ghostfox
This server is an MCP stealth-browsing toolkit that lets AI agents create self-hosted, fingerprint-coherent browser sessions and interact with pages using semantic accessibility refs instead of fragile CSS selectors.
Session management:
session_createlaunches the stealth engine with a fresh coherent identity (desktop or Android, headful/headless, optional proxy/persistent profile).See the page like an agent:
page_a11yreturns every visible interactive element with stable refs, roles, names, current values, and login state — piercing shadow DOM and same-origin iframes.Act by ref or selector:
page_click_ref,page_type_ref,page_read_ref, plus selector-basedpage_click,page_type,page_fill,page_press, andpage_upload_file— with mutation receipts.Wait and inspect:
page_wait_forpolls until a selector is visible;page_evalruns JS;page_snapshotandpage_screenshotcapture page state and visuals.Identity tools:
identity_generateproduces coherent identity TOML andidentity_auditchecks for contradictions a detector would flag.Evidence and anti-bot support:
session_evidencefetches recordings/event logs, andcaptcha_solvecan solve captchas via 2captcha when challenges do occur.Full browser automation workflow: create a session → open a page → inspect with
page_a11y→ act by ref → verify with receipts/evidence, all self-hosted with engine-level anti-detect.
Enables automated browsing on Cloudflare-protected sites by using engine-level anti-detect fingerprinting and solving Cloudflare Turnstile challenges through a CAPTCHA provider.
Ghostfox
The agent-native stealth browser you can own.
Self-hosted · Open source · MCP-first · Engine-level anti-detect
AI agents get blocked. Headless Chrome triggers Cloudflare 403s on ~20% of the web, and hosted "stealth browsers" route your agent's cookies, identities and sessions through someone else's cloud.
Ghostfox is the alternative: a complete browser stack you run yourself — a fingerprint-coherent stealth engine plus a Rust MCP runtime, in one repo.
Firefox (MPL-2.0)
└─ Camoufox (anti-detect patches, by daijro)
└─ Ghostfox engine engine/ — spoofing at the C++ level
└─ Ghostfox runtime runtime/ — Rust: sessions, identities, MCPGhostfox | Hosted stealth (Browserbase etc.) | playwright-mcp | Anti-detect suites (Multilogin etc.) | |
Self-hosted | ✓ | ✗ | ✓ | partially |
Open source | ✓ | ✗ | ✓ | ✗ |
MCP-native | ✓ | ✓ | ✓ | ✗ |
Engine-level anti-detect | ✓ (C++/Firefox) | vendor partnerships | ✗ | ✓ (closed) |
Coherent identities + auditor | ✓ | ✗ | ✗ | partial |
Runtime language | Rust | — | Node | — |
Eyes for agents — page_a11y. One call returns every visible interactive
element with a stable ref, semantic role, accessible name, live value —
piercing shadow DOM and same-origin iframes, so web-component UIs
(Reddit, modern frameworks) are fully visible. The snapshot also reports
login_state (logged-in / logged-out / unknown), page URL and title —
agents check session health before acting, not after failing.
Agents act by ref: page_click_ref e38, page_type_ref e21 "text" — no CSS
selectors needed. Rich editors (Lexical, Draft, ProseMirror) are handled via
editor-native input paths with fire-then-verify receipts. page_wait_for
replaces manual sleeps. page_read_ref gives full untruncated values.
page_upload_file bypasses native file pickers.
Android personas too — session_create {"platform": "android"} gives
portrait screens, Adreno/Mali GPUs, Android font stacks and Firefox-on-Android
UAs, all audited like desktop identities (500/500 coherent, see
runtime/docs).
One identity, no contradictions. Identities are generated from coherent device presets (platform, screen, GPU, fonts that actually ship together), injected at the engine level, and audited before use — a spoofed browser's worst enemy is itself saying "4 cores on a MacBook".
Quickstart
Requires: Rust toolchain (Linux, macOS, or Windows). Prebuilt engine binaries: see Releases.
# 1) Get the engine (prebuilt) and unpack it somewhere, e.g. /opt
unzip ghostfox-<ver>-lin.x86_64.zip -d /opt/ghostfox
# 2) Build the runtime
git clone https://github.com/autokeren/ghostfox.git
cd ghostfox/runtime
cargo build --release
# 3) Wire it into any MCP client (Claude Code, Cursor, ...){
"mcpServers": {
"ghostcloak": {
"command": "/path/to/ghostfox/runtime/target/release/ghostcloak-mcp",
"env": { "GHOSTFOX_HOME": "/opt/ghostfox" }
}
}
}Then the agent can: session_create → page_open → page_a11y → act by ref.
