Skip to main content
Glama

Render에서 Playwright MCP

클릭 한 번으로 Playwright MCP를 Render에 배포하세요. AI 도구가 HTTP를 통해 구동할 수 있는 호스팅된 headless-Chromium MCP 서버, AI 도구가 HTTP로 구동할 수 있는 서버를 얻을 수 있습니다 — 로컬 브라우저 설치도, 모든 머에서의 npx 실생도 필요 없습니다.

Deploy to Render

https://github.com/user-attachments/assets/0f31c279-f2e0-431f-a854-50677bd800c5

기능

Playwright MCP는 Model Context Protocol 서버로, LLM이 실제 브라우저를 열고, 이동, 클릭, 타입, 그리고 페이지 읽기를, 스크린샷이 아니라, 구조화된 접근성 스스냅샷을 통해 할 수 있게 해줍니다. 일반적으로 npx @playwright/mcp로 로컬에서 실되므로, 이 템플릿는 그 대신 단일 Render 웹 웹서비스로 실하므로 어떤 MCP 클라이언트든 공유된 HTTPS URL에 연결할 수 있습니다.

It's 공식 mcr.microsoft.com/playwright/mcp 이미지에 대한 얇은 환펴, 이 완전 테이 빌트 — 소스는 unchanged. 이 wrapper는 Render가 필요로 하는 flag들(--headless, --no-sandbox, plus --port와 --allowed-hosts from env)을 추가하고, 서버 앞에 small bearer-token gate 올려둔데, Playwright MCP에는 자체 auth가 없기 때문입니다.

Authenticated by default. Playwright MCP는 HTTP 모드에서 auth가 없고 RCE(remote code execution)에 准하는 도구를 동봉하고 있으므로, 이 템플릿은 서버를 직접 공개하지 않습니다. 요청은 Anti Authorization: Bearer $MCP_TOKEN을 반드시 갖고 있어야 하며, Render는 Deploy를 할 때 이 토큰을 당신을 대신해 생성합니다. 보안을 통해 이 인증이 무엇을 보호하고(보호 못 하지) 이해하세요.

전체 도구 목록, 설정 옵션, 클라이언트 설정법은 upstream README를 참고하세요.

Related MCP server: Playwright MCP

구조

하나의 Render web service가 bearer-token gate 뒤에 공식 Playwright MCP 이미지를 실행합니다. MCP client가 Render.s TLS가 TLS를 종단하는 edge를 통해 /mcp로 Streamable HTTP를 합니다. 그 gate가 토큰을 확인하고, 루프백 주소의 MCP server로 전달하면, 그 서버가 같은 컨테이너 안의 headless Chromium을 구동하고 접근성 스냅샷을 반환합니다.

┌─────────────┐   HTTPS /mcp    ┌────────────────────────────────────────────────┐
│  MCP client │ ──────────────► │ Render web service  (Docker, standard plan)    │
│ (Claude,    │  + Bearer       │                                                │
│  Cursor, …) │    token        │  render-entrypoint.sh                          │
│             │                 │    │ reads PORT, allowed hosts                 │
│             │  Streamable     │    ▼                                           │
│             │ ◄────────────── │  render-auth-proxy.mjs   :$PORT  (public)      │
└─────────────┘   snapshots     │    │ 401 unless the Bearer token matches       │
                                │    ▼                                           │
                                │  node /app/cli.js  127.0.0.1:8931  (loopback)  │
                                │    │                                           │
                                │    ▼                                           │
                                │  headless Chromium  (baked into base image)    │
                                └────────────────────────────────────────────────┘

배포 조립 방식:

File

역할

render.yaml

Blueprint로, 단일 서비스/플랜/리전, PORT 환경 변수, 그리고 생성된 MCP_TOKEN을 선언합니다. Deploy 버튼이 읽는 파일입니다.

Dockerfile.render

mcr.microsoft.com/playwright/mcp base image(headless Chromium 내장)의 얇은 래퍼입니다. 진입점(entrypoint)과 인증 게이트만 추가합니다. 브라우저 다운로드 없고, 소스 빌드가 없습니다.

render-entrypoint.sh

PORT를 읽고, allowed-hosts 값을 확인한 뒤, MCP server(loopback에 바인딩)를 인자로 auth gate를 exec합니다.

render-auth-proxy.mjs

PID 1. 실행 라이브러리만 사용하는 Node, zero 의존성. Authorization: Bearer $MCP_TOKEN이 없는 요청은 거부하고, 반복적은 추축은 rate limit으로 차단하고, 나머지 요청은 127.0.0.1:8391로 전달하고, MCP server를 감시하면서, 뒤쪽 server가 수락할 때까지 public port를 닫아 있으며, SIGTERM을 전달합니다.

render-auth-imitier.mjs

게이트의 rate limit. 상태를 지방하며 단독 테스트 가치가 있으므로 분리된 모듈입니다. 실패한 인증을, 모튼 클라이언트를 걸처, 고정 window로 제한합니다. proxy가 이를 import하므로 Dockerfile이 같이 복사해야 합니다.

render-smoke-test.sh

이치지를 빌드하고 wrapper를 end to end로 검증합니다: MCP_TOKEN이 없으면 fails closed(없이면 시지 않음), header 없으면 401, 반복된 429, 올바른 자격으의 handshake와 실제 브라우저 도구 호출, 그리고 정확한 SIGTERM. CI는 매 PR에서 이 테스트를 실행합니다.

[.env.example](./.이 environment.example)

컨테이너를 로컬에서 실할 때 같인 설정 옵션을 입니다.

Key 핵심 속성:

  • 얇은 퍼, 도구의 fork 없음. Playwright MCP 버전이 Dockerfile.render의 base image tag로 고정됩니다. 업그레이드는 tag 한 줄 변경입니다 (Playwright MCP 롯링 참고).

  • 데이터베이스도, 디스크도, 채울 필드도 없음. 유일한 크릿 MCP_TOKEN는 Render가 배포 시점에 생성합니다. 브라우저는 스트림 상한 default persistent profile을 유지하므로, 이인스턴스가 살아동안 로그인 상태가 요청들에 걸쳐 이어집니다. 이 템플릿가 가정하는 사용 모델인 “혼자만의 서버”에 중인합니다 (설정 참고).

  • 인증되며, fail-safe합니다. 뒤 게이트는 upstream이 아니라 templates가 추가한 것입니다. MCP_TOKEN이 설정 해제이면 그 테이님이 시작 리거부하므로, 서버가 익니니머스로 노출되는 설정은 존재하지 않습니다 (보안 참고).

선행 조건

배포를 하려면 다음이 필요한 있습니다:

  • Render 계정 — 가입은 무료. 서비스 자체는 유료 standard 인스턴스에서 실됩니다 (배포 참고).

  • GitHub 계정 — 이 저장스를 fork하기 위함입니다 (Deploy 버튼이 사용자 소유 storage소의 render.yaml을 읽습니다).

사용 API 키가나 서드파티 계정은 필요 없습니다. Ha 유일한 시크릿 MCP_TOKEN은 배포 시 Render가 생성해 주므로, MCP 클라이언트에 복사만 하면 됩니다 (배포 참고).

또한 로컬 실행을 원한다면(선택) — 로컬 실행 참고:

  • Docker with BuildKit(Docker Desktop 4.x+ 또는 Docker Engine 23+). Dockerfile.render는 # syntax= 디렉티브와 COPY --chmod를 사용하며, 둘 다 BuildKit 기능입니다.

  • .env 기반 복사. MCP client(e.g. Claude Code, Cursor) 또는 그냥 curl.

**필요하지 않습니다: Node.js, Playwright, 또는 로컬 Chromium — base image에 전부가 내장되어 있습니다.

배포

  1. 위의 Deploy to Render 클릭 (또는 이 리포지터리를 암시 fork하고 새 블루프린트 생성).

  2. Render가 render.yaml을 익고 오나Docker web service (playwright-mcp)를 standard plan으로 프로비저닌합니다.

  3. 배후가 live가 될 때까지 기다립니다. 당신의 서버는 http://<your-service>.render.com/mcp에 有입니다.

  4. 서비스의 Environment 페이지에서 Render Dashboard **MCP_TOKEN**을 복사합니다 — Render가 그기 위해 생성해 둔 것입니다. MCP client는 이 Authorization: Bear <token>에 보내야 합니다 (엡의 용) — 그리고 없이 없으면 하는 요청에 401입니다.

  5. 민감한 것을 잊기 전에 보안을 읽으세요. 그 토큐은 인턴읶과 이 컨테이너에서 ‘허 실행’ 사이의 유일한 방부입니다. 비밀번호로 처듀하시고, 가능하면 응 김이가 안.

플랜 스케일링: headless Chromium는 무료/starter 티어(512 MB)에서 OOM이 발생하므로, Blueprint는 standard(2 GB)를 default로 합니다. 더 작은 캅패시드에 작업이 맞다는 것을 확인하기 전까지는 closer down grade다는 마세요.

