Browser MCP
Browser MCP lets an AI agent drive your real, already-logged-in Chrome to automate browsing tasks, interact with pages, handle logins/2FA/CAPTCHAs, and manage multiple sessions while keeping you in the loop.
Navigate tabs, read page content (text/HTML/selector), extract long or virtualized lists, take screenshots, and execute JavaScript.
Interact with pages: click (CSS or text), fill forms, press keys, scroll, wait, hover, select options, set comboboxes/dates, handle dialogs, dismiss overlays, double/right-click, and click raw coordinates.
Manage tabs and frames: list/switch/close tabs, get newly opened tabs (OAuth popups), and list/select iframes.
Work with data and network: make CORS-free HTTP requests, wait for API calls, read/write cookies and localStorage, capture console logs, and extract API tokens from provider dashboards.
Solve CAPTCHAs (reCAPTCHA v2/v3, hCaptcha, Turnstile, FunCaptcha) via auto-click, AI vision grid selection, or human fallback.
Ask the user for input (2FA, credentials, CAPTCHA, consent) through an overlay dialog.
Upload files through file inputs or drag-drop zones, restricted to the server's working directory.
Run up to 20 concurrent agents, each with its own color-coded Chrome tab group and session isolation.
Self-diagnose connection/version/conflict issues and submit feedback or bug reports.
Runs locally with no account or telemetry; page data goes only to your configured MCP client.
Provides automated token extraction from Calendly dashboard and browser automation for Calendly.
Enables reading verification codes from Gmail and general Gmail automation.
Provides automated token extraction from Google Cloud Console (OAuth Client) and browser automation for Google services.
Provides automated token extraction from HubSpot dashboard and browser automation for HubSpot.
Provides automated token extraction from Mailchimp dashboard and browser automation for Mailchimp.
Enables browser automation for Reddit, such as posting and interacting with content.
Provides automated token extraction from Shopify admin and browser automation for Shopify.
Provides automated token extraction from Slack API dashboard and browser automation for Slack.
Provides automated token extraction from Stripe dashboard and general browser automation for Stripe.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@Browser MCPGo to my Gmail and check for recent emails from support"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Browser MCP by Agent360
The browser tool that can stop and ask you. A 2FA code, a CAPTCHA, a choice only you can make: it asks on your own screen, then carries on in the same signed-in Chrome.
It drives the Chrome you are already signed into: no login step to fail, no API key to wire up, no fresh profile that is a stranger to every account you have. Up to 20 agents at once, each in its own colour-coded tab group. 40 tools, MIT, runs on your machine.
→ What it can and cannot get past - every wall, marked measured, by design, not yet, or won't. Including the ones we have not fixed.

Browser MCP gives Claude Code (and MCP clients that run local servers, such as Cursor and VS Code agent mode) control of your actual Chrome: your cookies, your sessions, your 2FA. So it works on CAPTCHA, 2FA and anti-bot sites where Playwright and Puppeteer get blocked - because it's you browsing.
The killer move: it hits a login wall, opens your Gmail, reads the verification code, and continues the sign-in. There is no email API to set up. Operate platforms with no API, QA your own web app end-to-end, or work dashboards, LinkedIn and Reddit at human pace - with you approving the sensitive steps.
40 tools. Auto-clicks the reCAPTCHA v2 checkbox, with a human fallback for the rest. Multi-session color-coded tab groups. MIT, free, and it runs on your machine - no account, no telemetry, nothing sent to us.
The whole thing, in four steps
Rather not do it by hand? Paste this to your AI assistant - Claude Code, Cursor, Codex, VS Code, Windsurf, Cline - and it sets itself up:
Set up Browser MCP for me. Read https://browsermcp.dev/llms-install.md and follow it for whichever AI client you are running in. One step only I can do - tell me which one, and wait for me. When I confirm, call
browser_list_tabsto prove both halves are talking.If you cannot open URLs:
npx @agent360/browser-mcp install
It reads the same guide the four steps below spell out by hand. One step stays yours either way: Chrome will not let an extension install itself, so you load it once.
1 - Install the Chrome extension. One click from the Chrome Web Store; Chrome keeps it updated. No store? See the unpacked install below.
2 - Add the MCP server. Paste this in a terminal. Required - the extension does nothing on its own:
claude mcp add --scope user browser-mcp -- npx @agent360/browser-mcp@latest3 - Restart Claude Code. That is what starts the server. The extension shows no badge until step 4 - the server only takes a port the first time your agent actually uses the browser. A green badge with the number of connected agents appears then; nothing on the icon before that is normal. (The icon itself never changes colour - it is the badge that turns green.)
4 - Say this, to check it worked. Paste it to Claude Code:
Open example.com and take a screenshot.
You get an image back instead of "I don't have browser access". That's it - you're running. → What else to say
Using Cursor, VS Code, Codex or Windsurf? Same server, that client's own config - the prompt at the top handles it, or see browsermcp.dev/docs. Everything below is the long version.
Related MCP server: browser-auth-mcp
The long version - install, step by step
Browser MCP is two halves and you need both: a Chrome extension (drives the browser) and a local MCP server (what your agent actually talks to). Installing only the extension - e.g. straight from the Chrome Web Store - leaves it stuck on "Not connected", because there is no server for it to reach. Chrome cannot install the server, and npm cannot install the extension. Hence two steps.
Step 1: Register the MCP server with Claude Code
claude mcp add --scope user browser-mcp -- npx @agent360/browser-mcp@latestThat is Claude Code's own MCP command, so the entry lands in the config Claude Code actually reads. --scope user makes it available in every project.
Want the extension files on disk for the unpacked install in Step 2? Also run:
npx @agent360/browser-mcp installIt copies the extension to ~/.browser-mcp/extension/ and prints that path in the terminal - copy it. (It also registers the server with Claude Code, Codex, VS Code and Cursor if it finds them.)
Step 2: Load the extension in Chrome
Chrome won't let extensions install themselves from npm - you load it manually one time. To update later, re-run the install command and reload it (see Keeping it updated). Prefer the Chrome Web Store install if you'd rather have the extension auto-update.
Open Chrome and type
chrome://extensionsin the address barToggle "Developer mode" ON (top right corner)
Click "Load unpacked" (top left, next to "Pack extension")
Navigate to
~/.browser-mcp/extension/and click "Select"On Mac: Press
Cmd+Shift+Gin the file picker, paste~/.browser-mcp/extension/, press EnterOn Windows: Paste
%USERPROFILE%\.browser-mcp\extension\in the address bar (Windows is not yet verified: our automated tests do not pass there)On Linux: Type
~/.browser-mcp/extension/in the path field
Restart Claude Code so it picks up the new MCP server
That's it. The Browser MCP icon will appear in your toolbar, and 40 browser tools are now available in Claude Code.
Alternative: Manual zip download (no npm)
If you don't want to use npm, download the extension directly:
Download the extension zip (
agent360-browser-mcp-<version>.zip) from the latest GitHub releaseUnzip the file (anywhere - e.g.
~/Downloads/browser-mcp-extension/)Follow Step 2 above, but select the unzipped folder instead of
~/.browser-mcp/extension/Register the server - run
claude mcp add --scope user browser-mcp -- npx @agent360/browser-mcp@latest, or add this to~/.claude.jsonby hand:{ "mcpServers": { "browser-mcp": { "command": "npx", "args": ["@agent360/browser-mcp@latest"] } } }
Chrome Web Store (no Developer mode, auto-updating extension)
This replaces Step 2 only - you still need Step 1.
Install the extension from the Chrome Web Store → - no Developer mode toggle, and Chrome keeps it updated for you.
Register the MCP server:
claude mcp add --scope user browser-mcp -- npx @agent360/browser-mcp@latest(For Cursor / VS Code / Codex, use that client's own MCP config instead - see browsermcp.dev/docs.)
Restart Claude Code.
Skip step 2 and the extension icon will sit on "Not connected" forever - that is the symptom of a missing MCP server, not a broken extension.
You're in. Now what?
Nothing happens until you ask, and the hardest part of a new tool is knowing what to ask for. Paste one of these to your agent (where it says example.com, put your own site):
Say this | What it shows |
"Open example.com and take a screenshot." | Start here. An image back instead of "I don't have browser access" means both halves are talking. That is the whole install test. |
"Open Gmail and tell me who sent my last 3 emails." | The one that shows the difference - it works because it is your browser, already signed in. A fresh headless browser would hit a login wall here. |
"Go to my analytics dashboard, pull this month's numbers, and put them in a table." | A dashboard you are signed into in this Chrome. No API key, no export, no integration to build first. |
"Fill in the signup form at example.com/signup with my details. Stop and ask me before anything sensitive." | You stay in the loop - the agent can pause and ask you before passwords, payment details, or anything it should not decide alone. |
"Log me in at app.example.com. If it emails a code, open Gmail, read the code and continue." | The move that needs no email-API setup: it opens your Gmail, reads the one-time code and finishes the sign-in. |
"Walk through my app's signup flow as a real user and tell me where it breaks." | End-to-end QA of your own product, in the same browser your users have. |
The pattern: many of the browser tasks you would do yourself, on sites you are already signed into. It is strongest where there is no API - internal dashboards, admin panels, portals, LinkedIn. Built something good? Add it to the gallery.
Why This Over Playwright MCP / BrowserMCP?
Browser MCP | Playwright MCP | BrowserMCP.io | |
Browser | Your real Chrome, via extension | Persistent profile by default, or your Chrome via their extension | Your real Chrome |
Maintained | Actively - latest release v1.30.2 (2026-10-14) | Actively (Microsoft) | Last commit Apr 2025 |
Logins/cookies | Your existing session | Persistent profile keeps logins between runs | Already authenticated |
Several agents, one logged-in profile | 20 concurrent, each with its own color-coded tab group | Also supported: their extension gives each connected client its own coloured tab group | Single session |
Human-in-the-loop |
| None: 72 documented tools, none that can ask the person (checked 2026-09-19) | None |
Token-finding guides | 9 built-in (Stripe, HubSpot, Slack...) | None | None |
CORS bypass |
| N/A | Limited |
Network monitoring |
| Built-in | None |
CSP-strict sites | Chrome Debugger API throughout | Works | Limited |
Custom dropdowns | Angular Material, React Select support | Works | Limited |
Install |
|
|
|
The pages that defeat everything else
The reason this works where headless dies is not that it slips past anything. It is that there is nothing to slip past: it is your Chrome, your session, your consent. What is left is the hard part - pages that fight any automation because of how they are built.
Every release is gated on a flow test against a real Chrome that has to survive exactly those: all 40 tools are exercised, and the gate also checks that the extension Chrome is running is the one being released - not another copy with the same version number. The failures that do show up are honest ones: mouse events are not delivered to a tab that is not in front, and the tools say so instead of reporting success. What the test covers
strict CSP - navigate, read, execute, wait and click all still work (falls back to the Chrome Debugger API when script injection is blocked)
cross-origin iframes - seen into and reached inside
shadow DOM - selectors reach through it
controlled inputs -
fillsticks in a React-style controlled fieldhonesty checks -
clickrefuses a 0×0 element instead of hitting (0,0), and says so when the page never took the event
Known limitation: working in a tab you are not looking at
In a tab you are not looking at, the agent can navigate, read, screenshot, run scripts, click,
and fill a field it finds by CSS selector. Chrome does not deliver mouse and keyboard events to a
tab that is not the visible one in its window, so key presses, hover, double-click, right-click,
coordinate clicks, combobox typing, and filling a field found by its text all fail with an error
that says so. The agent can then call browser_switch_tab, which makes that tab the active one in
its window, but since 1.30.2 it does not bring Chrome in front of you. Input that needs Chrome in
front can then still fail, and the
agent asks you first: only with bring_to_front: true does Chrome come forward. A screenshot of a
window covered by other windows likewise answers window-covered instead of raising Chrome.
Those tools measure whether the page actually received the event rather than trusting Chrome's acknowledgement, so a background tab produces an honest failure instead of a silent one. (Introduced in 1.29.2 - see CHANGELOG.md for which release you are on.)
Fully hands-off background input is not part of 1.30, and it is not something we can fix: Chrome
delivers no mouse or keyboard input to a tab that is not the visible one in its window (measured).
Whether it does to the active tab of a window without the operating system's focus is unmeasured in
desktop Chrome, so the tools' landed answer decides. Some of it cannot be solved at all: CSS
:hover is a state the renderer owns and no script can fake it, a script-dispatched event is
never isTrusted, elementFromPoint stops at a cross-origin iframe, and the text selection a
real double-click makes is browser behaviour rather than an event.
That last group matters most. A tool that quietly reports success is worse than one that fails, because you build on the answer. Where we still fall short of it, it is written down: see #19.