Full tool surface (19 tools):
Category | Tools |
Session |
|
See |
|
Wait |
|
Act |
|
Inspect |
|
Identity |
|
Evidence |
|
Every mutation returns a receipt — page_fill reports landed_chars, while
type_ref fire-then-verifies async editors, so a silent page swap can't eat an
edit unnoticed. Sessions can also run headful ({"headful": true}) when
humans want to watch the agent work.
Every run records evidence. Each session writes an append-only event log
(events.jsonl), full page snapshots and the identity it used under
~/.ghostfox/recordings/ — fetch it any time with session_evidence.
Or install in one command (Linux x86_64):
curl -fsSL https://raw.githubusercontent.com/autokeren/ghostfox/main/install.sh | bashFrom source end-to-end (build the engine yourself):
see engine/README.md — make dir && make build.
Related MCP server: WeaveTab-MCP
Repository layout
runtime/ Rust: ghostcloak-{core,fingerprint,mcp,eval} (MIT OR Apache-2.0)
engine/ Browser fork: patches, branding, build system (MPL-2.0)Two directories, two licenses, one product. The runtime speaks Juggler natively — no Node, no Python at runtime.
Why own the engine?
Anti-detect that survives inspection. Spoofing happens inside the engine (navigator, screen, WebGL, fonts, WebRTC, timezone, audio) — not in injected JS that detectors can read.
No cloud dependency. Your agent's identities and cookies never touch a third-party host.
Upstream insurance.
engine/tracks daijro/camoufox asupstream; Ghostfox applies its own branding and can rebase whenever it wants — including if upstream patches go closed-source.
Status
Pre-alpha. Verified: identity coherence (500/500), full MCP round-trip
E2E (create → open → fill → submit), multi-page sessions. Known limits are
tracked in the changelogs under runtime/ and engine/.
Do not use against targets you don't have permission to test. This is a testing / research tool.
Credits
Ghostfox stands on the shoulders of giants — Camoufox (daijro) for the anti-detect patch stack, Mozilla Firefox for the engine, LibreWolf for the patch tooling lineage, and Playwright for the Juggler protocol.
License
engine/— MPL-2.0 (inherited from Firefox / Camoufox). See engine/LICENSE.runtime/— MIT OR Apache-2.0. See runtime/LICENSE-MIT.
Available Tools
19 toolscaptcha_solveA
Solve a CAPTCHA through the configured provider (env GHOSTFOX_CAPTCHA_PROVIDER=2captcha + GHOSTFOX_CAPTCHA_KEY). Turnstile/hcaptcha: pass sitekey + pageurl; image captchas: pass image_base64. Stealth-first: prefer not being challenged at all.
| Name | Required | Description | Default |
|---|---|---|---|
| pageurl | No | Turnstile/hcaptcha-style: the page URL the challenge lives on. | |
| sitekey | No | Turnstile/hcaptcha-style: the site's sitekey. | |
| session_id | Yes | ||
| image_base64 | No | Image captcha: the challenge image as base64 PNG. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the burden. It discloses the provider configuration via environment variables and a stealth-first preference, which is useful context. However, it does not describe the output (e.g., captcha token), failure modes, network/cost implications, or what happens when stealth succeeds.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and well-structured: it opens with the primary action, states the provider configuration, then lays out the two parameter modes, and ends with a strategic note. Every sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema and no annotations, the description should explain what the tool returns and how the required session_id is used. It does neither. It also omits practical details like timeouts, errors, or whether the result is a token to be used elsewhere.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds meaning beyond the schema by explaining which parameters should be used together: sitekey + pageurl for Turnstile/hcaptcha, and image_base64 for image captchas. However, it does not explain the required session_id parameter, whose schema description is absent.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's job: solve a CAPTCHA through a configured provider. It also differentiates between Turnstile/hcaptcha and image captchas, which are distinct modes of the same action. The tool is clearly distinct from the sibling page/identity/session tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides mode-specific guidance: use sitekey + pageurl for Turnstile/hcaptcha and image_base64 for image captchas. However, it does not explicitly state when to use this tool versus an alternative or when not to use it; the 'stealth-first' note is more philosophical than operational.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
identity_auditA
Audit an identity TOML for coherence violations (contradictory signals a detector would flag).
