Skip to main content
Glama
fullselfbrowsing

FSB (Full Self-Browsing)

Official
by fullselfbrowsing
OverviewSchemaSourceRelated ServersDiscussionsAdmin
JavaScript
Local

upload_file

Upload a real file from disk to a file input on a web page using its absolute path and CSS selector. Sets the file directly on the input via the browser DevTools protocol.

Instructions

Upload a real file from a local disk path to a file input on the page. Sets the file directly on the target via the browser DevTools protocol (DOM.setFileInputFiles), so it works for real binaries -- images, PDFs, documents -- that page JavaScript cannot upload. This is different from drop_file, which only fakes inline text content onto a dropzone; prefer upload_file whenever you know the file path on disk. Provide a CSS selector for the (or a container/dropzone that wraps a hidden one) and an ABSOLUTE file path. The browser reads the file and fires the input/change events natively. When to use: any web form upload where the file already exists on disk. For pure drag-only dropzones with no underlying file input, fall back to drop_file. Security: a sensitive-path denylist blocks secrets (~/.ssh, ~/.aws, .env, private keys, the FSB vault) and every upload is audit-logged. Related: drop_file (synthetic dropzone content), get_dom_snapshot (find the input[type=file] selector), read_page (verify the upload took). Multi-agent: agent-scoped tabs; cross-agent reject with TAB_NOT_OWNED; cap configurable (default 8, 1-64). Pass tab_id only when this agent owns multiple tabs; auto-resolves otherwise. RETURNS change_report: when this tool runs, the response includes a change_report field with a compact diff of what the action mutated (URL, dialogs_opened, nodes_added, nodes_removed, attrs_changed, inputs_changed, focus_shift). Use this to learn the consequence without calling read_page next. If the report exceeds the size cap, change_report.truncated:true and change_report_hint are set; call read_page for the full state.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
clientYesAllowlisted client label. Validated against the shared v0.9.36 server/extension allowlist (see mcp/src/tools/visual-session.ts -- MCP_VISUAL_CLIENT_LABELS). Required.
tab_idNoOptional. Tab id this action targets. Omit when the calling agent owns exactly one tab; pass to disambiguate when the agent owns multiple. Single-tab agents and legacy popup/sidepanel/autopilot do not need to pass this.
is_finalNoWhen true, the visual session clears immediately after this tool resolves. Optional (default false).
selectorYesCSS selector for the <input type="file"> element, or a container/dropzone that holds a hidden one (e.g. "#avatar", "input[type=file]", ".dropzone")
file_pathYesAbsolute path to the file on disk (e.g. "/Users/me/Documents/resume.pdf"). Relative or ~ paths are rejected; the file must be readable by the browser.
visual_reasonYesShort human-readable reason shown in the overlay (for example, "Logging in to GitHub"). Required.

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv0.1.0

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does so extensively: mechanism (DOM.setFileInputFiles via DevTools), native event firing, a sensitive-path denylist (~/.ssh, ~/.aws, .env, vault), mandatory audit logging, multi-agent tab ownership with TAB_NOT_OWNED, and a configurable cap (default 8, 1-64).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Purpose is front-loaded and the ordering (purpose → mechanism → when-to-use → security → related → returns) is logical, though the multi-agent and change_report passages make it noticeably long. Most sentences earn their place given the complexity, but it edges toward over-long.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema exists, so the description takes responsibility for explaining the return (change_report fields, truncation behavior with change_report_hint). Combined with security, tab, and fallback guidance, nothing an agent needs to call this correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3, but the description reinforces the critical constraint that the path must be ABSOLUTE and that the selector may target a container/dropzone wrapping a hidden input — nuances that matter at call time even though the schema states them.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource ('Upload a real file from a local disk path to a file input on the page') and immediately distinguishes itself from the sibling drop_file. An agent can tell upload_file apart from drop_file without reading either schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit when-to-use ('any web form upload where the file already exists on disk') and when-not ('For pure drag-only dropzones with no underlying file input, fall back to drop_file'), naming the alternative. Also notes it should be preferred over drop_file whenever the path is known.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools