frx-director-mcp
The frx-director-mcp server bridges powerful AI models (Claude/GPT) to the firefox-reverse browser's built-in reverse-engineering engine via MCP, offering two modes of operation:
Mode 1 – Delegate (cost-efficient): The strong model acts as director (sets goals, reviews conclusions) while a cheap worker model (DeepSeek, Qwen, GLM, etc.) executes all 44 browser engine tools. Token costs are split — the strong model only spends tokens on high-leverage decisions.
Mode 2 – Direct Drive: The strong model bypasses the worker and directly calls any of the 44 browser engine tools (e.g., signer_trace, jsvmp_trace, page_eval) using its own expertise, via agent_tools (discovery) and agent_call_tool (execution).
Core tools and capabilities:
frx_status– Preflight check: verify browser (Marionette) connectivity, worker model/provider config, and API key presence before starting.agent_start– Initiate a new reverse-engineering session, set target URL, working directory, and issue the first task to the worker.agent_wait_for_stop– Block-poll until the worker reaches a stage gate (supports 20–90 minute long-running turns).agent_read– Retrieve stage conclusions,progress.md/ledger.mdfiles, drift hints, and run log tails for director review.agent_state– Lightweight liveness snapshot (running/settled, step count, drift hint) without fullagent_readoverhead.agent_send– Core director action: append a guidance/correction message and trigger the next worker round.agent_set_mode– Toggle betweenassistmode (pauses at each stage gate for review) andautomode (unattended completion).agent_stop– Abort the current worker round immediately; progress is persisted to disk.agent_runlog– Access engine-level diagnostics (request/response timing, retries, idle watchdog, drift detection) to distinguish genuine dead-ends from model drift or timeouts.
Additional notes: The server operates entirely on local loopback, never handles API keys directly (configured in the browser), and is site-agnostic. It uses Marionette by default but can switch to a file-based bridge for alternate setups.
Provides tools for controlling a Firefox-based browser's built-in reverse-engineering Agent, enabling automated browser reverse engineering tasks such as packet capture, signature tracing, and script verification.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@frx-director-mcpstart reverse engineering the login flow on example.com"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
frx-director-mcp
两种模式驱动浏览器逆向 —— ① 强模型领航 · 低模型实操 ② 强模型带自建经验库 · 亲自直驱
EN — TL;DR: An MCP server bridging a high-capability model (Claude / GPT) to the firefox-reverse browser's built-in reverse-engineering engine. Two composable modes: (1) Delegate — the strong model directs while a cheap worker (DeepSeek / Qwen / GLM) executes all tooling (token cost-split); (2) Direct-drive — the strong model uses its own skill / experience library and calls the 68 browser tools itself via
agent_call_tool. It can also manage isolated fingerprint environments and signed Firefox extensions. Never touches your API key (configured once in the browser).
frx-director-mcp 是一个 MCP 服务,把强模型(Claude / GPT)通过标准 MCP 协议接到 firefox-reverse 浏览器内置的逆向引擎上。两种可自由组合的模式:
模式一 · 领航委派(高模型配置、低模型调用):强模型当 director 只下方向、审结论;便宜的 worker 模型(DeepSeek-flash / Qwen-turbo / GLM)在浏览器里执行全部工具(抓包、签名追踪、补环境、脚本验证…)。token 天然拆分——强模型的判断力用在最高杠杆点,重复执行交给低成本模型;worker 复用浏览器内置的逆向方法论。
模式二 · 经验库直驱(高模型带自建经验库、亲自调用):强模型用自己的经验库 / 技能(skill)/ 方法论,通过
agent_call_tool亲自直调浏览器的 68 个工具(signer_trace/jsvmp_trace/closure_read/page_eval/ 环境管理 / 扩展管理 / Skills…),跳过 worker。更快更准、可注入你自己的逆向经验;代价是每个工具回合花强模型的 token。
两种模式共用同一套桥接与浏览器引擎,可按任务、按步自由切换。0.3.0 起还可通过 MCP 管理 Firefox-Reverse 指纹环境(列表、新建、打开、关闭、导入采集 JSON),用 FRX_ENV_ID 启动指定独立 profile。0.3.2 起为 CLI 主模型补齐 agent_poll / agent_read_brief,避免 agent_start 后主模型停住不读结果。0.3.3 起修正三端自启动的 Marionette 端口传递方式。服务本身零站点逻辑、不接触任何 API Key(Key 仅在浏览器侧配置)。
目录
两种模式 · 工作流程 · 系统架构 · 快速开始 · 一键使用 · 工具参考 · 安全与约束 · 开发
Related MCP server: open-computer-use
两种模式
模式一 · 领航委派 | 模式二 · 经验库直驱 | |
谁执行工具 | 便宜的 worker 模型(浏览器内) | 强模型自己(经 MCP 直调) |
强模型角色 | 下方向 / 审阶段结论 | 亲自调用每个工具 |
经验 / 方法论来源 | 浏览器内置 skill(worker 用) | 强模型自带的经验库 / skill |
token 开销 | 低(每轮读结论 + 写一条方向) | 高(每个工具回合都花强模型 token) |
适合 | 长任务、省钱、worker 够用 | 强模型本身懂逆向、要更快更准、要带自己的经验库 |
关键工具 |
|
|
模式一(默认,省钱主路) 是结构性的成本拆分:强模型只在最高杠杆点介入,assist(AI 辅助阶段门)强制 worker 每阶段产出可审阅结论,让强模型尽早拦截错误路线。
模式二(0.2.0 起,opt-in 增益) 把浏览器的 68 个工具直接暴露给强模型:先 agent_tools 看清能力与参数,再 agent_call_tool 亲自直调。强模型可带自己的逆向经验库 / skill(例如把一套方法论作为 system prompt),用引擎级工具(页面检测不到)一步步控制浏览器。
两者不是二选一:可以同一会话里简单步骤亲自
agent_call_tool快跑、繁重重复步骤agent_start委派 worker。唯一约束:同一浏览器同一时刻只跑一种——agent_call_tool在有 worker 会话运行时会被拒绝(与 agent 共享标签页 / hook / trace 状态,并发会串味),先agent_stop/agent_wait_for_stop再直调。
工作流程
模式一 · 领航委派(强模型下方向、worker 执行):
强模型 director (Claude / GPT) firefox-reverse 浏览器
┌───────────────────────┐ MCP / stdio ┌──────────────────────────────┐
│ ① agent_start 下目标 │ ─────────────────▶ │ worker 模型(便宜)执行 68 工具 │
│ ② agent_poll 短轮询 │ │ 抵达阶段门 → 产出阶段结论 │
│ ③ agent_read_brief/read│ ◀───────────────── │ │
│ ④ agent_send 纠方向 │ ─────────────────▶ │ 按新方向继续 │
└───────────────────────┘ └──────────────────────────────┘
└──────────── 循环 ②~④,直到产出可独立运行的结果 ────────────┘强模型每轮只消耗少量 token(读结论 + 写一条方向);worker 承担全部工具执行。
模式二 · 经验库直驱(强模型带自己的经验库、亲自调每个工具):
强模型 (Claude + 自建经验库/skill) firefox-reverse 浏览器
┌───────────────────────┐ MCP / stdio ┌──────────────────────────────┐
│ ① agent_tools 看能力 │ ─────────────────▶ │ 返回 68 工具的名/参数/说明 │
│ ② agent_call_tool 直调 │ ─────────────────▶ │ 引擎级 dispatch → 工具信封 │
│ (signer_trace/ │ ◀───────────────── │ (与内置 Agent 同一套引擎) │
│ page_eval/…) │ │ │
└───────────────────────┘ └──────────────────────────────┘
└── 强模型用自己的判断+经验库,逐个工具推进,无需 worker ──┘强模型直接掌舵引擎工具:更快更准、可注入自己的逆向经验;代价是工具回合的 token 由强模型承担。
系统架构
director (Claude / GPT)
│ stdio (MCP)
▼
frx-director-mcp ──── 21 tools ──── BrowserBridge(Marionette 默认 / File 备用)
│ 模式一: agent_start/send/read… │ 模式二: agent_tools + agent_call_tool
│ │ TCP 127.0.0.1:2828 · chrome-context ExecuteScript
│ 每会话 convo / turnlog ▼
│ ChromeUtils.importESModule(AgentSession.sys.mjs)
▼ │ run / getState / stop
本地工作目录 agentSession 单例(firefox-reverse 父进程常驻)
▼
内置逆向 Agent(worker 模型)+ 工作目录 ledger.md / progress.md桥接层(BrowserBridge)是抽象接口,默认实现走 Marionette;可切换至 FileBridge 作为备用通道,工具层无需改动。
快速开始
前置条件
安装 firefox-reverse 浏览器,并在其 Agent 设置中为一个便宜的 worker 模型配置 API Key(DeepSeek / 通义千问 / GLM 等;本服务不接触该 Key)。
💡 worker 模型选型(重要):走 MCP 驱动这种长工具循环时,务必选标准 / 快速档,推荐
deepseek-v4-flash—— 实测零漂移、约 2–3 分钟/阶段、配合最顺。切勿用推理档(如deepseek-v4-pro):推理档在长工具循环里易退化成「只吐纯文本计划、不再调用工具」而中断,是 worker 的首要失败模式。可在浏览器 Agent 设置里把默认 worker 设为该档,或在agent_start({ model: "deepseek-v4-flash" })里临时指定(同一个 Key、无需改配置)。以 Marionette + 系统权限启动浏览器(chrome 上下文执行特权 JS 所必需)。macOS 推荐走
.app的 LaunchServices 启动链路:open -n -a "/Applications/Firefox Reverse.app" --args \ -marionette -remote-allow-system-access -no-remote \ -profile "<你的 profile>"Windows / Linux 可直接用 Firefox Reverse 可执行文件带同样参数启动。默认 Marionette 端口是
2828;自定义端口请配置FRX_MARIONETTE_PORT并使用自动拉起,启动器会通过官方 pref/环境变量传入。也可以配置FRX_AUTOLAUNCH=1+FRX_FIREFOX_BIN+FRX_PROFILE,由本服务自动拉起;macOS 下FRX_FIREFOX_BIN可指向/Applications/Firefox Reverse.app或.app/Contents/MacOS/firefox,MCP 会自动转换为open -n -a ... --args。Node.js ≥ 18。
方式一:让 AI 自动安装(推荐)
在你的 AI 编码工具(Cursor / Claude Code / Codex 等)对话框中输入:
帮我安装并配置这个 MCP 工具:frx-director-mcp 项目地址:https://github.com/WhiteNightShadow/frx-director-mcp
AI 将自动完成 克隆 → 安装依赖 → 构建 → 写入客户端 MCP 配置 的全过程。
方式二:手动安装
git clone https://github.com/WhiteNightShadow/frx-director-mcp.git
cd frx-director-mcp
npm install && npm run build # 产物:dist/index.js将以下条目加入你客户端的 MCP 配置(<安装路径> 替换为实际路径):
{ "mcpServers": { "frx-director": {
"command": "node",
"args": ["<安装路径>/frx-director-mcp/dist/index.js"]
} } }{ "mcpServers": { "frx-director": {
"command": "node",
"args": ["<安装路径>/frx-director-mcp/dist/index.js"]
} } }claude mcp add frx-director -- node <安装路径>/frx-director-mcp/dist/index.js可选环境变量(均有默认值;方式一会由 AI 自动填写,完整说明见 .env.example):
变量 | 说明 |
| Marionette 端口,默认 |
| 指向 firefox-reverse 的 |
| 会话工作目录根。默认放在 firefox-reverse 仓库旁 |
| MCP 自身状态(convo / turnlog,非逆向产物),默认 |
| 由本服务自动拉起带 Marionette 的浏览器;macOS 自动使用 |
| 绑定并启动指定 Firefox-Reverse 环境;默认环境根目录为 |
📂 逆向产物在哪里? 工作目录归属 firefox-reverse 项目、而非 MCP 工具自身。默认每个会话的目录是
<firefox-reverse 仓库旁>/firefox-reverse-ws/<会话id>/(从FRX_JSX_PROMPT_SRC推断仓库位置;推断不出则~/firefox-reverse-ws/<会话id>/)—— 抓取的脚本、还原代码、ledger.md/progress.md都落在这里,与你从哪个目录启动无关;agent_start/agent_read的返回也会带上该会话的具体路径。要改位置,设FRX_WORKSPACE_ROOT即可。