Corrected 2026-09-07, and again 2026-09-19. This table used to say Playwright MCP was headless and made you log in every time. That was wrong. The row we then called "the one that survives" - concurrent clients conflicting on one profile - was wrong too: that limitation belongs to their persistent-profile mode, and their Chrome extension explicitly gives each connected client its own coloured tab group, which is the same mechanism we describe on our own row. We had corrected one page and not the pattern. The row that actually survives is human-in-the-loop, and it is the one we measured: the Playwright MCP README lists 72 documented tools (counted 2026-09-19) and none of them can stop and ask the person for a code.
On the name: the similarly-named
browsermcp.io(@browsermcp/mcp) is a different, unaffiliated project with no commits since April 2025. This is Browser MCP by Agent360 (@agent360/browser-mcp) - actively maintained. Full side-by-side →
Environment variables
All three are optional. None is needed for normal use.
Variable | Effect |
| Makes |
| Pins the server to one specific Chrome extension. Use it when more than one copy of Browser MCP is loaded and you want a given session to always talk to the same one. It cannot tell Chrome profiles apart: the Chrome Web Store extension has the same id in every profile. |
| Withdrawn in 1.30.1 and ignored - the server says so when it starts. Pairing shipped in 1.30.0 but kept nobody out, so it was taken back rather than left as false protection. It will return redesigned. |
40 Tools
Navigation & Content
Tool | Description |
| Navigate to URL (reuses tab, or |
| Get page text or HTML |
| Screenshot via Chrome Debugger (works even when tab isn't focused; a covered window answers |
| Run JavaScript in page context |
| Read the rows of a long/virtualised list by scrolling its container until no new rows appear; scrolls with real wheel events in the active tab, so feeds that load on wheel (Threads, X) load; in a hidden page (a background tab) a list that loads while scrolling stops early, and |
Interaction
Tool | Description |
| Click via CSS or text selector ( |
| Fill input fields (works on CSP-strict sites); with a text selector, nothing is typed ( |
| Keyboard events (Enter, Tab, Escape, modifiers). With ctrl or meta: a, c, x, v, z, y are sent as Chrome's select all, copy, cut, paste, undo, redo commands |
| Scroll to element or by pixels |
| Wait for element to appear |
| Hover for tooltips/dropdowns; answers |
| Native |
| Autocomplete/combobox: type query → wait for filtered listbox → click option (multi-value chip support). Use when |
| Robust date inputs: tries native value-set → masked typing → calendar-picker navigation (MUI/AntD/react-datepicker/Lexical). Use when |
| Bulk-dismiss popups/modals/tooltips/banners via aria-label/text/×-char heuristics. |
| Accept/dismiss native alert/confirm/prompt dialogs |
| True double-click (two trusted press/release pairs); answers |
| Right-click to open page-level context menus; answers |
| Escape hatch: click at raw viewport coordinates (CSS pixels) with trusted mouse events |
| Recovery: force-detach and re-attach the Chrome debugger on the current tab |
Tabs & Frames
Tool | Description |
| List session's tabs only |
| Switch to tab by ID; Chrome stays where it is unless |
| Close tab (session-owned only) |
| Get most recently opened tab (OAuth popups) |
| List iframes on page |
| Execute JS in specific iframe |
Data & Network
Tool | Description |
| HTTPS request from the extension (bypasses the page's CORS and CSP), without your browser cookies (none are sent, none are stored) - pass a token in headers; plain http only to 127.0.0.1 |
| Wait for specific API call to complete |
| Open a known provider's API page and get instructions for finding or creating the token there (9 providers, below); it reads nothing itself |
CAPTCHA Solving
Tool | Description |
| Detect CAPTCHAs and work through them one step per call. Auto-detects reCAPTCHA v2/v3, hCaptcha, Turnstile, FunCaptcha. Actions: |
Human-in-the-Loop
Tool | Description |
| Ask you to act or answer: a small card you can drag aside while you log in or solve a CAPTCHA, or a dialog with fields for a 2FA code. The page can see what you type into it, so it is for secrets that belong to that page. It needs a page that loaded: on Chrome's error page or about:blank it fails at once and shows nothing. It makes the tab active and restores a minimized window, but does not bring Chrome in front of other apps. |
Data
Tool | Description |
| Get cookies for a site this session has open |
| Set cookies for a domain |
| Read localStorage from page |
| Write localStorage values |
| Capture console.log/warn/error messages from page |
| Upload files to |
| Upload via drop-zones: uses the target if it is a file input, then a hidden |
Diagnostics & feedback
Tool | Description |
| Self-check + report in one call. Compares the connected extension against this server and detects more than one Browser MCP extension connected at once, also the same extension connected more than once (for instance from several Chrome profiles or browsers); with |
| Project info + pre-filled links to submit a wish, use-case, or bug |
Multi-Session Support
Each Claude Code conversation gets its own MCP server on a unique port (9876-9895). The Chrome extension connects to all active servers simultaneously.
Need more than 20 at once? The range is a setting, not a hard limit, but both halves have to agree.
Set BROWSER_MCP_MAX_PORT in every chat's MCP config, set bmcpPorte to the same range in the
extension's storage, then reload the extension: it reads the range only when it starts. Change only the
server side and chat 21 binds a port the extension never looks at, so the browser goes quiet in that chat
with nothing to explain it. 100 is plenty; the hard cap is 200. Every extra port costs your browser one
refused connection every two seconds, whether you use it or not, so do not widen it for fun.
Claude Session 1 ←(stdio)→ MCP :9876 ←(WS)→
Claude Session 2 ←(stdio)→ MCP :9877 ←(WS)→ Chrome Extension → Browser
Claude Session 3 ←(stdio)→ MCP :9878 ←(WS)→Session isolation - each session gets a color-coded Chrome Tab Group
Tab ownership - sessions can only see and control their own tabs
Auto-cleanup - processes exit when Claude Code closes the conversation
Ports are taken on demand - a server binds its port on the first browser call, not at startup, and releases it 5 minutes after its last tab closes. A chat that never touches the browser never occupies a slot.
Running the agent on another machine
The extension only connects to 127.0.0.1, deliberately - it will not talk to a remote
WebSocket. If your MCP gateway runs on a different box than your browser, forward the port
range over SSH.
Recipe below contributed by @bkuri,
who ran into exactly this and solved it. Linux + systemd; needs autossh locally and your
public key already on the server:
# ~/.config/systemd/user/browser-mcp-tunnel.service
[Unit]
Description=SSH tunnel for browser-mcp WebSocket (ports 9876-9895)
After=network-online.target
Wants=network-online.target
[Service]
Type=simple
ExecStart=/bin/sh -c '/usr/bin/autossh -M 0 -N \
-o ServerAliveInterval=30 -o ServerAliveCountMax=3 \
-o ExitOnForwardFailure=yes -o LogLevel=ERROR \
$(for p in $(seq 9876 9895); do printf " -L %s:127.0.0.1:%s" "$p" "$p"; done) \
server-name'
Restart=on-failure
RestartSec=5
Environment="AUTOSSH_GATETIME=0"
[Install]
WantedBy=default.targetReplace server-name, then systemctl --user enable --now browser-mcp-tunnel.service.
The original recipe listed ports 9876-9885 by hand - the range was ten back then. It is twenty now, so the loop above generates them instead of hard-coding a list that goes stale the next time the range changes.
Built-in Provider Integrations
browser_extract_token opens the provider's API page and returns instructions for finding or creating the credentials. It reads nothing itself, and for HubSpot, Slack, Shopify and LinkedIn the page is a settings or app list on the way to the token, not the token page itself. Any other provider answers Unknown provider.
Provider | Token Format | Dashboard |
Stripe |
| stripe.com/apikeys |
HubSpot |
| app.hubspot.com |
Slack |
| api.slack.com/apps |
Shopify | Admin API token | admin.shopify.com |
Pipedrive | UUID | app.pipedrive.com |
Calendly | JWT | calendly.com |
Mailchimp |
| admin.mailchimp.com |
OAuth Client | console.cloud.google.com | |
Client ID/Secret | linkedin.com/developers |
Architecture
extension/
manifest.json # Manifest V3
background.js # Service worker - Chrome API dispatcher, session tab groups
offscreen.js # Persistent WebSocket bridge (multi-port scanning)
popup.html/js # Status UI - sessions, tabs, action log
mcp-server/
index.js # MCP server (stdio) + WebSocket client
tools.js # 40 tool definitions
bin/cli.js # Install CLIHow It Works
Claude Code starts → spawns MCP server via stdio
MCP server binds the first free port (9876-9895) the first time a tool needs the browser
Extension's offscreen document scans ports every 2s
WebSocket connection established
Commands flow: Claude Code → MCP → Extension → Chrome APIs
Process auto-exits when Claude Code closes (stdin detection)
Keeping it updated
Browser MCP has two parts, and they update independently - how the extension updates depends on how you installed it:
Part | Install method | How it updates |
MCP server | any | Automatic. Runs via |
Extension | Chrome Web Store | Automatic, but not immediate. A new version first has to pass Google's review, which usually takes 1-3 days; Chrome then picks it up in the background within hours. Nothing to do, but a fix published today does not reach you today. |
Extension | Unpacked ( | Manual. Chrome never auto-updates a load-unpacked extension. Re-run |
Not sure which you have? Open chrome://extensions and find Browser MCP. If it shows a "Loaded from /path/…" line, it's unpacked (manual updates). If there's no such line, it came from the Chrome Web Store (auto-updates).
Want zero-maintenance updates? Install the extension from the Chrome Web Store, then run claude mcp add --scope user browser-mcp -- npx @agent360/browser-mcp@latest to register the server. After that, both parts stay current on their own - as long as your config uses @agent360/browser-mcp@latest.
Troubleshooting
"Chrome extension not connected"
Check extension is loaded in
chrome://extensionsClick the extension popup → "Reconnect"
Wait 2-3 seconds for port scan
Screenshot fails
Uses the Chrome Debugger API for your session's own tab (works even when the tab isn't focused)
From 1.29.1 there is no fallback that captures whichever tab happens to be visible: if the debugger can't produce a frame, the call fails. (1.29.0 and earlier could fall back to the visible tab.) Run
browser_reattach_debuggerand try again
Click doesn't work on SPA
Try text selector:
browser_click("text=Submit")Uses real mouse events via Chrome Debugger API automatically
Upload fails with "Not allowed"
Chrome only hands a file to the page when "Allow access to file URLs" is on for the Agent360 Browser MCP extension (chrome://extensions, Agent360 Browser MCP, Details). It is off by default for Chrome Web Store installs
The switch also lets the extension open any local file as a page, so turning it on is your call; otherwise attach the file yourself
From 1.30.2 a "Not allowed" error from the handoff is reported as
file-access-offunless Chrome confirms that file access is on
Stale processes
Processes auto-exit when Claude Code closes (stdin detection)
Idle timeout: 4 hours without commands → auto-exit
Manual cleanup:
lsof -i :9876-9895 | grep LISTEN
💡 Help Shape Browser MCP
Browser MCP is built in the open and shaped by the people using it.
Browse what others want / built
💡 Wishlist → - features people are asking for
🎯 Use-cases → - what others have built (LinkedIn ICP scraping, vendor research, daily ops, …)
Contribute in 30 seconds
Or just ask Claude - it knows about the browser_about tool and will draft the report and hand you a link to review and submit when you say things like "I wish browser-mcp could …" or "share my browser-mcp use-case".
If it works for you
The Chrome Web Store ranks on ratings, and we have none - so a sentence from you moves this further than anything we can write. Leave a review if it earned one, and say so honestly if it did not. No signup, no reward, nothing gated behind it - we just have no signal at all right now.
The same idea, for the rest of your Mac
This drives your browser. Computer MCP drives everything else on macOS - menus, windows, the Dock, any app's accessibility tree - with the same stance: password fields are blacked out in memory before a screenshot is written, writes go through a consent gate, and every action lands in an append-only log. It runs in the background by default: the tools that could take over your screen are not offered unless you ask for them.
npx @agent360/computer-mcp · MIT · macOS.
Privacy
The point of this tool is that your browsing stays in your browser. There is no account and no server of ours between you and the page.
Page content - what a tool reads from a tab goes to the MCP client you configured, and nowhere else. We never see it.
Cookies, local storage and tokens are not copied anywhere by default, and the server keeps no copy of them - but they are reachable. Three tools read them directly (
browser_get_cookies,browser_get_local_storage,browser_extract_token), two more write them (browser_set_cookies,browser_set_local_storage), and three more can get to the same data another way:browser_execute_scriptruns in the page and can readdocument.cookie, andbrowser_get_page_contentandbrowser_extract_listwill carry a token that the page itself puts in the DOM. When any of them runs, that value goes to your MCP client like any other tool result. Nowhere else, and never to us.We collect nothing. No identifiers, no usage counts, no crash reports, no analytics in the extension or the server.