| Name | Required | Description | Default |
|---|---|---|---|
| identity_toml | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the behavioral burden. The verb 'Audit' implies a read-only analysis and the parenthetical defines what is being detected. Still, it does not disclose whether the tool returns a list of violations, a report, or errors, and it does not specify side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is one tight sentence that front-loads the action and object and adds a useful clarifying parenthetical. There is no filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Because there is no output schema and no annotations, the description should at least state what the audit produces so an agent can interpret the result. It does not, leaving the tool's return contract underspecified.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema provides 0% description coverage, and the description only repeats 'identity TOML' rather than explaining the expected format. An agent is left to infer whether identity_toml should be raw TOML content, a path, or something else.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific action ('Audit'), a specific resource ('an identity TOML'), and a concrete objective (find coherence violations/contradictory signals). This clearly separates identity_audit from sibling identity_generate, which creates identities rather than validating them.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The usage context is implied: call this when an identity TOML needs validation. However, the description does not explicitly state when to prefer this tool over identity_generate or other siblings, nor does it mention exclusions or preconditions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
identity_generateA
Generate a new coherent browser identity, returned as TOML.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden. It discloses that the tool generates an identity and returns it as TOML, giving basic transparency, but it does not mention side effects, persistence, randomness, or whether the identity is applied to the current browser session.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, front-loaded sentence with no filler. It states the verb, resource, and output format economically while remaining readable.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter, no-output-schema tool, the description provides the essential invocation information. It lacks details about what the TOML identity contains or how it relates to the current session, but the tool is simple enough that this is a minor gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, and the schema fully documents the empty object, so parameter semantics are not a concern. The description adds no parameter details, but none are needed; the baseline for a zero-parameter tool is strong.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description states a specific verb ('Generate') and resource ('new coherent browser identity'), and explicitly notes the output format ('returned as TOML'). This clearly distinguishes it from sibling identity_audit, which implies inspection rather than creation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The word 'new' implies this tool is for creating an identity rather than auditing an existing one, but the description does not explicitly state when to prefer identity_generate over related tools like session_create or identity_audit. Usage context is only implied, not explained.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
page_a11yA
Semantic snapshot of the page: every visible interactive element with a stable ref, role (button/link/textbox/...), accessible name and CURRENT value — pierces shadow DOM, so web-component UIs (Reddit, modern frameworks) are fully visible. Use this instead of guessing CSS selectors.
| Name | Required | Description | Default |
|---|---|---|---|
| page_id | Yes | ||
| session_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the behavioral transparency burden. It discloses meaningful behavior: it pierces shadow DOM, only includes visible interactive elements, and returns current values. It could add an explicit read-only guarantee or limitations around iframes, but the snapshot language strongly implies a non-mutating operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two dense, front-loaded sentences with no filler. The first sentence states what is returned and key traits, and the second gives a direct usage recommendation.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only snapshot tool with simple parameters and no output schema, the description adequately explains the returned content: refs, roles, accessible names, and current values. It could be more complete by explicitly linking the stable refs to sibling ref-based tools like page_click_ref, page_type_ref, and page_read_ref, but it is sufficient for an agent to invoke the tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are two parameters with 0% schema description coverage, and the description does not explain session_id or page_id. The names are inferable from the broader tool family, but the description adds no parameter-level meaning and does not compensate for the missing schema descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: a semantic snapshot of visible interactive elements with refs, roles, accessible names, and current values. It differentiates itself from guessing CSS selectors, but it does not explicitly distinguish itself from the sibling tool page_snapshot, which could be confused with a generic snapshot.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives a clear usage directive: use this instead of guessing CSS selectors, especially for shadow-DOM-heavy web-component UIs. It provides useful context for when to invoke it, though it does not name alternatives or state when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
page_clickA
Click an element by CSS selector. For form controls (buttons, inputs), uses a JS click; for links and other elements, dispatches real mouse events at coordinates. Prefer page_click_ref when you have a page_a11y ref — it scrolls into view first and is more reliable on web-component UIs. Returns 'ok' on success.
| Name | Required | Description | Default |
|---|---|---|---|
| page_id | Yes | ||
| selector | Yes | CSS selector. | |
| session_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the behavioral burden. It discloses the click mechanism for form controls vs links, that real mouse events are dispatched at coordinates, and the success return value. This is solid, though it omits error/not-found behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, each with a distinct job: core action, behavior detail, and sibling guidance. No wasted words, and the most actionable information is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple three-parameter click tool, the description covers purpose, behavior, return value, and the main alternative. It does not document error cases or prerequisite page state, but these are minor gaps given the tool's simplicity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 33%, yet the description adds no parameter-level meaning beyond what the schema already says. It repeats that the selector is a CSS selector but does not explain session_id or page_id, leaving the agent to infer their roles.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: click an element by CSS selector. It also distinguishes itself from the sibling page_click_ref by noting when that tool is preferable, so an agent can tell them apart.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly routes the agent to page_click_ref when a page_a11y ref is available, explaining that it scrolls into view and is more reliable on web-component UIs. This gives clear when-to-use guidance relative to the closest alternative.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
page_click_refA
Click an element by its ref from page_a11y. Scrolls it into view first. No selectors needed.