工具接入自检
外部 AI/CLI 成功加载本 MCP 后,顶层可调用工具中应至少出现
frx_status、agent_tools、agent_call_tool和frx_env_list。notes_add、net_get、page_click、run_node、fs_*属于 Firefox Reverse 浏览器内核工具:先调用agent_tools查看目录,再通过agent_call_tool({ name, args })直调;它们不会全部展开成顶层 MCP 函数。Firefox Reverse v0.24.0 起,
agent_tools应返回count:68、missingDeclared:[],其中addons_query用于搜索 AMO/查看已安装扩展,addons_manage用于签名安装、启停、卸载和打开配置页。如果本轮函数列表里只有
open_url,说明看到的是外部宿主自己的工具,本 MCP 尚未完成初始化;open_url不属于 Firefox Reverse 或 frx-director-mcp。先查看 MCP stderr / 客户端日志,并确认 Node、MCP 命令和环境变量配置。v0.3.6起,MCP 会先完成 stdio 握手和工具注册,再解析FRX_ENV_ID、分配端口、等待 Windows 冷启动与 Marionette;即使环境配置或浏览器启动失败,frx_status仍会保留并返回具体诊断。
一键使用(两种模式)
挑一种模式,将对应整段原样复制作为首条消息发给你的强模型;它会自动完成环境自检、引导你补齐配置、向你询问目标,并按该模式驱动逆向。
模式一 · 领航委派(省 token,worker 干活)
你现在通过一个叫 frx-director 的 MCP,指挥 firefox-reverse 浏览器里的内置逆向 Agent。
你是专业的 Web 端爬虫 / 签名逆向工程师,只负责【方向决策】,不亲自调用浏览器工具——所有工具执行由浏览器里那个便宜的 worker 模型完成,你只读它的阶段结论、给方向。成本拆分:你(强模型)每轮只花少量 token 审阅结论 + 写一条方向;便宜的 worker 承担全部工具执行。
【第 0 步 · 环境自检】先调用 frx_status。
- ready=true → 进入下面流程。
- bridgeConnected=false 或 hasKey=false → 把返回的 note 用一句话告诉用户、引导其补齐(用 -marionette 启动浏览器,或在浏览器 Agent 设置里为一个便宜 worker 模型如 qwen-turbo / deepseek-v4-flash 配置 Key);待其完成后再次 frx_status 确认,再继续。
【第 1 步 · 明确目标】若用户尚未提供目标,向其索取以下 4 项:
① 站点 URL(能观察到目标请求的页面) ② 接口 URL(要复现的请求) ③ 目标参数(要还原的签名 / 加密参数名) ④ 输出目标(通常为:Node.js 黑盒复刻、脱离浏览器独立请求成功)。
【第 2 步 · 启动】agent_start({task:"将上述 4 项整合为清晰任务", targetUrl:"站点 URL"});返回 tid,后续均使用它。
在 task 中给出你的判型与方法建议:简单站点优先 hook 比对标准算法、不必硬扣混淆;JSVMP 不逆字节码、走黑盒补环境;不臆测函数名,先 signer_trace 抓取真实入参。
【第 3 步 · 等待与审阅】
CLI/命令行客户端优先循环调用 agent_poll({tid, timeoutSec:60, intervalSec:5})。
- phase:"running" → worker 仍在执行,不是失败;继续 agent_poll,或改用 agent_wait_for_stop 长等待。
- phase:"settled" → 先使用返回里的 brief;若需要完整产物再 agent_read({tid, includeProgressFile:true})。
- phase:"error" 或 no-state → agent_read_brief({tid}) + agent_runlog({tail:30}) 做诊断。
支持长等待的客户端也可直接 agent_wait_for_stop({tid});settled 后用 agent_read_brief 或 agent_read 读取结论。
★采信结论前务必查看 driftHint:勿将「模型漂移为纯文本 / idle 超时」误判为「路线确属不通」(worker 的首要失败模式)。
【第 4 步 · 方向修正】agent_send({tid, guidance:"..."}) 写一条具体、有序、可防止走弯路的指令,例如:
「仅执行第 1+2+3 步」「每步先验证再进入下一步」「先完成两个简单目标、勿过早深入最难的 JSVMP」「输出不匹配通常是输入未喂对,勿转向字节级逆向」「仅回报这 3 项」。
同时识别其自相矛盾(日志显示成功却写为失败)、拦截其臆断(如「换一个 bundle 就要换密钥」)。
【第 5 步 · 循环】重复第 3–4 步,直至产出可用结果(Node 独立请求目标接口、返回有效业务数据)。
当路线已锁定、仅剩机械收尾时,可 agent_set_mode({tid, mode:"auto"}) 让 worker 无人值守完成;若卡住再切回 assist。
若发现其正驶向错误路线,agent_stop({tid}) 中止后再以 agent_send 修正(进展已持久化,中止不丢失)。
现在开始:先调用 frx_status。模式二 · 经验库直驱(强模型亲自调工具,可带你自己的逆向经验库)
适合用懂逆向的强模型(如 Claude)+ 你自己的方法论 / skill。把你的经验库(一套逆向方法论、站点经验、判型规则…)放在这段之前或作为 system prompt 一并给模型;它将用
agent_call_tool亲自驱动浏览器。
你现在通过一个叫 frx-director 的 MCP,亲自直驱 firefox-reverse 浏览器的逆向引擎工具(直驱模式,不经 worker)。
你是资深 Web 逆向工程师,按【你自己的经验库 / 方法论】判型与决策,并亲手调用浏览器引擎工具完成逆向。
【第 0 步 · 环境自检】先调用 frx_status。bridgeConnected=false → 引导用户用 -marionette 启动浏览器后重试。
注意:直驱模式只用浏览器引擎工具、不需要 worker 模型的 Key(hasKey=false 也能直驱)。
【第 1 步 · 看清能力】调用 agent_tools,记下 68 个工具的 name 与参数;重点关注引擎级 trace、页面、文件、Skills、环境管理与扩展管理能力
(signer_trace / jsvmp_trace / closure_read / webapi_trace / whitebox_diff / wasm_probe / crypto_scan 等,页面检测不到)。
【第 2 步 · 明确目标】若用户未给,索取:① 站点 URL ② 接口 URL ③ 目标参数(签名/加密参数名)④ 输出目标(通常 Node 黑盒复刻、脱离浏览器请求成功)。
【第 3 步 · 亲自直驱】用 agent_call_tool({name, args}) 按你的方法论逐步推进,例如:
- page_navigate 到站点 → net_capture 抓目标请求 → 看签名参数长相判型;
- 标准算法优先 hook 比对(signer_trace / page_eval 装 hook 记入参出参 → 本地标准库比对),不硬扣混淆;
- JSVMP 不逆字节码、走黑盒补环境;闭包真值用 closure_read;WASM 用 wasm_probe;
- 扩展先用 addons_query 搜索/查看状态,再用 addons_manage 管理生命周期或打开配置页;
- run_node 在工作目录里跑复刻、字节级比对自证;fs_write 落产物。
每次直调读返回信封(ok/data/error),据此决定下一步——这就是你的工具循环。
【约束】① 同一时刻只跑直驱:别再 agent_start 起 worker(会与直调抢同一标签页被拒)。
② 最终产物要能脱离浏览器独立运行(Node 补环境/纯算);浏览器只作分析与验证。
现在开始:先调用 frx_status,再 agent_tools。工具参考
通用
工具 | 说明 |
| 首先调用 —— 自检:Marionette 是否连通、当前 worker provider / model、Key 是否已配置;未就绪时返回引导说明 |
| 动态列出当前浏览器实际注册的 68 个工具(名称 / 说明 / 是否需确认 / 参数名),包含引擎级逆向工具( |
指纹环境管理
工具 | 说明 |
| 查看当前连接环境与本机环境列表 |
| 新建与内核一致的 Firefox 环境(默认中国大陆简体中文),或重命名已有环境 |
| 打开、关闭、删除独立 profile + 独立进程环境 |
| 导入完整环境 JSON 或外部浏览器采集到的 fingerprint JSON |
| 扫描当前页常见自动化暴露点,辅助比较手动启动与 MCP 启动差异 |
模式一 · 领航委派(强模型下方向,worker 执行)
工具 | 说明 |
| 创建会话:绑定工作目录、选择 AI 辅助模式、导航至目标、下达首轮任务(仅校验 |
| CLI 友好的短轮询:默认最多等 60 秒,仍在跑返回 |
| 阻塞至 worker 抵达阶段门( |
| 简短读取阶段结论,默认不带 |
| 读取阶段结论 + |
| 轻量存活 / 进度快照 |
| 委派模式核心动作 —— 携带上轮结论、追加方向指令、发起下一轮 |
| 在 |
| 中止当前轮(进展已持久化至工作目录,不丢失) |
| 引擎级运行日志,用于区分「确属路线不通」与「模型漂移 / idle 超时」 |
模式二 · 经验库直驱(强模型带自建经验库,亲自调用)
工具 | 说明 |
| 直驱核心动作 —— 强模型亲自直调一个浏览器引擎工具(跳过 worker)。先 |
Firefox 扩展直驱(Firefox Reverse v0.24.0+)
agent_call_tool({name:"addons_query", args:{action:"search", query:"Violentmonkey", limit:5}})
agent_call_tool({name:"addons_query", args:{action:"list"}})
agent_call_tool({name:"addons_manage", args:{action:"install", ref:"violentmonkey", confirm:true}})
agent_call_tool({name:"addons_manage", args:{action:"open_options", id:"扩展 GUID"}})安装来源仅接受 AMO 标识,Firefox 会校验哈希、兼容性、阻止列表和签名状态;安装与卸载必须显式传 confirm:true。系统/内置扩展不可修改,扩展配置页打开后继续使用 page_info / page_elements / page_click / page_type 操作。
📝 版本更新记录
v0.3.7(2026-09-03)
68 个浏览器工具说明同步:README 与
agent_tools描述同步 Firefox Reverse v0.24.0,明确 23 个顶层 MCP 编排工具和 68 个浏览器工具的边界。扩展管理直驱说明:补充
addons_query/addons_manage的搜索、列表、签名安装和配置页示例,以及确认与系统扩展保护边界。协议保持兼容:仍由
agent_tools动态读取浏览器真实注册表,旧浏览器返回其自身工具数量;本版不改变启动、会话、环境或 Marionette 协议。
v0.3.6(2026-08-20)
环境解析也不再阻塞注册:新增延迟浏览器桥,
FRX_ENV_ID读取、环境端口分配和真实 Bridge 创建全部移到 MCPinitialize/tools/list之后;彻底消除环境目录或端口探测拖慢外部宿主握手的剩余竞态。未就绪调用快速失败:浏览器桥尚在解析时,工具调用立即返回
startup.phase=resolving/starting,不会把单次 MCP 请求挂在几十秒冷启动后面。历史结论:启动握手阻塞从 MCP 初版就存在,旧静态
agent_tools在首次引入时也只返回 36/44 个有说明工具;v0.23 的独立 profile 冷启动与 66 工具扩容只是让旧问题更容易显现,并非 Firefox v0.23 新删了工具。回归扩展:新增延迟桥单测及
FRX_ENV_ID解析失败进程级测试,并继续要求 Windows / Ubuntu 双平台 CI。
v0.3.5(2026-08-20)
Windows 冷启动工具注册修复:MCP stdio 握手和固定工具注册提前到 Firefox 自动拉起 / Marionette 端口等待之前,避免浏览器启动几十秒时被外部 CLI 判定 MCP 启动超时、最终只剩宿主自带的
open_url。浏览器工具目录补全:
agent_tools改为读取浏览器实际 backend 注册表,修复旧静态 stub 只返回 38/66 个工具的问题;新增missingDeclared一致性诊断。失败保持可诊断:
FRX_FIREFOX_BIN、FRX_ENV_ID或浏览器启动配置错误不再直接退出 MCP;frx_status返回mcpToolsRegistered与startup.phase/error,用户修正浏览器配置后可明确复查。进程级回归测试:真实启动 MCP stdio 子进程,在故意破坏 Firefox autolaunch 的情况下验证
initialize/tools/list仍成功,且包含frx_status、agent_tools、agent_call_tool、不包含外部宿主的open_url。
v0.3.4(2026-07-29)
Firefox-only 环境创建:
frx_env_create不再接受浏览器内核类型,新环境始终使用与 Firefox Reverse 内核一致的 Firefox 指纹。中文地区参数:新建环境默认中国大陆简体中文,并支持传入
language、languages、locale和timezone自定义地区组合。兼容历史环境:已有环境的指纹文件和 profile 不会因 MCP 升级而自动修改;新增测试覆盖默认值、自定义值和旧环境兼容路径。
v0.3.3(2026-07-13,main 补丁)
Marionette 端口修复:移除 Firefox 153 不识别的
--marionette-port启动参数,改用MOZ_MARIONETTE_PREF_STATE_ACROSS_RESTARTS注入marionette.port,保证 Windows、macOS、Linux 以及多指纹环境使用各自端口。启动文档纠正:手动启动示例不再展示无效参数;自定义端口统一通过
FRX_MARIONETTE_PORT+FRX_AUTOLAUNCH=1配置。
v0.3.2(2026-07-07,main 补丁)
CLI 委派闭环增强:新增
agent_poll,把「短等待状态」和「settled 后简短读取」合成一个动作,降低 GPT/CLI 在agent_start后停住不读结果的概率。简短结果读取:新增
agent_read_brief,默认只读最近 5 步与 2000 字阶段结论,不加载progress.md/ledger.md,避免大输出让命令行主模型卡住或跳步。流程提示增强:
agent_start、工具描述和一键提示词补充agent_start → agent_poll/agent_wait_for_stop → agent_read_brief/agent_read的推荐闭环,不做底层硬拦截,保留外部编排、人工检查和长等待客户端的自由度。
v0.3.1(2026-07-07,main 补丁)
三端 autolaunch 加固:
FRX_AUTOLAUNCH=1启动时先检查 Marionette 端口,启动后等待端口 ready,不再把spawn成功误判为浏览器可用。macOS 启动修复:当
FRX_FIREFOX_BIN指向/Applications/Firefox Reverse.app或.app/Contents/MacOS/firefox时,自动转换为open -n -a "...app" --args ...,避免直接拉二进制导致 Firefox Reverse 短暂启动后退出。profile 锁处理:启动前检测
.parentlock/parent.lock/lock;确认没有真实进程占用时才清理 stale lock,避免误删正在使用的 profile 锁。失败诊断增强:记录启动方式、启动命令、早退
exitCode/signal/stderr、锁文件清理情况;frx_status与 MCP stderr 提示改为明确指出 profile 占用、端口不可达或浏览器早退。本地验证:新增 launcher 单测覆盖 macOS LaunchServices 与 Windows/Linux 直接可执行路径,并用临时 profile 实测 macOS autolaunch 可正常拉起 Marionette。
v0.3.0(2026-07-07)
Firefox-Reverse 环境管理:新增
frx_env_current/list/create/rename/open/close/delete/import_json/import_capture,可通过 MCP 管理指纹环境。指定环境启动:支持
FRX_ENV_ID/FRX_ENVS_ROOT,读取环境env.json后使用独立 profile、指纹配置、代理配置、trace 目录与 Marionette 端口启动。自动化暴露扫描:新增
frx_page_automation_scan,用于比较 MCP 启动与手动启动时的 WebDriver、UA-CH、plugins、permissions、WebGL/canvas/audio/WebRTC/storage 等暴露点。兼容旧模式:未设置
FRX_ENV_ID时继续沿用FRX_PROFILE,保留原有委派模式与直驱模式。
v0.2.x
直驱模式:新增
agent_tools/agent_call_tool,强模型可以跳过 worker,亲自调用浏览器内置逆向工具。长任务稳定性:强化阶段等待、运行日志、漂移提示和会话读取能力,降低长工具循环中断概率。
安全与约束
不接触 API Key —— Key 仅在浏览器侧配置;
agent_start仅校验hasKey布尔值;运行日志归档对疑似 Key 做脱敏处理。本地回环 —— Marionette 端口(2828)仅绑定