Your agent's own reports.
browser_provide_feedbackreturns its report to your AI client like any other tool result, and it tries to add one line per new report to~/.browser-mcp/feedback.jsonlon your machine: the time, the kind, the tool, what the agent says happened, what it tried and what worked in the end, the page's origin and path, version numbers, a short diagnosis, the number of connected extensions and a fingerprint used to skip repeats. In the three things the agent wrote (what happened, what it tried, what worked), email addresses and numbers of six or more characters are replaced with[email]and[number]first, in the file and in the pre-filled issue link it returns; the page address is only cut to origin and path. The server does not submit the report. Opening the link sends its contents to GitHub; an issue is created only when you submit it. Delete the file to clear it.The bridge between the extension and the MCP client runs on
localhost, on the same machine; the server reaches the network only for the npm version check you can turn on withBROWSER_MCP_CHECK_NPM=1. That bridge is local and unauthenticated: another program running as you on the same machine can connect to it. Browser MCP does not protect you from software you already run.
Full policy: https://browsermcp.dev/privacy
License
MIT - Agent360
Available Tools
40 toolsbrowser_aboutA
Returns Browser MCP info and pre-filled URLs the user can click to submit feature wishes, share use-cases, or report bugs. Call this PROACTIVELY whenever the user (a) mentions a feature they wish existed ("I wish browser-mcp could...", "it would be nice if..."), (b) says something is missing, broken, or unexpected, (c) asks how Browser MCP works or who maintains it, or (d) describes something cool they built with browser-mcp. Pass intent="wish" | "use_case" | "bug" | "info" plus an optional title and body, and offer the returned submit_url to the user. Browser MCP is community-shaped - this tool is how the user contributes back.
| Name | Required | Description | Default |
|---|---|---|---|
| body | No | Optional pre-filled body / first-comment draft. Will be URL-encoded into the submit link. Keep it short; user can expand on GitHub. | |
| title | No | Optional pre-filled issue title (e.g. "Support hCaptcha v3"). Will be URL-encoded into the submit link. | |
| intent | No | What the user wants to share. "wish" = feature request, "use_case" = share what they built, "bug" = something broken, "info" = general (default: "info"). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, so the description carries the full burden. It transparently states the tool returns info and pre-filled URLs, implies a read-only, non-mutating nature, and explains the community-contribution context. It does not explicitly rule out side effects, but nothing suggests any, and the description is honest about its purpose and output.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single well-structured paragraph that front-loads the core purpose, then provides actionable usage criteria and parameter mapping. Every sentence earns its place; there is no fluff or repetition. It is detailed but appropriately sized for the tool's complexity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has no output schema, so the description must explain what it returns and how to use it. It does: 'Returns Browser MCP info and pre-filled URLs' and 'offer the returned submit_url to the user'. Combined with the thorough usage triggers and parameter guidance, an agent has everything needed to call it correctly and handle the result.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the schema already documents each parameter. The description adds meaningful context: it explains how title and body are URL-encoded into the submit link, elaborates the intent enum values with examples ('wish' = feature request, 'bug' = something broken), and clarifies the optionality and default for intent. This goes beyond the schema's raw definitions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Returns') and resource ('Browser MCP info and pre-filled URLs'), and clarifies it is for feedback submission. It clearly differentiates from all sibling browser manipulation tools by its unique informational/feedback role, making it unmistakable.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives explicit, enumerated triggers ('Call this PROACTIVELY whenever...') with concrete user-language examples and maps them to the intent parameter. It also instructs what to do with the output ('offer the returned submit_url'), providing complete when-to-use guidance without needing to reference alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browser_ask_userA
Ask the user to do something or give information. Without fields it shows a small card in the bottom-left corner that the user can drag away while they act on the page (log in, solve a CAPTCHA, give consent); with fields it shows a dialog over the page. The prompt is drawn again after a navigation in the tab, but a prompt with fields ends with action navigated if the tab moves to another origin (another domain, subdomain or port) or, on a local file, to another file. Returns acknowledged, action (done, skip, timeout, tab_closed, replaced when a newer question in the same tab takes over, navigated, or removed_by_page when the page keeps removing the prompt) and, for done, values. The page cannot read the field values, but it can see the keystrokes, so ask only for secrets that belong to the page the tab is on. The tab must show a page that loaded (a web page or a local file): on Chrome's error page or about:blank the call fails at once and shows nothing. It makes the tab the active one in its window and restores a minimized window, but it does not bring Chrome in front of other apps.
| Name | Required | Description | Default |
|---|---|---|---|
| title | No | Dialog title (default: "Agent360 - Action Required") | |
| fields | No | Input fields for user to fill in. Each field has: name (key), label (display text), type (text/password/email). Omit for simple "Done/Skip" confirmation. | |
| message | Yes | What the user needs to do or provide | |
| timeout | No | Max wait time in ms (default: 120000 = 2 min) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does so thoroughly: it enumerates every return status (acknowledged, action with all terminal values, values for done), explains the navigation/origin rules that terminate a prompt, the timeout default, the tab-activation and window-restore side effects, the immediate failure on error pages/about:blank, and the keystroke-visibility caveat. This is unusually rich behavioral disclosure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the core purpose, and nearly every clause carries distinct behavioral information that an agent needs. The weakness is structural: it is one dense paragraph with heavy parentheticals instead of being grouped into purpose, inputs, returns, and caveats, which hurts scannability.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema, yet the description still documents the return contract in detail, along with failure conditions, security constraints, and tab/window side effects. Nothing an agent needs in order to invoke this correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3, but the description adds real meaning for the fields parameter by explaining its behavioral consequence (card vs. dialog) and its limited value visibility to the page. It also frames the action return values against the field input. It does not add much beyond the schema for title or timeout, keeping it below 5.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: "Ask the user to do something or give information," and then pins down the two concrete modes (card without fields, dialog with fields). An agent immediately knows this is an agent-initiated prompt to the human. It never names a sibling (e.g. browser_handle_dialog or browser_solve_captcha), so the differentiation is implicit rather than explicit.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives clear context for when to use it and how the two modes differ (simple Done/Skip confirmation vs. field collection), plus a prerequisite ("the tab must show a page that loaded") and a security condition (only ask for secrets belonging to the page the tab is on). There are no explicit exclusions or named alternative tools, so it stops short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browser_clickA
Click an element on the page. Supports CSS selectors AND text-based selectors. Auto-scrolls element into view. Uses real mouse events (works on Angular/React SPAs and CSP-strict sites like Google, Stripe). A text selector looks inside an open modal dialog first (a opened with showModal, or a visible element with aria-modal="true"), exact text before partial. If the mouse would not reach the target at its center - another element lies in front of it (an overlay, a dialog's backdrop), the target does not take clicks there (pointer-events, visibility, clipping), or a different control inside it would get the click (a delete button on a card; for a container that is not clickable itself, its own plain link with a real address (a hash route with a path, such as #/orders, counts; a fragment with no target on the page does not) does not count, nor does a web component's own button that covers it, nor a box with a checkbox, switch or radio role right next to a hidden field and the only one in the nearest label around it, a label of that field (a box inside a closed shadow root cannot be seen and is not counted), which counts as that field) - the answer is ok:false with error "covered" and covered_by. Found before the mouse is sent, nothing is sent; if it comes in front afterwards, the rest of the presses and clicks are stopped (a release the page moves elsewhere is let through), and the answer also has maybe_landed: true, because the page may already have reacted. Examples: "button:text(Get started)", "text=Submit", "#my-button", "a.btn-primary"
| Name | Required | Description | Default |
|---|---|---|---|
| selector | Yes | CSS selector or text selector. Text formats: "text=Click me" (any element), "button:text(Submit)" (specific tag) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and delivers: auto-scroll into view, real mouse events that work on SPA/CSP-strict sites, modal-dialog-first text resolution, and a detailed failure contract (ok:false, error 'covered', covered_by, maybe_landed). This is unusually rich disclosure of behavior an agent cannot infer from the schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The opening is front-loaded and crisp, but the 'covered' sentence is a single sprawling construction with deeply nested parentheticals ('...nor does a web component's own button...nor a box with a checkbox, switch or radio role right next to a hidden field...') that is very hard to parse. The information is valuable but the packaging is bloated and structurally poor.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema exists, so the description must and does explain the failure return shape ('covered', covered_by, maybe_landed). For a single-parameter click tool this is close to complete; only the success-path response and any waiting/timing semantics are unspecified, which are minor gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description exceeds that by enumerating concrete selector formats and giving four worked examples ('#my-button', 'text=Submit', etc.), plus documenting the modal-first text-matching order — meaning well beyond the schema's terse parameter note.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Opens with a specific verb and resource ('Click an element on the page') and immediately clarifies the selector model, which distinguishes it from pointer-coordinate siblings like browser_click_xy. It never names the sibling alternatives (browser_double_click, browser_right_click), so the differentiation is implicit rather than stated.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Offers rich tactical guidance on selector choice (CSS vs text, 'text=Submit' vs 'button:text(Submit)') and modal-priority resolution, which implicitly tells the agent how to invoke it. However, it never states when to choose this tool over browser_click_xy, browser_double_click, or browser_right_click, so alternative-selection guidance is absent.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browser_click_xyA
ESCAPE HATCH: Click at raw viewport coordinates (CSS pixels) with fully trusted mouse events. Use when a visible button resists every selector strategy (Azure portal dialogs, Knockout-bound divs, canvas UIs): take a screenshot, read the button's position, click its center. Coordinates are CSS pixels, NOT image pixels: convert with the viewport line browser_screenshot returns: x_css = x / W * css_width and y_css = y / W * css_width, where (x, y) is the point in the image and W is the width the image is shown to you at.
| Name | Required | Description | Default |
|---|---|---|---|
| x | Yes | X coordinate (CSS pixels, from left of viewport) | |
| y | Yes | Y coordinate (CSS pixels, from top of viewport) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden, and it delivers meaningful traits: clicks use 'fully trusted mouse events' and target the raw viewport rather than an element. It also flags the coordinate-system trap and the workflow (screenshot first, read position, click center). It stops short of saying what the tool returns or how it reports a mis-click/off-target click.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loads the critical framing ('ESCAPE HATCH') in the first four words, then escalates to the trigger condition and the coordinates caveat. The conversion formula is dense but earns its place; total length is justified for a tool whose main hazard is coordinate misinterpretation.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a two-parameter, no-output-schema, no-annotation click tool, the description covers the selection context, the coordinate system, and the recommended precondition (screenshot). It omits post-click behavior (waiting, failure reporting, whether it scrolls into view), which would round it out.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is already 100%, so the baseline is 3, but the description adds genuinely new meaning by warning that coordinates are CSS pixels rather than image pixels and supplying a conversion formula. That is real value beyond the schema's bare 'X coordinate (CSS pixels, from left of viewport)'.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Click at raw viewport coordinates (CSS pixels) with fully trusted mouse events') and frames itself as an escape hatch distinct from the selector-based browser_click sibling. An agent can immediately tell this apart from browser_click/browser_double_click.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives explicit trigger conditions — 'Use when a visible button resists every selector strategy' — and names motivating cases (Azure portal dialogs, Knockout-bound divs, canvas UIs). It effectively implies 'do not use this when a selector works', but never names the preferred alternative tool outright, so it falls just short of full when/when-not routing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browser_close_tabA
Close a browser tab by ID. Only tabs owned by the current session can be closed.
| Name | Required | Description | Default |
|---|---|---|---|
| tab_id | Yes | Tab ID to close (get from browser_list_tabs) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the burden of behavioral disclosure. It adds one important behavior: session ownership limits which tabs can be closed. However, it does not mention what happens on success or failure, whether closing is irreversible, or whether the tab's resources are also released. For a destructive action, some additional context would be valuable.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences with no filler. The core action is front-loaded, and the session ownership limitation is stated as a separate, important constraint. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This is a simple single-parameter tool with no output schema. The description covers what the tool does and the key limitation an agent must respect. It is mostly complete for a focused close operation, though it could briefly note what happens when the tab ID is invalid or stale.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and the tab_id parameter is already described clearly as 'Tab ID to close (get from browser_list_tabs)'. The description reinforces the parameter's role but does not add significant meaning beyond the schema. Baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action ('Close'), a specific resource ('a browser tab'), and the method ('by ID'). It clearly distinguishes this tool from siblings like browser_switch_tab and browser_list_tabs, so an agent can immediately understand its role.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description makes the tool's purpose obvious: call it when a specific tab should be closed. It also provides a meaningful constraint: only tabs owned by the current session can be closed. It does not explicitly name alternatives or describe when not to use it, but the narrow scope makes the usage context clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browser_console_logsA
Get recent console.log/warn/error messages from the page. Installs a lightweight interceptor on first call. Returns the last N console messages.
