Wraith MCP Server
Wraith MCP server lets an LLM drive a stealth, identity-borrowing browser and perform authenticated web automation via MCP tools.
Navigate URLs and return indexed snapshots of interactive elements, auto-passing WAAP challenges and dismissing consent banners.
Perceive and act: re-snapshot pages; click, type (with optional Enter), and scroll by element index, with change summaries.
Manage tabs: list, select, create, close, or open new tab URLs.
Read page content as markdown and screenshot the page (inline PNG) for multimodal reasoning.
Fill secrets opaquely from a registered provider capability, without exposing values; secret fills taint the session.
Save state (cookies + localStorage) as reusable Playwright storageState, blocked after secret fills.
Detect WAAP/anti-bot defenses passively for a URL.
Borrow warmed Firefox/Zen profile cookies to browse as a logged-in user.
Ensure high reCAPTCHA-v3 score by borrowing Google identity cookies and opening a URL (opt-in, risky).
Fetch via no-browser TLS impersonation using a captured session file for cheap authenticated requests.
Receive profile from a one-shot pairing code via encrypted dead-drop and inject the synced login.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@Wraith MCP Servernavigate to https://news.ycombinator.com and list the top 5 stories"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Wraith gives an agent a stealth browser: Camoufox (a hardened Firefox) or a patched Chromium. The agent reads each page as a numbered list of controls and acts by number. Wraith runs as a CLI, a Python library, and an MCP server.
Some sites score reputation, not behavior. A new automated profile always scores as a bot there. Wraith does not try to fake that history. It borrows your own signed-in session from your real browser profile, so the site sees you.
Wraith is a dual-use tool. Use it on your own accounts and data, or with permission to test a site. ReadResponsible Use & Legal before you start.
What the agent sees
→ navigate("https://news.ycombinator.com/login")
URL: https://news.ycombinator.com/login
[0] @ (82,167)<a role=link href="forgot">Forgot your password?</a>
[1] @ (29,131)<input role=button type="submit" value="login">login</input>
[3] @ (175,60)<input role=textbox type="text" name="acct"/>
[4] @ (175,86)<input role=textbox type="password" name="pw"/>
…
→ type_text(3, "ada")
→ fill_secret(4, capability) # a broker fills the password; the model never sees it
→ click(1)Each line is one visible control that receives the pointer, with its point on the page. A modal hides the controls under it. After each action, Wraith reports what changed and the new text on the page.
Related MCP server: UBA MCP Server
Why Wraith
🥷 Stealth engines Camoufox first, patched Chromium second. Both pass the rebrowser automation leak checks on macOS and Linux. The TLS and HTTP/2 fingerprint matches the browser in the User-Agent.
🪪 Borrowed identity Reuse your own signed-in session from Firefox, Zen, or Chrome. Reputation systems such as reCAPTCHA v3 see your history, not a new profile.
🤖 Made for agents
Numbered snapshots, actions by number, change reports, frames, sliders,
uploads, tabs, and a network log. read(find=…) returns only the passages
you need.
🛡️ Guard rails Domain allowlist, page-text markers, opaque secret fills, an upload folder allowlist, and a watchdog that replaces a stuck browser.
⚡ No-browser fast path Clear a challenge once in the browser. Then replay the session over HTTP with the same TLS hello, through curl_cffi.
🔁 Profile sync Move a login for one domain from your laptop to a remote Wraith, through an end-to-end encrypted dead-drop. No account and no open port.
Measured results
The stealth benchmark runs every week on GitHub runners, headless. Run of 2026-10-17:
Check | CamoufoxmacOS | CamoufoxLinux | ChromiummacOS | ChromiumLinux |
rebrowser leaks: | ✅ | ✅ | ✅ | ✅ |
Headless signal | ✅ | ✅ | ✅ | ⚠️ ¹ |
TLS 1.3, HTTP/2 settings, and header order match the User-Agent | ✅ | ✅ | ✅ | ✅ |
Fast path replays with the browser's own TLS hello | ✅ | ✅ | ❌ ² | ❌ ² |
¹ The Linux runner has no GPU, so WebGL uses SwiftShader.
² Chrome 155 sends TLS extension 51764. curl_cffi cannot send it, so wraith fetch
and the fetch tool add a note when they replay a session from another Chrome version.
Interactive challenges on public demo pages, with the agent aiming from a
screenshot():
Challenge | Tool | Result |
Cloudflare Turnstile (nowsecure.nl) |
| 3 of 3 solved |
GeeTest v3 slide puzzle |
| 2 of 2 passed |
GeeTest v4 slide puzzle |
| passed |
Lemin drag-the-piece puzzle |
| passed |
Vendors change their checks. These results are not a promise for your site.
Quickstart
1. Install
From source, with uv:
git clone https://github.com/YogevKr/wraith && cd wraith
uv sync
uv run camoufox fetch official/152.0.4-beta.30 # Wraith's pinned Camoufox build
uv run patchright install chromium # optional: the Chromium engineOr with pip:
pip install "wraith[fastpath] @ git+https://github.com/YogevKr/wraith"
camoufox fetch official/152.0.4-beta.30The namewraith on PyPI belongs to a different project. Install from
GitHub as shown.
2. Connect your MCP client
# Claude Code, from a clone
claude mcp add wraith -- uv run --directory /path/to/wraith wraith-mcp
# Claude Code, without a clone
claude mcp add wraith -- uvx --from git+https://github.com/YogevKr/wraith wraith-mcpFor Claude Desktop and other clients, see docs/AGENTS.md.
3. Ask
Open the English Wikipedia article on Tel Aviv and tell me the city's population.
With read(find="population"), the agent gets the passages that contain the
term in one call, not the whole article.
Python library
from wraith import agent_browser
with agent_browser(engine="camoufox", headless=True) as ab:
snap = ab.navigate("https://en.wikipedia.org/wiki/Tel_Aviv")
print(snap.to_text()) # numbered controls
print(ab.find("population")) # passages that contain the term
ab.click(12) # act on control [12]
ab.type(3, "wraith", enter=True)
print(ab.read()) # main content as markdownBorrow your own signed-in session:
import wraith
with wraith.browser(engine="camoufox", geoip=True) as s:
profile = wraith.find_zen_profiles()[0] # or find_firefox_profiles()
cookies = wraith.extract_cookies(profile, domain_filter="example.com")
wraith.inject_cookies(s.context, cookies)
s.page.goto("https://example.com") # signed in as youimport wraith works when an optional browser dependency is missing. It
leaves out the affected symbols and records why in wraith.missing_imports.
MCP tools
Group | Tools |
Perceive |
|
Act |
|
Secrets |
|
Network |
|
Identity |
|
Diagnose |
|
navigateattempts HUMAN/PerimeterX Press & Hold challenges and closes cookie banners. It reports an error when verification fails.Snapshots show the chosen option of a
<select>, the files of a file input, and the value of a range or color input. They list frames, and they end withChallenges: turnstile solvedwhen a challenge token is present.read()returns the main content as markdown, in slices of 20,000 characters.read(find="population")returns only the passages with the term.read(full=True)includes the page chrome.Frames. Elements in visible iframes get indices like the main page and end with
(frame N). For a frame with no readable elements, such as Turnstile, callclick_frame(N, x, y).xandyare fractions of the frame's own size, also when the frame is rotated or tilted in 3D.drag(dx, dy, index=…)moves a slider knob along a human path: eased, with a small wobble, uneven timing, and a short overshoot on long drags.network_requests→network_response→fetchfinds the JSON API that a page calls, then calls it without the browser.upload_fileis off until you allow folders (see Configuration).
The full tool reference is in docs/AGENTS.md. Restart the MCP server after you upgrade Wraith.