| Name | Required | Description | Default |
|---|---|---|---|
| ref | Yes | Element ref from page_a11y (e.g. "e12"). | |
| page_id | Yes | ||
| session_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden of disclosing behavior. It explicitly states that the element is scrolled into view before clicking, which is a meaningful behavioral trait beyond the basic action. It does not mention potential side effects of the click or failure modes, but for a simple click-by-ref tool the disclosed behavior is reasonable.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three short sentences with no filler. The primary action is stated first, followed by the key behavioral detail and the distinguishing constraint. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The core usage is clear and the ref-based semantics are well explained, making the tool minimally viable. However, there is no output schema, no annotations, and two of three parameters remain undocumented, so an agent may be unclear about expected return values or how session_id/page_id are used.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 33%; only 'ref' is described. The description reinforces the ref semantics but adds little beyond the schema, and it does not clarify 'session_id' or 'page_id' at all. With low schema coverage, the description should compensate, and it fails to do so for the required context parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the specific action ('Click an element') and the resource/identifier used ('by its ref from page_a11y'). It also distinguishes itself from sibling tools by noting 'No selectors needed,' making it obvious this is the ref-based counterpart to page_click.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies clear usage context: use this tool when you have an element ref from page_a11y and do not need selectors. It does not explicitly name alternatives or provide exclusion criteria, but the mention of ref-based access and 'No selectors needed' gives sufficient guidance for an agent to select between this and selector-based siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
page_evalA
Evaluate a JavaScript expression in the page's main frame and return its JSON value. Read-only introspection is safest; treat results of mutations with care.
| Name | Required | Description | Default |
|---|---|---|---|
| page_id | Yes | ||
| expression | Yes | JavaScript expression; the JSON-ified result is returned. | |
| session_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden. It meaningfully discloses that mutations are possible and should be treated with care, and it scopes evaluation to the page's main frame. It does not cover error behavior or serialization limits, but the explicit safety warning is valuable.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences with no filler. The core action is front-loaded, and the safety guidance is placed immediately after it, making the tool easy to parse quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a code-execution tool with no annotations and no output schema, the description covers the evaluation scope and return format but omits details about exceptions, serialization behavior, and the role of session_id/page_id. It is adequate but leaves meaningful gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 33%: only 'expression' has a description, while 'session_id' and 'page_id' are undocumented. The tool description adds little beyond restating the expression parameter and does not compensate for the missing parameter semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Evaluate'), a specific resource ('JavaScript expression in the page's main frame'), and the expected output ('return its JSON value'). This clearly distinguishes page_eval from all page_* siblings, since only this tool evaluates arbitrary expressions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear usage context: read-only introspection is the recommended use, and mutations are explicitly flagged for caution. It does not name alternative tools or state explicit when-not-to-use conditions, so it stops short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
page_fillA
Set an input's value directly (form fill). Works where key-event typing hits engine bugs; fires input/change events like real edits.
| Name | Required | Description | Default |
|---|---|---|---|
| text | Yes | ||
| page_id | Yes | ||
| selector | Yes | CSS selector. | |
| session_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the behavioral burden. It discloses that the value is set directly rather than via key events, and that it 'fires input/change events like real edits,' which is important for agent reasoning about side effects. This is meaningful added context, though it could mention more about limitations or error behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, focused sentence that front-loads the core action and then adds the most important behavioral detail. There is no redundancy, filler, or unnecessary technical jargon.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's moderate complexity, the description covers the core behavior, the reason to use it over an alternative, and relevant event behavior. The main gap is parameter-level detail, but the required parameters are standard across siblings and mostly inferable from names.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 25% (only selector has a description). The description does not explain session_id, page_id, or text semantics beyond the implied 'value' of an input. While parameter names are somewhat self-explanatory, the description does not compensate for the low schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function: 'Set an input's value directly (form fill)'. It uses a specific verb and resource, and differentiates itself from key-event typing, which maps to sibling page_type. An agent can tell this tool apart from related siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives explicit context for when to use this tool: 'Works where key-event typing hits engine bugs.' This implies page_type as the alternative and identifies a clear condition for choosing page_fill. It doesn't state an explicit when-not-to-use list, but the guidance is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
page_openA
Navigate to a URL in an existing session. Returns a page_id (string) that must be passed to all subsequent page tools. Waits for the page to load. If the page has iframes or shadow DOM, use page_a11y instead of guessing CSS selectors. Example: page_open(session_id, 'https://example.com') returns a page_id like 'abc123'.