| Name | Required | Description | Default |
|---|---|---|---|
| count | No | Number of recent messages to return (default: 50) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations to lean on, the description does extra work by disclosing a side effect ('Installs a lightweight interceptor on first call') and the bounded nature of the result ('last N console messages'). This goes beyond a bare read-operation description, though it could clarify interceptor persistence or message format.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences with no filler. The primary action and resource appear first, followed by a critical behavioral caveat and a clear output summary.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-optional-parameter, no-output-schema tool, the description covers the essential behaviors: what is returned, how many messages, and the install-on-first-call side effect. Minor gaps like exact message object shape or lifecycle of the interceptor are not blocking for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already documents the single 'count' parameter with default and meaning. The description adds no new parameter-level details, but that is acceptable because schema coverage is 100%, so it does not need to compensate for missing documentation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses the specific verb 'Get' with a clear resource: console.log/warn/error messages from the page. It is instantly distinguishable from all sibling browser tools, none of which target console messages.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use the tool: whenever recent page console messages are needed. However, it gives no explicit when-not-to-use conditions or alternatives, relying on the agent to infer the use case from the tool's purpose.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browser_dismiss_overlaysA
Dismiss visible popups, modals, tooltips, banners, and "Are you sure?"-style overlays in one call. Heuristic-based: finds close affordance via aria-label, text content (Skip/Cancel/Ikke nu/Don't show/Got it/Close), or × character button. Use when a flow is interrupted by unexpected dialogs (cookie banners, onboarding tooltips, draft-confirm prompts on Meta Ads, etc.). Returns list of what was dismissed.
| Name | Required | Description | Default |
|---|---|---|---|
| scope | No | non_critical (default): skip dialogs containing editable form inputs (preserves user data). aggressive: dismiss everything. | |
| max_passes | No | Number of dismissal passes (some overlays reveal others when closed). Default: 3 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses that the tool is heuristic-based, how it locates close affordances, the effect of scope values (non_critical preserves form inputs, aggressive dismisses everything), and that it returns a list of what was dismissed. This is strong transparency, though it could have noted potential edge cases like shadow DOM or unclosable overlays.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and front-loaded: purpose, heuristic mechanism, usage examples, and return value are each covered in a few tight sentences. There is no filler or redundant restatement.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no annotations and no output schema, the description covers the key decision factors: what the tool does, when to use it, how it behaves heuristically, and what it returns. The main gap is not explicitly excluding native JavaScript dialogs, which could cause confusion with the sibling browser_handle_dialog, but overall an agent can invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3 and the schema already explains both scope and max_passes. The description adds useful context for max_passes ('some overlays reveal others when closed') and reinforces the scope trade-off, but it does not carry the parameter-documentation burden.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: dismiss visible popups, modals, tooltips, banners, and 'Are you sure?'-style overlays in one call. The heuristic details (finding close affordances via aria-label, text, or ×) distinguish it from related siblings like browser_handle_dialog, which handles native dialogs.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides clear usage context: 'Use when a flow is interrupted by unexpected dialogs' with concrete examples such as cookie banners, onboarding tooltips, and Meta Ads draft-confirm prompts. It does not explicitly state when not to use it or mention alternatives for native dialogs, but the described conditions are unambiguous.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browser_double_clickA
True double-click on an element (two trusted press/release pairs with escalating clickCount). Use for open-item actions (calendar events, file lists) where two single clicks would trigger inline-rename instead (e.g. OWA month view). If the mouse would not reach the target at its center - another element lies in front of it (an overlay, a dialog's backdrop), the target does not take clicks there (pointer-events, visibility, clipping), or a different control inside it would get the click (a delete button on a card; for a container that is not clickable itself, its own plain link with a real address (a hash route with a path, such as #/orders, counts; a fragment with no target on the page does not) does not count, nor does a web component's own button that covers it, nor a box with a checkbox, switch or radio role right next to a hidden field and the only one in the nearest label around it, a label of that field (a box inside a closed shadow root cannot be seen and is not counted), which counts as that field) - the answer is ok:false with error "covered" and covered_by. Found before the mouse is sent, nothing is sent; if it comes in front afterwards, the rest of the presses and clicks are stopped (a release the page moves elsewhere is let through), and the answer also has maybe_landed: true, because the page may already have reacted.
| Name | Required | Description | Default |
|---|---|---|---|
| selector | Yes | CSS or text selector |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does so richly: it discloses the pre-flight coverage check, the exact failure contract (ok:false with error "covered" and covered_by), that nothing is sent when detection fires early, that remaining presses are aborted on late obstruction, and the maybe_landed:true signal. This is far more behavioral context than a typical definition supplies.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The purpose is front-loaded, but the body is one sprawling run-on sentence with parentheses nested several levels deep (e.g. the label/shadow-root/role clauses), making the coverage rules very hard to parse. Valuable content is buried in a structure that resists reading rather than a concise statement with the edge cases separated out.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a no-output-schema tool, the description supplies the return contract (ok:false, covered_by, maybe_landed), the sequencing of events, and the obstruction edge cases, so an agent has what it needs to call and interpret the result. Nothing essential is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% for the single 'selector' parameter ('CSS or text selector'), so the schema already documents it. The description refers to 'an element' but adds no selector syntax or matching detail, matching the baseline 3 when the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The opening sentence gives a precise verb+resource: 'True double-click on an element (two trusted press/release pairs with escalating clickCount)'. It further distinguishes itself from a naive two-single-click approach by explaining the inline-rename failure mode, so an agent can separate it from browser_click without opening either schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It states when to use it explicitly ('Use for open-item actions (calendar events, file lists) where two single clicks would trigger inline-rename'), with a concrete example (OWA month view). It does not name the sibling tool (browser_click) that should be used otherwise, leaving the exclusion implicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browser_drop_fileA
Handing a file to the page needs "Allow access to file URLs" for the Agent360 Browser MCP extension (off by default for Chrome Web Store installs); that switch also lets the extension open any local file as a page, so whether to turn it on is the user's call. A "Not allowed" error from the handoff is reported as file-access-off unless Chrome confirms that file access is on. Upload a file when browser_upload_file fails. Two strategies: (1) uses the target itself when it is a file input, or a hidden inside it; (2) if there is none, clicks the target and intercepts the NATIVE OS file-chooser it opens - pass the selector of the button that opens the dialog, and the file is supplied programmatically without the dialog ever appearing. Other file inputs on the page do not get the file: when neither strategy works, the error lists them in other_file_inputs, each with a selector to pass if it is the right field - a CSS selector that matched that input alone when the tool looked (built from its id, its name or its position on the page), or null when none did, for instance for an input inside a shadow root. The answer describes the input that got the file in input. If the field is empty afterwards although the page's change handler saw the file in it, the answer is ok with cleared_by_page: true and seen_in_field - X and Facebook empty the field after reading the file, and a page that rejects the file can do the same, so check the page before attaching again. Files must be regular files inside the working directory the MCP server runs in - folders, symlinks and hardlinks that point outside it are refused.
| Name | Required | Description | Default |
|---|---|---|---|
| file | No | Single absolute file path. Alias: `file_path`. | |
| files | No | Array of absolute file paths | |
| selector | Yes | CSS selector for the drop-zone target element (e.g. ".upload-area") |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does so richly: it discloses the file-access prerequisite, the 'Not allowed' -> file-access-off error mapping, two distinct internal strategies (direct file input vs. intercepting the native OS chooser), and filesystem constraints (regular files inside the working directory; folders/symlinks/hardlinks pointing outside refused). This is unusually complete behavioral disclosure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Every sentence is substantive, but the text is a dense wall of long sentences with embedded parentheticals, and it is front-loaded with a prerequisite rather than the purpose. An agent gets the content but pays a high reading cost and must assemble the purpose itself.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description does the job of describing returns and error payloads (input, cleared_by_page, seen_in_field, other_file_inputs, file-access-off). It is complete for a complex, multi-strategy tool, though the file vs. files parameters and the exact shape of the success response remain only implicitly covered.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the schema documents file/files/selector; the description still adds real meaning by explaining that selector points at the drop-zone target in strategy 1 but at the button that opens the dialog in strategy 2, and by tying the file argument to the working-directory constraint. It does not clarify the file vs. files (alias) distinction, keeping it below 5.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description conveys that the tool hands a file to a page and explicitly routes relative to browser_upload_file ("Upload a file when browser_upload_file fails"), so the verb+resource is clear. However, no single crisp purpose sentence leads the text — the opening sentence is a prerequisite about the 'Allow access to file URLs' switch, so an agent must infer the core purpose from later fragments.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It names the alternative explicitly ("Upload a file when browser_upload_file fails") and gives the selecting condition, plus a prerequisite (the file-URLs switch) and a re-attach caution after cleared_by_page. It stops short of stating when NOT to use it or why the sibling would fail, so the guidance is clear but not fully exhaustive.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browser_execute_scriptA
Execute JavaScript in the current page. IMPORTANT: the parameter is code (NOT script - though that alias is accepted), and it must be an EXPRESSION, not statements: use an IIFE (() => { ...; return x; })(). Top-level return is a syntax error (the handler wraps code in parentheses).
| Name | Required | Description | Default |
|---|---|---|---|
| code | Yes | JavaScript EXPRESSION to evaluate in page context. For multi-statement logic use an IIFE: (() => { ...; return result; })() |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses the handler wrapping behavior (which causes top-level return to fail) and the alias acceptance. This gives useful insight into how the tool processes input, though it does not warn about potential side effects or security implications of executing arbitrary JavaScript.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, focused sentence that front-loads the core purpose and then immediately addresses the most critical usage pitfalls. Every word earns its place, with no fluff or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-parameter tool with no output schema, the description covers the essential aspects: what it does, the parameter name, the expression requirement, and the wrapping behavior. It does not specify the return value, but that is not necessary given the lack of an output schema. The description is sufficient for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already describes the code parameter as an expression with IIFE guidance, achieving 100% coverage. The description adds value by clarifying the alias (script) and explaining the consequence of using top-level return, which is not in the schema. This extra semantic detail helps the agent avoid common mistakes.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool executes JavaScript in the current page, with a specific verb and resource. It distinguishes itself from siblings like browser_fetch or browser_console_logs by its purpose, and the prominent IMPORTANT note adds specificity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides critical usage instructions: the correct parameter name (code, not script) and the requirement that the input be an expression, not statements. It also warns about the top-level return error. However, it does not explicitly state when to use this tool versus alternatives like browser_fetch or browser_evaluate (if such existed), so it lacks guidance on tool selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browser_extract_listA
Read the rows of a long or virtualised list by scrolling its container until no new rows appear. Use this instead of browser_get_page_content whenever a page shows a repeating list longer than the viewport - mail lists (Outlook, Gmail), invoice/billing tables, search results, transaction histories. Those UIs keep only ~7 rows in the DOM at a time, so a single page read returns a sliver and looks complete. Pass the CSS selector of one repeating row (e.g. '[role="option"]', 'tr', '[role="listitem"]'); the scrollable ancestor is found automatically. When the tab is the active one in its window, it scrolls with real wheel events, also at the bottom, so a feed that loads more rows on wheel (Threads, X) loads them. A hidden page (a background tab) gets no wheel or scroll events, IntersectionObserver callbacks or animation frames, so a list that loads or renders rows while you scroll stops at what is already there; then reached_end is false and note says why. Returns deduplicated row text, scroll_method (wheel or script) and reached_end, which is true only when the list stood at its bottom in a visible page with no new rows, growth or movement for stable_rounds rounds in a row. If the selector matches no rows with text, the answer is error "no-rows".
| Name | Required | Description | Default |
|---|---|---|---|
| wait_ms | No | Wait after each scroll so new rows can render (default 350) | |
| max_rows | No | Stop after this many unique rows (default 500, max 5000) | |
| selector | Yes | CSS selector matching ONE repeating row (e.g. '[role="option"]' in Outlook, 'tr' in a table) | |
| container | No | Optional CSS selector for the scrollable container. Omit to auto-detect the row's nearest scrollable ancestor. | |
| scroll_step | No | Pixels per scroll. Omit for 85% of the container height. | |
| stable_rounds | No | Rounds in a row with no new rows, growth or movement before stopping, and at the bottom before reached_end (default 3) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden and does so thoroughly: it discloses the wheel-vs-script scroll method, the hidden/background-tab limitation (no wheel events, IntersectionObserver callbacks or animation frames, so reached_end is false and 'note' explains why), deduplication of row text, and the error case ('no-rows'). This is unusually rich behavioral disclosure well beyond what a bare schema conveys.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with purpose and the alternative, then progressively deeper behavior. It is long but nearly every sentence carries distinct information (scroll method, tab visibility effects, return fields, error code). Dense rather than padded, though the volume is at the upper edge of what is needed.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema exists, so the description must explain return values, and it does: deduplicated row text, scroll_method (wheel or script), and reached_end semantics (true only at the bottom of a visible page after stable_rounds of no growth). Combined with the error case and hidden-page caveat, an agent has everything needed to call and interpret results correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3, but the description adds real meaning: it explains what the selector must match (one repeating row, with per-site examples) and that the container's scrollable ancestor is auto-detected when omitted. The reached_end/stable_rounds coupling is also clarified, tying a parameter to an output semantic.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Read the rows of a long or virtualised list by scrolling its container') and explicitly scopes it to a class of page. It directly distinguishes itself from the sibling browser_get_page_content, so an agent can choose between them without opening either schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly names the alternative ('Use this instead of browser_get_page_content whenever a page shows a repeating list longer than the viewport') and gives concrete trigger examples (Outlook, Gmail mail lists, invoice tables, search results, transaction histories). It also explains why the alternative fails (~7 rows in DOM), which is exactly the routing rationale an agent needs.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browser_extract_tokenA
Open a known provider's API page (stripe, hubspot, slack, shopify, mailchimp, pipedrive, calendly, google, linkedin) and get instructions for finding or creating its API credentials there. It reads nothing itself: read the page with browser_get_page_content or browser_screenshot afterwards. For HubSpot, Slack, Shopify and LinkedIn the page is a settings or app list on the way to the token, not the token page itself. Any other provider answers Unknown provider; use browser_navigate and read the page yourself.