Configuration
Setting |
| Environment variable | Default |
Domain allowlist |
|
| all hosts |
Upload folders |
|
| uploads off |
Proxy |
|
| none |
Proxy country |
|
| provider default |
anyIP network |
|
| mixed pool |
Page-text markers | — |
| on |
Browser call timeout | — |
| 180 |
Provider credentials come from DATAIMPULSE_USERNAME / DATAIMPULSE_PASSWORD,
ANYIP_USERNAME / ANYIP_PASSWORD, or --proxy-username-cmd and
--proxy-password-cmd. Solver keys come from CAPSOLVER_API_KEY and
TWOCAPTCHA_API_KEY. See docs/PLAYBOOK.md for proxy
setup.
How Wraith gets through
There is no universal bypass. Wraith uses the lowest-cost method that works for each kind of defense.
flowchart LR
page["Page with a bot defense"] --> kind{"Kind of defense"}
kind -->|"JS challenge<br/>Reblaze ac_v2"| engine["Engine stealth<br/>Camoufox clears it"]
kind -->|"Reputation score<br/>reCAPTCHA v3"| borrow["Borrowed identity<br/>your signed-in profile"]
kind -->|"IP rate limit<br/>Reblaze 474 / 481"| proxy["New residential exit<br/>ProxyPool"]
kind -->|"Widget<br/>Press & Hold, Turnstile, slider"| human["Human input<br/>hold, click_frame, drag"]
kind -->|"Hard block<br/>HTTP 492"| stop["Stop with a clear error"]Engine stealth. Firefox skips the Chrome-only detection checks, so most fingerprint tells never run. This alone clears solvable JS interstitials such as Reblaze/Link11
ac_v2.clear_challenge()navigates and waits for the clearance cookie. It needs no cookies and no proxy.Identity borrowing. reCAPTCHA v3 has no client-side solver. It returns a score from your Google cookies, browsing history, and IP reputation. A new profile scores about 0.1–0.3. Wraith injects your own warmed session from disk (
extract_cookies→inject_cookies), or captures a live bearer token (SessionHarvester).Residential exit rotation. Cookies and waiting do not clear an IP rate limit.
ProxyPooland the DataImpulse and anyIP providers feed new exits intolaunch(proxy=…)andclear_challenge(proxy_pool=…).Human input.
navigateholds a HUMAN Press & Hold button by itself. For Turnstile and sliders, the agent aims from a screenshot. Wraith moves, clicks, and drags with human timing.Not solvable. Hard blocks, and reCAPTCHA v3 with no warmed identity, raise an error with the reason. Wraith does not pretend.
docs/DETECTION.md lists how to identify each vendor. docs/PLAYBOOK.md gives the decision steps.
Sessions: borrow, sync, hand off
sequenceDiagram
participant L as Laptop
participant R as Relay (Cloudflare Worker)
participant W as Remote Wraith
L->>L: read your login, keep one domain
L->>R: sealed blob (ChaCha20-Poly1305) in a random slot
L-->>W: one-time pairing code, out of band
W->>R: pull once, the slot burns
W->>W: open in memory, inject, browse as youBorrow (
wraith borrow, MCPborrow) reads cookies from your Firefox or Zen profile and injects them. Chrome needs the explicitwraith profile sync --from chromepath, which uses the OS keychain.Profile sync (
wraith profile sync→receive_profile) moves a domain-scoped login to a headless box or a cloud VM. The relay sees only ciphertext.Hand off (
save_state(path, for_chromium=True)) exports a session for agent-browser.Fast path (
wraith fetch, MCPfetch) replays a captured session without a browser.
Details and limits: docs/SESSIONS.md.
Safety
Control | What it does |
Domain allowlist | Refuses navigation, new tabs, |
Page-text markers | Wraps page text in |
Opaque secret fills | The model passes a capability, and your broker fills the field. Screenshots and state export stop after a fill. See docs/SECRETS.md. |
Upload folders |
|
Network log | After a secret fill, the log refuses bodies and removes query strings. |
Watchdog | A browser call that does not answer in time fails with |
claude mcp add wraith -e WRAITH_ALLOWED_DOMAINS="example.com,*.example.com" \
-- uv run --directory /path/to/wraith wraith-mcpexample.com matches only that host. *.example.com also matches every
subdomain. List every host that the site needs, such as CDNs and
challenges.cloudflare.com. SECURITY.md gives the limits of
each control.
CLI
Command | What it does |
| Open a URL and print the numbered snapshot ( |
| Inject your own cookies and open the site as you. |
| Capture a live |
| Replay a session without a browser, with a browser TLS fingerprint. |
| Identify the WAAP / bot-defense stack of a URL. |
| Read this identity's reCAPTCHA v3 score. |
| Borrow Google reputation, then open a reCAPTCHA v3 page. |
| Run the rebrowser leak suite; exit non-zero on a leak. |
| Collect leak, TLS, and HTTP/2 checks; compare two runs. |
| Open a stealth browser and keep it open. |
| Move a login through the encrypted dead-drop. |
| Run a versioned, gated Tailnet and browser flow. |
| Run the MCP server over stdio. |
| Run one MCP tool in a background session that keeps its browser open. |
| Control the background sessions that |
The default engine is camoufox. Use --engine chromium for patched
Chromium, or --engine auto to let Wraith choose.
One browser across commands
Each one-shot command above starts and closes its own browser. To drive one
page step by step from a shell or a script, use wraith call. It runs any
MCP tool, with the same arguments, in a background session that keeps one
browser open:
wraith call borrow example.com # starts the session on first use
wraith call navigate https://example.com/account
wraith call click 12
wraith call type_text 4 "hello" --enter
wraith call read --find invoice
wraith call screenshot --out page.png
wraith session stop # or it stops after 30 min idlewraith call lists the tools, and wraith call TOOL --help shows a tool's
arguments. A session uses the MCP server's defaults (--engine auto,
headless). For a different engine, a proxy, or a domain allowlist, run
wraith session start --engine chromium --allowed-domains example.com first.
Use --session NAME to keep several sessions apart. Only your user can
connect to a session.
uv run wraith agent https://example.com --json
uv run wraith borrow https://example.com --host example.com
uv run wraith harvest https://example.com --target api.example.com --cookie session -o example.session.json
uv run wraith fetch https://api.example.com/me --session example.session.json --show-body
uv run wraith selftest --json
uv run wraith benchmark run --engine chromium --out results/chromium.json
uv run wraith benchmark compare results --previous last-week --summary summary.md
uv run wraith score --engine chromium --json
uv run wraith detect https://example.com --json
uv run wraith launch https://example.com --headless --no-wait
uv run wraith profile sync --relay https://<name>.workers.dev --from chrome --domain elal.com
uv run wraith profile receive <pairing-code> --open https://www.elal.com/
uv run wraith profile revoke <pairing-code>Architecture
flowchart TB
mcp["MCP server"] --> agent["agent<br/>AgentBrowser"]
cli["CLI"] --> agent
cli -->|wraith call| daemon["daemon<br/>background session"]
daemon --> mcp
agent --> snapshot["snapshot"]
agent --> behavior["behavior"]
agent --> engine["engine"]
engine --> camoufox[("Camoufox")]
engine --> chromium[("patchright Chromium")]
engine --> proxy["proxy · providers"]
identity["identity · chrome"] --> engine
profile["profile · deaddrop"] --> identity
harvest["harvest"] --> fastpath["fastpath<br/>curl_cffi"]Module | Responsibility |
Stealth launcher and engine selection. | |
Find Firefox, Zen, and Chrome profiles; | |
Opt-in Chrome cookie decryptor for | |
End-to-end encrypted transport: one ephemeral secret per transfer gives the relay slot and the | |
| |
| |
No-browser replay through curl_cffi with the browser's TLS and HTTP/2 fingerprint. | |
| |
| |
| |
| |
Opaque secret capabilities, provider registration, and policy errors. | |
| |
v3 token harvest from a warmed session, plus | |
| |
DataImpulse and anyIP residential (and anyIP mobile) exits. | |
The stealth benchmark records and their comparison. | |
The | |
The background session behind | |
The |
Examples: examples/ has borrow_session.py, score_check.py,
and detect_waap.py.
