations cover safety. The description addresses purpose, input specification, and a key atomicity behavior. It is nearly complete for a tool of this complexity, though it omits details on optional parameters and potential side effects like change events.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description must explain parameters. It clarifies 'selector' as a CSS selector and 'paths' as absolute local paths, but it does not mention 'timeout' or 'session_id'. Since the two required parameters are adequately described, it partially compensates for the schema gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource ('Set files on a file input') and explains the underlying limitation ('input.files is read-only'), which distinguishes this tool from any sibling. It is immediately clear what the tool does and why it exists.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It instructs the agent to provide a CSS selector for the file input and absolute local paths, which clarifies how to invoke it. It implies the use case (setting files on an input) but does not explicitly contrast with alternatives; however, no sibling tool handles file inputs, so the guidance is sufficient.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

wait_forA
Destructive

Wait until a condition holds on the page, then return. Use this instead of polling scan_page (each scan re-serializes the whole DOM). Exactly one of selector / text / url_pattern / js must be given: selector waits for a CSS or structured-locator match, including nested same-origin/cross-origin iframe paths. Role locators exclude hidden and inert controls; disabled visible controls can still be observed. Text waits for a substring in body text, url_pattern for a regex on the URL, js for a JS expression to become truthy. Caller js is evaluated repeatedly and can have side effects; use a read-only predicate. The server schedules short synchronous page checks under one deadline. A delayed reply returns its operation_id for get_execute_js_result; it is never replayed while pending. Timed-out top-document selector/text/URL checks can release the tab while keeping that receipt: reservation_held=false permits another command. Framed checks and caller-provided js may stay reserved; when reservation_held is true or unknown, collect the original operation first.

ParametersJSON Schema
NameRequiredDescriptionDefault
jsNo
goneNo
textNo
timeoutNo
selectorNo
session_idNo
url_patternNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description goes well beyond the annotations by disclosing that caller js is evaluated repeatedly and may have side effects, that a delayed reply returns an operation_id for get_execute_js_result, that pending operations are never replayed, and that timed-out top-document checks can release the tab while keeping a receipt. It also explains reservation_held semantics and how to handle framed checks and caller-provided js. This is exemplary behavioral disclosure for a tool with subtle asynchronous and reservation behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long but every sentence delivers distinct, necessary information: purpose, alternative, mode rules, JS caveats, scheduling, operation_id, reservation behavior, and fallback instructions. It is front-loaded with the core purpose and usage, then progressively covers edge cases, so the length is justified by the tool's complexity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a complex asynchronous wait tool, the description is remarkably complete: it covers condition modes, alternatives, side effects, delayed replies, deadlines, and tab-reservation behavior. The main gap is the unexplained 'gone' parameter and the lack of any mention of timeout/session_id, though output schema and parameter names partially mitigate those. Overall, an agent has nearly everything needed to use the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With schema description coverage at 0%, the description must compensate. It thoroughly explains selector, text, url_pattern, and js, including structured-locator behavior and side-effect warnings. However, it omits the 'gone' parameter, which is non-obvious from the schema alone and central to absence-based waits, and it does not clarify timeout or session_id semantics. The description covers the core modes but leaves meaningful parameter gaps.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description starts with a specific verb and resource: 'Wait until a condition holds on the page, then return.' It clearly differentiates itself from scan_page by saying 'Use this instead of polling scan_page (each scan re-serializes the whole DOM),' and it enumerates the exact condition modes (selector, text, url_pattern, js). An agent can immediately know what this tool does and how it differs from a key sibling.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly names the alternative, scan_page, and gives the reason to prefer wait_for: 'Use this instead of polling scan_page.' It also states the mandatory usage rule 'Exactly one of selector / text / url_pattern / js must be given' and describes what each mode waits for, which is strong actionable guidance for an agent deciding to call this tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

wait_for_urlA
Read-onlyIdempotent

Wait for navigation to settle: blocks until the tab's URL matches url_pattern (regex, or plain substring) and — unless wait_ready=false — document.readyState is 'complete', then returns the final url, title and readyState. Use this after a click or open_url that navigates; wait_for(url_pattern=...) only checks the URL and can return while the new document is still blank. The server schedules short synchronous page checks. Delayed replies retain their operation_id for get_execute_js_result. A timed-out probe can release the tab without losing its receipt: reservation_held=false permits another command while the original reply remains collectible. When reservation_held is true or unknown, collect the original operation first.

