Open an HTTP(S) page in a new session and return a compact full snapshot. Cancellation cleans up this opening attempt, including late-created pages, without closing sibling sessions or the shared browser. The browser stays warm for subsequent calls.

Read the page and mint a new snapshot_id. Scope to one CSS root with selector or the visible viewport with viewport_only to reach controls beyond a truncated page. Changing scope resets the diff baseline. Respect truncation and frame metadata. When secrets are configured, available_secrets lists aliases available for the observed frame and top-level origin; it contains no secret values.

Search the current frame for visible text, scrolling a page or one observed vertical scroll container in bounded steps. Use container_ref with its current snapshot_id for a virtual list. Returns a fresh viewport snapshot with actionable refs when found; found:false means no match within the searched range, not proof the whole application lacks it. This changes scroll position but does not click or submit.

Execute 1–20 ordered actions against a current snapshot. Optional post_checks run only after the whole batch completes, using this same snapshot's refs; they poll for asynchronous outcomes and return verification evidence in this call. A failed postcondition keeps completed effects, sets replan_required, and skips later queued tools. Ref checks fail if the document or node changes; use separate tab_verify after navigation. Use fill_secret with an observed ref and a secret alias from snapshot.available_secrets for configured credentials. Includes hover, double_click, explicit local-file upload, and click_xy in main-viewport CSS pixels after visual inspection (coordinates lack DOM identity guards). Default 30s action budget, maximum 60s; verification has a separate timeout. Stops on first action failure. A followed popup returns its snapshot and replan_required without running post_checks. Cancellation closes the session; completed effects remain.

Read bounded text, links or table data, optionally within a CSS selector. Returns truncation information when the result is limited.

Check 1–20 explicit assertions. For current input/textarea/select values, use kind:value with exactly one observed ref or CSS selector. Any ref requires the current snapshot_id; the same snapshot remains readable after act if no newer snapshot or document change replaced it. Text checks inspect visible page text, excluding raw form values. A successful click alone does not prove success.

Capture the current viewport, or the full page when explicitly requested. Images can contain visible page data. Returns an image and URL metadata.

List the sessions owned by this server. Does not launch a browser or discover unrelated user tabs.

Close one session owned by this server and release its resources. Unsaved changes in that session are lost.

Navigate within an existing session while retaining cookies and tabs. Supports goto, back, forward and reload. Returns a fresh snapshot; previous references are invalidated.

List, open, switch or close tabs within a session. Popups stay open and appear in snapshots; switch explicitly to work in them. Only this session's pages are accessible. Closing its last tab closes the session.

List downloads created by this session. Supply download_id to wait up to timeout_ms for completion. Completed results include an owned local artifact path. Pending is not completed; failed downloads set isError. Files remain after closing the session.

Arm a one-shot accept or dismiss response before the action that opens an alert, confirm or prompt. Optional prompt_text is entered only for that dialog. Unarmed dialogs are dismissed and reported as unsupported flow; check actual outcomes before retrying.

Save cookies, localStorage and IndexedDB to a private local artifact file for a later tab_open storage_state import. The file can contain credentials; state contents are not returned to the model. SessionStorage, extensions and open tabs are not saved.

Print the active page into a private local PDF artifact and return its path, SHA-256 and source URL. Files survive closing. Print layout can differ from the screen; inspect the artifact when layout matters.

Read named fields from observed DOM using selectors, validate strict JSON Schema draft-07, and return per-field source URL/selector/quote provenance. Supports text, attributes, current non-sensitive values, typed scalars and arrays. At most 30 fields, 20 matches per field, 100 total. Does not call a model or infer missing facts; hidden/password controls and truncated evidence are rejected.