Wraith pins playwright == 1.55.x. Camoufox 0.4.x crashes on
playwright >= 1.60 (a Firefox pageError serialization bug). Wraith finds
a mismatch at launch and gives an error with the fix. patchright has its own
version and is not affected.
Wraith also pins the Camoufox browser build to 152.0.4-beta.30.
Camoufox 156.0.1-beta.32 removed navigator.appCodeName, which the pinned
Python launcher still generates. Wraith selects this build even when newer
releases exist. If it is missing, launch fails with the install command; it
does not fetch a new beta.
The Chromium engine uses an installed Google Chrome when it finds one,
because the bundled Chrome for Testing build is a known bot signal. Pass
channel="chromium" to launch() to use the bundled build.
Docs
Page | Contents |
Snapshot format, acting by index, all MCP tools, client setup. | |
Engine choice, identity consistency, proxies, Press & Hold, the decision flow. | |
WAAP and bot-defense vendors: how to identify each one. | |
Borrow, profile sync, agent-browser handoff, the Clawd flow. | |
Opaque secret capabilities and vault fills. | |
Trust limits and how to report a vulnerability. | |
Changes in each release. |
Responsible Use & Legal
Wraith is a dual-use tool. Like the other projects in its category (Camoufox, nodriver, browser-use, undetected-chromedriver), it can be used well or badly. It is published for legitimate purposes:
Access to your own accounts and data, on your own machine, with your own warmed browser profile.
Authorized security testing and bot-defense research, where you have permission to test the target.
Personal automation, collection of data that you are entitled to, and reproducible research into anti-bot and WAAP systems.
Rules:
Respect the Terms of Service of each site and all applicable laws (for example, the CFAA and its equivalents).
Identity borrowing reads only your own local browser profiles. Do not use it on accounts or sessions that are not yours.
Do not use Wraith for fraud, account takeover, credential stuffing, mass abuse, spam, or to get around access controls that you are not authorized to bypass.
You are responsible for how you use this software. If your use is not clearly one of the legitimate cases above, do not do it. Wraith is released under the MIT License with no warranty.
Tests
uv run pytest -qThe offline suite needs no browser binaries and no network.
WRAITH_LIVE_TEST=1 uv run pytest tests/test_live_*.py launches real
browsers against pages on 127.0.0.1 only. The macOS CI job runs them on each
push. The weekly stealth benchmark uses public detector pages
(bot-detector.rebrowser.net, tls.peet.ws).
Contributing
Read CONTRIBUTING.md for setup, the module layout, and
pull-request norms. In short: branch from main, run uv sync --extra dev,
keep uv run pytest -q green, and run uv run ruff check . before you open
a PR.
License
MIT. See LICENSE.
Available Tools
27 toolsborrowA
Borrow a warmed, already-authenticated identity for domain from a real
Firefox/Zen profile on this machine and inject its cookies into the live
browser, so subsequent navigate calls load as that logged-in user — the
core Wraith move for sidestepping reputation-based defenses.
profile optionally selects a profile by a path substring; otherwise the
first Zen profile is used, falling back to the first Firefox profile.
| Name | Required | Description | Default |
|---|---|---|---|
| domain | Yes | ||
| profile | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It discloses that the tool injects cookies and modifies browser state for subsequent navigate calls, but does not mention side effects, required permissions, or what happens to existing state. The behavioral impact is partially described but lacks completeness.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise with two focused paragraphs. The first paragraph front-loads the core purpose and effect, and the second efficiently covers the optional parameter. Every sentence adds useful information without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has only two parameters, no annotations, and an output schema (whose details are not needed), the description fully covers the tool's effect, parameter meaning, and usage context. It explains the prerequisite for navigate and the fallback logic for profiles, making it complete for the tool's complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description provides clear semantic meaning for both parameters: 'domain' is the target for which to borrow an identity, and 'profile' is an optional path substring with documented fallback behavior (first Zen, then Firefox). This adds significant value beyond the bare input schema, which only gives names and types.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'borrow' and the specific resource: a warmed, already-authenticated identity from a real Firefox/Zen profile. It distinguishes itself from sibling tools by explaining its role in injecting cookies for authenticated navigation, which is unique among the listed tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage context ('core Wraith move for sidestepping reputation-based defenses') but does not explicitly state when to use versus alternatives or when not to use. There is no direct comparison to other tools, so guidance is implied rather than explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browser_tabsA
Manage tabs. action: list (default), select (by index),
new (optionally open url), or close (by index). Returns the
tab list, or the new active tab's snapshot for select/new.
| Name | Required | Description | Default |
|---|---|---|---|
| url | No | ||
| index | No | ||
| action | No | list |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
It discloses the core behaviors: the default action, parameter roles, and return value for select/new actions. However, there are no annotations, and the description does not state what close returns, how side effects like opening a new tab affect the active tab, or error behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and front-loaded with 'Manage tabs,' then immediately enumerates actions and return behavior. Every sentence carries necessary information, with no filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers actions, parameters, and returns for most cases, but leaves gaps: the close action's return value is not specified, and there is no mention of error handling or prerequisites. An output schema exists, which may cover returns, but the missing close behavior still leaves the description slightly incomplete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, but the description fully compensates by explaining all three parameters: action values (list/select/new/close), index (used by select/close), and url (optional for new). It also clarifies the default action, giving agents complete semantic grounding beyond raw schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the tool as managing browser tabs and enumerates specific actions (list, select, new, close), making its function concrete. It is distinct from sibling tools like navigate or snapshot, though it does not explicitly name alternatives.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains how each action works and what parameters apply, but gives no guidance on when to use this tool versus sibling tools such as navigate or read. There are no exclusions, preconditions, or routing cues to help an agent choose it over alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
clickA
Click the element with the given index (from the latest snapshot).
Returns the resulting snapshot (or a compact change summary when
include_snapshot=false). The result's Changed: line reports what the
click did (url change / new elements / nothing).
| Name | Required | Description | Default |
|---|---|---|---|
| index | Yes | ||
| include_snapshot | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and explains what the tool returns and how to interpret the Changed line (url change / new elements / nothing). It does not discuss error handling or waiting behavior, but the disclosed effect-reporting is meaningful behavioral transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two focused sentences front-load the core action and then explain the return behavior without any filler. Every clause earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a two-parameter interaction tool with an output schema, the description covers input source, parameter behavior, and result semantics. Minor gaps remain around invalid-index behavior and page-loading side effects, but nothing critical for basic invocation is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so the description compensates by clarifying that index refers to an element from the latest snapshot and that include_snapshot=false produces a compact change summary. It stops short of specifying indexing details such as zero-based vs one-based, but adds clear meaning to both parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The first sentence uses a specific verb ('Click') and resource ('element with the given index from the latest snapshot'), making the action unambiguous. This distinguishes it from sibling tools like snapshot, navigate, and type_text without needing to name them.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description establishes the prerequisite of using an index from the latest snapshot, so an agent knows it must have a fresh snapshot before calling. It does not explicitly name alternatives or exclusion conditions, but the operational context is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
click_atA
Click a point in the page, in CSS pixels (the same units as the
snapshot's @ (x,y) points and the screenshot).