| Name | Required | Description | Default |
|---|---|---|---|
| provider | Yes | One of: stripe, hubspot, slack, shopify, mailchimp, pipedrive, calendly, google, linkedin |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden and largely meets it: it discloses that the tool navigates the browser but returns no content ('It reads nothing itself'), that four providers land on an intermediate settings/app-list page rather than the token page, and that unsupported providers yield 'Unknown provider'. It does not say whether it navigates the current tab or opens a new one, nor anything about failure/timeout behavior, which is a meaningful gap for a state-mutating browser tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four tightly packed sentences, front-loaded with the core action and provider list, then the read-it-yourself caveat, then the edge cases. No filler; every clause carries operational information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema and no annotations, so the description must cover behavior, and it does cover navigation semantics, follow-up actions, and edge cases. The one remaining ambiguity is what the tool itself returns (instructions text, a status, or nothing before the follow-up read), which the description implies but never states outright.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and the schema already lists the accepted provider strings, so the baseline is 3. The description adds genuinely new semantics beyond the schema: the behavior for out-of-list values ('Unknown provider') and the note that several listed providers route to an intermediate page, which affects how the result should be interpreted.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'Open a known provider's API page ... and get instructions for finding or creating its API credentials there.' It enumerates the supported providers and immediately distinguishes itself from sibling tools like browser_navigate and browser_get_page_content, so an agent can select it without reading the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It states when to use it (only for the nine named providers), when not to (any other provider), and names the alternative explicitly: 'Any other provider answers Unknown provider; use browser_navigate and read the page yourself.' It also prescribes the required follow-up step. This is explicit when/when-not/alternative guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browser_fetchA
Make an HTTPS request from the extension background. It is not subject to the page's CORS or CSP, so it works for API calls (Google, Stripe, Slack) where a fetch from the page would be blocked. Your browser cookies are not sent and the answer's cookies are not stored: pass a token in headers. Plain http works only to 127.0.0.1.
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | URL to fetch | |
| body | No | Request body (for POST/PUT) | |
| method | No | HTTP method (default: GET) | |
| headers | No | Request headers as key-value pairs |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does so well: it discloses CORS/CSP immunity, that browser cookies are neither sent nor stored, that a token must be passed via headers, and that plain http only reaches 127.0.0.1. It omits error/timeout behavior and the response shape, keeping it just below a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three tightly packed sentences with zero filler; the core capability is front-loaded and each clause adds a distinct constraint (scope, cookie policy, protocol limit).
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a fetch tool with no annotations and no output schema, the description covers the critical behavioral traits an agent needs to call it safely. The one gap is the return value/response format, which nothing else in the structured data supplies.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents url, body, method, and headers; baseline is 3. The description adds the useful auth hint ('pass a token in headers') tied to the cookie policy, but gives no additional syntax for body/method beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific action (make an HTTPS request from the extension background) and immediately distinguishes it from an in-page fetch by noting CORS/CSP bypass. It does not name sibling tools like browser_navigate or browser_execute_script, but the resource and scope are unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives a concrete when-to-use context ('API calls (Google, Stripe, Slack) where a fetch from the page would be blocked'), which tells the agent the exact scenario this tool exists for. It stops short of naming alternatives or stating exclusions, so it's clear but not fully routing-aware.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browser_fillA
Fill a form input field with a value. Supports CSS selectors AND text-based selectors. Auto-scrolls and focuses the element. Works on CSP-strict sites via Chrome Debugger API. For date inputs use browser_set_date, for autocomplete/combobox use browser_set_combobox. With a text selector the field is clicked first, so the same check as browser_click applies: if the mouse would not reach it at its center, nothing is typed and the answer is ok:false with error "covered".
| Name | Required | Description | Default |
|---|---|---|---|
| value | Yes | Value to fill in | |
| selector | Yes | CSS selector or text selector for the input field |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden and does so well: it discloses auto-scroll and focus, that CSP-strict sites are handled via the Chrome Debugger API, that text selectors trigger an implicit click first, and that an unreachable element yields ok:false with error "covered". What is missing is whether the fill replaces or appends existing content and whether the value is set via native setter/input events, which matters for framework-bound forms.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four sentences, front-loaded with the core action, then capabilities, then sibling routing, then the failure contract. Every sentence carries information, though the click-precondition sentence is dense enough that it could be trimmed slightly without losing meaning.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema, so the description compensates by documenting the failure shape (ok:false with error "covered"). Combined with capability disclosure and sibling routing, an agent has everything needed to invoke it correctly and interpret the result.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3, but the description adds real meaning beyond the schema: it clarifies that the selector accepts either CSS or text-based forms and explains the behavioral difference between them (text selectors are clicked first). It does not add anything for value, though that parameter is largely self-explanatory.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Opens with a specific verb+resource (fill a form input field with a value) and immediately carves out territory from siblings by naming browser_set_date and browser_set_combobox as the correct tools for date and combobox fields. An agent can distinguish this from browser_click, browser_select_option, and the other input-related siblings without opening a schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicit routing is given: date inputs go to browser_set_date, autocomplete/combobox to browser_set_combobox. It also states the precondition for success with text selectors (the element must be clickable at its center) and what happens when it is not, which tells the agent when to expect failure rather than a silent no-op.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browser_get_cookiesA
Get cookies for a site this session has open in one of its tabs (the site itself, a parent domain or a subdomain). Navigate to the site first - cookies for sites the session is not working on are refused.
| Name | Required | Description | Default |
|---|---|---|---|
| domain | Yes | Domain to get cookies for (e.g. ".stripe.com"). Must match a tab this session has open. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the burden of behavioral disclosure. It reveals the constraint that the site must be open in a tab, which is valuable, but doesn't disclose the return format (e.g., JSON structure) or potential errors beyond refusal. This is adequate but not rich.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences long with no fluff. The core action and constraint are front-loaded, and the prerequisite is placed second. Every word contributes to understanding.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter read operation with no output schema, the description covers the essential context: what it does, the prerequisite, and the limitation. Minor gaps like error handling or return format are not critical given the low complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema description for the 'domain' parameter is already detailed, including the example and the note that it must match an open tab. The description reiterates the domain scope but adds little new semantic meaning beyond the schema, so a baseline 3 is appropriate given 100% coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description specifies the verb 'get' and the resource 'cookies for a site', and clearly indicates the domain scope (site itself, parent domain, or subdomain). However, it doesn't explicitly contrast with the sibling browser_set_cookies, which could cause slight ambiguity, though the action is distinct enough.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly instructs to navigate to the site first and warns that cookies for non-open sites are refused. This provides clear conditions for use and implies when it should not be used, effectively guiding the agent on prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browser_get_local_storageA
Read localStorage from the current page. Pass key for a specific value, or omit for all.
| Name | Required | Description | Default |
|---|---|---|---|
| key | No | Specific localStorage key to read (omit for all) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the behavioral burden. 'Read' communicates a non-mutating operation and 'from the current page' gives scope, but the description does not disclose return format, behavior for missing keys, or origin/security constraints. For a simple getter this is acceptable but not comprehensive.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two short sentences with no filler. The primary action is front-loaded, and the optional parameter behavior is explained immediately and clearly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with one optional parameter, no output schema, and no annotations, the description covers selection and invocation adequately. The only notable gap is the lack of explicit mention of return shape or missing-key behavior, but overall it is sufficiently complete for a simple localStorage reader.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and the schema already documents the key parameter exactly as the description does. The description adds no new meaning beyond the schema, so it meets the baseline but does not exceed it.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a clear verb and resource: 'Read localStorage from the current page.' It is immediately distinguishable from sibling browser_set_local_storage because the verb 'Read' directly contrasts with 'set.' The optional-key behavior is also stated precisely.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context: reading from the current page, with 'Pass key for a specific value, or omit for all.' It does not explicitly name alternatives or exclusion criteria, but the read-vs-set distinction is obvious from the sibling set_local_storage tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browser_get_new_tabA
Get the most recently opened tab (useful after clicking links that open new tabs, OAuth popups, etc.).
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. 'Get' reasonably signals a non-destructive read, and the use-case context adds some value. However, it does not disclose the crucial behavioral detail of whether 'get' returns a tab reference for subsequent use or also activates/switches to the tab — a meaningful ambiguity given browser_switch_tab exists as a sibling.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence with the core action front-loaded ('Get the most recently opened tab') and the use case appended as a tight parenthetical. Every word earns its place; there is no filler, repetition, or schema echo.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter tool this is mostly adequate — it covers what the tool does and when to use it. But with no output schema and no annotations, the description is the sole source of the return contract, and it leaves unspecified whether the result is a tab ID, a tab handle, and whether the active tab changes. Some guidance relating it to browser_switch_tab or browser_list_tabs would close the gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so the baseline is 4 — there is nothing the description needs to explain about inputs. The description adds useful context about what the returned entity represents (the most recently opened tab) and when the call is relevant, which is more than the empty input schema alone could convey.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource — 'Get the most recently opened tab' — and adds a concrete use case (links opening new tabs, OAuth popups). It is unambiguous about what is retrieved. However, it does not explicitly differentiate from closely related siblings like browser_switch_tab or browser_list_tabs, leaving the agent to infer the distinction.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The parenthetical gives explicit usage context: 'useful after clicking links that open new tabs, OAuth popups, etc.' This tells the agent the trigger condition for choosing this tool. It stops short of naming alternatives or exclusions, such as pointing to browser_switch_tab for already-known tabs or browser_list_tabs for enumerating tabs, so it lacks the when-not guidance of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browser_get_page_contentA
Get the content of the current page as text or HTML. Pass selector to read one part of a large page instead of all of it - on a big logged-in app the full HTML can run past a million characters. The answer is capped at 30000 characters by default and says so when it had to cut, with the real length, so a truncated page is never mistaken for a whole one.
| Name | Required | Description | Default |
|---|---|---|---|
| format | No | Output format (default: text) | |
| selector | No | CSS selector. Reads only that element instead of the whole page. If it matches nothing the call fails rather than silently returning the whole page. | |
| max_chars | No | Cap on returned characters (default: 30000). Over the cap the answer carries truncated: true and total_chars. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It transparently discloses the 30000-character cap, the truncation flag and total_chars field, and the fact that truncation is never silently mistaken for a full page. It also mentions the selector's failure behavior indirectly via the schema, but the description itself does not repeat that. It lacks details on error handling (e.g., page not loaded) but covers the most important behavioral quirk.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the primary purpose, then a targeted usage tip, then a crucial behavioral note. No fluff, every clause earns its place. The structure leads with the core action and immediately addresses the most common pitfall (large pages).