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | ||
| session_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden and adds key behavior: it returns a page_id, waits for the page to load, and clarifies that page_id must be reused. It could also mention timeouts or errors, but the critical operational behavior is disclosed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three purposeful sentences with no filler. The most important fact—navigation and the returned page_id—is front-loaded, and the example adds clarity without bloating the description.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a two-parameter tool, the description provides enough to call it correctly: required inputs, return value, and how that return value connects to sibling tools. It does not cover failure modes or timeout behavior, but this is a minor gap given the tool's simplicity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must explain the two parameters. It does so by explaining the relationship between session_id and URL and providing a concrete example. Some parameter-level detail is still implicit rather than explicit.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the action as navigating to a URL within an existing session, linking it to the sibling tools by returning a page_id used by subsequent page tools. It is specific and distinguishes page_open from session_create and other page tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It states the context ('existing session') and gives conditional guidance to use page_a11y when iframes or shadow DOM are present. It could be more explicit about when not to use page_open, but the routing to an alternative is present.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
page_pressA
Press a named key (Enter, Tab, Escape, ArrowDown, ...) — e.g. Enter to submit a search box.
| Name | Required | Description | Default |
|---|---|---|---|
| key | Yes | Key name: Enter, Tab, Escape, Backspace, Delete, ArrowUp/Down/Left/Right, Home, End, PageUp, PageDown. | |
| page_id | Yes | ||
| session_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of behavioral disclosure, but it only restates the action ('press') already implied by the tool name. It doesn't mention whether the press triggers navigation, key-up/key-down semantics, focus requirements, or any side effects — genuine gaps for an input-mutation tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence states the action and example with zero filler. Every word earns its place by either defining the key scope or showing a realistic use case.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a straightforward 3-param action tool, the description covers the core semantics but omits details like return behavior, errors, or whether key presses require a focused element. Against the rich sibling set, an agent could still succeed by relying on its understanding of key names and page context, but the lack of any behavioral detail keeps it at average.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is only 33%, so the description must compensate. It adds value by clarifying the key parameter with a concrete example and the ellipsis implying a known set, but it leaves session_id and page_id entirely unexplained, relying on sibling-tool convention for their meaning.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states a specific verb ('Press') and resource ('a named key'), immediately distinguishing it from mouse-action siblings like page_click and text-entry tools like page_type or page_fill. The example ('Enter to submit a search box') reinforces the intended action without ambiguity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear contextual usage via the search-box example, implying this tool is for discrete key presses rather than typing or clicking. It does not explicitly mention alternatives or when not to use it, so it stops short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
page_read_refA
Read the FULL value of an element by its page_a11y ref — no truncation. Use when the snapshot's 200-char preview isn't enough (body text, long input fields).
| Name | Required | Description | Default |
|---|---|---|---|
| ref | Yes | Element ref from page_a11y (e.g. "e12"). | |
| page_id | Yes | ||
| session_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the behavioral burden. It clearly identifies this as a read operation and adds the key trait 'no truncation', which is behaviorally meaningful. It does not describe error cases or exact return formatting, but for a read-only ref-based tool the core behavior is well exposed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences with no filler, and the most important information (read full value, no truncation) is front-loaded. The usage guidance is compact and directly actionable.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-by-ref tool with three parameters and no output schema, the description gives enough context: what it does, what sets it apart, and when to use it. It could mention return value shape or invalid-ref behavior, but these are minor given how clearly the core use case is defined.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 33%, with only 'ref' documented. The description adds meaning by explaining that the ref comes from page_a11y and that the point is reading the full, untruncated value. However, it does not clarify session_id or page_id, though their names are relatively self-evident from context.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a precise verb and resource: read the full value of an element using its page_a11y ref. It also differentiates itself from the snapshot tool by emphasizing no truncation, so an agent can distinguish it from page_a11y, page_snapshot, and the other page_* siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives an explicit when-to-use condition: when the snapshot's 200-char preview is insufficient, such as for body text or long input fields. This directly contrasts with the snapshot preview and makes the selection decision clear without needing to inspect sibling schemas.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
page_screenshotA
Capture a PNG screenshot of a page (viewport by default, full page with full_page=true). Saved under the session recordings dir; returns the file path. Feeds the live view when enabled.
