Mode

Connection

When to use

Direct gateway (default)

Popup: Device ID + Token → wss://code-mcp.tuanm.workers.dev/ws/{id}

Remote agents over the internet; extension serves MCP itself, no local server

Local bridge

ws://localhost:7777/browser/ws + http://127.0.0.1:7777/mcp

File store (file_read, large downloads/uploads) or a plain local HTTP endpoint

Group

Tools

Discovery

snapshot, find, get, is, styles

Interaction

click, dblclick, type, fill, check, uncheck, select, hover, focus, press, drag, scroll, upload

Navigation

navigate, reload, back, forward, close, tabs, window, groups, history, bookmarks, session

Page reads

extract, execute, screenshot (image block), pdf, wait, highlight

Network & DevTools

network, intercept, har, ws, throttle, resources, coverage, pseudo, site_data, notify

State & debugging

store, cookies, storage, console, errors, status, file_read, extension

Emulation & control

emulate, set, perms, auth, webauthn, dialog, frames, touch, download, record

Media & narration

speak, transcript, paint

Vault

vault

Tool

Behavior

speak

Narrates each step via native speech synthesis (say/voices/stop/status; English-first). During session recording the voice is additionally routed into the WebM where the browser allows — speechSynthesis itself plays to the system speakers and cannot be captured by MediaRecorder

transcript

Caption bar for narrated text (show with duration_ms/position, clear, status) — always captured in recordings/screenshots even when the TTS voice cannot be routed into the audio track

paint

Draws arrows, boxes, circles, highlights and text labels on a fixed overlay (draw/clear/status) that is part of the page pixels, so annotations appear in recordings and screenshots

Action

Purpose

init, unlock, lock, status

Vault lifecycle

set, get, list, delete

Credential CRUD

fill

Fill a login form from the vault — secrets never leave the extension

auth (vault_name)

Supply HTTP Basic/Digest credentials from the unlocked vault instead of tool arguments

Suppressed

How

WebAuthn / passkey dialog (Windows Hello, security key, Okta/WAM)

A CDP virtual authenticator is armed before every agent click/navigation and survives the redirect, so a click that bounces into an Okta/Entra page which fires WebAuthn on load is answered inside the renderer

HTTP Basic/Digest prompt

Auth-challenge interception is enabled on the tab, so Chrome never renders its own prompt (auto-cancelled after 60 s instead of hanging)

Download Keep/Discard bubble + downloads shelf

Browser.setDownloadBehavior + downloads UI hidden whenever the debugger attaches

Action

Purpose

enable, disable, status

Install / remove / inspect the virtual authenticator for a tab

auto

Toggle the automatic guard above

add, list, remove, clear

Manage credentials (resident passkeys). add generates an ES256 key in-browser when private_key is omitted

Flag

Description

Default

--port <n>

Listen port

7777 or $PORT

--bind <addr>

Bind address

127.0.0.1

--token <s>

Require auth on /mcp and /files/*

none

--extension-token <s>

Require this token from the extension

none

--gateway <domain>

Link the MCP endpoint through a code-mcp-gateway

none

--id <uuid>

Gateway device id (overridden by the popup ID)

random

--files-dir <path>

Where downloaded/uploaded files are stored

./files

--allow-any-origin

DEV ONLY: skip the extension Origin check

off