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with three optional parameters and no required ones, the description covers the essential usage scenarios, the truncation behavior, and the selector's purpose. The output schema is absent, but the description explains what the response includes (text/HTML, truncation metadata), so an agent has enough to call it correctly and interpret results.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3, but the description adds genuine value: it explains why the selector exists (to handle very large pages) and gives a concrete size example, and it clarifies the truncation semantics for max_chars. This goes beyond what the schema states, making the tool easier to use correctly.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Get') and a precise resource ('content of the current page as text or HTML'), and it is immediately distinguishable from sibling tools like browser_screenshot (image capture), browser_extract_list (structured data), or browser_fetch (network request). No ambiguity about what this tool does.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides clear contextual guidance on when to use the selector parameter ('read one part of a large page instead of all of it') and explains the rationale with a concrete example (big logged-in app HTML exceeding a million characters). It does not explicitly mention when not to use this tool or name alternatives, but the context implies it is the default for reading page content.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browser_handle_dialogA
Arm automatic handling of the next JavaScript alert/confirm/prompt on the active tab, then return immediately. Call this BEFORE the click that opens the dialog - a dialog freezes the tab, so nothing can be clicked once it is on screen. Pass wait=true only when the dialog is already opening. A dialog that is already on screen cannot be answered from here: the answer is tab-not-responding, with what to do instead.
| Name | Required | Description | Default |
|---|---|---|---|
| text | No | Text to enter for prompt() dialogs | |
| wait | No | Block until a dialog appears instead of arming and returning (default: false). Only use when the dialog is already on its way. | |
| action | No | Accept or dismiss the dialog (default: accept) | |
| timeout | No | How long the arming stays active in ms (default: 60000) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does so well: it discloses the non-blocking arm-and-return semantics, the fact that a dialog freezes the tab, and the specific failure mode (tab-not-responding) with a pointer to alternatives. This is the behavioral context an agent needs to avoid a deadlock.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four sentences, each earning its place and front-loaded: purpose first, then timing, then the conditional, then the failure mode. No filler or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Complete for a tool with no annotations and no output schema: timing rules, the blocking/non-blocking distinction, the freeze hazard, and the error path are all covered. Nothing an agent needs to invoke it correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and the description's guidance on wait essentially restates the schema's own note ('Only use when the dialog is already on its way'). The arming-window timing is useful context, but the per-parameter meaning is already fully documented in the schema, so baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('arm automatic handling') and resource ('next JavaScript alert/confirm/prompt on the active tab'). It is unmistakably distinct from siblings like browser_click or browser_dismiss_overlays, since it handles a dialog that has not yet appeared.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives explicit sequencing guidance ('Call this BEFORE the click that opens the dialog') and a conditional branch ('Pass wait=true only when the dialog is already opening'). It also states the when-not case: a dialog already on screen cannot be answered here and yields tab-not-responding.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browser_hoverA
Hover over an element to trigger tooltips, dropdown menus, or hover states. Supports CSS and text selectors. If the mouse would not reach the target at its center - another element lies in front of it (an overlay, a dialog's backdrop), or the target does not take clicks there (pointer-events, visibility, clipping) - the answer is ok:false with error "covered" and covered_by. Found before the mouse is sent, nothing is sent; if it comes in front afterwards, the rest of the mouse movement is stopped and the answer also has maybe_landed: true, because the page may already have reacted.
| Name | Required | Description | Default |
|---|---|---|---|
| duration | No | How long to hold hover in ms (default: 500) | |
| selector | Yes | CSS or text selector to hover over |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does substantial work: it discloses the 'covered' failure case, the covered_by field, that nothing is sent when coverage is detected pre-move, and that maybe_landed:true is returned when something occludes mid-movement. Missing only success-path detail, but the failure/ordering semantics are unusually well disclosed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Purpose and selector support are front-loaded in the first two sentences. The final sentence is a dense run-on (awkward phrasing like 'the page may already reacted'), but it earns its length by conveying non-obvious ordering semantics.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no annotations and no output schema, the description compensates by describing the shape of the failure response (ok:false, error 'covered', covered_by, maybe_landed). An agent has enough to call and interpret results, though success-return behavior is left implicit.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and both parameters carry descriptions, so the baseline is 3. The description's 'Supports CSS and text selectors' largely restates the selector schema entry and adds no format syntax or duration guidance beyond it.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a precise verb (hover) plus resource (element) and names the concrete outcomes it produces (tooltips, dropdown menus, hover states). This clearly distinguishes it from the many click/keyboard siblings such as browser_click and browser_double_click.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use it by listing the UI behaviors it triggers, but offers no explicit when-not guidance and names no alternative sibling (e.g. browser_click for actual clicks). Usage is inferable but not spelled out.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browser_list_framesA
List all frames (iframes) in the current page with their URLs and indices.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, so the description carries the full burden. It discloses the output content (URLs and indices) and scope (current page), but it does not mention whether nested frames are included, ordering behavior, or that the indices are meant for later frame selection.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One concise sentence with no filler. The core action, resource, and output fields are immediately available.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter listing tool, this is mostly complete: it says what is listed and what is returned. Minor gaps remain around nested frame handling and the relationship to browser_select_frame, but they do not seriously impair usability.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters and the schema is empty, so there is nothing to explain. The baseline of 4 applies since no parameter semantics are needed.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('List'), a specific resource ('frames (iframes) in the current page'), and the returned data ('URLs and indices'). This clearly distinguishes it from sibling tools like browser_select_frame and browser_list_tabs.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies this is a discovery step on the current page, but it does not explicitly say when to use it versus alternatives such as browser_select_frame. No exclusions or direct usage conditions are provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browser_list_tabsA
List the tabs this session owns (tabs it opened or adopted): id, URL, title, and each tab's active flag (whether Chrome shows it in front of its window, not which tab this session is working in). Tabs of other sessions are not included.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden. It does disclose the most likely source of confusion: the 'active' flag means Chrome foregrounding within its own window, not which tab this session is working in, and it states that other sessions' tabs are excluded. It omits anything about ordering or staleness of the list, but for a zero-parameter read this is solid disclosure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A compact two-sentence block, front-loaded with the scope, then the field list, then the disambiguation of 'active'. Every clause earns its place; nothing is padded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema exists, so the description must convey the return shape, which it does by naming id, URL, title, and active. Combined with the explicit session-scope exclusion, this is nearly complete for a trivial read; only list ordering/staleness is unaddressed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes no parameters, so the schema has nothing to document and the baseline of 4 applies. The description correctly adds no parameter noise.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource (list tabs) plus the exact scope (tabs this session owns, defined as opened or adopted) and enumerates the returned fields (id, URL, title, active flag). This lets an agent separate it from browser_switch_tab, browser_get_new_tab, and browser_list_frames without opening a schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the use case (discover which tabs exist in this session) but never states when to prefer it over alternatives like browser_switch_tab or browser_get_new_tab, nor any exclusions beyond the scope note. Usage is inferable but not guided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browser_press_keyA
Press a keyboard key (Enter, Tab, Escape, ArrowDown, etc.). Useful for submitting forms, navigating dropdowns, closing dialogs. Supports modifier keys (ctrl, alt, shift, meta). While ctrl, meta or alt is held, no character is typed. With ctrl or meta (and no shift), the letters a, c, x, v, z and y are sent with Chrome's own editing command - select all, copy, cut, paste, undo, redo; z with shift is redo - including on macOS, where Chrome runs no shortcut for a synthetic key without it. The answer names the command that was sent in shortcut; landed says the page received the key, not what the command did. Paste inserts the user's real clipboard into the page, and copy and cut replace what is on it.
| Name | Required | Description | Default |
|---|---|---|---|
| alt | No | Hold Alt key | |
| key | Yes | Key to press: "Enter", "Tab", "Escape", "ArrowDown", "ArrowUp", "Backspace", "a", "1", etc. | |
| code | No | Key code (optional, defaults to key name). E.g. "KeyA" for "a" | |
| ctrl | No | Hold Ctrl/Cmd key | |
| meta | No | Hold Meta (Cmd on Mac) key | |
| shift | No | Hold Shift key |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does so well: it warns that ctrl/meta/alt suppress character typing, that ctrl/meta+a/c/x/v/z/y map to Chrome's own editing commands, and that paste writes the user's real clipboard while copy/cut overwrite it. It also clarifies the return semantics of `shortcut` vs `landed`. These are side effects an agent could not infer from the schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The opening two sentences are well front-loaded, but the middle section is dense and hard to parse, particularly "including on macOS, where Chrome runs no shortcut for a synthetic key without it," which is grammatically tangled. The length is largely justified by the behavioral detail, but the wording needs tightening.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 6-parameter, unannotated, no-output-schema tool, it covers key usage, modifier semantics, clipboard side effects, and even the shape of the response (`shortcut`, `landed`). It omits prerequisites such as whether the target element must be focused and how unrecognized keys fail.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the 3 baseline applies, and the description adds real meaning beyond the schema's terse "Hold Ctrl/Cmd key" strings: it explains that no character is typed while a modifier is held and that certain modifier+letter combinations dispatch browser editing commands. It does not clarify `code` behavior beyond the schema, keeping it short of a 5.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ("Press a keyboard key") and immediately grounds it with concrete key names and the scenarios it serves: submitting forms, navigating dropdowns, closing dialogs. An agent can distinguish this keyboard-input tool from browser_fill, browser_click, or browser_select_option without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives clear positive contexts ("submitting forms, navigating dropdowns, closing dialogs") that tell the agent when this is the right tool. It stops short of naming alternatives or when-not conditions (e.g., use browser_fill to enter text, browser_select_option for dropdown values), so the routing guidance is contextual rather than exhaustive.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browser_provide_feedbackA
Self-diagnosis + feedback in one call. Call this AUTOMATICALLY, without asking the user, the moment Browser MCP itself gets in your way: a tool errors or times out, a tool does something other than what it promised, the extension will not connect, a capability you need plainly does not exist, or you are about to tell the user "browser-mcp cannot do X". It first CHECKS THE INSTALL - the connected Chrome extension's version against this server (set BROWSER_MCP_CHECK_NPM=1 to also compare this server against the latest published on npm; it is off by default so the call stays fast and works offline), and whether more than one Browser MCP extension is connected at once, also the same extension connected more than once, for instance from several Chrome profiles or browsers (a known cause of tabs and sessions behaving randomly) - so a problem that is really "your copy is outdated" or "you have two extensions loaded" is identified as such instead of reported as a bug. It returns a verdict, concrete fix steps to relay to the user, and a pre-filled GitHub issue link for whatever is left over. Cheap to call speculatively. It uploads nothing: it returns the report to you and tries to add one line to ~/.browser-mcp/feedback.jsonl on this machine (a report with the same kind, tool and first 160 characters of what_happened, with numbers and long hex strings ignored, is written once per server run, and again only if the earlier write failed; logged_locally says whether a line was written). Email addresses and numbers of six or more characters are replaced with [email] and [number] in what_happened, attempted and worked before they are written or put in the issue link. With BROWSER_MCP_CHECK_NPM=1 it also runs npm view against your configured npm registry.
| Name | Required | Description | Default |
|---|---|---|---|
| url | No | The page it happened on, if relevant. Strip query strings that contain tokens. | |
| kind | No | "blocked" = you could not complete the task (default). "broken" = a tool misbehaved or lied about its result. "missing" = the capability does not exist. "wish" = a feature idea. "use_case" = something worth sharing that you built. | |
| tool | No | The browser_* tool involved, e.g. "browser_click". Omit if none in particular. | |
| worked | No | The route that did work in the end, if any. This is the most useful part. | |
| attempted | No | What you already tried (other selectors, other tools, retries) so the report does not suggest what you have ruled out. | |
| what_happened | Yes | Required. What you tried and what actually happened, in one or two plain sentences. Include the exact error text if there was one. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does so: it discloses that nothing is uploaded, that a redacted single line is written per run to ~/.browser-mcp/feedback.jsonl with dedup and retry semantics, that emails and long numbers are stripped, and that BROWSER_MCP_CHECK_NPM controls npm comparison. This is unusually rich behavioral disclosure for a no-annotation tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The purpose and the call-automatically instruction are front-loaded, which is correct. However, the install-checking sentence is a long, heavily parenthesized run-on that packs environment variables, offline behavior, and multi-extension detection into one breath, costing some readability.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with no annotations and no output schema, the description covers what would be returned (verdict, concrete fix steps, pre-filled issue link), the privacy model, local logging behavior, and the env-var toggle. An agent has everything needed to call it correctly and to relay its results.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, which sets the baseline at 3, and the description goes beyond it by explaining that what_happened, attempted, and worked are sanitized (emails and 6+ character numbers replaced) before logging or inclusion in the issue link — a processing detail absent from the schema. It does not otherwise elaborate on the enum or url/tool fields, so it stops short of a 5.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The opening states a specific dual function ('Self-diagnosis + feedback in one call') and then enumerates exactly what the self-diagnosis does: check extension version, detect duplicate connections, return a verdict, fix steps, and a GitHub issue link. No sibling tool overlaps this role, so the agent can identify it immediately.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives explicit trigger conditions ('the moment Browser MCP itself gets in your way: a tool errors or times out, a tool does something other than what it promised, the extension will not connect, a capability you need plainly does not exist') and even an imperative to call it automatically without asking. This is as close to unambiguous routing as it gets.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browser_reattach_debuggerA
RECOVERY: Force-detach and re-attach the Chrome debugger on the current tab. Use when interactive tools (click/fill/press_key) start timing out or reporting ghost-attach ("Debugger attach failed ... ghost") while list_tabs still works - faster than reloading the extension.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description bears the full burden. It discloses the core behavior (force-detach and re-attach) and the symptom it addresses. However, it does not mention any side effects, such as whether the page state is preserved, whether the tab reloads, or what the return value may be. The description gives enough to invoke it but not full behavioral context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, well-structured sentence that front-loads the action ('RECOVERY: Force-detach...') and then provides the triggering condition and benefit. It is concise, with no wasted words. Every clause earns its place, conveying purpose, usage, and the contrast with an alternative.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter utility tool with no output schema, the description adequately covers the 'what' and 'when'. It explains the specific failure scenario and why this tool is preferred. However, it does not describe what happens after execution (e.g., success signal, page state), which is a minor gap but not critical for a recovery tool that likely returns a simple status. Overall it is complete enough for an agent to decide and invoke.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so the schema provides nothing to explain. The baseline for 0 params is 4. The description appropriately avoids adding parameter-related text since there are none, and it adds no irrelevant information. It fully satisfies the requirement for parameter semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Force-detach and re-attach'), a specific resource ('Chrome debugger'), and a scope ('current tab'). It also called out as a recovery operation, clearly distinguishing it from the many interactive sibling tools. An agent can immediately understand its purpose without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly states when to use it: when interactive tools (click/fill/press_key) start timing out or report ghost-attach, while list_tabs still works. It also provides an alternative (faster than reloading the extension), giving clear decision guidance. No ambiguity about the trigger conditions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browser_right_clickA
Right-click an element (trusted CDP mouse events) to open page-level context menus (web apps like OWA/Google Docs render their own). Note: Chrome's NATIVE context menu does not open via CDP - only in-page menus. If the mouse would not reach the target at its center - another element lies in front of it (an overlay, a dialog's backdrop), or the target does not take clicks there (pointer-events, visibility, clipping) - the answer is ok:false with error "covered" and covered_by. Found before the mouse is sent, nothing is sent; if it comes in front afterwards, the rest of the presses and clicks are stopped (a release the page moves elsewhere is let through), and the answer also has maybe_landed: true, because the page may already have reacted.