| Name | Required | Description | Default |
|---|---|---|---|
| page_id | Yes | ||
| full_page | No | Capture the whole scrollable document instead of the viewport (optional). | |
| session_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full behavioral burden. It usefully discloses side effects and outputs: the screenshot is saved under the session recordings directory, returns the file path, and feeds the live view when enabled. This goes well beyond a bare 'capture screenshot' description, though it could still mention failure modes or prerequisites.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences with no filler. The key action is front-loaded, the parameter-dependent mode is stated clearly, and side effects are summarized in the remaining sentences. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers the action, output, and side effects reasonably well. However, with no output schema and no annotations, it leaves gaps around required parameters, prerequisite page/session setup, and error conditions, so an agent may not fully understand how to construct a correct invocation beyond the obvious session_id/page_id names.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 33%: full_page is documented in the schema, but the required session_id and page_id have no schema descriptions. The description does not explain what these identifiers refer to beyond the general 'page' and 'session recordings' context, so it fails to compensate for the low coverage gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: capture a PNG screenshot of a page. It also clarifies the critical scope options (viewport by default, full page with full_page=true) and distinguishes this from sibling tools like page_snapshot by explicitly covering the image-capture behavior.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use the tool: whenever a page screenshot is needed, especially a visual record. However, it does not explicitly discuss alternatives such as page_snapshot, nor when screenshot might be inappropriate, leaving selection between siblings partially to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
page_snapshotA
Extract the visible text content of a page as plain text (token-friendly). Returns: url, title, and content (all visible text, no HTML). For semantic element data with refs and values, use page_a11y instead — it gives you interactive elements with roles and names. Use this when you just need to READ page content without needing to interact with elements.
| Name | Required | Description | Default |
|---|---|---|---|
| page_id | Yes | ||
| session_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It discloses that the operation is read-only ('READ page content'), specifies output format (url, title, content, no HTML), and implies no interaction with elements. It could mention whether it waits for page load or handles dynamic content, but for a simple snapshot it is adequately transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is brief and front-loaded with the primary action and output. Every sentence adds value: it states the output, clarifies the no-HTML format, and differentiates from a sibling. No filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity and the absence of an output schema, the description fully explains what is returned (url, title, content) and the nature of that content (visible text, no HTML). It also clarifies the use case and differentiation from a sibling, making it complete for an agent to call correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It does not mention session_id or page_id at all. While the parameter names are self-explanatory, the description fails to clarify their roles or any required format, leaving the agent to infer from names alone. This is a notable gap given the low coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'extract' and the resource 'visible text content of a page', and explicitly lists what it returns (url, title, content). It also differentiates from page_a11y by contrasting text-only output with semantic element data, making the tool's purpose unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives explicit when-to-use guidance ('when you just need to READ page content') and when-not-to-use (for interactivity, use page_a11y instead). It names the alternative tool and the condition that selects it, leaving no ambiguity.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
page_typeA
Type text character-by-character into an element by CSS selector (human-like key events). Prefer page_type_ref when you have a page_a11y ref — it handles rich editors (Lexical/Draft/ProseMirror) and returns a verified receipt. Use this only when you only have a CSS selector and don't need rich editor support. Returns 'ok' on success.
| Name | Required | Description | Default |
|---|---|---|---|
| text | Yes | ||
| page_id | Yes | ||
| selector | Yes | CSS selector. | |
| session_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden and does disclose human-like key events and the success return value. However, it does not explain failure behavior, whether text is appended or replaces existing content, or any focus/visibility requirements.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three sentences with no filler. It front-loads the core operation, then gives routing guidance and the return value, so every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers the core purpose, the main alternative, and the return value, which is useful given no output schema. But with no annotations, it leaves operational gaps around error handling, content replacement, and preconditions that would be needed for fully confident invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 25%, and the description does not sufficiently compensate. It adds minimal meaning for 'text' and 'selector', but session_id and page_id remain unexplained, and selector semantics mostly repeat the schema's existing 'CSS selector' note.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action: typing text character-by-character into an element by CSS selector with human-like key events. It explicitly distinguishes this tool from page_type_ref, making the purpose and scope clear even without a title.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives explicit guidance: 'Prefer page_type_ref when you have a page_a11y ref' and 'Use this only when you only have a CSS selector and don't need rich editor support.' This clearly tells the agent when to use this tool versus the main alternative.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
page_type_refA
Type text into the element a page_a11y ref points at (inputs and rich editors). Returns landed chars as a receipt.