127.0.0.1,请勿对外暴露:能连接该端口者即拥有agentSession的全部能力(含page_eval/ 文件写入 /run_node)。站点无关 —— 本服务仅负责「驱动 + 读取状态」,不含任何站点逻辑或算法。
桥接机制 —— 经 Marionette 在 chrome 上下文中
importESModule命中父进程单例(newSandbox:false)。若未来 Firefox 构建破坏此路径,可切换FRX_BRIDGE=file使用FileBridge备用通道。
开发
npm run dev # tsx 直接运行 src/index.ts
npm run typecheck # tsc --noEmit
npm test # vitest(mock 桥接 + mock Marionette 服务,无需真实浏览器)技术栈:TypeScript(strict、NodeNext)+ 官方 @modelcontextprotocol/sdk,stdio 传输。源起于实战工具 frx_drive.py(经 Marionette 编程驱动 firefox-reverse 内置 Agent),将其子命令封装为标准 MCP 工具,并修复了 4 处经实测验证的缺陷:等待超时上调至 5400s 且「超时 ≠ 失败」、仅以 settled 判定阶段结束、agent_read 折入 drift / runlog 信号、fire‑and‑forget 后重新轮询确认启动。
License
本项目为 firefox-reverse 的配套工具,遵循同一项目的授权与使用声明 —— 仅供安全研究、接口对接与授权测试,请在合法授权范围内使用。
Available Tools
23 toolsagent_call_toolDirectly run ONE browser tool (bypass the worker)A
★你(director)亲自跑一个浏览器引擎工具,跳过 DeepSeek worker —— 强模型直驱引擎级工具,比委派 worker 磨更快更准。代价:每个工具回合都花 director 的 token(打破默认成本拆分;按需用、不用就仍走 agent_start/agent_send 省钱流)。先 agent_tools 查 name 和参数。返回工具信封(ok/data/error);浏览器侧 dispatch 永不抛、已校验未知工具与缺参。⚠ 任一会话(agent_start 起的)正在跑时会被拒绝:raw 直调与运行中的 agent 共享同一标签页/hook/trace 状态,并发会串味——先 agent_stop/agent_wait_for_stop 再直调。需浏览器 v0.20.0+。
| Name | Required | Description | Default |
|---|---|---|---|
| args | No | 该工具的参数对象(按 agent_tools 给的 params 填);省略=空对象 | |
| name | Yes | 工具名(来自 agent_tools),如 code_search / signer_trace / page_eval / addons_query / addons_manage | |
| workspaceRoot | No | 本次调用的工作目录绝对路径(影响 fs_*/run_node/trace 落盘);省略=引擎默认 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations supplied, the description carries the full burden and does so well. It discloses token cost, the ok/data/error envelope, never-throw dispatch behavior, validation of unknown tools/missing args, concurrency rejection, and the minimum browser version.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is dense but well-organized: purpose, cost tradeoff, prerequisites, return envelope, and concurrency warning each earn their place. The warning is clearly marked and front-loaded enough to prevent misuse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite having no output schema, the description covers invocation semantics, error model, concurrency constraints, version requirements, and discovery flow. This is complete for a generic direct-dispatch tool with three parameters.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3. The description adds value by telling the agent to populate args per agent_tools params and clarifying that workspaceRoot affects fs_*/run_node/trace persistence, which reinforces the schema rather than merely repeating it.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action: directly run one browser engine tool, bypassing the DeepSeek worker. It clearly distinguishes this from delegation-based sibling tools like agent_start and agent_send, so an agent can select it correctly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly tells the agent to look up names/params via agent_tools first, to prefer agent_start/agent_send for cost-saving flows, and to stop any running agent session before direct calls. This is strong when-to-use and when-not-to-use guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
agent_pollShort-poll a worker turn for CLI clientsA
CLI 友好的短轮询:最多等 30-120 秒查看 worker 是否 settled,避免一次 agent_wait_for_stop 长等 5400s 导致命令行无进度。默认 timeoutSec=60、intervalSec=5; 若 settled 且 readOnSettled 未设 false,会自动附带 brief 结论。agent_start 后推荐优先循环调用它。
| Name | Required | Description | Default |
|---|---|---|---|
| tid | Yes | ||
| stepTail | No | settled 后 brief 返回最近多少步,默认 5 | |
| timeoutSec | No | 默认 60 秒;CLI 建议 30-120 | |
| intervalSec | No | 默认 5 秒 | |
| contentChars | No | settled 后 brief content 上限,默认 2000 | |
| readOnSettled | No | 默认 true;settled 后自动带 agent_read_brief 结果 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It explains automatic behavior (settled + readOnSettled), default values, and the benefit of avoiding long waits. However, it lacks details on error states, side effects (if any), and safety of repeated calls.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise, front-loaded with the English title, and the full text in Chinese is informative with no superfluous sentences. Every sentence adds value, making it efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Without an output schema, the description partially covers return value (brief conclusion if settled) but does not specify exact format or structure. Given tool complexity (6 params, 1 required), it is mostly complete but lacks explicit return specification.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 83% (high), baseline 3. The description adds context beyond schema: explains tid requirement, default timeoutSec=60 and intervalSec=5, and the effect of readOnSettled and stepTail/contentChars on response. This enhances understanding.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it is a 'short-poll' for a worker turn, specifically for CLI clients, and distinguishes itself from the long wait of agent_wait_for_stop (5400s). The verb 'short-poll' and resource 'worker turn' are specific, and the purpose is unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly recommends calling it in a loop after agent_start, contrasts with agent_wait_for_stop, and suggests timeout ranges (30-120s). It provides usage context for CLI clients but could be more explicit about when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
agent_readRead the worker's stage conclusionA
读 worker 的阶段结论(①发现 ②2-3 方向 ③推荐)给 director 评判:含完整 content 尾、步骤尾、工作目录 progress.md/ledger.md(worker 真正依赖的持久知识),以及 ★driftHint + runlogTail——assist 模式下任何'纯文字无工具'都被强制成 final,真结论和模型漂移经 getState 分不开,所以读结论时必须看 driftHint/runlog 的 finishReason,别把 drift/idle-timeout 当成真的'路线走不通'(这是 worker 头号失败模式)。只读、可反复调。
| Name | Required | Description | Default |
|---|---|---|---|
| tid | Yes | ||
| stepTail | No | 回传最近多少步,默认 16 | |
| contentChars | No | 结论文本回传上限,默认 4000 | |
| includeProgressFile | No | 默认 true=带上 progress.md/ledger.md |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description carries full burden. Discloses read-only nature, repeatable calls, and internal content. Highlights critical failure mode (confusing drift with conclusion). Does not cover permissions or all failure modes, but sufficient.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with purpose, then details. Slightly long but every sentence adds value. Could be more concise but still effective.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema, but description explains return contents (content tail, step tail, progress files, driftHint, runlog). Covers read-only and repeatable use. Lacks explicit return format but complete enough for tool usage.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 75% (3 of 4 params described). Description adds context for stepTail (max steps) and contentChars (text limit), but does not introduce new semantics beyond schema. driftHint/runlog advice is behavioral, not parameter-specific.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states it reads the worker's stage conclusion, listing included elements (content tail, step tail, progress.md/ledger.md, driftHint, runlogTail). Distinguishes from sibling tools like agent_send (sends messages) and agent_runlog (reads runlogs).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says when to use (read conclusion for director judgment) and warns about misinterpreting driftHint/runlog. States it is read-only and callable repeatedly, implying no side effects. Lacks explicit alternatives but context suffices.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
agent_read_briefRead a compact worker conclusionA
CLI 友好的简短读取:等价于 agent_read({includeProgressFile:false, stepTail:5, contentChars:2000})。用于 settled 后快速把 worker 结论交给主模型,避免 progress.md/ledger.md 或大 steps 输出让某些 CLI 卡住。
| Name | Required | Description | Default |
|---|---|---|---|
| tid | Yes | ||
| stepTail | No | 默认 5 | |
