Show the effective configuration (base URL, reference dir, route mapping), the reference screenshots found and the available auth profiles. Start here.

Capture pages from the running site and SSIM-compare them with the reference screenshots.

pages: reference names (file names without extension); default all references. viewport: all | desktop | mobile (names ending in "-mobile" use a 390px mobile context). profile: auth profile for pages behind a login. align: how to handle different image sizes — resize (default, legacy), crop, or pad (pad makes page-height changes count as differences). A page FAILs when SSIM < threshold OR more than max_changed_ratio of its pixels clearly changed colour (catches local changes such as a recoloured header that SSIM averages away). Returns a JSON summary (failures first, with changed regions in px) plus side-by-side reference|live preview images of up to max_images failing pages.

QA a single page against its reference (fast iteration while fixing). url overrides the route mapping for this call. Returns the result and, on failure, a reference|live side-by-side preview cropped around the changed regions.

Screenshot any URL (desktop or mobile viewport, optionally logged in via profile). clip_selector captures a single element. Saved under runtime/captures/.png.

SSIM-compare two image files (e.g. a Figma export vs a capture). Paths may be relative to the project root. Returns score, changed regions, a heatmap path and an a|b preview.

Capture a named set of pages (e.g. label="before" before a refactor, "after" after it). Pages default to all reference names; any names work if you pass pages and the route mapping resolves them. Use compare_sets afterwards. Proves a refactor is pixel-neutral without depending on golden references.

Diff two capture sets (labels from capture_set, or directories). identical: true means every page scored >= threshold. Returns previews of the most-changed pages.

Compare two running servers (e.g. main branch on :8080 vs a worktree on :8091) page by page.

Make the current look of a page its reference screenshot: from source (an image), else the latest qa_page capture, else a fresh capture right now (so this also creates a first baseline for a page that has no reference yet). The old reference is backed up. Only do this when the USER has confirmed the look is intended; set confirm=true.

Download Figma frames into the references directory (needs FIGMA_TOKEN). Frame names become reference names; overwrites existing references with the same name.

List auth profiles, or show one (secrets are never shown).

Create or update an auth profile. Only the fields you pass change (dicts are merged).

Any secret may be given as "env:VAR_NAME" so it is read from the server's environment instead of passing through the conversation — prefer that.

origins: origins that receive headers/tokens, e.g. ["https://app.example.com"] (default: the base_url's origin). Credentials are never sent to other origins. access_token/token_type/expires_in/refresh_token: a bearer token you already have. apply_token_as: where the app expects the token — any of "header" (Authorization: Bearer), "header:X-Api-Key", "local_storage:", "session_storage:", "local_storage_json:" (whole token object as JSON), "cookie:". oauth: {grant_type: client_credentials|password|refresh_token|authorization_code, token_url, client_id, client_secret, scope, audience, username, password, authorize_url, redirect_uri, client_auth: post|basic, extra_params}. For client_credentials/password a token is fetched immediately and refreshed automatically. For authorization_code, call auth_oauth_login next. cookies: Playwright cookies [{name, value, url} or {name, value, domain, path}]. local_storage/session_storage: {origin: {key: value}} injected before page scripts run. http_credentials: {username, password} for HTTP basic auth. clear: field names to remove, e.g. ["token", "cookies", "storage_state"].

Log in with a real browser and save the session (cookies, localStorage and sessionStorage) into profile name. Works for any login incl. SSO/MFA/OAuth redirects.

headed=true opens a visible window where the user logs in (or finishes MFA); if username/password are given (use "env:VAR" for secrets) the form is filled first. Completion is detected by success_url_pattern (regex on the URL), success_selector, or — if neither is given — by leaving the login page's URL.

Run the OAuth authorization-code + PKCE flow for profile name (configure oauth with grant_type "authorization_code", authorize_url, token_url, client_id, redirect_uri first). The user signs in in the opened window; the redirect is intercepted, the code exchanged, and the token (with refresh_token if issued) stored and auto-refreshed.

Import a Playwright storage-state JSON (cookies + localStorage), e.g. from a Playwright test setup's storageState output, into profile name.

Open url (default: the base URL) with profile name and report whether the session works: HTTP status, final URL (a redirect to a login page means it expired) and a screenshot.

Delete an auth profile and its saved session.

Show automatic error-reporting status (pending/reported crash and error reports, target repo). flush=true posts pending reports to GitHub now.