| Name | Required | Description | Default |
|---|---|---|---|
| ref | Yes | Element ref from page_a11y (e.g. "e12"). | |
| text | Yes | ||
| page_id | Yes | ||
| session_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the behavioral burden. It discloses the core write operation and the 'landed chars' receipt, which is genuinely useful. However, it omits side effects like whether existing text is replaced or appended, whether the element must be visible/editable, and what happens on failure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence with high signal-to-noise: it states the target, allowed element types, and return receipt. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers target and return but omits operational details such as whether typing appends or replaces, focus/wait requirements, and failure modes. For a mutation tool with no annotations and no output schema, this leaves the agent to guess some important behaviors.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 25%, so the description must compensate. It gives meaning to ref (page_a11y element) and text (typed text), but session_id and page_id are left undocumented, and text format/behavior is not explained.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it types text into the element a page_a11y ref targets, restricted to inputs and rich editors. The ref-based targeting differentiates it from sibling page_type, though it does not name the alternative explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It specifies the context: use this tool when you have a page_a11y ref and need to type into inputs or rich editors. No explicit when-not or alternative is named, but the scope is clear enough for an agent to route itself.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
page_upload_fileA
Upload a file to an input[type=file] by CSS selector. The file must exist on the machine running the engine.
| Name | Required | Description | Default |
|---|---|---|---|
| page_id | Yes | ||
| selector | Yes | CSS selector for the file input (input[type=file]). | |
| file_path | Yes | Absolute path to the file to upload. | |
| session_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden of behavioral disclosure. It adds a useful constraint about file existence and implies a mutating action, but it does not describe what happens after upload, whether the input is cleared first, or how failures are surfaced. No annotation contradiction exists.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences with no filler. The main action is front-loaded, and the key prerequisite is stated immediately afterward.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a mutation tool with no annotations and no output schema, the description is under-specified. It lacks guidance on session/page identification, return values, post-upload behavior, and failure handling, leaving the agent to infer several important details.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already documents selector and file_path, and the description only reinforces that file_path must exist locally. session_id and page_id remain undocumented in both schema and description, which is a gap given only 50% schema description coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific operation: upload a file to an input[type=file] by CSS selector. This clearly distinguishes it from all sibling tools, none of which handle file uploads.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clearly conveys when to use the tool (to upload a file into a file input) and gives an important prerequisite: the file must exist on the engine machine. It does not explicitly mention when not to use it, but no sibling tool offers a comparable alternative.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
page_wait_forA
Wait until a CSS selector becomes visible on the page (replaces manual sleeps). Returns true if found, false on timeout.
| Name | Required | Description | Default |
|---|---|---|---|
| page_id | Yes | ||
| selector | Yes | CSS selector to wait for. | |
| session_id | Yes | ||
| timeout_ms | No | Timeout in milliseconds (default 10000). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the behavioral burden. It explicitly says the tool waits for visibility, returns true when found, and returns false on timeout, which tells an agent the operation does not throw on a negative result. It does not specify polling behavior or the exact definition of visibility, but the core behavior is transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences deliver the core behavior and return contract with no filler. The main action is front-loaded and the timeout outcome is stated immediately after.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a low-complexity wait utility, the description covers what the tool does, when it is useful, and what it returns on success and timeout. It omits edge-case behavior and relies on the schema for parameters, but nothing critical is missing for selecting and invoking it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 50%, with selector and timeout_ms described; page_id and session_id are left to convention. The description reinforces that the selector is the CSS selector being waited on but does not add meaning beyond the schema. This puts it at the baseline rather than adding parametric insight.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific action and target: 'Wait until a CSS selector becomes visible on the page.' It also states the drop-in purpose ('replaces manual sleeps') and distinguishes this from the mutation-oriented sibling page tools by focusing on waiting rather than acting.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The parenthetical 'replaces manual sleeps' gives clear context for when to use this tool instead of hard-coded delays. It does not explicitly name alternative tools or conditions to avoid using it, but the intended use case is reasonably clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
session_createA
Create a new browsing session: launches the engine with a fresh coherent identity. Returns session_id.