앱 사용

MCP client당신의 서비스 /mcp endpoint에, MCP_TOKEN을 bearer to큰으로 보내면서 연결하거하세요. 예를 들어, Claude Code를 기준으로:

claude mcp add --transport http playwright https://<your-service>.onrender.com/mcp \
  --header "Authorization: Bearer <your-MCP_TOKEN>"

혹은 클라이언트의 설정에 directly 추가하세요:

{
  "mcpServers": {
    "playwright": {
      "url": "https://<your-service>.onrender.com/mcp",
      "headers": {
        "Authorization": "Bearer <your-MCP_TOKEN>"
      }
    }
  }
}

클라이언트가 401을 보고하면, header가 들거나 토큰가 Dashboard나 Client라인트의 현 재 값과 일지 않기 때입니다.

그런 다음에 어시스턴트에 인터넷을 로바우즈하도록 요청하세요 — 예: "example.com을 열어고 제목과 main 헤딩 목 알려줘이" 그렇게 하면 호스팅된 브라우저에서 Playright MCP 도구를 호출하여 Result를 반환합니다.

로컬 실시 (Optional)

위 배포 경유에는 이 단계가 필요 하지 않습니다. render-entrypoint.sh를 변아서 시하기 전에 미리 확인을 힜는 등에 유用になります.

git clone https://github.com/render-examples/playwright-mcp-render.git
cd playwright-mcp-render
cp .env.example .env          # then set MCP_TOKEN, e.g. to `openssl rand -hex 32`
docker build -f Dockerfile.render -t playwright-mcp-render .
docker run --rm --env-file .env -p 10000:10000 playwright-mcp-render

준비가 끝으면, 컨테이너는 업스트림 자기 신의 Listening on …을 출력합다. 그런데에 게이트가 [auth] Bearer-token gate listening on …게. 그러내세 순서인 이 이유는, 뒤의 서버가 host를 받을 때까지 이 gate가 ublic 포트를 닫두기 때문이며 — 따라서 마고마지 줄이 서비스 도달 가능을 나타도에 줍니다. (그 위의 [startup]줄에 https:// URL을 출력하는 데, 그 scheme는 배포된 서비스용이며 로컬에서는 http를 사용.) .env에 넯은 토큰을 먼저 export해서 밑음의 험더가 해석되게 한 뒤, MCP handshake로 서버를 확인하세요:

curl -sS -X POST http://localhost:10000/mcp \
  -H "Authorization: Bearer $MCP_TOKEN" \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"curl","version":"1"}}}'

serverInfo 블로크에 Playwright라는 이름이 잡아야 합니다. 이어서 Authorization 해더를 뻬면 401 Unauthorized가 올 조입니다. 클라이언트를 배포된 URL처럼 동일하게 http://localhost:10000/ord에 연결하세요.

MCP_TOKEN은 부분 my를 공급해야 하는 유일한 변수입니다. 없이 없으면 컨테이너가 즉시 замел. .env의 나머는 편입니다.의 끝. Render 밖에는 RENDER_EXTERNAL_HOSTNAME이 없기 때문에 다른 --external --allowed-hosts * already used, PORT are --를 fallback합니다.

Docker를 쉑어고 싶나요? Upstream은 그냥 npx @playwright/mcp@latest --port 10000을 직접 실행합니다 — 이는 npm이 게시해는 라스트 버전이지 이 템플릿가 고정한 tag이 아니며, 인증 gate 없음은 이 호스트림 개.add… (그게이 템플릿 추가의. 그 이 경주도 Render가 배포하는 것는 아니라, 변경을 컨테이너에 확인하고 시`하에 앞에 시 합시다.

설정

모든 것은 render.yaml에 정의되어 있으며, .env.example(로컬 실행 설명) 같인 환경변수.

Env var

Default

용도

PORT

10000

인증 게이트가 바인딩 하는 포트. Render가 여го고 라인딩합니다.

MCP_TOKEN

렌–가 생성

필수. 인증 hedar must. 헤더 없이는 컨테이너 부팅이 실패. 회전은 Dashboard에서 값을 변혹하거나 Generate를 다시 클해 클라이언트를 업데이트.

UPSTREAM_PORT

8931

MCP서버(게이트 뒤)가 리슨닝하는 loop백 포트. 컨테이너 안의 것과 충할 때 만 변경.

.env.example에는 PLAYWRIGHT_MCP_HOST, PLAYWRIGHT_MCP_HEADLESS, PLAYWRIGHT_MCP_NO_SANDBOX도 나열되어 있습니다. 이 변수들은 서버를 (이 이미지 외부에서) 직접 실행할 때만 의미가 있습니다. Render에서는 render-entrypoint.sh가 항상 이에 해당하는 CLI 플래그를 전달하고 CLI 플래그가 우선하므로, Render 대시보드에서 설정해도 효과가 없습니다. 유일한 예외는 PLAYWRIGHT_MCP_ALLOWED_HOSTS이며, 엔트리포인트는 이것만 존중합니다.

엔트리포인트는 Render의 RENDER_EXTENAL_HOSTNAME를 통해 서버 호스트 검사를 당신 서비스 자신의 onrender.com 호스트명으로 자동 축소. 사용자 정의 도메인을 추가하면 PLAYWRIGHT_MCP_ALLOWED_HOSTS를 설정하기 전에는 해당 도메인으로의 요청이 호스트 검사에 걸려 거부됩니다(쉼표로 구분, 예: myapp.com,myapp.onrender.com, *는 검사를 끔).

브라우저 프로필 상태

엔트리포인트는 프로필 플래그를 하나도 전달하지 않으므로 Playwright MCP의 기본 동작을 사용하게 됩니다. 즉 컨테이너 파일 시스템에 영구 프로필(persistent profile, ~/.cache/ms-playwright/mcp-*)를 만드는 것입니다. 알아두어야 할 두 가지 결과가 있습니다.

  • 로그인은 호출 사이에도 유지됩니다. 일반적으로 원하는 동작입니다. 호스팅된 브라우저에서 한 번 인증하면 이후 세션도 그 세션을 다시 사용합니다. URL을 가리키는 모든 클라인트가 그 하나의 프로필을 공유하모로, 이는 서비스가 내 것임을 전제로 합니다(보안 참고). Disk가 연결되어 있지 않으므로 재시작하거나 재배포하면 프로필은 삭제됩니다.

  • 동시 클라인트는 충듈할 수 있습니다. 업스트림에 따르면 영구 프로필은 "한 번에 하나의 브라우저 인스턴스에서만 사용할 수 있으모로, 동일한 작업 공간을 공유하는 동시 MCP 클라인트는 충돌합니다" — 즉 하나의 URL을 향하는 두 편집기는 충돵할 수 있습니다. 인스턴스를 하나 이상으로 확장하면 각 인스턴스가 각자 기만의 프로필을 갖게 됩니다.

이러한 동작을 변경하려면 render-entrypoint.sh를 편집하세요:

원하는 것

추가할 것

세션마마다 새 인메모리 프로필, 닫을 때 폐기

--isolated

재배포 후에도 유지되는 프로필(저장된 로그인)

a Render Disk 및 --user-data-dir <mourt-path>

보안

실제로 실행되고 있는 것

Playwright MCP는 browser_run_cod_unsafe를 노출합니다. 업스트림의 설명은 다음과 같습니다: "Playwright 코드 스니펫을 실행합니다. 위험하지 않습니다: Playwright 내부 프로세스에서 자익의 JavaScript를 실행하며 RCE와 동등합니다." 고정된 버전에서 이 도구는 옵트인 기능(opt-in awake abilities) 중 하나가 아니라 **Core automation**에 나열되어 있으며, [--capes](https://github.com/microsoft/playwright-mcp/blob/v0.0.78/README.md#configuration)는 **추가능** 기능(vision, devtools? Actually 원.text is vision, pdf, devtools)만 활성화 - wait, "capabilities" is "기능" or "capabilities"? I want to translate: "추가능 기능(vision, pdf, devtools`)" properly. So raw. "그러므로 이 도구를 수 없고, 개별 도구를 제외할 래그도 없습니다. 이 서버를 호출할 수 있는 사람이면 누구든 컨테이너 사용자로서 컨테이너 안에서 코드를 실동할 하고, 프라이빗이트 네트워크를 통해 다른 Render 서비스에도 도달할 수 있습니다.

업스트림은 HTTTP 모드에서 인증을 제공하지 않습니다. 이는 서버 npx로 당신 노트북의 로프백 인터페이스에서 행할 때에만 말이 됩니다. Render에서 공개 URL을 갖게 되모로, 이 템플레이트가 빠즜린 이 문을 추가합니다.

템플레이트가 이에 대해 하는 일

render-auth-proxy.mjs이 $PORT 포트에서 청는 유일한 존재입니다. 이 프록시는 Authorization: Bearer $MCP_TOKEN이 없는 요청에는 401로 응답하고, 나머지 요청은 127.0.0.1에만 바인딩되고 외부로 공개되지 않는 MCP 서버로 전달합니다. 구체적으로:

  • Fails closed(e= 연다). MCP_TOKEN이 없으면 시작하지 않습니다. 검사를 비활성화하는학 래그를 il by no, 서버가 인증 없이 " anonymous remains.
    We also lack in original "no flag to disable". We include.

  • 생성된 기반 비밀, 기본 값이 아니라. render.yaml이 generateValue: true를 사용하므로 각 서비스는 각자만의 토큰을 갖습니다. This token is created once when service is created and remains stable across redeploys, so clients can keep 동작합니다. 이 리포지토리에는 유출될 공유 자격 증명이 없습니다.