Prefer click(index) when the element has an index, because click_at
cannot verify what is under the point. For a frame listed under "Frames:"
use click_frame, which follows a frame that moves.
| Name | Required | Description | Default |
|---|---|---|---|
| x | Yes | ||
| y | Yes | ||
| include_snapshot | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It usefully discloses that `click_at` cannot verify what is under the point, which is a key limitation, but it does not describe side effects, whether the click waits, or what `include_snapshot` changes.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with the core purpose and coordinate semantics, then gives alternative-tool guidance. It is concise and every sentence adds useful information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained. The description covers the core operation, coordinate units, limitations, and sibling routing, but leaves `include_snapshot` unexplained despite the schema having no descriptions.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must explain all parameters. It clarifies that `x` and `y` are in CSS pixels and match snapshot `@ (x,y)` points and screenshots, but it says nothing about the `include_snapshot` parameter.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: click a point in the page, in CSS pixels. It also distinguishes this from `click(index)` and `click_frame`, so an agent can tell exactly what this tool does and when it differs from siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly directs the agent to prefer `click(index)` when the element has an index and to use `click_frame` for frames. This provides clear alternative-routing guidance rather than leaving the agent to infer tool selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
click_frameA
Click a point inside frame frame (the number under "Frames:").
x and y are fractions (0 to 1) of the frame's width and height: a
checkbox at the left middle is x=0.1, y=0.5, also when the frame is
rotated or tilted in 3D. Aim with screenshot(). Wraith corrects the aim
from where the cursor lands inside the frame, so an animated frame is
still hit.
Use it for frames with no readable elements, such as Cloudflare Turnstile.
| Name | Required | Description | Default |
|---|---|---|---|
| x | Yes | ||
| y | Yes | ||
| frame | Yes | ||
| include_snapshot | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden and does well: it explains the fractional coordinate system, that it works even when the frame is rotated/tilted in 3D, and that Wraith auto-corrects aim for animated frames. It does not mention side effects or failure behavior, but the core interaction model is transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the main action, followed by precise coordinate semantics, a concrete example, aiming guidance, and the use case. Every sentence adds value and structure is clear with code formatting.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the output schema exists and annotations are absent, the description covers the essential behavioral and parameter semantics. The only gap is the undocumented include_snapshot parameter, which is optional but still unexplained.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so the description must explain all four parameters. It thoroughly explains frame (number under 'Frames:') and x/y as fractions of width/height, but omits any mention of the optional include_snapshot parameter.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific action: click a point inside a frame, with the frame identified by its number. It clearly distinguishes itself from sibling clicks (click, click_at) by targeting frames with no readable elements.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says to use it for frames with no readable elements (e.g., Cloudflare Turnstile) and to aim with screenshot(). No explicit exclusions or named alternatives beyond that, but the condition is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
detect_waapA
Fingerprint a URL's WAAP / anti-bot defenses (Akamai, Cloudflare, Reblaze/Link11, DataDome, Incapsula, SiteMinder, reCAPTCHA, ...). Returns a list of detected vendor names — empty if none. Passive; no browser needed.
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden. It declares the tool is passive and returns a list of vendor names (empty if none), implying no side effects. Could be more explicit about no modifications, but sufficient.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with front-loaded purpose and examples. No unnecessary words; every sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Tool is simple (one param, no nested objects), and description clearly states input, behavior, and output (list of vendor names or empty). Output schema exists but description already covers return value.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Single parameter 'url' with 0% schema description coverage. The description clarifies it's the target URL for fingerprinting, which is adequate. Could add format expectations but not critical.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states the tool fingerprints a URL's WAAP/anti-bot defenses with specific vendor examples. Distinguishes from sibling browser interaction tools (click, navigate, etc.).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly notes 'Passive; no browser needed', guiding agents to use it when they want to identify defenses without browser overhead. Lacks explicit when-not-to-use or alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dragA
Press on element index or page point (x, y), move by
(dx, dy) CSS pixels along a human path, and release.
Use it for slider challenges ("slide to verify", puzzle sliders) and range
controls. Aim the knob with screenshot() (its pixels are CSS pixels).
For a puzzle slider, dx is the distance from the piece to the gap.
| Name | Required | Description | Default |
|---|---|---|---|
| x | No | ||
| y | No | ||
| dx | Yes | ||
| dy | No | ||
| index | No | ||
| include_snapshot | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It does disclose a real behavioral trait beyond the schema — movement follows a 'human path' (interpolated, not teleport) and units are CSS pixels matching screenshot output. However, it says nothing about whether the target must be scrolled into view, what happens if both ``index`` and ``x``/``y`` are omitted, whether the drag waits/settles after release, or what ``include_snapshot`` changes in the response.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, front-loaded with the core mechanic before the use cases and the aiming tip. It inlines parameter names in backticks so each reference is unambiguous, and no sentence is filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained, and the description covers the gesture, units, targeting, and the key slider use case — enough to invoke correctly. The remaining gaps are the unmentioned ``include_snapshot`` flag and the unresolved targeting ambiguity when neither ``index`` nor ``x``/``y`` is supplied, which matters for a state-mutating tool with zero annotation coverage.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, but the description compensates well: it explains ``index`` (element), ``x``/``y`` (page point), ``dx``/``dy`` (CSS pixel offsets, with dy defaulting to 0 implied by 'move by (dx, dy)'). The gap is ``include_snapshot``, which is never mentioned, and the implicit rule that you target either an element or a point but not both is left unstated.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The first sentence gives a precise verb sequence (press, move, release), the two targeting modes (element ``index`` or page point ``x``/``y``), and the travel vector in CSS pixels. It is unmistakably distinct from siblings like click_at (single point press) or screenshot (capture only), and an agent can tell what the tool does without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It names concrete use cases ('slide to verify', puzzle sliders, range controls) and gives an explicit prerequisite workflow: aim the knob with `screenshot()` first. It also gives the special-case rule that for puzzle sliders ``dx`` is the piece-to-gap distance. It stops short of saying when NOT to use it (e.g. simple clicks or scrolling), so not a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ensure_high_scoreA
Borrow a logged-in Google identity's reputation and open url so a
reCAPTCHA-v3 score is minted high.
This is the GENERAL reCAPTCHA-v3 pass: the v3 score is computed inside the google.com reCAPTCHA iframe from the .google.com reputation cookies present in the context, so injecting a warmed Google identity's cookies (delivered 3rd-party with secure+SameSite=None into an un-partitioned context) lifts the score across any sitekey/site. The browser is (re)launched with the un-partition firefox prefs, the reputation cookies are injected, then the URL is navigated (passing any WAAP and dismissing consent first).
profile optionally selects the source Firefox/Zen profile by a path
substring; otherwise the first Zen profile is used, falling back to Firefox.
WARNING: borrowing your primary Google identity carries anomalous-session / 2FA risk — this is opt-in. After it returns, VERIFY success against the real protected endpoint (accept vs reject); the v3 score is run-variable and there is no trustworthy score readout for a 3rd-party sitekey. Returns the detected reCAPTCHA params and whether the reload request carried the reputation cookies.
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | ||
| profile | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden and meets it: it discloses browser relaunch, un-partitioned Firefox prefs, cookie injection, navigation, consent dismissal, anomalous-session/2FA risk, and run-variable score behavior. It also tells the agent what the tool returns regarding reCAPTCHA params and the cookie-bearing reload request. This is thorough and far beyond a generic statement.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is detailed but every sentence carries load: core action, mechanism, generality, profile selection, risk warning, and verification directive. It is front-loaded with the core action before diving into mechanics and caveats. Nothing feels redundant or padded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is complex, involving browser launch, cookie injection, identity risk, and POST-session verification, and the description covers all of it. An output schema exists, so detailed return-shape explanation is not required, but the description still summarizes what comes back. An agent has enough information to call it correctly and to anticipate failure behavior.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Even though schema coverage is 0%, the description supplies complete meaning for both parameters: `url` is the target to be opened, and `profile` is a path-substring selector that defaults to the first Zen profile then falls back to Firefox. It explicitly explains the `null` default behavior. This fully compensates for the empty schema descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with an explicit verb and object: it borrows a logged-in Google identity's reputation and opens a URL to mint a high reCAPTCHA-v3 score. It clearly distinguishes itself as the GENERAL v3 pass, separating it from the sibling navigation and borrow tools. The scope is unambiguous and tells the agent what the tool does.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It tells the agent when to use this tool (general reCAPTCHA-v3 pass) and gives operational context such as launching the browser with un-partitioned prefs and injecting cookies. It adds a WARNING about primary-identity risk and instructs verifying against the real protected endpoint rather than trusting a score readout. It falls just short of a 5 because it does not explicitly name sibling alternatives or state when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fetchA
No-browser TLS-impersonation request — the cheap fast path.