| Name | Required | Description | Default |
|---|---|---|---|
| proxy | No | Proxy URL, e.g. socks5://user:pass@host:port (optional). | |
| headful | No | Run with a visible browser window instead of headless (optional) — for humans who want to watch the agent work. | |
| platform | No | Restrict identity platform: "windows" | "macos" | "linux" | "android" (optional). | |
| profile_dir | No | Reuse a persistent profile directory (optional). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden. It does disclose that the tool launches the engine, creates a fresh coherent identity, and returns a session_id, which is useful. However, it omits session lifecycle details, cleanup expectations, resource cost, or side effects of reusing a profile_dir.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two short sentences, front-loaded with the action, and each sentence contributes: one defines what the tool does, the other states the essential output. There is no filler or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a session-creation tool with no output schema and no annotations, mentioning session_id is valuable. Still, the description lacks lifecycle context, usage ordering relative to other tools, and any error or cleanup behavior, making it minimally complete rather than fully actionable.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and the input schema already explains proxy, headful, platform, and profile_dir with helpful detail. The description adds no parameter-level meaning, but the schema carries that burden fully, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb and resource ('Create a new browsing session'), states the engine-launching behavior, and notes the key return value (session_id). It also distinguishes itself from siblings like page_open and identity_generate by framing this as the session-level creation step.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no guidance on when to use this tool versus alternatives such as identity_generate or page_open, and no prerequisites or ordering constraints are mentioned. An agent must infer that creating a session should precede page operations.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
session_evidenceB
Get recorded evidence for a session: event log, snapshot files, identity used. Recordings live under ~/.ghostfox/recordings/.
| Name | Required | Description | Default |
|---|---|---|---|
| session_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral disclosure burden. It reveals where recordings are stored, but it does not state read-only behavior, behavior for missing sessions, permissions, or return format.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, front-loaded with the action and evidence contents. The storage path adds useful context with no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a low-complexity one-parameter read tool, it provides the key evidence categories and storage location. However, it omits session_id provenance, return format, and error or empty-session behavior, which matters because there is no output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0% and the description never explains 'session_id' beyond the generic phrase 'for a session'. It does not say where the session_id comes from or what format it uses, so the description fails to compensate for the schema gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a clear action, 'Get recorded evidence', and a specific resource, 'a session', with concrete contents: event log, snapshot files, identity used. It is distinguishable from sibling tools like session_create or page_snapshot, though it does not explicitly name any alternative.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies this is for retrieving previously recorded session artifacts and provides the storage location as context. It does not explicitly state when to prefer this tool over siblings or when not to use it, so usage guidance remains mostly implied.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
19 tool updates
v0.1.0- First observed
captcha_solve - First observed
identity_audit - First observed
identity_generate - First observed
page_a11y - First observed
page_click - First observed
page_click_ref - First observed
page_eval - First observed
page_fill - First observed
page_open - First observed
page_press - First observed
page_read_ref - First observed
page_screenshot - First observed
page_snapshot - First observed
page_type - First observed
page_type_ref - First observed
page_upload_file - First observed
page_wait_for - First observed
session_create - First observed
session_evidence
TDQS
Scored across 19 tools
Most tools are clearly separated by resource and action, and pairs like page_click/page_click_ref are explicitly distinguished via selector-based vs. a11y-ref-based interaction. A couple of input-setting tools (page_type vs page_fill) could be misselected without close reading, but the descriptions resolve this.
The dominant pattern is resource-prefixed actions (page_open, session_create, identity_generate, captcha_solve), which is predictable and readable. Deviations like page_a11y, page_snapshot, and session_evidence are noun-style but follow the same prefix convention, so only minor inconsistency exists.
19 tools is slightly above the ideal 3-15 range but justified by the need for selector-based and ref-based variants plus identity, session, page, and captcha coverage. No tool feels redundant enough to cut outright, though the set is substantial.
The core browsing loop—create session, open page, read, interact, wait, screenshot, collect evidence—is well covered, and identity/captcha workflows are included. Missing session/page teardown (e.g., session_close, page_close) and navigation controls are minor gaps but not blocking for most automation tasks.
Maintenance
Related MCP Connectors
- openhelmOAuthai.openhelm
Autonomous cloud agent tasks: real browser + your tools, structured evidence-backed results.
Live browser debugging for AI assistants — DOM, console, network via MCP.
Stealth web browser for agents: search, fetch, click, download and type in persistent MCP sessions.
Stealth web automation for AI agents. Login, signup, navigate, screenshot.
Related MCP Servers
- AlicenseAqualityDmaintenanceEnables cloud browser automation through Browserbase and Stagehand, allowing LLMs to interact with web pages, take screenshots, extract data, and perform automated actions with support for proxies, stealth mode, and parallel sessions.142,444 npmApache 2.0
- AlicenseNot gradedqualityCmaintenanceThe Zero-Setup Local Browser MCP. Enables AI agents to control web browsers via CDP with zero vision tokens and high-speed DOM mapping.17 npmMIT
- AlicenseNot gradedqualityAmaintenanceMCP-first browser-control toolkit enabling AI agents to safely automate browser actions using redacted snapshots and ref-based interactions.Apache 2.0
- AlicenseNot gradedqualityCmaintenanceA local MCP server for Firefox that gives AI agents full control over the browser via a Unix socket, enabling automation of tabs, pages, cookies, and more without exposing any network ports.8 npm1MIT