  • 상수 시간 비교 사용. SHA-256 다이gest에 대한 상수 시간 비교을 사용하므로 검사가 토큰을 바이트 단위로 누출하지 않으며, 토큰의 일부 정확한 prefix는 허용되지 않습니다.

  • 토큰를 로고하지 않음. 거부 때 로그에는 method, path, 401 only remain in state, not client provided.

  • 추측에 비율 제한을 적용합니다. Failed 시도는 하나의 전역 예산(budget)을 공유합니다: 1분 with 10번 거부 시도로 예산, 남은 시간 창에 대신 429 provisioning Retry-After plus one 로그 line per attempt 대신. 예산은 원래 어떤 excess anyway refused 되는 요청에만 scored, valid token Приority never by budget consumed. Jagdon can't locked you about 않고, attacker 동안 당신은 항상 back into the system 다시 진입할 수 있습니다. 의도적으로 클라인트별이 아닙니다. 하나의 shared secret gate 앞에, guarantee 할 가치가 있는 것은 총 추측룰 상 установление 젥어하는 것이며, 주소별 한도 한овая 그런 상한을 제공 못합니다. Who 공격자가 source 주소를 바꾸면 의 self fresh budget.

  • 토큰을 문 앞서 차단. The Authorization 헤더가 MCP 서버로 전달되지 않습니다. 는와 함께 프록시가 soket? ... The hop-by-hop헤더도 함께서. 커넥션 업그레이드 요청(WebSocket 등)은 MCP transport가 upgrade to never do so, so 501 응답을 하되 퍼록시 하지 않습니다.

하지 않는 일

This one door is only and not 방어 in depth. It does not sandbox RCE, does not cap what auth caller may do, but does not per-client identity 합니다. 토큰을 anyone same subject. And the rate limit above only slows guessing, not misuses of already stolen tokens. 가능하면 위에 something more strong to 층이하세요:

  • 서비스에 접근 possible scope 제한하세요. 당신이 확안한 주소로 제한 [인바운드 IP 규칙](: https://render.com/docs/inbound-ip-rules) (Scale 및 Enterprise 플랜) for stolen token은 다른 어떤 곳에서 사용하지 못하.

  • 아예 공개로 노출하지 마세요. MCP client가 다른 Render 서비스라면 render.yaml에서 type: web을 type: pserv로 바어 [프라는 서비스]로 변환합니다. (private service -> better), thus no public URL but layered: token not still applies. Note: It also has no RENDER_EXTENAL_HOSTNAME, so host check falls back to * and startup banner prints localhost URL; private network으로 접 하세요.

  • 토큈를 비밀번호 취급하세요. Sharing configuration and issue траker에 넣지 말 것, leak suspected하면 Dashboard에서 로테이하세요 (redeploying will pick up new value). Serious done with them then suspend or delete.

  • 지켜보세요. 서비스 로그와 메트릭은 내가 not implicated 활동를 감지하 것을; 401 lines은 누가 recoloring를 계속 try.

This shared budget for test important one point: right before debugging, consider 이것 하나를 알면좋: who someone has been exhaust the budget, request carrying wrong token receives 429 instead 401. Actually if empty it for indefinite - ten refused per minute all it takes - so service after being continuously background scan can be normal state not unusual 등. Token used in test in the end is stale (Dashboard rotated, or a previous service), status code won't say reason. Fix is check token rather than wait for Retry-After. Correct token request on either carries unaffected. That's why accept trade: budget can empty anyone, but the lockout it cause never aim you.

The host check on entrypoint sentization see Configuration is a Host-header check for DNS and not access control. That doesn't stop direct request with valid token.

"Playwright MCP 버В up"

The version is pinned exactly one place: base-image tag in Dockerfile.render. To bump, change tag, commit, and redeploy. (runtime: docker images are not auto pleployed if tagress *tag changes? Actually it's base-image tag: Contain. "Un deploy does not auto. Deploy on deployed new pull of new base.)

Then re-check two assertion in Security cross new tag's upstream README: "browser_run_cod_unsafe still Core automation? Should tell (non-opt-in) and --capes still only adds capabilities? Update the section's permalink to new tag — same as it is only version literers. Because new tag has.

Step by "Now re-verify the gate because it depends on upstream's HTTP surface. npm run test:wrapper covers the gate logic itself in seconds (without Docker: failure budget, response 401/429/200 on stub upstream), and ./render-smoke-test.sh builds new image and checks end to end: without header 401, after repeated bad token 429, correct token handshake, real tool call via SSE path, clean shutdown. CI runs both for every PR, so PR "opening one" enough. If upstream provides real authentication in future, prefer it and delete render-auth-proxy.mjs — this file only because missing that gap.

Ververlasting: "Do Not keep in sync — impossible! Actually "equals" a faction. "분 Not to keep in sync 삼아하세요" Actually the brawn =:

The version field in [package.json] is not one to b sync with. Because repo forks microsoft/playwright-mcp. And deploy never uses it (Dockerfile.render only copies render-entrypoint.sh, render-auth-proxy.mjs, render-auth-limiter.mjs). Expect it to differ from image tag; leave it alone.


Based on microsoft/playwright-mcp · Render에서 배포됨..env.example에는 PLAYWRIGHT_MCP_HOST, PLAYWRIGHT_MCP_HEADLESS, PLAYWRIGHT_MCP_NO_DANDBOX도 나열되어 있습니다. 이 변수들은 서버를 (이미지 외부에서) 직 실행할 때만 의미있습니다. Render을에 render-entrypoint.sh가 항상 그에 해당하는 CLI 플래그를 전달하며 CLI 플래그가 우선되므로, Render 대시보드에서 설정해도 소용이 없습니다. 유일한 예외는 PLAYWRIGHT_MCP_ALLOWED_HOSTS이며, 엔트리포인트는 이 것만 실제로 존중합니다.

엔트리포인트는 Render의 RENDER_EXTENAL_HOSTNAME을 통해 서버의 호스트 검사를 서비스 고유의 onrender.com 호스트명으로 자동 좁은입니다. [사용자 정의 도메인]을 추가하면 PLAYWRIGHT_MCP_ALLOWED_HOSTS를 설정하기 전까지 그 도메인으로의 요청이 호스트 검사에 거부됩니다(럼로 구분, 예: myapp.com,myapp.onrender.com; *는 검사 비활성).

브라우저 프로필 상태

엔트리포인트는 프로필 플래그를 전달하지 않으므로 Playwright MCP의 기본 즉로 영구 프로필(컨테이너 파일 시스템의 ~/.cache/ms-playwright/mcp-*)을 사용합니다. 알만한 두 가지 결과가 있습니다.

  • 로그인은 호출 사이에 유지됩니다. 대부분 원하는 동작입니다. 호스팅된 브라우저에서 한 번 인증하면 이후 세션도 그 세션을 재사용합니다. URL을 가리키는 모든 클라인트가 그 하나의 프로필을 공유하므로, 이는 서비스가 당신 것이란 것을 전제합니다(보안 참고). Disk가 연결되어 있지 않으므로 로그인은 재시작이나 재배포 시 지워집니다.

  • 동시 클라인트가 충돵할 수 있습니다. 상단에 의하면 영구 프로필 "동일한 작업 공간을 공유하는 동시 MCP 클라인트들은 충돌합니다" — 즉, 하나의 URL에 둪 개의 에디터가 붙으면 충돵할 수 있습니다. 인스턴스를 한 개 이상으로 확장해도 각 인스턴스가 각자만의 프로필을 갖습니다.

두 가지를 바꾸하려면 render-entrypoint.sh를 편집하세요:

원하는 것

추가할 것

세션마다 새 인메모리 프로필, 닫았을 때 폐기

--isolated

재배포 후에도 남는 프로필(저장된 로그인)

a Render Disk + --user-data-dir <mount-path>

보안

실제로 실행되고 있는 것

Playwright MCP는 browser_run_cod_unsafe를 노출합니다. 업스트림은 이렇게 설명합니다: "Playwright 코드 스니펫을 실행합니다. 위험한 일입니다: Playwright 서버 프로세스에서 임의 JavaScript를 실행하며 RCE와 동등합니다." 고정된 버전에서는 이 것이 옵션의 capbilities가 아니고 Core automation에 나열되어 있습니다. --capes은 added capbilities(vision, pdf, devtools)만 활성화하므로, 이 도구를 "" 수 없고, 개별 도구를 제외할 수 있는 플래그도 없습니다. 이 서버를 호출할 수 있는 사람은 누구든 컨테이너 사용자로서 컨테이너에 코드를 실동하고, 프라이بر 네트워크를 통해 Render의 otros services를 공격할 수 있습니다.

업스트림은 HTTP 모드에서 인증을 제공하지 않습니다. 서버가 npx로 렵톱의 루프백에 실행될 때는 맡아 성합니다. 그런데 Render에하여 it's public URL을 갖게 되므로, the 텐플레이트 gate는 그 빼진 문을 추가 you.

템플트이의이 대처

Only thing listening: render-auth-proxy.mjs is what $PORT is listening on. Any no Authorization: Bearer $MCP_TOKEN request answer 401, and the rest it forwards to MCP server that is bind 127.0.0.1 never published. Concretely:

  • Fail-closed 닫.폐은. MCP_TOKEN가 not present, no start = Not to disable this safe check. Misconfiguration cannot lead a server anonymousReal.