| contentChars | No | 默认 2000 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description transparently reveals it is an alias for agent_read with specific arguments (includeProgressFile:false, stepTail:5, contentChars:2000). It explains the behavioral trait of avoiding large outputs to prevent CLI blockage, providing sufficient context for an agent without annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences convey the tool's nature and use case with zero wasted words. Information is front-loaded and efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simple read operation with no output schema, the description adequately covers the tool's purpose. It could explicitly state the return value (the conclusion text), but the title and equivalence to agent_read imply it. Overall, it is sufficiently complete for an agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Two of three parameters have schema descriptions. The description adds the equivalent call parameters (includeProgressFile:false) but doesn't elaborate beyond defaults. Schema coverage is moderate, and the description provides some context but not extensive value beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it reads a compact worker conclusion via a specific parameterization of agent_read. It distinguishes itself from agent_read by being CLI-friendly and avoiding large outputs, making its purpose unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description specifies usage after 'settled' and for quickly giving the main model a conclusion, avoiding progress.md/ledger.md or large steps. While not explicitly listing when not to use it, the context implies it's for lightweight reads, with agent_read as the alternative.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
agent_runlogEngine run log (diagnostic)A
引擎级 run 日志(getRunLog):请求/响应时序、重试、idle 看门狗超时、finishReason、drift 检测。诊断用——让 director 区分'worker 真的判定路线走不通' vs '模型侧 drift / idle 超时 / 推理档模型(如 deepseek-v4-pro)吐了纯文字计划没调工具',下结论前先核它。
| Name | Required | Description | Default |
|---|---|---|---|
| tid | No | 省略=全部 run 记录 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided; the description carries full burden. It describes the log contents but does not explicitly state that the tool is read-only or has no side effects. The behavior is implied as safe, but lack of explicit safety declarations is a gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with a bullet-like list, but it is somewhat lengthy and complex. It could be more structured for easier parsing by an AI agent, though no extraneous information is present.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with no output schema, the description lists the log contents (timing, retries, etc.) which provides basic completeness. However, it lacks details about output format, pagination, or how to interpret results, which are important for a diagnostic tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% (one optional parameter 'tid'). The description does not add meaning beyond the schema's description. Baseline score of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it provides engine-level run logs for diagnostic purposes, listing specific content types (timing, retries, timeouts, etc.). It subtly distinguishes itself from sibling agent action tools by its diagnostic nature, but does not explicitly compare.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states when to use: before drawing conclusions about tool execution failures, to differentiate between worker decision and model-side issues. Implicitly avoids usage for non-diagnostic tasks, but does not list alternatives or exclusion criteria.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
agent_sendSend a direction correction (the director's core move)A
★director 的核心动作:把方向纠正作为下一条 user 消息发出去并起下一轮(=harness 的 advance)。服务端会:把 worker 上一轮的【完整】最终结论作为 assistant 轮接上(上一轮空/被停则合成占位,保证 user/assistant 交替合法)→ 追加你的 guidance 作为新 user 轮 → 持久化 → 以当前模式重跑。若还有一轮在跑会拒绝(先 wait 或 stop)。guidance 写得像真人纠正:具体、有序、'只做第 1+2+3 步'、'每步先验证再下一步'、'只回报这 3 件事'、防兔子洞。
| Name | Required | Description | Default |
|---|---|---|---|
| tid | Yes | ||
| assist | No | 覆盖本轮模式;省略=沿用会话模式 | |
| guidance | Yes | director 亲笔写的方向纠正/纠矛盾/防绕圈(成为新的 user 轮) | |
| maxRounds | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses the full internal process: the server appends the worker's previous conclusion as an assistant turn, appends the guidance as a new user turn, persists, and reruns with the current mode. It also notes the rejection behavior when a round is active. This is highly transparent, especially given no annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is somewhat lengthy and mixed in language, but it is front-loaded with the core purpose and logically structured: purpose, behavior, usage guidance. Every sentence adds value, though some redundancy could be trimmed.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 4 parameters, no output schema, and no annotations, the description covers behavioral details, rejection conditions, and usage tips comprehensively. Missing formal descriptions for 'tid' and 'maxRounds' are minor gaps, but the overall context is sufficient for an agent to use the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds significant semantic value to the 'guidance' parameter with practical writing tips ('具体、有序、只做第1+2+3步' etc.), going beyond the schema description. For 'tid' and 'maxRounds', the schema provides coverage but the description lacks explicit details, though the context implies 'tid' is a thread ID.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: '把方向纠正作为下一条 user 消息发出去并起下一轮', which translates to sending a direction correction as the next user message. It explicitly labels itself as the director's core move and distinguishes from sibling tools like agent_read or agent_stop.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides usage context: it mentions that if a round is still running, the tool will reject and advises to 'wait or stop' first. It also gives detailed guidance on how to write the 'guidance' parameter, including concrete examples. However, it does not explicitly compare with alternatives among siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
agent_set_modeSwitch assist/autoA
切会话模式:'assist'=每轮阶段门停给 director review(成本拆分默认);'auto'=worker 跑到完成不停。路线锁定后可切 'auto' 让 worker 无人值守收尾,卡住再切回 'assist'。
| Name | Required | Description | Default |
|---|---|---|---|
| tid | Yes | ||
| mode | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Without annotations, the description carries the behavioral burden. It explains that 'assist' pauses for director review at each phase gate and 'auto' runs to completion without stopping. It mentions a prerequisite ('route locked') for using 'auto'. However, it does not describe side effects, permission requirements, or what happens to existing state, which is a minor gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences long, front-loaded with the action ('Switch conversation mode'), and efficiently defines both mode options and use cases. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a state-changing tool with two parameters and no output schema or annotations, the description covers the core functionality and use cases. However, it lacks explanation of the 'tid' parameter, return behavior, and potential errors, leaving some gaps for an agent to infer.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so description must explain parameters. It explains the 'mode' parameter well (meanings of assist and auto). However, it does not mention the 'tid' parameter (task ID) at all. The description adds value for half the parameters but leaves the other half undocumented.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: switching conversation mode between 'assist' and 'auto'. It uses a specific verb-resource combination ('切会话模式' meaning switch mode) and distinguishes from sibling tools by focusing on mode control, not reading or running logs.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives concrete usage guidance: switch to 'auto' after route is locked for unattended completion, and switch back to 'assist' if stuck. It explains default behavior ('assist' for cost). However, it does not explicitly mention when not to use or contrast with alternatives like agent_start or agent_stop.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
agent_startStart a worker sessionA