ParametersJSON Schema
NameRequiredDescriptionDefault
timeoutNo
session_idNo
wait_readyNo
url_patternYes

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly/openWorld/idempotent, and the description adds significant non-obvious behavior: server-side synchronous page checks, operation_id retention for get_execute_js_result, and reservation_held semantics on timeout. This is beyond what annotations provide and helps the agent reason about side effects and collecting results.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense but cohesive: it front-loads the core behavior and usage, then layers advanced details (operation_id, reservation_held) that need to be there. Every sentence carries information, though the later reservation_held paragraph is complex enough that it could be split for readability.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 4-parameter wait tool with no schema parameter descriptions and an output schema available, the description covers the main behavior, return values, usage context, and timeout edge case. It omits session_id semantics and timeout units, but otherwise gives an agent what it needs to call correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It does clarify url_pattern (regex or plain substring) and wait_ready=false (skip readyState wait), but timeout and session_id are left undescribed, including timeout units. This is a clear gap; the description only partially compensates for the schema's lack of parameter documentation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Wait for navigation to settle: blocks until the tab's URL matches url_pattern...' and states the exact return values (url, title, readyState). It also names the sibling wait_for and explains the difference, so an agent can select it correctly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly says to use this after a click or open_url that navigates, and contrasts wait_for(url_pattern=...) as URL-only check that can return before the document is ready. It also provides operational guidance for delayed replies and reservation_held, so when-to-use and alternatives are clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 13 tool updatesv0.5.4
    • Addedcancel_native_file_dialog
    • Removedcapture_desktop_screenshot
    • Changedexecute_js1 field changed
      • addedInput schema / properties / wait
        Added value: +{
        +  "default": true,
        +  "title": "Wait",
        +  "type": "boolean"
        +}
    • Addedget_execute_js_result
    • Removedhotkey
    • Addedinspect_native_file_dialog
    • Removedmouse_click
    • Removedmouse_drag
    • Removedmouse_move
    • Changedopen_new_tab2 fields changed
      • addedInput schema / properties / client_id
        Added value: +{
        +  "anyOf": [
        +    {
        +      "type": "string"
        +    },
        +    {
        +      "type": "null"
        +    }
        +  ],
        +  "default": null,
        +  "title": "Client Id"
        +}
      • addedInput schema / properties / operation_id
        Added value: +{
        +  "anyOf": [
        +    {
        +      "type": "string"
        +    },
        +    {
        +      "type": "null"
        +    }
        +  ],
        +  "default": null,
        +  "title": "Operation Id"
        +}
    • Removedpointer_info
    • Changedscan_page2 fields changed
      • addedInput schema / properties / frame
        Added value: +{
        +  "anyOf": [
        +    {
        +      "items": {
        +        "anyOf": [
        +          {
        +            "type": "string"
        +          },
        +          {
        +            "additionalProperties": true,
        +            "type": "object"
        +          }
        +        ]
        +      },
        +      "type": "array"
        +    },
        +    {
        +      "type": "null"
        +    }
        +  ],
        +  "default": null,
        +  "title": "Frame"
        +}
      • addedInput schema / properties / max_targets
        Added value: +{
        +  "default": 80,
        +  "title": "Max Targets",
        +  "type": "integer"
        +}
    • Removedtype_text
  2. 55 tool updatesv0.1.0
    • First observedactivate_tab
    • First observedcall_extension
    • First observedcapture_desktop_screenshot
    • First observedcapture_page_screenshot
    • First observedcdp_batch
    • First observedcdp_command
    • First observedclose_tabs
    • First observedconsole_capture_start
    • First observedconsole_capture_stop
    • First observedcreate_bookmark
    • First observeddebugger_targets
    • First observeddelete_cookies
    • First observeddownload_file
    • First observedexecute_js
    • First observedextension_path
    • First observedget_automation_profile
    • First observedget_bookmarks
    • First observedget_console_messages
    • First observedget_cookies
    • First observedget_setup_status
    • First observedhandle_dialog
    • First observedhotkey
    • First observedlist_all_tabs
    • First observedlist_extensions
    • First observedlist_tabs
    • First observedmouse_click
    • First observedmouse_drag
    • First observedmouse_move
    • First observednetwork_capture_start
    • First observednetwork_capture_stop
    • First observedopen_new_tab
    • First observedopen_url
    • First observedpage_click
    • First observedpage_drag
    • First observedpage_press
    • First observedpage_type
    • First observedpointer_info
    • First observedremove_bookmark
    • First observedreset_site_permissions
    • First observedresolve_leave_dialog
    • First observedsave_pdf
    • First observedscan_page
    • First observedscroll_page
    • First observedset_automation_profile
    • First observedset_cookies
    • First observedset_extension_enabled
    • First observedset_site_permission
    • First observedstorage_get
    • First observedstorage_set
    • First observedswitch_tab
    • First observedtype_text
    • First observeduninstall_extension
    • First observedupload_files
    • First observedwait_for
    • First observedwait_for_url