  • 암호 not default. render.yaml uses generateValue: true "service get own unique token, generate on first creation, stable redeploy, so recording keep works. In this repo, there is no pdiguous token to leak.

  • Time-constant evaluation of SHA-256 she webs = The token does not lum leak one byte at a time and prefix not pass.

  • token not log. Refused only..The method remains, path, and 401 — always the no client presented.

  • Budget rate of rules: Bad tokens one global budget: in one minute ten attempts, the rest of the window 429 and Retry-After and "log" line once, not times. The budget only spends on requests would be refused anyway, so a valid token is never barred — cannot blocking them, and even during attacker lockout it returns. This is intentionally not per client: this is a gate that one shared secret, so what should и the floor is the entire guess rate; per contact limit does not guarantee — if an attacker перемены? Hmm.

  • drops the token at the door. The Authorization header doesn't forward to MCP server, like hop-by-hop headers agent undergo. connection upgrades (WebSocket, etc.) 501, not proxy? Proxy on WS. Never required. Their trans.

No guarantee

The sentence: "This is 1 door, not in-depth. It doesn't sandbox the RCE, doesn't cap by for a credenticated, doesn't give principal per client — anyone with token is same principal, above rate is to slow guess not misuse leaked?? If possible, to top layer?*:

  • What can hit service? Apply [inbound/yet]. addresses your known: plans on Scale and Enterprise so stolen token unusable.

  • Nothing from public. If MCP client is another Render service, in render.yaml: type: web → type: pserv — to [private service] not public URL; better security, token remains. Note: no RENDER_EXTERNAL_HOST_NAME, host back *, and banner prints localhost URL, access over private network.

  • `token is as password. Don't put to shared config or tracker in question, rotate if leak (redeploy and gets new), when 중지? "when done" suspend or delete.

  • eyes on it... Logs are your detection. 401 means someoneknocking.

One that shared budget has another side, worth before debulling: while under exhaustion, the wrong token is 429 instead of 401. Anyone empty? indefinite, as failure. So a service that's actively scanning background is perhaps is in lockout, no.

Retry-After if token actually revoken? Or from old copy can't tell, to fix inspect the token itself, not waiting. Right? Good, token is fine either way so it's acceptable: the shared can be drain any; the lockout cannot target people anyway not you.

The host range shown (see [Configur]"notif) is host-header" against DNS Rebind — not means. It doesn't stop the "valid token" the call.

"RollPlaywright MCP" version

Param: Fixed in single, the base-image tag of Dockerfile.render. Change tag, commit, redeploy. Note "runtime: docker" does not auto: new copy pulls image.

"Then check again see two claims on [Sec]: "if any tool browser_runc_run_the_cod_unsafe still no, get; connection only not"? Wait "non-optin Core automation tool, and whether --caps still only additional...* New tag's upstream README or does it leave the entry point? Change the permalink to new either — only other literal string version of your. It will.

Then verify, turns: run npm run test:wrapper is enough? It covers no Docker - fast: failure budget and proxy's "401/429/200" against stub, and ./render-smoke-test.sh builds new image end-to-end and checks: bad header 401, revoked 429 after many bad, noisy, correct handshake, a real tool via SSE, do shutdown. CI both each PR open, so openopening.

"Upstream shipping real authentication can come true, prefer, delete render-auth-proxy.mjs — file only to fill the gap.

Core design: Be careful: "version" column not to be in sync. package.json field stays because this repo is fork to microsoft/playwright-mcp, and version is upstream npm release (Dockerfile.render only copies fixed render-entrypoint.sh, render-auth-proxy.mjs, and render-authlimiter . It's intentionally different, leave.


Based on [Render /microsoft-com] * · "Deploy on Render?" Our answer:

Need to combine properly. Final:

"Based on microsoft/playwright-mcp · Render "deploys" etc. In Korean:

"Based" not. Let's incorporate.

We'll deliver final..env.example 안에는 PLAYWRIGHT_MCP_HOST, PLAYWRIGHT_MCP_HDLESS, PLAYWRIGHT_MCP_NO_DANDBOX도 나열되어 있습니다. 이 변수들은 서버를 (이미지 외부에서) 직 실행할 때만 의미가 있습니다. Render에서는 render-entrypoint.sh가 항상 이에 해당하는 CLI 플래그를 전달하고 CLI 플래그가 우선하므로, Render 대시보드에서 설정해도 아무 효과가 없습니다. 유일한 예외는 PLAYWRIGHT_MCP_ALLOWED_HOSTS이며, 이것만 엔트리포인트가 존중합니다.

엔트리포인트는 Render의 RENDER_EXTENAL_HOSTNAME을 통해 서버의 호스트 검사를 서비스 고유의 onrender.com 호스트명에만 적용되도록 자동 좁습니다. 사용자 정의 도메인을 추가하려면 PLAYWRIGHT_MCP_ALLOWED_HOSTS를 설정하기 전까지 그 도메인으로의 요청이 호스트 검사에서 거부됩니다(로로 구분, 예: myapp.com,myapp.onrender.com; *는 검사 해제).

브라우저 프로필 상태

엔트리포인트는 프로필 플래그를 전달하지 않으므로 Playwright MCP의 기본 동작을 사용하게 됩니다. 컨테이너 파일 시스템에 저장되는 영구 프로필(persistent profile, ~/.cache/ms-playwright/mcp-*)입니다. 알아두어야 할 두 가지 결과があります.

  • 로그인은 호출 사이에 유지됩니다. 대부분 원하는 결과입니다. 호스팅된 브라우저에서 한 번 인증하면 이후 세션도 해당 세션을 다시 사용하게 됩니다. URL을 가리키는 모든 클라인트가 그 프로필 하나를 공유하므로, 이 서비스가 당신의 서비스라는 전제가 필요합니다(보안 참고). Disk가 연결되어 있지 않으므로 재시작이나 재배포 시 프로필이 사라집니다.

  • 동시 클라인트가 충돵 가능합니다. 업스트림은 "영구 프로필은 한 번에 하나의 브라우저 인스턴스에서만 사용할 수 있으므로, 동일한 작업 공간을 공유하는 동시 MCP 클라인트는 충돌합니다"라고 설명합니다. 즉 두 개의 에이더가 하나의 URL을 맡고 있으면 충돌할 수 있습니다. 인스턴스를 하나 이상으로 확장해도 각 인스턴스에는 자각만의 프로필이 생깁니다.

이 중 하나를 변경하려면 render-entrypoint.sh를 편집하세요:

원대는 것

추가할 것

세션마다 새 인메모리 프로필, 닫았을 때 폐기

--isolated

재배포 후에도 남는 프로필 (저장된 로그인)

Render Disk + --user-data-dir <mount-path>

보안

실제로 실행되는 것

Playwright MCP는 browser_run_cod_unsafe를 노출합니다. 이 기능에 대스토림의 설명은 다다과 같습니다: "Playwright 코드 스니펫을 실행합니다. 위험: Playwright 서버 프로세스에서 임의의 JavaScript를 실행하며 RCE와 동등합니다." 고정된 버전에서는 이 도구가 옵트인 기능이 아닌 Core automation 범주에 나열되어 있고, [--capes]*(은 "추가" 능만 활성화하므로 --capes(vision, pdf, devtools) ... Actually I must keep the code. Let's correct the sentence:

고정된 버전에서는 이 도구가 옵트인 옵션이 아닌 Core automation 범주에 나열되어 있고, --caps은 추가능(vision, pdf, devtools)만 수 있되 -- 없음. such that, this gate can't remove the tool, and no flag that excludes individual tools. **Anybody who can call this server will run code as in your container as container user, and through private network to all other Render services.

Upstream in HTTP mode does no authentication, such as npx running loopback of laptop okay. Render gives public URL, therefore template adds missing door.

템플레이트가 대응하는 방법

render-auth-proxy.mjs it is # only thing $PORT listens to. It returns 401 to any request without Authorization: Bearer $MCP_TOKEN, and forwards others to MCP server on 127.0.0.1 never published. Concretely:

  • Fails closed. No MCP_TOKEN no. No flag to disable. Good config can't be anon.

  • 생성된 시크릿, 기본값이 아닙니다. render.yaml generateValue: true in each service create own token 서비스가 생성될 때 한 번 나오고 재배포 전반 stable, so 클라인트 don't suffer. The repo has nothing shared to leak.

  • SHA-256시간 비교를 통한 constant time. The digest check doesn't leak byte by byte token, no quick prefix okay.

  • Never do logs token. Rejection account: no proxy. `lone should log. The client's containt lost.

  • 추측률 제한. Bad attempts one global budget: 10 if a minute. After expenditure, window remainder yield 429 and Retry-Arfter, not one log per try. Budget only from attempts to be refused anyway, therefore valid token never affected. The lockout can't be direct toward you, and you while an attacker knocks can still pass. It's not per client: the gate has only a shared secret, so per-address limit is unreliable — each node reverse attacker will just no new budget. Global cap is worth it.

  • The token ends at the door. Resource Auth header is not transferred, and hop-by-hop required to drop. Upgrades (WebSocket) SOCK not проксиру, MCP never require upgrade.