开一个新的逆向会话:配置 worker 模型(默认沿用浏览器里已配的)+关掉工具确认门、(可选)导航到目标 URL、建工作目录、用便宜的 worker 模型以【AI 辅助模式】发出第一轮(task 作为第 0 条 user)。返回 tid,后续都用它。推荐流程:GPT/CLI 委派模式下,agent_start 返回后继续 agent_poll/agent_wait_for_stop 观察阶段状态,settled 后用 agent_read_brief/agent_read 读取结论。绝不读/写 worker 的 key——key 由用户预先在浏览器里配好;这里只校验 hasKey=true。worker 选标准/快档别选推理档(推理档在长工具循环里易漂移成纯文字),如 deepseek-v4-flash / qwen-turbo / glm。
| Name | Required | Description | Default |
|---|---|---|---|
| task | Yes | 逆向目标(成为 convo[0] 的 user 内容),例如:还原 xxx.com 的 X-S 签名并 Node 实打接口 | |
| model | No | worker 模型名(省略=沿用浏览器配置)。flash 档,如 deepseek-v4-flash(中转)/deepseek-chat(直连) | |
| assist | No | 默认 true=阶段门停。false=全自动 | |
| provider | No | 切到这个 provider 再跑(如 deepseek/zhipu/custom),省略=沿用浏览器当前 active。不碰 key,只校验该 provider 的 hasKey | |
| maxRounds | No | 单轮最大工具回合,默认 80 | |
| targetUrl | No | 开跑前把当前 tab 导航到这个 URL | |
| workspaceRoot | No | 工作目录绝对路径(省略=在 FRX_WORKSPACE_ROOT 下自动建一个) | |
| ensureConfirmOff | No | 默认 true=关掉工具确认门(无人值守必需) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description fully carries the burden. It details configuration steps (worker model, confirm gate, navigation, directory creation), return value (tid), key handling (only check hasKey), and mode behavior (assist vs auto). Slightly lacks explicit blocking/non-blocking behavior, but overall transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is lengthy but well-structured: starts with core purpose, then workflow, then warnings, then recommendations. Every sentence is informative; minimal redundancy. Could be slightly more concise, but highly effective.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 8 parameters, no output schema, and no annotations, the description covers all major aspects: purpose, workflow, behavioral details, parameter semantics, and caveats. It provides sufficient context for correct tool invocation without needing external references.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% (all 8 parameters described in schema). Description adds value beyond schema: clarifies 'assist' default and its meaning, gives model examples, explains 'targetUrl' effect, and describes default for 'workspaceRoot'. Exceeds baseline 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it starts a new reverse session ('开一个新的逆向会话'), identifies the specific resource (session) and action (start), and is distinct from sibling tools like agent_poll (observation) and agent_read (reading conclusions).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly recommends a workflow: after agent_start, use agent_poll/agent_wait_for_stop, then agent_read_brief/agent_read. Also advises against reading/writing worker keys and suggests model selection (standard/fast not reasoning). Provides clear when-to-use and when-not-to-use guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
agent_stateCheap liveness snapshotA
廉价的存活/进度快照(比 agent_read 轻):running/settled/nSteps/checkpointSeq/错误/contentTail 短尾/driftHint。用在等待循环里,或发 guidance 前确认上一轮真的停了。注意:健康的 turn 也会几十秒 nSteps 不动(一个长工具/LLM 回合),别据此判'卡死'——唯一可靠的'活着'信号是有没有 settled。
| Name | Required | Description | Default |
|---|---|---|---|
| tid | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description fully handles behavioral disclosure. It explains the fields, the lightweight nature, and the critical nuance that nSteps may not move for tens of seconds during a healthy turn. It lacks explicit mention of side effects (none expected) or idempotency, but covers enough for a read-only snapshot tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single paragraph that starts with the purpose and key fields, then gives usage guidance. It is dense but efficient. The mixed language slightly impacts readability, but the information-to-word ratio is good. No redundancy, each sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool with one parameter and no output schema, the description adequately explains the return fields and usage context. It provides a warning about misinterpretation of nSteps. It does not explicitly list return types or formats, but the field names give sufficient semantic hints. The tool's simplicity limits the need for more completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has one parameter 'tid' (type string, required) with 0% description coverage. The description does not explain what 'tid' represents or how to obtain it. The agent must infer from context or other tools, which is insufficient. The description fails to add any meaning beyond the schema's raw type definition.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states it's a 'cheap liveness snapshot' lighter than agent_read, lists the fields returned (running/settled/nSteps/checkpointSeq/error/contentTail/driftHint), and implies it provides a quick status of the agent. The purpose is clear despite language mixing Chinese and English. However, the mixed language could cause confusion for an AI agent expecting pure English, slightly diminishing clarity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says 'use in wait loops or before sending guidance to confirm previous turn stopped' and warns against using nSteps as a stuck indicator, stating the only reliable signal is 'settled'. This provides clear when-to-use, when-not-to-use, and behavioral expectations, differentiating it from alternative tools like agent_read.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
agent_stopAbort the current grindA
砍掉 worker 当前这一轮(agentSession.stop)。用在:读到快照发现 worker 正冲向错误路线,想立刻截停并 agent_send 纠正、不想干等它 settle。进展已落盘(ledger/progress.md),停掉不丢持久状态。
| Name | Required | Description | Default |
|---|---|---|---|
| tid | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Without annotations, description discloses that stopping does not lose persistent state, which is key for safety. However, lacks details on side effects, permissions, or error handling.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences in Chinese, front-loading the action and then the use case. No unnecessary words; efficient and to the point.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (1 param, no output schema, no annotations), the description covers purpose and usage adequately but misses parameter explanation. Could be slightly more complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The only parameter 'tid' is not explained in the description. With 0% schema description coverage, the tool definition fails to clarify what tid represents, leaving the agent guessing.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool aborts the current worker round (agentSession.stop). It distinguishes from siblings like agent_wait_for_stop by specifying immediate intervention use case.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly describes when to use: when snapshot shows worker heading wrong, need immediate stop to correct via agent_send. Assures persistent state is not lost, but does not mention alternatives or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
agent_toolsList the browser-side toolsA
列出浏览器侧实际可用的工具清单(名称/说明/是否需确认/参数名)。Firefox Reverse v0.24.0 提供 68 个工具,包含引擎级逆向工具(signer_trace/jsvmp_trace/closure_read/webapi_trace/whitebox_diff/wasm_probe 等)、环境管理以及 Firefox 扩展查询/管理(addons_query/addons_manage)。默认走成本拆分(把工具名写进 guidance、委派 worker 执行);0.2.0 起也可用 agent_call_tool 亲自直调。只读、无副作用,先看这个再决定委派还是直调。
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does so well: it discloses that the tool is read-only and has no side effects, and explains its default operational behavior (cost-splitting via delegating work to a worker). This goes beyond the bare 'list tools' semantics.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact but information-dense: purpose is front-loaded, followed by concrete scope and examples, then usage decision guidance. Every sentence earns its place without padding.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter listing tool with no output schema, the description fully covers what the agent needs: what will be listed, what categories are included, the default execution path, the alternative direct-call route, and the read-only safety profile. Nothing critical is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters and the schema is complete, so the baseline is 4. The description adds no parameter-specific meaning because none is needed; it appropriately focuses on the output contents instead.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: '列出浏览器侧实际可用的工具清单' with explicit output fields (name/description/confirmation/parameters). It also distinguishes itself from agent_call_tool by framing the tool as the listing step before direct invocation, so an agent can tell it apart from its siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly says '先看这个再决定委派还是直调' — use this tool first to decide between delegation and direct invocation. It also names the alternative agent_call_tool and explains the default delegation path, giving clear when-to-use and how-to-route guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