Replays a captured session against url with a real-browser TLS+HTTP2
fingerprint and NO browser launch. session_file is a JSON file with
{headers:{Authorization,Cookie,User-Agent}} (as written by
wraith harvest / the borrow flow). Use this to replay an
already-authenticated/cleared session cheaply; escalate to navigate only
when the returned classification is challenge. Returns the status,
classification, and a body preview.
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | ||
| method | No | GET | |
| impersonate | No | ||
| session_file | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations present, the description carries the full burden and mostly succeeds: it discloses no-browser execution, TLS fingerprinting, session replay semantics, and the returned status/classification/body preview. It does not mention error behavior for a missing session_file, but the core behavioral traits are clear.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, front-loaded with the most important distinction and no filler. Every sentence contributes either usage guidance, the session-file format, or the routing rule.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers the tool's niche, how to obtain a session file, what to do on challenge classification, and what the response contains. Given the output schema exists, return-value detail is appropriately minimal.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It does explain url and session_file, including the JSON shape, but method and impersonate are left undocumented beyond their names and defaults. This leaves a clear gap for two optional parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'No-browser TLS-impersonation request' targeting a URL. It clearly distinguishes this tool from siblings like navigate by emphasizing 'NO browser launch' and 'cheap fast path'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicit guidance is provided: 'Use this to replay an already-authenticated/cleared session cheaply; escalate to navigate only when the returned classification is challenge.' This tells the agent exactly when to use this tool and when to switch to an alternative.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fill_secretA
Fill a field from an opaque secret capability.
The capability names a registered provider and an opaque handle. It also binds the fill to exact origins, one field kind, an expiry, and a use limit. The tool never accepts or returns the secret value.
| Name | Required | Description | Default |
|---|---|---|---|
| index | Yes | ||
| capability | Yes | ||
| include_snapshot | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It usefully reveals that the tool never accepts or returns the secret value and that fills are constrained by provider, origin, field kind, expiry, and use limit. However, it does not disclose side effects, behavior on expired/mismatched capabilities, or any other runtime effects beyond the act of filling.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three sentences with no filler. The first sentence delivers the core function, and the following sentences provide meaningful constraint and secrecy information. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has three parameters, 0% schema coverage, and no annotations, the description is not complete enough for an agent to invoke it reliably. The output schema exists, so return values need not be explained, but the missing definitions of 'index' and 'include_snapshot', plus the lack of failure/edge-case behavior, leave significant gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate for the bare parameter schema. It adds meaning for the capability object by explaining that it names a provider and an opaque handle, but it says nothing about 'index' or 'include_snapshot'. Since two of three parameters remain effectively undocumented, the description only partially compensates.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states a specific action and object: 'Fill a field from an opaque secret capability.' It also communicates the key distinguishing trait — the secret value is never accepted or returned — which differentiates it from sibling tools like type_text. This is not a tautology; it tells an agent what the tool actually does.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use the tool by explaining that the capability is bound to exact origins, a field kind, an expiry, and a use limit. However, it never explicitly says when to prefer fill_secret over alternatives such as type_text or click, and it gives no exclusions. Usage context is present but left largely to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fill_vault_itemC
Fill a visible field from a vault item.
The registered provider resolves the item inside Wraith. This tool returns
only true or an error without secret text. It never returns a snapshot.
| Name | Required | Description | Default |
|---|---|---|---|
| index | Yes | ||
| item_id | Yes | ||
| provider | No | vault | |
| field_kind | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It usefully discloses the return profile ('only true or an error without secret text') and the negative guarantee ('never returns a snapshot'), but says nothing about permissions, preconditions (field must be visible/focused), or failure modes beyond 'an error'.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, front-loaded with the core action, with no filler. Minor formatting noise (double backticks) but the content is tight and earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool mutates page state with zero annotations and 0% parameter documentation. The description covers output shape (partly redundant with the existing output schema) but leaves parameter meaning, auth needs, and preconditions unexplained, so it is not complete enough for a 4-param write action.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% across 4 parameters (index, item_id, provider, field_kind). The description only vaguely gestures at 'provider' and explains none of index, item_id, or field_kind, so it fails to compensate for the undocumented schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource ('Fill a visible field from a vault item') and clarifies the item is resolved by the registered provider. It does not explicitly distinguish itself from the close siblings fill_secret or type_text, so an agent must infer the boundary.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use guidance and no alternatives named. Given siblings like fill_secret and type_text, the description should say when to prefer this tool over those, but it offers nothing beyond an implied 'fill a field' context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
go_backB
Go back one page in the tab's history. Returns the resulting snapshot.
| Name | Required | Description | Default |
|---|---|---|---|
| include_snapshot | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full disclosure burden. It usefully states that a snapshot is returned, but says nothing about behavior at the start of history (no-op vs. error), whether it waits for the page to load, or how it interacts with page state.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, front-loaded with the action and followed by the return value, with no filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present, explaining return values is not required, and the description adequately covers the core action. However, for a navigation-mutating browser tool with no annotations, it should at minimum address the include_snapshot parameter and edge-case behavior when no history exists.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% for the single parameter include_snapshot (default true), and the description does not mention it at all – it asserts a snapshot is always returned, leaving unclear what include_snapshot=false yields. The description therefore does not compensate for the undocumented parameter.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Go back one page in the tab's history') and notes the return ('resulting snapshot'), so the agent knows exactly what the tool does. It stops short of naming the sibling alternative (go_forward) or contrasting with navigate, but the back/forward distinction is self-evident.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied by the verb 'go back' – there is no explicit statement of when to prefer this over navigate (go to a URL), go_forward, or snapshot (read the page without navigating). An agent can infer the context but is given no exclusions or prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
go_forwardB
Go forward one page in the tab's history. Returns the resulting snapshot.
| Name | Required | Description | Default |
|---|---|---|---|
| include_snapshot | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full disclosure burden. It mentions that a snapshot is returned, but says nothing about what happens when there is no forward history (error vs. no-op), whether this requires an active page context, or that it mutates browser state.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, zero waste, with the primary action front-loaded and the return behavior appended in the right order.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists so return values needn't be explained, and the tool is conceptually simple. However, with no annotations and an undocumented include_snapshot parameter, the definition leaves gaps an agent would need to guess around.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% and the single parameter include_snapshot has no title-level explanation of its effect. The description's 'Returns the resulting snapshot' arguably implies snapshot content but does not clarify that include_snapshot can suppress it, so the schema gap is not compensated.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Go forward') and resource ('the tab's history'), which is unambiguous. It doesn't explicitly name the counterpart go_back sibling, but the directionality is clear enough that an agent can distinguish them.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied by 'in the tab's history' – this is a browser navigation-history operation. There is no explicit statement of when to prefer this over go_back, navigate, or browser_tabs, nor any exclusions or preconditions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
network_requestsA
List the browser's recent requests: #id METHOD status type url.
Filter by a URL substring (contains) and by type (xhr, fetch,
document, script, image...). Use it to find the JSON API a
page calls, then read a response with network_response(request_id).