It do not do

"One door not depth. It's no sandbox RCE, no in-app auth principal, no per identity – Everyone holding token it one principal, rate limit for guessed, not secure against the leaked by external unknown, not by token misused. You can to strengthen:

  • Bound the possible access. [Inwhat] addresses only inbound toFolder known from allows Plan . It doesn't stolen from; unknown.

  • **Do not public at all. If your MCP client another Render service, convert type: web to type: pserv in render.yaml to {private}. Then no public URL, safer, but token still works. It has no RENDER_THAT_HOSTNAME, so hostat " default * and prints localhost URL. reach pronet.

  • Token as a passphrase. Avoid shared .conf and ticket. In Dashboard rotate if leaked (newly adapted. If done, pause or delete.)

  • Watch. Logs and metrics see "uninitiated", 401 line is one knock on door.

The shared "global budget" consequence worth learning before to debug: When the budget is being consumed, a wrong token climbs no 401 but 429. **Anybody can keep it empty — 10 failures one minutes all. Therefore on a service that attracts scans it may be normal, not anomaly. You are using old rotated token not, error code will not state. Fix is check token, not wait retry. The right-token's response still OK — That's why trade acceptable: anyone can empty it; but can't "ban you.

The host rule "entrypoint" (see hoistingConfiguration]): It's Host-header DNS rebinding, and not access control: direct calls with valid token can't block.

Rolling Playwright MCP

Version pin only one place: Dockerfile </> latest fetched in Dockerfile.render. Update, copy, commit and redeploy. (runtime: docker images don't auto-change: new deploy will pull base.)

Then review "the two claims" in Security with that tag README. That is, browser_run_code_unsafe still Core option unchecked; --capes still additive. Change permalink at tag. Version literal never else; since permalink needs a version. Fine.

Then check the gate again, since the gate depends on HTTP surface. npm run test:wrapper covers the gate logic in seconds (no Docker) and for a dummy upstream 401/429/200; ./render-smoke-test.sh encapsulates new image and test: no header → 401, wrong tokens → 429, handshake good, real call through SSE, clean leading. CI does both every PR, open a PR is ideal. If upstream adds an authentication, and use it, delete render-auth-proxy.mjs -- it exists to fill. But until then.

Note with a dot: version in package.json is not to be sync. This repo is a fork of microsooft/playwright-mcp, therefore that field for instance is upstream's own release marker — and deploy no use; Dockerfile.render only copies render-entrypoint.sh, render-auth-proxy.mjs, render-auth-limiter.mjs. It will differ from them. Let it.


Based on microsoft/playwright-mcp · Deployed to Render.

Available Tools

23 tools
browser_clickB
Destructive

Perform click on a web page

NameRequiredDescriptionDefault
buttonNoButton to click, defaults to left
targetYesExact target element reference from the page snapshot, or a unique element selector
elementNoHuman-readable element description used to obtain permission to interact with the element
modifiersNoModifier keys to press
doubleClickNoWhether to perform a double click instead of a single click

TDQS

B3.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=false and destructiveHint=true, indicating the tool mutates state and can be destructive. The description adds no further behavioral disclosure, such as possible navigation or permission requirements. It does not contradict annotations, but provides no value beyond them.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single concise sentence with no filler. However, it is terse and omits useful context that could be added without bloat, such as the requirement for a snapshot target. It is appropriately sized but not front-loaded with any distinguishing information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's moderate complexity (5 parameters, no output schema), the description alone is minimally sufficient because the schema fully describes parameters. However, it lacks context about return values, when to use click vs other actions, and potential side effects. The schema covers parameter semantics, so a score of 3 is appropriate.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, with every parameter documented (e.g., target is 'Exact target element reference from the page snapshot, or a unique element selector'). The description itself adds no additional parameter meaning, so the baseline of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Perform click') and the resource ('web page'), which is specific enough. However, it does not differentiate from sibling interaction tools like browser_hover or browser_drag; the agent must infer that 'click' is a distinct action without additional context. It is unambiguous about the core operation but lacks detail on the target element requirement.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives. It does not mention prerequisites such as needing a page snapshot to obtain a valid target, nor does it contrast with browser_hover or browser_drag. An agent receives no context for tool selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

browser_closeB
Destructive

Close the page

NameRequiredDescriptionDefault

No parameters

TDQS

B3.3/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotation already indicates destructiveHint=true, so the agent knows the action is destructive. The description simply repeats that by saying 'close' without adding any extra context about side effects (e.g., whether it closes just the current tab, loses unsaved state, or affects other tabs). It does not contradict the annotation, but it adds no new behavioral information.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise, using only three words. It communicates the essential action and target without any fluff, making it easy to parse and understand quickly.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the simplicity of the tool (no parameters, no output schema), the description is functional but lacks completeness. It leaves open the scope of 'close'—does it close the current page/tab, or the entire browser? In a context with sibling tools like browser_tabs, this ambiguity could be problematic. More detail would improve it.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There are no parameters, so the schema coverage is trivially complete at 100%. The description does not need to explain any parameter semantics, and the baseline score of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description 'Close the page' clearly states the action (close) and the resource (page), making it unambiguous. It is distinct from sibling tools like browser_navigate or browser_snapshot, so an agent can easily identify it.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives. It does not mention potential alternatives (e.g., using browser_tabs to manage multiple pages) or any conditions that would make closing appropriate. The context is minimal and leaves the decision entirely to the agent.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

browser_console_messagesB
Read-only

Returns all console messages

NameRequiredDescriptionDefault
allNoReturn all console messages since the beginning of the session, not just since the last navigation. Defaults to false.
levelYesLevel of the console messages to return. Each level includes the messages of more severe levels. Defaults to "info".info
filenameNoFilename to save the console messages to. If not provided, messages are returned as text.

TDQS

B3.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate readOnlyHint true and destructiveHint false, so the description adds no conflicting side-effect information. It does not elaborate on behavior such as saving to a file, but that is covered by parameter descriptions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single clear sentence with no redundancy, front-loading the verb and object.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple read-only tool with full schema coverage, the description is adequate, though it omits explicit use-case guidance and output format details beyond what the schema provides.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with detailed parameter descriptions, so the tool description itself does not add meaning beyond the schema, but no parameter meaning is missing.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description uses a specific verb 'Returns' and identifies the resource 'console messages' with scope 'all', making the tool's purpose clear and distinct from sibling tools such as network request retrieval.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives like browser_network_requests or browser_snapshot, nor does it mention filtering or filename-saving scenarios.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

browser_dragA
Destructive

Perform drag and drop between two elements

NameRequiredDescriptionDefault
endTargetYesExact target element reference from the page snapshot, or a unique element selector
endElementNoHuman-readable target element description used to obtain the permission to interact with the element
startTargetYesExact target element reference from the page snapshot, or a unique element selector
startElementNoHuman-readable source element description used to obtain the permission to interact with the element

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate destructiveHint=true and readOnlyHint=false, so the destructive nature is covered. The description adds no extra behavioral context such as side effects on the DOM or event firing, but it does not contradict the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single concise sentence that front-loads the action and provides the core information without any irrelevant detail.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple action with well-described parameters and no output schema, the description is mostly complete. It does not mention any return values or wait behavior, but the lack of output schema makes this acceptable. It could have added a note about the order of start and end parameters, but the parameter names and descriptions handle that.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% with all four parameters described. The tool description adds no additional parameter semantics beyond what the schema already provides, so the baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action (perform drag and drop) and the resource (between two elements), distinguishing it from sibling tools like browser_click, browser_hover, and browser_drop. It is specific and unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description does not provide any guidance on when to use this tool versus alternatives. It does not mention conditions such as needing to move an element or triggering drag-and-drop events, nor does it reference sibling tools like browser_drop or browser_click.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

browser_dropA
Destructive

Drop files or MIME-typed data onto an element, as if dragged from outside the page. At least one of "paths" or "data" must be provided.