agent_wait_for_stopWait for the worker's stage gateA
阻塞轮询直到 worker 这一轮 settled(阶段门到了)。这是'便宜模型磨完了、该读了'的信号。★真实 turn 常 20-30 分钟,默认超时 5400s;★超时但还 running 时返回 phase:'running'(=还在磨、去 agent_read 看看再决定继续等还是 stop+纠正),绝不是'失败'。settled 才是唯一的'阶段结束'信号(不靠 nSteps 之类)。
| Name | Required | Description | Default |
|---|---|---|---|
| tid | Yes | ||
| timeoutSec | No | 默认 5400(=90min)。turn 可能很长,别设太小 | |
| intervalSec | No | 初始轮询间隔秒,默认 10(自动退避到 30) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, but description covers blocking behavior, timeout handling, auto-backoff, return phase:'running' on timeout (not failure), and typical turn length. Could mention side effects or idempotency, but core behavior is well explained.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a dense paragraph with informal symbols (★, ;). It contains all necessary info but could be more structured and concise. Some details (e.g., '真实turn常20-30分钟') are useful but add length.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema, so description should detail return values. It only mentions timeout returns phase:'running', but not what a successful wait returns (presumably a settled phase). Also no error handling or status codes. Incomplete for a blocking tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 67% (timeoutSec and intervalSec have descriptions). The tool description adds context on defaults and auto-backoff but does not clarify the 'tid' parameter, which lacks schema description. Parameter-related info is present but incomplete for required param.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: blocking poll until the worker is 'settled' (stage gate), and positions it as the signal that the cheap model is done. It distinguishes from sibling tools like agent_stop.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit when-to-use guidance: it's the signal to read, default timeout 5400s, and what to do on timeout (check agent_read, decide to wait or stop+correct). States settled is the only stage-end signal, not nSteps.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
frx_env_closeClose a Firefox Reverse environmentC
关闭指定环境进程。
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description bears full responsibility for behavioral disclosure. It merely states the action 'close' without explaining what the operation entails (e.g., abrupt termination vs graceful shutdown, reversibility, side effects on other environments).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, short sentence that conveys the core purpose without verbosity. However, it could be expanded slightly to add necessary context without losing conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simplicity of the tool (one parameter, no output schema), the description is incomplete. It does not explain what the 'id' parameter refers to, what a successful close looks like, or any error conditions. Essential operational context is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema defines one required parameter 'id' with no description. The tool description does not clarify what 'id' represents (e.g., environment ID, process ID), leaving the AI agent to infer its meaning. With 0% schema description coverage, the description fails to compensate for this gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Close the specified environment process' clearly states the verb (close) and resource (environment process). However, it does not explicitly differentiate from sibling tools like frx_env_delete, leaving ambiguity about whether 'close' terminates the process or deletes the environment entirely.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives such as frx_env_delete or frx_env_stop. There are no conditions, prerequisites, or exclusions mentioned, leaving the AI agent without context for appropriate invocation.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
frx_env_createCreate a Firefox Reverse environmentB
一键新建 Firefox 环境;内核版本和系统跟随 Firefox Reverse,默认中国大陆简体中文。
| Name | Required | Description | Default |
|---|---|---|---|
| name | No | 环境名称 | |
| locale | No | 地区标识,如 zh-CN | |
| language | No | 首选语言,如 zh-CN | |
| timezone | No | 时区,如 Asia/Shanghai | |
| languages | No | 语言列表,如 [zh-CN, zh, en-US, en] | |
| randomize | No | 默认 true,只随机分辨率、DPR 和 CPU 核数等非身份参数 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It mentions that the kernel version and system follow 'Firefox Reverse' and that the default locale is mainland China Simplified Chinese, which offers some behavioral context. However, it does not disclose side effects, resource allocation, required permissions, or what return value to expect, which is a significant gap for a creation tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no unnecessary fluff. It efficiently conveys the core action and a couple of key defaults, though it could be slightly more informative without sacrificing conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 6 optional parameters, no output schema, and no annotations, the description is too sparse to be complete. It does not explain what 'Firefox Reverse' refers to, what happens after creation (e.g., whether it opens automatically or returns an ID), or how parameters interact. This is a substantial gap for a tool with this complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description adds minimal parameter context by indicating a default locale, which the schema does not state, but it does not elaborate on any other parameters. No additional syntax or meaning is provided beyond what the schema already gives.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description explicitly states '一键新建 Firefox 环境' (one-click create Firefox environment), clearly identifying the action (create) and the resource (Firefox environment). It also distinguishes itself from sibling tools like frx_env_rename and frx_env_delete by focusing on creation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies it is for creating a new Firefox environment with defaults, but it does not explicitly state when to use this tool versus alternatives like frx_env_import_json or frx_env_import_capture. No exclusions, prerequisites, or comparison to other creation methods are provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
frx_env_currentGet current Firefox Reverse environmentA
返回当前连接的 Firefox Reverse 进程所属环境;不是环境进程时 environment=null。
| Name | Required | Description | Default |
|---|---|---|---|
| refresh | No | 是否刷新运行状态,默认 true |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided; the description mentions it returns environment or null but lacks details on side effects, authentication needs, or potential errors.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, front-loaded with key information, no redundant content.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool with one optional parameter and no output schema, the description adequately explains the core functionality, though it could detail the return structure.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema covers 100% of parameters with descriptions; the tool description adds no extra meaning to the 'refresh' parameter beyond what's already in the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool returns the environment of the connected Firefox Reverse process, distinguishing it from sibling tools like frx_env_list and frx_env_create.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage when needing the current environment but does not provide explicit guidance on when to use or avoid this tool, nor alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