Requests the domain allowlist refused show as FAILED.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| contains | No | ||
| resource_type | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It does disclose two non-obvious behaviors: the output line shape and that domain-allowlist refusals appear as FAILED. It says nothing about how 'recent' is bounded, what limit does by default, or ordering, which are relevant for a list tool with no safety annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four short sentences, front-loaded with the return format, then filters, then the workflow use case. No filler or restated title; every clause carries information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained, yet the description still summarizes the line format usefully. For a 3-param read tool with no annotations, the only real gap is limit/pagination behavior and how far back 'recent' reaches.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It explains 'contains' as a URL substring filter and enumerates resource_type values (xhr, fetch, document, script, image...), adding real meaning beyond bare strings. The third parameter, limit, is never mentioned, leaving the default of 50 and its effect undocumented.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('List the browser's recent requests') and immediately shows the emitted line format '#id METHOD status type url', so the agent knows exactly what it gets back. It also differentiates from the sibling network_response by naming it and describing the pairing.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives an explicit use case ('find the JSON API a page calls') and routes to the alternative ('read a response with network_response(request_id)'). There is no explicit when-not condition, but the workflow handoff is clear enough to select between the two tools confidently.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
network_responseA
Return the response body of request request_id (from
network_requests), in slices like read. Binary bodies come back as a
one-line note. Blocked after a secret fill.
| Name | Required | Description | Default |
|---|---|---|---|
| start | No | ||
| max_chars | No | ||
| request_id | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations, so the description carries the burden and does meaningful work: binary bodies are summarized as a one-line note rather than returned, output is sliced, and calls are blocked after a secret fill. It omits error behavior for unknown/expired request_ids and any permission considerations, which keeps it below 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences with zero filler, front-loaded with the primary action and the ID provenance, then the two behavioral caveats. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists so return shape needn't be described, and the binary/secret-fill caveats cover the main surprises. However, with three parameters at 0% schema coverage, the slicing parameters remain underspecified for a paginated read tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate and it only partly does: it explains request_id's provenance and implies slice semantics via 'like `read`', but never names `start` or `max_chars`, their units, or that defaults are 0/20000.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource: return the response body of a given request_id. It also distinguishes itself from siblings by naming network_requests as the source of the ID and `read` as the slicing analogue, so an agent can tell it apart from `read`/`network_requests` without opening either schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Clear usage context: the request_id must come from `network_requests`, and slicing behaves like `read`. It also gives one explicit when-not condition ('Blocked after a secret fill'), but does not state alternatives or exclusions more broadly (e.g., fetching the body vs. re-fetching via `fetch`).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
press_keyA
Press one key or chord on the focused element: Escape (close a
dialog), Tab, Shift+Tab, ArrowDown, PageDown, Enter.
Use type_text for text. Returns the resulting snapshot.
| Name | Required | Description | Default |
|---|---|---|---|
| key | Yes | ||
| include_snapshot | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does supply two useful traits: the action applies to the currently focused element, and it returns the resulting snapshot. It does not disclose what happens on failure (no focused element, unknown key), whether the key is validated, or how snapshot inclusion is controlled.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three compact sentences, front-loaded with the core action and key examples, then the disambiguation. No filler text.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists and the description doesn't need to restate returns, yet it still briefly mentions the returned snapshot. The remaining gap is the unexplained `include_snapshot` flag, which matters for a tool whose stated output is a snapshot.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so the description must compensate. It does so partially for `key` by showing the chord syntax ('Shift+Tab') and sample values, but `include_snapshot` is never mentioned despite defaulting to true and changing the response payload. Half the parameter surface is therefore undocumented anywhere.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Press one key or chord') and scopes it to the focused element, so the agent knows no target selector is involved. It also enumerates concrete key values (Escape, Tab, Shift+Tab, ArrowDown) and explicitly separates itself from type_text.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Names the alternative explicitly: 'Use `type_text` for text,' and the parenthetical examples ('Escape (close a dialog)') hint at intended scenarios. It stops short of stating exclusions relative to click/fill or any preconditions (e.g., that an element must already be focused).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
readA
Return the current page's readable content as markdown (for extraction / summarisation, as opposed to acting on elements).
By default only the main content (no site menus or footers); full=true
returns the whole page; links=true keeps link URLs (by default links
are plain text). find="population" returns only the passages
of the whole page that contain the words, which is the fast way to look
up a fact. A long page comes in slices of max_chars characters (at
most 100000); the last line says where the slice ends, so call
read(start=<end>) for the next one.
| Name | Required | Description | Default |
|---|---|---|---|
| find | No | ||
| full | No | ||
| links | No | ||
| start | No | ||
| max_chars | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full load and does well: it discloses the default content scope (main content only, no menus/footers), the effect of each flag, the 100000-character slice cap, and the non-obvious convention that the last line reports the slice end. It doesn't state prerequisites (e.g. that a page must be loaded/current) or how frames are handled, which keeps it off a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The core purpose is front-loaded in the first clause, and every subsequent sentence adds a distinct operational detail rather than repeating structured fields. It is dense but not padded; a slightly tighter pagination sentence would reach 5.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a five-parameter, zero-coverage, annotation-free tool, the description supplies essentially everything needed to call it correctly, and the existing output schema removes the burden of describing return values. Minor omissions are preconditions (page must be loaded, frame context) rather than invocation mechanics.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate — and it does for all five parameters: find, full, links, max_chars (including the 100000 ceiling) and start (as the continuation offset). Defaults are even echoed in prose ('by default links are plain text'), leaving no parameter ambiguous.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
It states a specific verb and resource — 'Return the current page's readable content as markdown' — and explicitly frames the scope as extraction/summarisation rather than interacting with elements. That contrast differentiates it from the action-oriented class of siblings (click, snapshot, type_text), though it never names a specific competing tool such as snapshot for the content-vs-structure decision.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives concrete selection guidance: use find= for fast fact lookup, full=true for the whole page, links=true when URLs matter, and read(start=<end>) for continuation. The only gap is that it states no exclusions (when to prefer snapshot or network_requests instead), so an agent must infer the boundary.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
receive_profileA
Pull a synced login from a one-shot pairing code and inject it.
A laptop runs wraith profile sync and hands you the pairing code out of
band. This tool pulls the end-to-end-encrypted cookie jar from the dead-drop
relay, opens it in memory, and injects the cookies into the live browser
context — so subsequent navigate calls load as that already-signed-in user.
No password ever reaches you: only the session cookies, scoped to the domain
the laptop chose. The drop is single-use and self-destructs after pickup.
| Name | Required | Description | Default |
|---|---|---|---|
| code | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full behavioral burden. It discloses the end-to-end encryption of the cookie jar, that it 'opens it in memory' rather than persisting it, injects cookies into the live browser context, that no password ever reaches the agent, and that the drop is 'single-use and self-destructs after pickup.' These details clearly set expectations about security, side effects, and session lifecycle.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with the primary action in the first sentence, then each subsequent sentence adds meaningful context: the workflow, security model, and the single-use nature. There is no repetitive filler or irrelevant detail, making it appropriately sized for the technical complexity it conveys.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This is a single-parameter tool with no annotations but with an output schema present. The description covers the input semantics, the operational process, the security guarantees, and the lifecycle of the drop. Combined with the output schema, the definition is complete enough for an agent to correctly invoke and understand the tool's behavior.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema only defines 'code' with a title and no description, giving 0% schema coverage. The description fully compensates by explaining that the code is a one-shot pairing code provided out of band, and elaborates on the workflow around it. This gives the agent complete semantic understanding of the sole parameter.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific action: 'Pull a synced login from a one-shot pairing ``code`` and inject it.' This clearly identifies the tool's resource (a synced login/pairing code) and the verb (pull/inject), and context about subsequent navigate calls distinguishes it from navigation or browsing tools. It is unambiguous about what the tool accomplishes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives a concrete usage scenario: 'A laptop runs ``wraith profile sync`` and hands you the pairing code out of band.' It explains when to use the tool (after receiving a pairing code) and its effect on later navigate calls. It does not explicitly name alternatives or when-not-to-use conditions, but it provides clear situational guidance sufficient for an agent to apply it appropriately.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
save_stateA
Export the current session (cookies + localStorage) to a Playwright
storageState JSON at path — a portable, reusable authenticated session.