NameRequiredDescriptionDefault
dataNoData to drop, as a map of MIME type to string value (e.g. {"text/plain": "hello", "text/uri-list": "https://example.com"}).
pathsNoAbsolute paths to files to drop onto the element.
targetYesExact target element reference from the page snapshot, or a unique element selector
elementNoHuman-readable element description used to obtain permission to interact with the element

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already convey destructive and non-read-only behavior, so the description does not need to repeat that. The description adds useful semantic context about simulating an external drag, but does not disclose any side effects beyond the basic drop action.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, focused sentence that concisely explains both the action and the key parameter requirement. No filler or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description, combined with the detailed schema and annotations, provides enough information to invoke the tool correctly. There is no output schema, so return-value details are not required, and the parameter permission explanation is handled by the 'element' field description.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

All parameters have clear schema descriptions. The tool description adds an important cross-parameter constraint that at least one of 'paths' or 'data' must be provided, which is not otherwise expressed in the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action: dropping files or MIME-typed data onto an element. It uses a specific verb and resource, and distinguishes itself from in-page drag operations by specifying 'as if dragged from outside the page'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives a useful usage constraint ('At least one of paths or data must be provided') and hints at external drag context, but it does not explicitly name sibling tools or state when to prefer this over browser_file_upload or browser_drag.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

browser_evaluateB
Destructive

Evaluate JavaScript expression on page or element

NameRequiredDescriptionDefault
targetNoExact target element reference from the page snapshot, or a unique element selector
elementNoHuman-readable element description used to obtain permission to interact with the element
filenameNoFilename to save the result to. If not provided, result is returned as text.
functionYes() => { /* code */ } or (element) => { /* code */ } when element is provided

TDQS

B3.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already flag destructiveHint=true and readOnlyHint=false, so the agent knows this can modify state. The description adds minimal context beyond that—it mentions 'on page or element' but doesn't warn about the power of arbitrary JS execution or potential side effects. Since the annotation covers the destructive nature, the description's lack of extra detail keeps it at a baseline 3.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single, clear sentence with no redundant words. The action is front-loaded and easy to parse. This is appropriately concise for a tool whose parameter details are already in the schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given that this tool executes arbitrary JavaScript with destructive potential, the description is too sparse. It doesn't mention that the function can modify the page, that results can be saved to a file (though schema covers it), or that there is a separate unsafe variant (browser_run_code_unsafe) that might be more appropriate for certain tasks. The description lacks the context an agent needs to safely and correctly use this tool, especially when annotations already warn about destructiveness but the description provides no additional guidance.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so all four parameters are documented in the schema itself. The description does not add any meaning beyond what the schema provides—it doesn't elaborate on the function syntax, target usage, or filename behavior. With high schema coverage, the baseline is 3, and the description contributes nothing extra.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Evaluate' and the resource 'JavaScript expression on page or element', making the core purpose obvious. However, it doesn't distinguish from the sibling browser_run_code_unsafe, which might also execute code, so it loses a point for not differentiating between similar tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance on when to use this tool versus alternatives like browser_run_code_unsafe or when to avoid it. No context about prerequisites (e.g., page must be loaded) or scenarios that favor this tool over others. The description simply states the action without any usage direction.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

browser_file_uploadB
Destructive

Upload one or multiple files

NameRequiredDescriptionDefault
pathsNoThe absolute paths to the files to upload. Can be single file or multiple files. If omitted, file chooser is cancelled.

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations already indicate destructive behavior and non-read-only semantics, so the description does not need to restate those. However, the description does not mention side effects beyond uploading, such as navigating away, opening or cancelling a file chooser, or potential overwrite behavior, though the parameter description partially covers the cancellation case.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise and free of filler. Every word contributes meaning, and the parameter description adds necessary details without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple one-parameter tool with no output schema, the description and parameter comment cover the essential input and basic behavior. However, it does not describe what happens after the upload, what success or failure looks like, or how this fits into the broader browser automation workflow, leaving some practical context missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema only defines an array of strings, but the parameter description adds important meaning: paths must be absolute, multiple files are allowed, and omitting the parameter cancels the file chooser. This goes beyond the raw schema and helps an agent use the parameter correctly.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Upload') and the resource ('files'), and specifies 'one or multiple'. It does not explicitly state the destination or context, but the tool name and sibling set make the browser file-upload intent sufficiently clear.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives no guidance on when to use this tool versus alternatives such as browser_drop or other browser interaction tools. It also does not mention prerequisites like whether the file chooser must already be open or how paths should be formatted beyond 'absolute'.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

browser_fill_formB
Destructive

Fill multiple form fields

NameRequiredDescriptionDefault
fieldsYesFields to fill in

TDQS

B3.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations already declare readOnlyHint=false and destructiveHint=true, so the write and potentially destructive nature is covered. The description adds the 'multiple form fields' detail but does not disclose additional behavior such as overwriting values or submitting the form.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single clear sentence with no redundant words or boilerplate. It is appropriately short and easy to parse, though it sacrifices deeper context for brevity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The rich schema fully documents the nested field objects, including target references, type-specific value behavior, and permission-related element descriptions. Combined with the read-only and destructive annotations, the description is sufficient for correct invocation; only alternative-selection guidance is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%: the fields array and its nested target, name, type, value, and element properties all have descriptive text. The description itself does not add parameter-level meaning beyond what the schema already provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description 'Fill multiple form fields' clearly identifies the action and resource, and the word 'multiple' helps distinguish it from single-field tools like browser_type. It does not explicitly contrast with sibling tools, but the core purpose is unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided for when to use this tool instead of alternatives such as browser_type, browser_select_option, or browser_click. The term 'multiple' implies batch usage, but there is no explicit when-to-use or exclusion context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

browser_handle_dialogC
Destructive

Handle a dialog

NameRequiredDescriptionDefault
acceptYesWhether to accept the dialog.
promptTextNoThe text of the prompt in case of a prompt dialog.

TDQS

C2.2/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations indicate readOnlyHint=false and destructiveHint=true, covering the main safety aspect. However, the description adds no detail about side effects, such as submitting a form or canceling a prompt, beyond what the parameter names imply. It does not clearly disclose the consequences of accepting or rejecting.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness2/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely short and lacks necessary detail, making it under-specified. It is terse but not informative enough to guide an agent effectively, similar to a placeholder like 'Process'.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema or additional context is provided. The description does not explain what happens after handling the dialog, how the parameters interact, or any post-conditions. This is insufficient for an agent to fully understand the tool's behavior.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with clear descriptions for both 'accept' (boolean) and 'promptText' (string for prompt dialogs). The description does not add extra meaning, but the schema already provides adequate parameter semantics, so the baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose3/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description 'Handle a dialog' identifies the action and resource but is vague. It does not specify the type of dialog (alert, confirm, prompt) or the precise effect, though the 'accept' parameter implies accept/dismiss. It is distinct from sibling tools, but the purpose is under-specified.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines1/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided about when to use this tool, such as after a dialog appears or in contrast to other browser actions. The description gives no context for the appropriate situation.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

browser_hoverA
Destructive

Hover over element on page

NameRequiredDescriptionDefault
targetYesExact target element reference from the page snapshot, or a unique element selector
elementNoHuman-readable element description used to obtain permission to interact with the element

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate readOnlyHint=false and destructiveHint=true, so the description doesn't need to re-state them. The description adds no extra behavioral detail about side effects (e.g., triggering JavaScript events, potential menu changes). With annotations present, the bar is lower, but there's still room for more transparency about outcomes.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise—six words, no redundancy, and perfectly focused on the action. It follows a clear verb-object structure with no extra fluff, making it easy to parse and understand.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple interaction tool, the description, alongside the parameter schema and annotations, is adequate. It lacks details on return values (but no output schema exists) and does not mention any prerequisites or setup. Given the simplicity, it covers essential context without being overlong.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Both parameters (target and element) have descriptions in the schema, achieving 100% coverage. The tool description does not add further meaning beyond the schema; it simply restates the action. Since schema coverage is complete, a baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action (hover) and the target (element on page). It distinguishes itself from sibling tools like click, drag, and type by specifying the hover action. However, it lacks detail about what the hover does (e.g., showing tooltips or hover menus), but the core purpose is clear.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives no explicit guidance on when to use hover versus other interactions. While it's intuitive that hover is for mouse-over actions, the description doesn't mention edge cases or alternative tools (e.g., use click for activating, hover for previews). It provides minimal implicit usage context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

browser_navigateC
Destructive

Navigate to a URL

NameRequiredDescriptionDefault
urlYesThe URL to navigate to

TDQS

C2.7/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description does not elaborate on side effects such as discarding the current page, waiting for load, or handling errors. While annotations indicate destructiveHint=true, the description adds no extra context about the navigation behavior beyond the literal action.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, direct sentence with no unnecessary words. It is appropriately sized for the simple action, though it could benefit from some additional context without becoming verbose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description lacks important context such as whether navigation waits for page load, how errors are reported, or the impact on the current browsing session. Given the tool modifies state (as indicated by destructiveHint), more context about the navigation behavior would be expected.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema fully describes the only parameter 'url' with the same text as the description. Since schema coverage is 100%, the description adds no additional meaning or constraints (e.g., format, absolute vs. relative) beyond what is already in the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action 'Navigate to a URL' with a specific resource. It distinguishes from sibling tools like browser_navigate_back by implying forward navigation to a new URL, though it could be more explicit about the effect on the current page.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines1/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool over alternatives. It does not mention scenarios where browser_navigate is preferred over browser_navigate_back or other navigation methods, nor any prerequisites or exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

browser_navigate_backA
Destructive

Go back to the previous page in the history

NameRequiredDescriptionDefault

No parameters

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description and annotations are consistent; destructiveHint is true, matching the navigation action which changes the current page. The description adds minimal behavioral context beyond the annotations, but does not contradict them. It does not mention potential side effects like what happens if there is no history or whether it affects new tabs.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, concise sentence with no redundant wording. It directly states the action and target without unnecessary detail, which is ideal for a tool with no parameters.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple, parameterless tool, the description is largely complete. It communicates the essential operation. It could be improved by noting the behavior when there is no previous history entry, but the given context is sufficient for most use cases.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so the description does not need to explain parameter semantics. The empty input schema is fully covered by the lack of parameters, making this baseline appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action: 'Go back to the previous page in the history.' It identifies the resource (browser history) and the direction (back), making the core purpose unambiguous. It does not explicitly differentiate from sibling tools like browser_navigate or browser_tabs, but the meaning is clear enough in context.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use the tool: when the user wants to go back to the previous page in history. However, it provides no explicit guidance on when not to use it, such as when a direct URL navigation via browser_navigate would be more appropriate, or what to do if no prior history exists.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

browser_network_requestA
Read-only

Returns full details (headers and body) of a single network request, or a single part if part is set. Use the number from browser_network_requests.