frx_env_deleteDelete a Firefox Reverse environmentA
删除已关闭环境。必须显式传 confirm:true。
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | ||
| confirm | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden. It discloses the destructive nature (delete) and the safety requirement (must pass confirm:true). It does not detail what happens if the environment is not closed or the result of the operation, but the confirm flag provides notable transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise, with two short sentences that are front-loaded with the core purpose. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple deletion tool with two parameters and no output schema, the description is mostly adequate. It states the resource (closed environment) and the mandatory flag. However, it lacks information about return values, error conditions, or whether the operation is reversible, which could be useful.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It only explains the confirm parameter (must be true), but provides no semantic meaning for the id parameter. The value added is minimal beyond what the schema already provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'delete' and the specific resource 'closed environment', distinguishing it from sibling tools like frx_env_close which likely closes an environment.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly requires passing confirm:true to proceed, which is a critical usage guideline. However, it does not mention when to use this tool vs alternatives like frx_env_close or frx_env_create.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
frx_env_import_captureImport pasted fingerprint capture JSONC
把外部浏览器控制台采集到的 JSON 文本导入指定环境。
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | ||
| text | Yes | 采集脚本弹出的 JSON 文本 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations. Description does not disclose behavior such as whether existing data is overwritten, validation performed, error handling, or environment must be open. Very limited behavioral context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence is concise but too brief, lacking necessary context. Could be improved with more structure.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 2 parameters, no output schema, and no annotations, description is insufficient. Does not explain id, JSON format, or environment state requirements.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 50% (only 'text' has description). Description adds no meaning beyond schema; 'id' parameter is left unexplained.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Title 'Import pasted fingerprint capture JSON' and description specify verb (import), resource (JSON text), and source (external browser console). Distinguishes from sibling frx_env_import_json which likely imports from other sources.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool vs alternatives like frx_env_import_json. No prerequisites, exclusions, or context provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
frx_env_import_jsonImport a full Firefox Reverse environment JSONA
导入完整环境 JSON。新环境只接受 Firefox 指纹;支持 {name,id,fingerprint,proxy,generateOptions} 或 {env,fingerprint,proxy},id 已存在时需 overwrite:true。
| Name | Required | Description | Default |
|---|---|---|---|
| id | No | 可选;指定导入到哪个环境 id | |
| name | No | 可选;覆盖导入后的环境名称 | |
| text | No | 完整环境 JSON 文本 | |
| config | No | 完整环境 JSON object | |
| overwrite | No | id 已存在时是否覆盖 fingerprint/proxy/name |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, so the description carries the full burden. It discloses key behavioral traits: only Firefox fingerprints are accepted for new environments, two supported JSON formats are listed, and overwrite:true is required when the ID already exists. It does not mention error behavior or side effects beyond overwrite, but it provides meaningful constraints beyond the schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two short sentences, front-loaded with the core action and resource. It efficiently packs format variants and the overwrite rule without redundancy or irrelevant details.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 5 optional parameters and no output schema, the description covers the primary input formats and the overwrite constraint. It lacks explicit success/error behavior and does not distinguish between text and config parameters, but the schema descriptions and title cover most of that ground, making this reasonably complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% for the 5 parameters, so baseline is 3. The description adds value beyond the schema by specifying accepted JSON structures ({name,id,fingerprint,proxy,generateOptions} or {env,fingerprint,proxy}) and explaining when the overwrite parameter is necessary, enhancing the minimal field descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states a specific action: '导入完整环境 JSON' (import full environment JSON), identifying the resource and scope. It distinguishes from the sibling frx_env_import_capture by focusing on full JSON import rather than capture-based import, and from frx_env_create by the import semantics.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides usage context: importing a full environment, with explicit constraints that new environments only accept Firefox fingerprints and that existing IDs require overwrite:true. It does not explicitly name alternative tools (e.g., frx_env_create, frx_env_import_capture) or state when not to use this tool, but the context signals are clear enough for selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
frx_env_listList Firefox Reverse environmentsC
列出 firefox-reverse 环境,供 MCP 侧环境管理按钮使用。
| Name | Required | Description | Default |
|---|---|---|---|
| refresh | No | 是否刷新运行状态,默认 true |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must disclose all behavioral traits. It only implies that listing may involve refreshing status (via the 'refresh' parameter) but does not mention side effects, permissions, or limitations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single efficient sentence with no wasted words. However, it is overly brief and could benefit from more information without becoming verbose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema and low complexity, the description should detail what the listing returns (e.g., environment names, statuses). It only states the tool's purpose without explaining the output or full behavior.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% (single param 'refresh' with description). The tool description adds no extra meaning beyond the schema, so baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'list' and the resource 'firefox-reverse environments', matching the title. It is unambiguous but does not differentiate from sibling tools like frx_env_open or frx_env_current.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description mentions a specific use case ('for MCP side environment management button') but provides no general guidance on when to use this tool vs alternatives. No exclusions or context are given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
frx_env_openOpen a Firefox Reverse environmentC
打开指定环境:独立 profile + 独立 Firefox 进程。
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description should disclose behavioral details. It mentions 'independent profile and independent Firefox process' but does not explain side effects of opening an already-opened environment, required permissions, or what 'open' entails (e.g., launching Firefox).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very short but conveys the core purpose. However, it sacrifices necessary detail for brevity. It is not front-loaded with key information beyond the verb.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool likely involves launching a browser environment, the description lacks completion details like return value, error conditions, prerequisite states, or whether the tool is synchronous or asynchronous.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0% and the description does not explain the 'id' parameter. The agent has no context on what the ID represents (e.g., environment name, path, or numeric identifier).