| Name | Required | Description | Default |
|---|---|---|---|
| selector | Yes | CSS or text selector |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden and does so well: it discloses the 'covered' failure contract (ok:false, covered_by), that nothing is sent when coverage is detected up front, that remaining presses/clicks are aborted if it arrives later, and the maybe_landed:true signal. This is exactly the failure-mode detail an agent needs for a click primitive.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The core purpose is front-loaded in the first clause, but the remainder is a single dense, run-on sentence with em-dash parentheticals that is harder to parse than it needs to be. It is information-dense but not well structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter tool with no output schema, the description is complete: it covers success behavior, the coverage/occlusion failure path with error codes, the abort semantics, and the maybe_landed ambiguity. An agent has everything needed to call and interpret results.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% for the single 'selector' parameter (CSS or text selector), so the schema already documents it. The description says only 'an element' and adds no selector syntax or format detail beyond the schema, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Right-click an element') plus the mechanism (trusted CDP mouse events) and the goal (open page-level context menus). It implicitly separates itself from browser_click/browser_double_click via 'right-click' but never names them, so it stops short of full sibling differentiation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The note that Chrome's native context menu does not open via CDP is genuinely useful scope guidance, implying this tool only works for in-page menus. However there is no explicit when-to-use vs alternatives statement or routing to a sibling tool, so usage is only implied.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browser_screenshotA
Take a screenshot of the visible area of the current tab. Returns base64 PNG, or saves to disk if path is provided. The image is in device pixels; when Chrome reports them in time, the answer also gives the CSS viewport size and devicePixelRatio, which browser_click_xy coordinates need. Chrome stays where it is: if its window is covered by other windows, there is no picture and the answer is error "window-covered".
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | File path to save the screenshot to (e.g. /path/to/screenshot.png) | |
| bring_to_front | No | Raise Chrome in front of the user if its window is covered, and leave it there. Takes the user's screen: only after the user agreed (browser_ask_user). Default false. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does so well: it discloses the return format (base64 PNG or file on disk), the pixel semantics (device pixels), the conditional viewport/dPR extras, and a concrete failure mode with its error string ('window-covered'). It also states a side-effect constraint (Chrome stays where it is).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loads the core action, then layers return format, coordinate caveat, and error case. Dense but every clause contributes; only the window-covered wording is slightly verbose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema exists, so the description must explain returns, which it does (base64 PNG / file, viewport size + dPR). Error behavior and side effects are covered; edge cases like image dimensions or timing are left implicit but not critical.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so both parameters are already documented, including the user-consent caveat on bring_to_front. The description adds only the consequence of path ('saves to disk') and the coordinate relevance of the output; it does not meaningfully extend parameter semantics, so baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Take a screenshot of the visible area of the current tab') with a clearly scoped target (visible area, current tab). No sibling tool does screenshots, so it is trivially distinguishable.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It ties the tool to downstream use ('devicePixelRatio, which browser_click_xy coordinates need') and to the prerequisite for bring_to_front ('only after the user agreed (browser_ask_user)'), giving clear contextual guidance. It stops short of stating explicit when-not conditions or alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browser_scrollA
Scroll the page to an element or by pixel amount. Useful for reaching elements below the fold.
| Name | Required | Description | Default |
|---|---|---|---|
| x | No | Pixels to scroll horizontally (positive = right) | |
| y | No | Pixels to scroll vertically (positive = down, e.g. 500) | |
| selector | No | CSS or text selector to scroll to (element scrolled into center of viewport) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, so the description carries the burden of disclosing behavior. It accurately describes the basic scrolling action but does not explain what happens if both selector and pixel coordinates are provided, or how scrolling interacts with the current scroll position. This leaves some behavioral ambiguity, though the core behavior is clear.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact, front-loaded with the primary action, and includes only useful additional context. Both sentences earn their place, with no redundant wording or unnecessary detail.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a low-complexity tool with optional parameters and no output schema, the description covers the essential invocation scenarios well. It explains both modes and gives a practical use case. The only minor gap is the lack of explicit guidance on parameter precedence, but this is unlikely to be critical for a scrolling action.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the input schema already documents each parameter's meaning. The description adds a high-level mapping between 'element' and selector, and 'pixel amount' and x/y, but does not provide additional detail beyond what the schema already contains. A baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('scroll') and resource ('the page'), and clearly distinguishes two modes: by element or by pixel amount. It also adds a concrete use case ('reaching elements below the fold'), which makes the tool's purpose immediately identifiable among the sibling browser tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear usage context by explaining that scrolling is useful for reaching elements below the fold, which tells an agent when this tool is appropriate. It does not explicitly mention alternatives or when not to use it, but the tool's function is distinct enough among the siblings that this is not a major gap.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browser_select_frameA
Execute JavaScript in a specific iframe by frame index. Use browser_list_frames first to find the right index.
| Name | Required | Description | Default |
|---|---|---|---|
| code | No | JavaScript to execute in the frame (default: returns text content) | |
| frame_index | Yes | Frame index from browser_list_frames (0 = main frame) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must carry the behavioral disclosure burden. It says what the tool does but not what side effects executing JavaScript may have, whether the frame context persists for later commands, or what the return value is. The name 'select_frame' also creates ambiguity about whether this is a temporary execution context or a persistent selection.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short, focused sentences with the primary action front-loaded and the prerequisite in the second sentence. No wasted words or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple two-parameter tool, the description plus schema covers the essentials. However, there is no output schema and no annotation safety profile, so the lack of any mention of return behavior or post-conditions leaves a minor but real gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already fully documents both parameters, including the meaning of frame_index and the default behavior of code. The description adds a useful link to browser_list_frames but does not substantially expand parameter semantics beyond the schema, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states a specific action (execute JavaScript), a specific target (a specific iframe), and the selection mechanism (frame index). It distinguishes itself from the generic browser_execute_script sibling by scoping execution to a frame.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly instructs the agent to call browser_list_frames first to find the right index, which is a concrete usage prerequisite. It does not enumerate alternatives or when not to use the tool, but the guidance is clear enough for correct invocation.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browser_select_optionA
Select an option from a dropdown menu. Works with native elements AND custom dropdowns (Angular Material, React Select, etc.). For custom dropdowns: clicks the trigger, waits for options, then clicks the matching option by text. For autocomplete (typing filters options) use browser_set_combobox instead. A custom dropdown's trigger gets the same check as browser_click: if the mouse would not reach it at its center, nothing is opened and the answer is ok:false with error "covered". So does the option once the list is open: if it is covered, it is not clicked, and the answer is ok:false with error "covered" and trigger_clicked: true - the list may still be open. If the click on the trigger was sent, but neither its press is shown to have reached it nor its click landed, no option is clicked and the answer is ok:false with maybe_landed: true; a click that cannot be checked in the page is not sent, and the answer says so; if it opens a dialog, or the option is not found, the answer has trigger_clicked: true.
| Name | Required | Description | Default |
|---|---|---|---|
| wait | No | Ms to wait after clicking trigger for options to appear (default: 300) | |
| option | Yes | Text OR value of the option to select. Exact value match wins, then exact text, then partial text. Aliases: `value`, `label`. Fails loudly with the available options if nothing matches. A controlled component may reset the field and store the choice elsewhere, so a success can come with `landed: null` and `maybe_landed: true`: the page changed, but the change does not prove it was the selection. Read the page before selecting again. | |
| selector | Yes | CSS or text selector for the dropdown trigger / <select> element |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With zero annotations, the description carries the full burden and delivers: it discloses the click-reachability check shared with browser_click, the 'covered' error for both trigger and option, the trigger_clicked/maybe_landed/landed:null outcome fields, and the policy that unchecked clicks are not sent. This is unusually rich behavioral context for a mutation-ish interaction tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The purpose and the sibling routing are front-loaded well, but the final sentence is a dense run-on stacking several conditional outcomes ('if it opens a dialog, or the option is not found...') that is hard to parse. Much of the edge-case detail could be a structured table or bullet list rather than prose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema, so the description must convey return semantics, and it does so thoroughly for failure and ambiguity cases (ok:false, covered, trigger_clicked, maybe_landed, landed:null). A canonical success shape is implied rather than stated, which is the only meaningful gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents selector, option, and wait (including the 300ms default and the alias/match-order rules). The description's parameter-related content largely restates the option semantics ('Read the page before selecting again') already present in the schema, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Select an option from a dropdown menu') and immediately scopes the resource: native <select> AND custom dropdowns. It explicitly distinguishes itself from the closest sibling by naming browser_set_combobox for the autocomplete case.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives one explicit routing rule with its condition: 'For autocomplete (typing filters options) use browser_set_combobox instead.' That is a clear alternative with a selector condition, but there is no broader when-to-use/when-not guidance (e.g., vs browser_click or browser_fill on a select element).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browser_set_comboboxA
Set value(s) on an autocomplete/combobox input. Handles the click → type query → wait for filtered listbox → click option flow as one MCP call. Supports multi-select (e.g., Languages on Meta Ads). Use when browser_select_option fails because options render lazily after typing.
| Name | Required | Description | Default |
|---|---|---|---|
| multi | No | True if combobox accepts multiple values (chips). Default: auto-detected from presence of values array | |
| value | No | Single value to select (use this OR values) | |
| values | No | Array of values for multi-select. E.g. ["Danish", "English", "Swedish"] | |
| wait_ms | No | Max ms to wait for options listbox to appear after typing (default: 3000) | |
| selector | Yes | CSS selector for the combobox/autocomplete input | |
| query_chars | No | How many characters to type as filter query (default: 4 or full value length, whichever is smaller) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full transparency burden. It clearly discloses the internal interaction sequence: click, type query, wait for listbox, click option. It also notes configurable waiting behavior and multi-select. Minor omissions like whether existing selections are cleared before setting values keep it from a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three tightly worded sentences front-load the core action, then explain the internal flow, multi-select support, and when to use the tool. There is no redundancy or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers the operation's workflow, multi-select behavior, and the key alternative comparison. All six parameters are fully documented in the schema. The main gap is the absence of return-value or post-condition information, but that is minor for a UI interaction tool with no output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents every parameter fully. The description adds context about multi-select and the lazy-rendering use case, but does not add meaningful parameter semantics beyond what the structured schema provides. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb+resource ('Set value(s) on an autocomplete/combobox input') and explains the exact multi-step flow it automates. It explicitly distinguishes this from browser_select_option, making its purpose and scope immediately clear.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage guidance is explicit: 'Use when browser_select_option fails because options render lazily after typing.' This tells the agent exactly when to choose this tool over the closest sibling, and the multi-select example adds real context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browser_set_cookiesB
Set one or more cookies for a domain.