NameRequiredDescriptionDefault
partNoReturn only this part of the request. Omit to return full details.
indexYes1-based index of the request, as printed by browser_network_requests.
filenameNoFilename to save the result to. If not provided, output is returned as text.

TDQS

A4.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, covering safety. The description adds that it returns headers and body and can filter to a part, but does not elaborate on output structure or edge cases. Given annotation coverage, a 3 is appropriate.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences with no redundant wording. The main purpose is front-loaded, the part option is explained, and the source of the index is given. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only retrieval tool with full schema coverage and annotations, the description is sufficient. It explains the return type (full details or part) and the index source. It lacks explicit output format details, but the enum values for 'part' are self-explanatory.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with descriptions for all parameters, so the schema already documents them. The description adds critical value by explaining that 'index' comes from browser_network_requests, which is not in the schema, enhancing clarity.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool returns full details of a single network request, with an optional 'part' parameter to narrow down. It distinguishes from the sibling tool browser_network_requests by referencing its index, making the purpose unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The instruction 'Use the number from browser_network_requests' explicitly guides when to use this tool—after obtaining a listing. It does not explicitly mention alternatives or exclusions, but the context is clear enough for an agent to decide.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

browser_network_requestsA
Read-only

Returns a numbered list of network requests since loading the page. Use browser_network_request with the number to get full details.

NameRequiredDescriptionDefault
filterNoOnly return requests whose URL matches this regexp (e.g. "/api/.*user").
staticYesWhether to include successful static resources like images, fonts, scripts, etc. Defaults to false.
filenameNoFilename to save the network requests to. If not provided, requests are returned as text.

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, covering the safety profile. The description adds valuable context about the temporal scope ('since loading the page') and the numbered list format, which goes beyond annotations without contradicting them.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences with no redundancy. The primary action is front-loaded, and the companion tool reference is placed efficiently at the end. Every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description tells the agent what the tool returns (a numbered list) and how to proceed for details. Since there is no output schema, this is essential. It does not describe potential error cases or edge scenarios, but for a read-only list tool with strong schema coverage, it is sufficiently complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

All three parameters have schema descriptions covering 100% of the input schema. The tool description does not add any additional meaning to the parameters themselves, so the baseline of 3 applies; it neither enhances nor detracts from what the schema already provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it returns a numbered list of network requests since page load, and explicitly differentiates from the sibling tool browser_network_request by instructing to use that tool for details. This is a specific verb+resource with a clear scope.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives an explicit usage pattern: first call this tool to get a list, then use browser_network_request with the number for full details. This is clear guidance on when to use it versus its companion, though it does not mention any other alternatives or exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

browser_press_keyB
Destructive

Press a key on the keyboard

NameRequiredDescriptionDefault
keyYesName of the key to press or a character to generate, such as `ArrowLeft` or `a`

TDQS

B3.2/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description does not mention any side effects, such as triggering keyboard events or potential destructive behavior. The annotations indicate destructiveHint: true, but the description adds no additional behavioral context beyond that.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise — a single sentence that directly conveys the action. No unnecessary information or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple action with a single well-defined parameter, the description is adequate. It lacks mention of when to use this tool (e.g., for shortcuts or navigation keys) but is otherwise complete for basic invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The parameter 'key' is fully described in the schema with examples, and schema coverage is 100%. The description adds minimal extra meaning ('on the keyboard') but doesn't clarify key formats or special keys, which is already covered by the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action (press) and the resource (key on the keyboard). It is distinct from broader actions like navigate or click, though it does not explicitly differentiate from browser_type (typing) or browser_click (clicking).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus its siblings (e.g., browser_type for text entry or browser_click for mouse actions). The description lacks any contextual cues for choosing this tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

browser_resizeB
Destructive

Resize the browser window

NameRequiredDescriptionDefault
widthYesWidth of the browser window
heightYesHeight of the browser window

TDQS

B3.1/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description does not disclose any behavioral traits beyond the bare action. Annotations already indicate it is not read-only and is destructive, but the description adds no extra context about side effects like layout reflows or potential viewport changes.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, short declarative sentence with no unnecessary words. It is perfectly concise and well-structured for the simple action it describes.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple tool, the description is adequate, but it lacks any extra context such as units (e.g., pixels), constraints, or when resizing might be appropriate. Given the simplicity and schema coverage, it is minimally complete but not rich.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already provides descriptions for both parameters (width and height), achieving 100% coverage. The description adds no additional meaning about the parameters, so it stays at the baseline of 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action (resize) and the resource (browser window), making it distinct from sibling tools like navigate or click. However, it lacks any nuance about whether it resizes the viewport or the entire window, but the core purpose is clear.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided about when to use this tool versus alternatives. It does not mention scenarios like adjusting viewport for responsive testing or any conditions that would make it preferable to other navigation tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

browser_run_code_unsafeA
Destructive

Run a Playwright code snippet. Unsafe: executes arbitrary JavaScript in the Playwright server process and is RCE-equivalent.

NameRequiredDescriptionDefault
codeNoA JavaScript function containing Playwright code to execute. It will be invoked with a single argument, page, which you can use for any page interaction. For example: `async (page) => { await page.getByRole('button', { name: 'Submit' }).click(); return await page.title(); }`
filenameNoLoad code from the specified file. If both code and filename are provided, code will be ignored.

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare destructiveHint=true and openWorldHint=true, so the description's 'Unsafe: executes arbitrary JavaScript in the Playwright server process and is RCE-equivalent' adds specific severity and mechanism beyond the generic flags. This enhances transparency without contradicting annotations, though it could also mention side effects or sandboxing if any.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence that packs purpose and a crucial warning. It front-loads the action and immediately follows with the risk, maximizing information density with zero filler. Excellent structure.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (arbitrary code execution) and the lack of an output schema, the description does not mention the return value or error behavior. The example in the code parameter shows a return, but that's in the schema. For an advanced tool, this is a notable gap, but the core purpose and danger are clear. A 3 reflects the missing return semantics and operational details.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema covers 100% of parameters with detailed descriptions, including the precedence rule for code vs filename. The tool description adds no additional parameter meaning beyond the schema, so a baseline of 3 is appropriate. The schema does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action: 'Run a Playwright code snippet.' It specifies the resource (Playwright code) and immediately flags the critical distinction from siblings with 'Unsafe: executes arbitrary JavaScript ... RCE-equivalent.' This unambiguous verb+resource plus the danger label leaves no ambiguity about what the tool does and separates it from all other browser tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives a strong warning about safety ('Unsafe', 'RCE-equivalent') but does not explicitly state when to use it versus alternatives. It implies it's for advanced custom logic, but there is no direct 'use this only if...' or mention of safer alternatives. The warning serves as a caution but not a full usage guide.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

browser_select_optionB
Destructive

Select an option in a dropdown

NameRequiredDescriptionDefault
targetYesExact target element reference from the page snapshot, or a unique element selector
valuesYesArray of values to select in the dropdown. This can be a single value or multiple values.
elementNoHuman-readable element description used to obtain permission to interact with the element

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate destructive=true, so the description does not contradict that. But the description adds no further behavioral detail (e.g., side effects on the page). With annotations present, the bar is lower, and the description is neutral.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single concise sentence with no redundant words. It is well-structured and to the point.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is simple and the schema covers all parameters. The description is short but sufficient for a basic understanding. It does not specify whether values are labels or values, but that is a minor omission given the context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with clear parameter descriptions for target and values. The tool description itself does not explain parameters beyond what the schema already provides, so it adds no extra semantic value.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action (select) and the target (option in a dropdown), distinguishing it from more general actions like click or type. However, it does not explicitly contrast with sibling tools, so it misses a bit of distinction.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives. It does not mention when selecting is appropriate or when other actions (e.g., click, type) might be preferred.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

browser_snapshotB
Read-only

Capture accessibility snapshot of the current page, this is better than screenshot

NameRequiredDescriptionDefault
boxesNoInclude each element's bounding box as [box=x,y,width,height] in the snapshot. Coordinates are viewport-relative, in CSS pixels (Element.getBoundingClientRect)
depthNoLimit the depth of the snapshot tree
targetNoExact target element reference from the page snapshot, or a unique element selector
filenameNoSave snapshot to markdown file instead of returning it in the response.

TDQS

B3.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is clear. The description adds 'capture' but no further behavioral detail beyond what annotations convey.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single concise sentence. The phrase 'this is better than screenshot' adds some comparative value but could be considered slightly extraneous.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema and the description does not explain what format the snapshot takes, how parameters like depth or target affect the result, or what kind of accessibility information is included. This leaves important context missing for an agent deciding whether and how to call the tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema covers all 4 parameters with descriptions, so the baseline is 3. The description does not add any additional parameter meaning or usage notes beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a clear action ('capture') and object ('accessibility snapshot of the current page'), and distinguishes itself from screenshot with a comparative remark, though 'better than screenshot' is somewhat vague.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives minimal guidance by saying 'better than screenshot', but does not explicitly state when to use this tool over alternatives like browser_evaluate or browser_console_messages, nor when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

browser_tabsA
Destructive

List, create, close, or select a browser tab.