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool opens a specific environment with independent profile and Firefox process, but does not differentiate from sibling tools like frx_env_create or frx_env_current.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives like frx_env_create or frx_env_close. Does not specify prerequisites or conditions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
frx_env_renameRename a Firefox Reverse environmentC
重命名已有环境。
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | ||
| name | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full behavioral disclosure burden. It only states 'rename' but fails to mention if the operation is idempotent, if the environment must exist, or if it affects other resources. Minimal transparency beyond the action itself.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise (one sentence), which is positive for readability, but it sacrifices necessary detail and structure. It fits the minimal viable format but is too terse to be fully effective.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simple input schema and no output schema, the description should at least clarify parameter roles and expected behavior. It fails to do so, leaving gaps that reduce completeness for an agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description does not explain what the 'id' and 'name' parameters represent. Without any parameter details, an agent cannot reliably use this tool without additional knowledge.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description '重命名已有环境。' clearly indicates the tool renames an existing environment, which is a specific verb+resource. It distinguishes itself from sibling tools like frx_env_create, frx_env_delete, etc. However, it is very brief and lacks additional context about the environment type or scope.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No usage guidelines are provided. The description does not indicate when to use this tool versus alternatives like frx_env_create or frx_env_delete, nor does it mention prerequisites or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
frx_page_automation_scanScan browser automation exposure in the current pageA
在当前网页内容上下文扫描常见自动化/底层环境暴露点:navigator.webdriver、UA-CH、plugins、permissions、WebGL/canvas/audio/WebRTC/storage 等。用于比较手动打开与 MCP 打开的全局差异,不做单站点加密分析。
| Name | Required | Description | Default |
|---|---|---|---|
| saveTo | No | 可选;保存完整扫描 JSON 的工作目录相对路径,如 diagnostics/automation-scan.json |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must cover behavioral traits. It lists what is scanned and clarifies the scope (no encryption analysis), but it does not explicitly confirm the operation is non-destructive or describe rate limits, authentication needs, or side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise, consisting of two sentences that front-load the action and key details. Every sentence adds value without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (one optional parameter, no nested objects, no output schema), the description covers the main purpose and usage context. However, it does not describe the return format of the scan results, which is a minor gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The single optional parameter 'saveTo' is fully described in the input schema (100% coverage). The tool description adds no additional meaning or usage guidance beyond the schema, meeting the baseline.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool scans for common automation/environment exposure points in the current webpage, listing specific elements like navigator.webdriver, plugins, WebGL, etc. It distinguishes itself from sibling tools (agent_*, frx_env_*) by focusing on browser automation detection.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context: it is used to compare manual vs. MCP opening and explicitly states it does not perform single-site encryption analysis. However, it does not mention alternative tools or when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
frx_statusPreflight: check setup before startingA
★开跑前先调这个自检:MCP 工具是否已注册、浏览器启动阶段、marionette 连没连、当前 worker provider/model、worker key 配没配。没就绪就照返回的 note 一句话引导用户(启动浏览器加 marionette / 在浏览器设置里配便宜 worker 模型的 Key),就绪了再 agent_start。只读、无副作用。
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
在无任何注释的情况下,描述明确声明'只读、无副作用',直接披露了关键行为特性。同时说明返回的note用于引导用户,提供了结果处理方式。这完全承担了行为披露的责任,没有矛盾。
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
描述虽然较长但信息密度高,每条检查项都是必要的。结构上先给出使用前提,再列举检查点,最后给出条件处理,逻辑清晰,没有冗余内容。
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
对于零参数且无输出schema的工具,描述覆盖了使用场景、检查内容、结果处理方式(note引导)以及后续动作(agent_start),足够让代理正确调用。虽未详细描述返回格式,但已提及note的存在,在无输出schema下可接受。
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
工具无参数,且schema覆盖100%为空,符合基线4。描述无需添加参数含义,因为不存在参数,因此保持基线评分。
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
描述明确指明了工具的功能:在启动前进行环境自检,列出所有检查项(MCP注册、浏览器启动、marionette连接、worker配置),并说明用途是确保环境就绪后再启动agent。这与兄弟工具如agent_start形成明确区分,因为它是前置检查步骤。标题和描述都强化了这一目的。
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
描述明确说明使用时机:'开跑前先调这个自检',并给出条件性指引:未就绪时按返回的note引导用户,就绪后调用agent_start。虽然没有明确列出替代工具或何时不使用,但通过关联agent_start提供了清晰的上下文。
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
1 tool update
v0.3.7- Changed
agent_call_tool1 field changed- changed
Input schema / properties / name / descriptionPrevious value: -"工具名(来自 agent_tools),如 code_search / signer_trace / page_eval / jsvmp_trace"New value: +"工具名(来自 agent_tools),如 code_search / signer_trace / page_eval / addons_query / addons_manage"
1 tool update
v0.3.4- Changed
frx_env_create6 fields changed- removed
Input schema / properties / browserRemoved value: -{ - "description": "默认 chromium;也可传 firefox", - "type": "string" -} - added
Input schema / properties / languageAdded value: +{ + "description": "首选语言,如 zh-CN", + "type": "string" +} - added
Input schema / properties / languagesAdded value: +{ + "description": "语言列表,如 [zh-CN, zh, en-US, en]", + "items": { + "type": "string" + }, + "type": "array" +} - added
Input schema / properties / localeAdded value: +{ + "description": "地区标识,如 zh-CN", + "type": "string" +} - changed
Input schema / properties / randomize / descriptionPrevious value: -"默认 true,随机生成一致的桌面参数"New value: +"默认 true,只随机分辨率、DPR 和 CPU 核数等非身份参数" - added
Input schema / properties / timezoneAdded value: +{ + "description": "时区,如 Asia/Shanghai", + "type": "string" +}
14 tool updates
v0.3.0- Added
agent_call_tool - Added
agent_poll - Added
agent_read_brief - Added
agent_tools - Added
frx_env_close - Added
frx_env_create - Added
frx_env_current - Added
frx_env_delete - Added
frx_env_import_capture - Added
frx_env_import_json - Added
frx_env_list - Added
frx_env_open - Added
frx_env_rename - Added
frx_page_automation_scan
9 tool updates
v0.1.0- First observed
agent_read - First observed
agent_runlog - First observed
agent_send - First observed
agent_set_mode - First observed
agent_start - First observed
agent_state - First observed
agent_stop - First observed
agent_wait_for_stop - First observed
frx_status
TDQS
大部分工具职责清晰:agent_* 覆盖会话生命周期,frx_env_* 覆盖环境管理。但 agent_poll/agent_wait_for_stop/agent_state 以及 agent_read/agent_read_brief 之间存在一定的功能重叠,依赖详细描述才能准确区分。
工具名基本遵循 agent_<动词> 和 frx_<名词/动词> 的清晰前缀模式,整体可预测。少量名词形式(agent_state、agent_runlog、agent_tools、frx_status、frx_env_current)以及两种前缀混用造成轻微不一致,但不影响理解。
23 个工具处于 16-25 的偏重区间。对于 Firefox Reverse 逆向协调这类复杂场景,多数工具有明确用途,但 agent_* 生命周期工具占了 12 个,整体仍显得略多,存在合并精简空间(如 agent_read_brief 和 agent_poll 的部分功能重叠)。
agent 会话的启停、轮询、读取、纠正、模式切换和诊断工具齐全,环境管理也覆盖了增删改查和导入。明显缺口是缺少会话列表/恢复工具和环境导出工具,但核心工作流没有死胡同。
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
MCP server for AI agents to plan, verify, and deploy Cloudflare-native apps.
MCP server exposing the Backtest360 engine API as tools for AI agents.
MCP server for building and testing AI agents with multi-model experimentation and insights.
MCP Server for an Agent Task Marketplace
Related MCP Servers
- FlicenseAqualityDmaintenanceLocal MCP server that enables delegating low-risk tasks like summarization or code patches to a low-cost model, with the main agent reviewing results.2-
- AlicenseNot gradedqualityAmaintenanceMCP server that gives any LLM a managed Docker workspace with live browser, terminal, code execution, document skills, and autonomous sub-agents.1,628118MIT
- FlicenseNot gradedqualityBmaintenanceA local, privacy-first MCP server that orchestrates Ghidra, Binary Ninja, x64dbg, and system tools to provide AI assistants with powerful binary analysis capabilities.-
- AlicenseNot gradedqualityCmaintenanceMCP server that enables delegation of small coding implementations to a cheaper language model with propose_patch and apply_patch tools, while the primary agent retains architecture, review, and approval.MIT
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/WhiteNightShadow/frx-director-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server