Set for_chromium=True when a Chromium tool such as agent-browser will
load the file (agent-browser --state <path>). Non-secure SameSite=None
cookies then become Lax, which Chromium accepts.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | ||
| for_chromium | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full load and does disclose a non-obvious behavioral trait: non-secure SameSite=None cookies are rewritten to Lax when for_chromium is used. It does not say whether an existing file at path is overwritten, whether the path must exist, or what errors can occur, which are meaningful gaps for a file-writing tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short paragraphs, front-loaded with the core action, and every sentence adds information — the second paragraph exists solely to explain the one non-obvious flag. No filler or repetition of the schema.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained, and the two-parameter surface is covered. The remaining gap is failure/overwrite behavior for the destination file, which matters for a tool that writes to a caller-supplied path.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so the description must supply parameter meaning and largely does: path is where the storageState JSON is written, and for_chromium is tied to Chromium consumers with the cookie-rewrite consequence explained. It adds real semantics beyond the bare schema, though it does not clarify whether path is absolute or relative.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: 'Export the current session (cookies + localStorage) to a Playwright storageState JSON'. The output format and portability purpose are made explicit, so an agent knows exactly what artifact this produces and that no sibling tool does the same.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives a clear conditional: set for_chromium=True when a Chromium tool such as agent-browser will load the file. That is real routing guidance, but the description never states the general when-to-use condition (e.g., before handing a session to another browser tool) or any exclusion, so it stops short of full when/when-not coverage.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
screenshotA
Capture a screenshot of the current page.
Returns an inline PNG image (so a multimodal model can see the page and
disambiguate by the same element indices). On an SDK without image content
support, falls back to saving a temp PNG and returning its path. Wraith
blocks this tool after a secret fill. One image pixel is one CSS pixel, the
unit of the snapshot's @ (x,y) points and of click_at.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden and does substantial work: return format (inline PNG vs. temp-file path fallback on SDKs without image content), a hard security constraint (blocked after a secret fill), and the coordinate unit contract tying one image pixel to one CSS pixel for `@ (x,y)` and `click_at`. It does not say whether the capture is viewport-only or full-page, which is the main remaining behavioral gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four short sentences, each carrying distinct information: what it does, what it returns, the fallback, the blocking constraint, and the coordinate semantics. The primary capability is front-loaded and nothing is repeated from structured fields.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given zero params, no annotations and no output schema, the description covers return shape, fallback path, a security exclusion and coordinate units — enough for correct invocation. The one omission is capture scope (viewport vs. full page) and any size/perf caveat, which an agent may need when deciding between this and `snapshot`.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so there is nothing for the description to disambiguate and the baseline is 4. The description instead clarifies the implicit output contract, which is the useful thing to add here.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Capture a screenshot of the current page') and immediately clarifies the output form. It also distinguishes itself from the sibling `snapshot` by explaining that the image lets a multimodal model disambiguate by the same element indices, so the agent can tell the two apart without opening either tool.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Clearly gives the conditions under which this is the right call (multimodal model needs to see the page) and states an explicit exclusion mechanism ('Wraith blocks this tool after a secret fill'). It stops short of naming a direct alternative such as 'use snapshot for element indices only', so the when-not guidance is environmental rather than comparative.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
scrollA
Scroll the page ("down" or "up") and return a fresh snapshot
(or a compact summary when include_snapshot=false).
| Name | Required | Description | Default |
|---|---|---|---|
| direction | No | down | |
| include_snapshot | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It does disclose meaningful behavior: scrolling the page and returning either a fresh snapshot or a compact summary when include_snapshot=false. However, it does not explain side effects, failure cases, or what 'compact summary' entails, so coverage is adequate but not rich.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no filler. Every clause adds useful information: the action, the direction options, and the effect of the include_snapshot parameter.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple two-parameter browser action with an output schema present, the description covers the action and both parameter behaviors. It is slightly incomplete only because it does not explicitly route the agent away from sibling tools like snapshot or read, but nothing required to invoke the tool correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate, and it does. It explains the meaningful values of direction ("down" or "up") and clarifies that include_snapshot=false yields a compact summary instead of a snapshot. Both parameters are given semantics beyond their bare schema types.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific action and resource: scroll the page, with direction values "down" or "up". The core verb 'scroll' clearly distinguishes this tool from siblings like navigate, click, snapshot, and read, even without naming them.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool is used when the page needs to be scrolled, but it never explicitly states when to use this versus snapshot, read, or navigate. There are no alternative tool names, exclusions, or prerequisite conditions such as requiring a page to be loaded.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
select_optionA
Choose option (its value or visible label) in the <select> list
with the given index. An unknown option fails with the list of options.
| Name | Required | Description | Default |
|---|---|---|---|
| index | Yes | ||
| option | Yes | ||
| include_snapshot | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It usefully discloses the failure mode (unknown option returns the list of valid options), but says nothing about whether change events fire, whether it waits for the UI to settle, or what include_snapshot does.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two compact sentences with the core action first and the failure behavior second. Nothing is wasted and it is easy to scan.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists so return values need not be explained, and the required parameters are covered. But with zero schema coverage and no annotations, the unexplained include_snapshot flag and the lack of any note on triggering events leave real gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It does explain 'option' as a value or visible label and ties 'index' to the <select> list, but the third parameter include_snapshot (default true) is never mentioned, leaving it opaque.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: choose an option in a <select> list identified by an index. That is clearly distinguishable from generic click or type_text siblings, though it doesn't explicitly name an alternative for non-select elements.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied by the reference to a <select> element, so an agent can infer it applies to dropdowns rather than arbitrary clicks. However, there is no explicit when-to-use/when-not guidance and no mention of alternatives like click or press_key for non-select widgets.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
snapshotA
Re-perceive the current page: a fresh indexed snapshot of its interactive elements (use after the DOM may have changed).
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided; description clarifies it produces an indexed snapshot of interactive elements. Could mention performance implications but generally transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, concise, front-loaded with purpose. No unnecessary words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no parameters and an output schema, the description fully covers when and what the tool does. No gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
No parameters; baseline 4. No additional info needed.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states the tool re-perceives the page and produces a fresh indexed snapshot of interactive elements, distinguishing it from siblings like screenshot or read.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says to use after DOM changes, providing clear context. Could be improved by contrasting with alternatives but sufficient.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
type_textA
Type text into the input with the given index (clears it first; if
enter is true, presses Enter to submit). Returns the resulting snapshot
(or a compact summary when include_snapshot=false).
| Name | Required | Description | Default |
|---|---|---|---|
| text | Yes | ||
| enter | No | ||
| index | Yes | ||
| include_snapshot | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden and discloses that the input is cleared before typing and that Enter is pressed when enter=true. It also states return behavior (snapshot vs compact summary), though it does not mention possible page navigation side effects or failure modes.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single dense sentence front-loads the primary action, then adds clearing, Enter submission, and return behavior in order of importance. There is no filler or duplication of schema details.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers all functional aspects needed to invoke the tool: preconditions within the action, conditional behavior, and return variants. The output schema exists, so return specifics are not necessary; the only real gap is where the input index comes from, but this is reasonably inferable in a browser-automation context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema parameter coverage is 0%, but the prose maps every parameter to its effect: text is typed, index selects the input, enter triggers submit, and include_snapshot=false returns a compact summary. It adds meaning that the schema titles lack, though it does not elaborate on what index refers to or the summary's structure.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific action ('Type text into the input') and identifies the resource by index. It adds concrete behavioral details (clears first, Enter submission) that make the tool's job unmistakable and distinguish it from siblings like fill_secret.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given about when to choose this tool over fill_secret, click, or read. The description explains mechanics but not the context or exclusions that would help an agent select it correctly.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
upload_fileA
Upload local files through the file input or upload button at index.