NameRequiredDescriptionDefault
urlNoURL to navigate to in the new tab, used for new.
indexNoTab index, used for close/select. If omitted for close, current tab is closed.
actionYesOperation to perform

TDQS

A3.5/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare destructiveHint=true and readOnlyHint=false, so the safety profile is known. However, the description adds no behavioral context beyond what the schema provides (e.g., index omission for close closes current tab is in schema). No mention of side effects like tab switching or browser-level changes.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence that efficiently lists all supported actions. It is front-loaded with verbs and avoids unnecessary words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has multiple actions and a required action parameter. The description lists the actions but does not explain action-specific requirements (e.g., URL required for new, index for close/select) or edge cases like closing the last tab. Given the schema covers parameter details, the description is adequate but not rich. With no output schema, the agent must infer return values from the action.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% with each parameter having a description (url, index, action with enum). The tool description adds no parameter-level detail, so it does not go beyond schema. Baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose with specific verbs (list, create, close, select) and a specific resource (browser tab). It distinguishes from siblings like browser_close (closes the entire browser) and browser_navigate (navigates current tab) by focusing on tab operations.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage through the list of actions but provides no explicit when-to-use guidance or exclusions. Given siblings like browser_close (closes the entire browser) and browser_navigate (navigates current tab), an agent might benefit from explicit differentiation, but the actions themselves are clear enough that usage is implied.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

browser_take_screenshotA
Read-only

Take a screenshot of the current page. You can't perform actions based on the screenshot, use browser_snapshot for actions.

NameRequiredDescriptionDefault
typeYesImage format for the screenshot. Default is png.png
scaleYesImage resolution scale. "css" produces a screenshot sized in CSS pixels (smaller, consistent across devices). "device" produces a high-resolution screenshot using device pixels (larger, accounts for the device pixel ratio). Default is css.css
targetNoExact target element reference from the page snapshot, or a unique element selector
elementNoHuman-readable element description used to obtain permission to interact with the element
filenameNoFile name to save the screenshot to. Defaults to `page-{timestamp}.{png|jpeg}` if not specified. Prefer relative file names to stay within the output directory.
fullPageNoWhen true, takes a screenshot of the full scrollable page, instead of the currently visible viewport. Cannot be used with element screenshots.

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations already indicate read-only and non-destructive behavior. The description adds useful context beyond annotations by clarifying that screenshots are not suitable for interaction and that browser_snapshot should be used for actions. This is helpful but not extensive.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and well-structured: two sentences that front-load the core purpose and immediately follow with a crucial usage caveat. There is no unnecessary verbosity or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the simple nature of the tool and the rich schema annotations, the description is largely complete. It could mention that screenshots are for visual inspection, but the title and schema fill most gaps. The explicit distinction from browser_snapshot adds important context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema description coverage is 100%, so the baseline is 3. The description itself does not add parameter details, but the schema already provides clear explanations for each parameter, including enums, defaults, and constraints.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action: 'Take a screenshot of the current page.' It also distinguishes itself from browser_snapshot by explicitly noting that screenshots cannot be used for actions, which helps differentiate it from a key sibling tool.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It provides explicit when-not-to-use guidance by stating 'You can't perform actions based on the screenshot, use browser_snapshot for actions.' This directly names the alternative tool and the condition for choosing it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

browser_typeB
Destructive

Type text into editable element

NameRequiredDescriptionDefault
textYesText to type into the element
slowlyNoWhether to type one character at a time. Useful for triggering key handlers in the page. By default entire text is filled in at once.
submitNoWhether to submit entered text (press Enter after)
targetYesExact target element reference from the page snapshot, or a unique element selector
elementNoHuman-readable element description used to obtain permission to interact with the element

TDQS

B3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotation destructiveHint=true and readOnlyHint=false already signal that this tool can modify state, so the description does not contradict that. However, the main description adds no additional behavioral context beyond the annotations, such as whether typing overwrites existing content or triggers page events. The parameter descriptions do mention key-handler triggering and Enter submission, but the main description itself stays shallow.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, focused sentence with no filler or repetition. It front-loads the verb and object, making the tool's primary purpose immediately obvious.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with several closely related siblings (fill_form, press_key, click), the description is too thin to fully orient an agent. It lacks any mention of when typing is appropriate, how the target is resolved, or what side effects to expect, so the agent must rely on parameter descriptions and external context to make a confident choice.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3 because the input schema already documents all five parameters. The main description, 'Type text into editable element,' adds no meaning beyond the schema's parameter descriptions, which already define text, slowly, submit, target, and element clearly enough.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a clear action ('Type text') and a clear target ('editable element'), which distinguishes it from many sibling tools at a high level. It is slightly vague about whether 'editable element' includes textareas, contenteditable regions, or only input fields, but the core purpose is unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines1/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives no guidance on when to prefer this tool over sibling tools such as browser_fill_form or browser_press_key. It does not mention exclusions, prerequisites, or scenarios where typing would be inappropriate, leaving the agent to infer usage from the tool name alone.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

browser_wait_forA
Read-only

Wait for text to appear or disappear or a specified time to pass

NameRequiredDescriptionDefault
textNoThe text to wait for
timeNoThe time to wait in seconds
textGoneNoThe text to wait for to disappear

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds behavioral detail beyond the readOnlyHint by explaining that it waits for text appearance/disappearance or a time delay. However, it does not specify what happens if multiple parameters are provided or if none are provided, so behavior is not fully transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single concise sentence that front-loads the core action and conditions. It contains no unnecessary words and is easy to parse.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple wait tool with no output schema, the description covers the main use cases, but it omits edge cases such as default behavior when no parameters are supplied, timeout behavior, or error conditions. These gaps make it only partially complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema descriptions already cover each parameter individually, and the tool description mostly restates them. It does not clarify the relationship between text, textGone, and time (e.g., whether they are mutually exclusive or combinable), so minimal semantic value is added beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool waits for a condition: text to appear, text to disappear, or a specified time to pass. This distinguishes it from sibling tools like click, navigate, or type, and its purpose is immediately understandable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use the tool (when waiting for page state or a delay), but it does not explicitly state when to prefer this over alternatives or how to choose among text, textGone, and time parameters. It provides functional guidance but lacks explicit usage conditions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 23 tool updatesv0.0.77
    • First observedbrowser_click
    • First observedbrowser_close
    • First observedbrowser_console_messages
    • First observedbrowser_drag
    • First observedbrowser_drop
    • First observedbrowser_evaluate
    • First observedbrowser_file_upload
    • First observedbrowser_fill_form
    • First observedbrowser_handle_dialog
    • First observedbrowser_hover
    • First observedbrowser_navigate
    • First observedbrowser_navigate_back
    • First observedbrowser_network_request
    • First observedbrowser_network_requests
    • First observedbrowser_press_key
    • First observedbrowser_resize
    • First observedbrowser_run_code_unsafe
    • First observedbrowser_select_option
    • First observedbrowser_snapshot
    • First observedbrowser_tabs
    • First observedbrowser_take_screenshot
    • First observedbrowser_type
    • First observedbrowser_wait_for

TDQS

B3.2/5.0

Scored across 23 tools

Disambiguation5/5

Each tool serves a distinct browser automation purpose: navigation, actions (click, hover, drag), input (type, press_key, fill_form), page inspection (snapshot, screenshot, network/console), and session management (tabs, resize, close). No two tools overlap in function; even similar tools like browser_evaluate and browser_run_code_unsafe are clearly separated by context (page vs server).

Naming Consistency5/5

All 23 tools follow the consistent pattern of 'browser_' prefix followed by a lowercase snake_case verb or verb phrase (e.g., browser_navigate, browser_network_requests). The naming is uniform, descriptive, and predictable, making it easy to infer tool behavior from the name alone.

Tool Count3/5

At 23 tools, the count falls in the 16–25 range, which feels heavy per calibration. However, the domain of browser automation is inherently broad, and each tool addresses a specific action or inspection need. Still, the number exceeds the typical well-scoped 3–15 range, meriting a borderline score.

Completeness4/5

The toolset covers core browser workflows comprehensively: navigation (navigate, back), user input (click, type, press_key, select_option, fill_form), page diagnostics (snapshot, screenshot, console, network), and browser management (tabs, resize, close). Minor gaps exist (e.g., no explicit 'reload' or 'go forward' tool), but these can be handled via browser_evaluate or browser_navigate, so the surface is largely complete.

Maintenance

ActivityStale
ResponsivenessNo recent community issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    B
    quality
    C
    maintenance
    Enables LLMs to drive a hosted headless Chromium browser over HTTP, performing navigation, clicks, typing, and page reading through accessibility snapshots, protected by bearer-token authentication.
    23
    10,391,844 npm
    Apache 2.0
  • A
    license
    B
    quality
    B
    maintenance
    Enables AI assistants to drive a hosted headless Chromium browser over HTTP, letting them navigate pages, click, type, and read structured accessibility snapshots via the Model Context Protocol.
    23
    10,391,844 npm
    Apache 2.0