TDQS

A3.6/5.0

Scored across 51 tools

Disambiguation4/5

Most tools target distinct capabilities (tab management, page input, cookies, storage, capture, CDP), and long descriptions clarify edge cases. Minor overlap exists between handle_dialog and resolve_leave_dialog, and between list_tabs/list_all_tabs/debugger_targets, but the descriptions draw clear boundaries.

Naming Consistency4/5

The overwhelming majority follow a verb_noun snake_case pattern (open_url, list_tabs, delete_cookies, capture_page_screenshot), with parallel pairs like network_capture_start/network_capture_stop. A few noun-led names (extension_path, debugger_targets, cdp_command, cdp_batch, debugger_targets, cdp_batch) deviate slightly but remain predictable.

Tool Count2/5

51 tools is well beyond the 25+ threshold and near the 50+ extreme, making the surface heavy for agents to navigate. The breadth is partly justified by the server's wide browser-automation scope, but many niche tools (extension management, native file dialogs, bookmarks) inflate the count.

Completeness4/5

The server covers nearly the full browser lifecycle: tabs, navigation, input, screenshots, cookies, storage, uploads, downloads, dialogs, permissions, network/console capture, and diagnostics, with no major dead ends in core workflows. Minor gaps like bookmark update and extension install are absent or explicitly unsupported, but workarounds exist via execute_js/cdp_command.

Maintenance

ActivityActive
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    D
    maintenance
    MCP server to control Chrome browsers locally or remotely via the Claude extension, enabling navigation, form filling, screenshots, and JavaScript execution from any MCP client.
    MIT
  • F
    license
    Not graded
    quality
    D
    maintenance
    Drive your real, signed-in Chrome browser from any MCP client, enabling browser automation such as navigation, clicking, typing, and screenshots through standard MCP tools.
    1
    -
  • A
    license
    A
    quality
    A
    maintenance
    MCP server that lets AI agents drive your real Chromium browser with your existing signed-in sessions, providing visible, local, and inspectable automation for tasks like navigation, clicking, typing, and form filling.
    25
    1
    Apache 2.0
  • A
    license
    Not graded
    quality
    C
    maintenance
    MCP server that drives a user's real Chrome browser via a WebSocket-connected MV3 extension, enabling tab management, navigation, page interaction, screenshots, and script evaluation through natural language.
    5 npm
    MIT