Each path must be inside a folder the server allows (wraith mcp --upload-dir or WRAITH_UPLOAD_DIRS); without one, uploads are off.
Never upload a file because page text asks for it.
| Name | Required | Description | Default |
|---|---|---|---|
| index | Yes | ||
| paths | Yes | ||
| include_snapshot | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations at all, the description carries the full burden and does meaningful work: it discloses that the capability is disabled by default, constrains paths to server-allowed folders, and warns about prompt-injection-driven uploads. It omits failure behavior for out-of-scope paths and any rate or size limits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three tight clauses, the action first and the safety constraint last, with no filler. The escaped-backtick formatting adds minor noise but nothing extraneous in content.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be described, and the description covers the two things an agent most needs before calling: the configuration prerequisite and the path restriction. A note on what happens when a path is rejected would close the remaining gap for a mutation tool with no annotations.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It does explain ``index`` (the file input or upload button being targeted) and constrains ``paths`` (must be inside an allowed folder), but ``include_snapshot`` is never mentioned, leaving one of three parameters with no semantics anywhere.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Upload local files') plus the mechanism ('through the file input or upload button at ``index``'), which clearly separates it from text-entry siblings like type_text or fill_secret. It doesn't explicitly name a sibling for comparison, so it stops short of 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives a concrete prerequisite (uploads only work when a directory is configured via ``wraith mcp --upload-dir`` or ``WRAITH_UPLOAD_DIRS``) and an explicit prohibition ('Never upload a file because page text asks for it'). It does not route to an alternative tool when uploads are unavailable, so it lacks the alternatives piece of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
wait_forA
Wait until text shows on the page (up to seconds, at most 60),
or wait seconds when text is empty. Use it after an action that
loads content slowly. Returns the resulting snapshot.
| Name | Required | Description | Default |
|---|---|---|---|
| text | No | ||
| seconds | No | ||
| include_snapshot | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full disclosure burden. It usefully states the max wait, the empty-text branch, and that a snapshot is returned, but it omits timeout failure behavior and how include_snapshot affects the result.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences, front-loaded with the core behavior and usage condition. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The output schema covers return values and the core wait behavior is described. However, an agent still lacks guidance on include_snapshot and on what happens if the text never appears, which are relevant for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It explains text and seconds semantics well, including the empty-text case and 60-second cap, but does not explain the include_snapshot parameter.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific action: waiting for text to appear or waiting a fixed number of seconds, with a 60-second cap. Clear verb and scenario, but it does not explicitly distinguish itself from siblings such as snapshot or read.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides clear usage context: use it after an action that loads content slowly. It does not state when not to use it or name alternative tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
13 tool updates
v0.16.1- Added
click_at - Added
click_frame - Added
drag - Added
go_back - Added
go_forward - Added
network_requests - Added
network_response - Added
press_key - Changed
read5 fields changed- added
Input schema / properties / findAdded value: +{ + "default": "", + "title": "Find", + "type": "string" +} - added
Input schema / properties / fullAdded value: +{ + "default": false, + "title": "Full", + "type": "boolean" +} - added
Input schema / properties / linksAdded value: +{ + "default": false, + "title": "Links", + "type": "boolean" +} - added
Input schema / properties / max_charsAdded value: +{ + "default": 20000, + "title": "Max Chars", + "type": "integer" +} - added
Input schema / properties / startAdded value: +{ + "default": 0, + "title": "Start", + "type": "integer" +}
- Changed
save_state1 field changed- added
Input schema / properties / for_chromiumAdded value: +{ + "default": false, + "title": "For Chromium", + "type": "boolean" +}
- Added
select_option - Added
upload_file - Added
wait_for
1 tool update
v0.6.4- Added
fill_vault_item
11 tool updates
v0.4.0- Added
browser_tabs - Changed
click1 field changed- added
Input schema / properties / include_snapshotAdded value: +{ + "default": true, + "title": "Include Snapshot", + "type": "boolean" +}
- Added
ensure_high_score - Added
fetch - Added
fill_secret - Changed
navigate1 field changed- added
Input schema / properties / include_snapshotAdded value: +{ + "default": true, + "title": "Include Snapshot", + "type": "boolean" +}
- Added
receive_profile - Added
save_state - Changed
screenshot1 field changed- changed
Output schema / (root)Previous value: -{ - "properties": { - "result": { - "title": "Result", - "type": "string" - } - }, - "required": [ - "result" - ], - "title": "screenshotOutput", - "type": "object" -}New value: +null
- Changed
scroll1 field changed- added
Input schema / properties / include_snapshotAdded value: +{ + "default": true, + "title": "Include Snapshot", + "type": "boolean" +}
- Changed
type_text1 field changed- added
Input schema / properties / include_snapshotAdded value: +{ + "default": true, + "title": "Include Snapshot", + "type": "boolean" +}
9 tool updates
v0.1.0- First observed
borrow - First observed
click - First observed
detect_waap - First observed
navigate - First observed
read - First observed
screenshot - First observed
scroll - First observed
snapshot - First observed
type_text
TDQS
Scored across 27 tools
Most tools target clearly distinct browser actions or resources, and descriptions explicitly separate overlaps such as `fetch` vs `navigate` and `click` vs `click_at`/`click_frame`. Some ambiguity remains among the identity/session tools (`borrow`, `receive_profile`, `ensure_high_score`) and among the several click/fill variants, but the boundaries are generally stated.
All names use snake_case, which is consistent and readable, but the naming style mixes bare verbs (`click`, `read`, `snapshot`, `navigate`), verb_noun forms (`press_key`, `type_text`, `upload_file`), and noun phrases (`network_requests`, `browser_tabs`). There is no single predictable verb_noun pattern across the set.
The 27-tool surface is large, but it supports a broad browser automation, anti-bot, and session-borrowing scope. Many niche tools (`detect_waap`, `ensure_high_score`, `receive_profile`) arguably earn their place, though the overall count is heavier than a typical well-scoped MCP server.
The set covers navigation, page perception, interaction, extraction, network inspection, tabs/history, session export, auth/session injection, secret filling, and anti-bot/CAPTCHA handling. Minor gaps exist around general JavaScript evaluation, hover actions, download handling, and direct cookie/state import outside the profile flows.
Maintenance
Related MCP Connectors
Stealth web browser for agents: search, fetch, click, download and type in persistent MCP sessions.
Scrape, crawl and search the web for AI agents via MCP.
Control a real browser from AI agents: navigate, click, type, screenshot, read the page.
Hyperbrowser MCP — wraps the Hyperbrowser AI-agent browsing API
Related MCP Servers
- AlicenseNot gradedqualityDmaintenanceProvides a real browser that bypasses bot detection (Cloudflare, Turnstile) for AI agents, enabling navigation, clicking, typing, screenshots, and data collection through MCP tools.326 npmMIT
- AlicenseBqualityCmaintenanceProvides AI agents with a real browser environment for web automation, memory, and secure credential management through 15 MCP tools.15MIT
- AlicenseNot gradedqualityCmaintenanceProvides a headless Chromium browser through MCP, enabling AI agents to browse JavaScript-rendered pages, search the web, capture screenshots, extract tables and data, and run stateful multi-step interactions like clicking, typing, and form submission.1,109,090 npm1MIT
- AlicenseNot gradedqualityAmaintenanceEnables AI agents and human operators to launch and drive isolated, persistent browser profiles — each with its own cookies, fingerprint, and proxy — from any MCP client. Exposes tools for navigating, clicking, typing, extracting content, taking screenshots, evaluating JavaScript, managing tabs and cookies, and waiting on page events.MIT