| Name | Required | Description | Default |
|---|---|---|---|
| url | No | URL for the cookie (alternative to domain) | |
| name | Yes | Cookie name | |
| path | No | Cookie path (default: /) | |
| value | Yes | Cookie value | |
| domain | No | Cookie domain (e.g. ".example.com") | |
| secure | No | Secure flag (default: true) | |
| cookies | No | Array of cookie objects to set multiple at once | |
| httpOnly | No | HttpOnly flag (default: false) | |
| sameSite | No | SameSite attribute (default: lax) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It only states the action and does not mention whether existing cookies are overwritten, how defaults like secure or sameSite behave, or whether the cookie persists beyond the current session.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, direct sentence with no filler, front-loading the key action and scope. It is appropriately concise for the primary purpose statement.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 9 parameters, no annotations, and no output schema, the description is under-specified. It omits how to use the bulk 'cookies' parameter, the relationship between url and domain, default flag behavior, and any side effects or prerequisites.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema fully documents all 9 parameters. The description adds no parameter-level meaning beyond what the schema provides, which matches the baseline of 3 for full schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'set', the resource 'cookies', and the scope 'for a domain'. It also explicitly covers both single and bulk operations ('one or more cookies'), which distinguishes it from the sibling browser_get_cookies without needing inference.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this tool versus alternatives, such as browser_set_local_storage or browser_get_cookies. No prerequisites, timing, or exclusion conditions are mentioned, so the agent must infer the appropriate context from the name alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browser_set_dateA
Robustly set a date input - handles native , masked text inputs (e.g. MM/DD/YYYY), and calendar pickers (MUI, react-datepicker, AntD, Lexical/Meta). Tries native value-set, format-aware typing via Input.insertText, and ARIA-based picker navigation in sequence with read-back verification. Use instead of browser_fill when fill fails or for any input that opens a calendar widget.
| Name | Required | Description | Default |
|---|---|---|---|
| date | Yes | ISO date string (YYYY-MM-DD), e.g. "2026-05-15" | |
| selector | Yes | CSS selector for the date input element | |
| skip_picker | No | If true, only try native + masked paths and skip calendar-picker navigation (default: false) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full disclosure burden and does solid work: tries native value-set, Input.insertText typing, and ARIA-based picker navigation in sequence, with read-back verification. It does not disclose failure behavior, side effects like the calendar widget popping open, or what the call returns, which prevents a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two dense sentences with zero filler: the first front-loads the purpose, the covered input types, the strategy sequence, and verification; the second hands the agent the decision rule against browser_fill. Every clause earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 3-parameter tool with full schema coverage, the combination of strategy, supported frameworks, read-back verification, and the fallback routing to browser_fill is sufficient for an agent to invoke it correctly. The only notable gap is no indication of return/error signals, which is not covered by an output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so date (ISO string), selector (CSS selector), and skip_picker (skip calendar navigation) are already fully documented. The description adds only a marginal hint about masked vs ISO date format and mostly restates what the schema already conveys, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a specific verb and resource — 'Robustly set a date input' — and enumerates the concrete input types it covers (native date inputs, masked text inputs, and calendar pickers for MUI, react-datepicker, AntD, Lexical/Meta), making the scope unambiguous. It also explicitly names browser_fill as the sibling it replaces, so an agent can tell them apart without opening either schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives an explicit decision rule: 'Use instead of browser_fill when fill fails or for any input that opens a calendar widget,' naming the alternative and the condition that selects this tool. It does not spell out negative exclusions (e.g., defer to browser_fill for plain non-date inputs), so it stops just short of full when/when-not guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browser_set_local_storageA
Set a localStorage key-value pair on the current page.
| Name | Required | Description | Default |
|---|---|---|---|
| key | Yes | localStorage key to set | |
| value | Yes | Value to store (string) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of behavioral disclosure. It states the mutation and scope, but does not mention that existing values are overwritten, that localStorage persists, or that this depends on a valid same-origin page context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single active-voice sentence with no filler. The core information—action, resource, and scope—is front-loaded and every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple two-parameter tool with no output schema, the description and schema cover the essentials. It could mention return behavior or error cases, but the operation is simple enough that the omission is a minor gap rather than a blocker.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already documents both parameters with 100% coverage, so the baseline is 3. The description adds no extra meaning about key format, value serialization, or length constraints beyond what the schema provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a concrete verb ('Set') with a specific resource ('localStorage key-value pair') and clearly scopes the action to the current page. It is immediately distinguishable from browser_get_local_storage and other browser tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context for when the tool should be used: writing a localStorage value on the current page. It stops short of explicitly naming the reading counterpart or stating when not to use it, so it lacks full routing guidance but is still unambiguous.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browser_solve_captchaA
Detect CAPTCHAs on the current page and work through them, one action per call. "detect" reports reCAPTCHA v2/v3, hCaptcha, Cloudflare Turnstile and FunCaptcha. "click_checkbox" tries the reCAPTCHA checkbox and detects again. "click_grid" clicks the reCAPTCHA image-challenge cells you choose; this tool returns no image, so take one with browser_screenshot first. "ask_human" returns the message to show the user with browser_ask_user.
| Name | Required | Description | Default |
|---|---|---|---|
| grid | No | For click_grid: the size of the reCAPTCHA image grid in your screenshot, 3 (3x3) or 4 (4x4). | |
| cells | No | Grid cell indices to click (0-indexed, left-to-right, top-to-bottom) for image challenges. E.g. [2, 5, 7] to click cells 3, 6, 8. Pass grid to say which grid you see; without it, the grid is read as 4x4 only when an index is 9 or higher. | |
| action | No | Action to take. "detect" scans for CAPTCHAs. "click_checkbox" clicks the reCAPTCHA checkbox. "click_grid" clicks specific reCAPTCHA grid cells (pass cells, and grid 3 or 4). "ask_human" returns the message to show the user with browser_ask_user; it shows nothing itself. Default: "detect" |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden and does well: it discloses the one-action-per-call stateful pattern, that 'click_grid' returns no image (a genuinely non-obvious trait), and that 'ask_human' shows nothing itself but returns a message. It doesn't cover failure/detection-negative behavior, permissions, or rate limits, which keeps it from a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the core verb, then four tight sentences mapping one-to-one to the action enum. There is some duplication between the body text and the 'action' parameter description, but the structure is dense and every sentence carries actionable information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 3-param, no-annotation, no-output-schema tool, the description covers the action state machine and its cross-tool dependencies well enough to drive correct invocation. It could be more complete about what 'detect' reports back and what happens when solving fails, but nothing essential for calling it is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents 'action', 'grid', and 'cells' thoroughly, including the 0-indexed ordering and the 4x4 fallback rule. The prose largely restates the enum meanings; its added value is sequencing (pass cells together with grid), which is closer to usage guidance than parameter semantics. Baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource (detect and work through CAPTCHAs on the current page) and then enumerates the four concrete action modes with what each one does. It distinguishes itself from siblings by naming browser_screenshot and browser_ask_user as the tools that complement specific actions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Each action is given a clear usage context: 'click_grid' requires a prior browser_screenshot because the tool returns no image, and 'ask_human' requires browser_ask_user to actually display anything. What's missing is explicit when-not-to-use guidance (e.g. when to give up and escalate, or when the CAPTCHA is unsolvable), so it stops just short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browser_switch_tabA
Switch to a specific browser tab by ID. Get tab IDs from browser_list_tabs or browser_get_new_tab. The other tools then act on that tab. Chrome is not brought in front of the user: the tab is made active in its window, and visibility says whether the page is hidden behind other windows.
| Name | Required | Description | Default |
|---|---|---|---|
| tab_id | Yes | Tab ID to switch to | |
| bring_to_front | No | Also bring the Chrome window in front of the user. Takes the user's screen: only after the user agreed (browser_ask_user). Default false. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does well: it discloses that Chrome is not brought in front of the user, that the tab is made active within its window, and it decodes the 'visibility' status semantics. It omits error behavior for invalid tab IDs, but the side-effect profile is unusually well disclosed for an unannotated tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three tight sentences, front-loaded with the core action and ID sourcing before the behavioral nuance. Every sentence earns its place, though the final sentence about visibility is slightly dense.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema or annotations, so the description must carry the behavioral load, and it largely does—covering tab activation scope, the front-of-screen distinction, and ID provenance. Only the failure mode for an invalid or closed tab ID is left unaddressed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% so the baseline is 3, but the description adds genuine meaning beyond the schema by distinguishing 'active in its window' from 'in front of the user' and explaining what visibility conveys about tab_id's effect.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource ('Switch to a specific browser tab by ID') and immediately differentiates it from siblings by naming where IDs come from (browser_list_tabs, browser_get_new_tab) and clarifying that subsequent tools act on the switched tab.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives clear context for when this tool is the right step (after listing/creating tabs, before other tab-scoped tools) and flags the consent prerequisite for bring_to_front via browser_ask_user. It stops short of an explicit 'do not use when...' exclusion, but the routing guidance is strong.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browser_upload_fileA
Handing a file to the page needs "Allow access to file URLs" for the Agent360 Browser MCP extension (off by default for Chrome Web Store installs); that switch also lets the extension open any local file as a page, so whether to turn it on is the user's call. A "Not allowed" error from the handoff is reported as file-access-off unless Chrome confirms that file access is on. Upload a file to a element on the page. Uses Chrome Debugger API to set files programmatically - no dialog needed. For drag-drop zones without visible file input use browser_drop_file. If the field is empty afterwards although the page's change handler saw the file in it, the answer is ok with cleared_by_page: true and seen_in_field - X and Facebook empty the field after reading the file, and a page that rejects the file can do the same, so check the page before attaching again. Files must be regular files inside the working directory the MCP server runs in - folders, symlinks and hardlinks that point outside it are refused.
| Name | Required | Description | Default |
|---|---|---|---|
| file | No | Single file path (alternative to files array). Alias: `file_path`. | |
| files | Yes | Array of absolute file paths to upload. E.g. ["/Users/me/photo.jpg"] | |
| selector | No | CSS selector for the file input (default: input[type="file"]) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does so richly: it names the mechanism (Chrome Debugger API, no dialog), the permission prerequisite, the error mapping ("Not allowed" reported as file-access-off), and the non-obvious cleared_by_page/seen_in_field post-upload behavior. This is well beyond a typical definition.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Every sentence carries usable content, but the structure is not front-loaded: it opens with a browser-extension setting caveat and a long error-mapping sentence before stating the core action mid-paragraph. An agent scanning the first line learns about a toggle rather than what the tool does.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema, and the description compensates by explaining the relevant return semantics (ok with cleared_by_page and seen_in_field) as well as the failure signal (file-access-off). Prerequisites, constraints, alternatives and edge cases are all covered for this level of tool complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the schema documents file/files/selector including the file_path alias, establishing a baseline of 3. The description adds genuine semantics on top: files must be regular files inside the server's working directory, with folders, symlinks and hardlinks pointing outside refused.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: "Upload a file to a <input type=\"file\"> element on the page." It further distinguishes itself from the sibling browser_drop_file by routing drag-drop zones without a visible input there, so an agent can pick the right tool without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives explicit when-not-use guidance ("For drag-drop zones without visible file input use browser_drop_file") and surfaces the key precondition ("Allow access to file URLs" toggle, including that it also grants broader local-file page access). It also advises re-checking the page before re-attaching when the field is cleared, which is actionable selection guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browser_waitA
Wait for an element to appear on the page. Supports CSS and text-based selectors.
| Name | Required | Description | Default |
|---|---|---|---|
| timeout | No | Max wait time in ms (default: 10000) | |
| selector | Yes | CSS selector or text selector (e.g. "text=Success", "button:text(Next)") to wait for |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the behavioral burden. It does disclose the primary behavior: waiting for an element to appear and supporting CSS/text selectors. However, it does not mention what happens on timeout, whether it waits for visibility vs existence, or what the return value/error behavior is.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, focused sentence that front-loads the primary purpose and adds selector-type support without unnecessary detail. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple two-parameter tool with a fully described schema, the description is largely adequate. Gaps remain around timeout behavior and return/error semantics, which an agent would need to know for robust invocation, but the core usage is clear.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the input schema fully documents both selector and timeout. The description only restates selector types already present in the schema and adds no additional meaning beyond the structured definitions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('wait') and resource ('element to appear on the page'), clearly stating the tool's core action. It also distinguishes itself from the sibling browser_wait_for_network by focusing on DOM elements rather than network activity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided about when to use this tool versus alternatives like browser_wait_for_network. The description implies usage ('when you need to wait for an element') but gives no exclusions or decision criteria.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browser_wait_for_networkA
Wait for a network request to complete. Useful after clicking buttons that trigger API calls - ensures data is loaded before reading the page. Monitors real network traffic via Chrome DevTools Protocol.
| Name | Required | Description | Default |
|---|---|---|---|
| timeout | No | Max wait in ms (default: 15000) | |
| url_pattern | No | Substring to match in the request URL (e.g. "/api/users", "graphql"). Empty = any request. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full behavioral burden. It does disclose an important trait: 'Monitors real network traffic via Chrome DevTools Protocol.' However, it does not explain behavior on timeout, whether it waits for the first matching request or all requests, or what happens if no request matches. Adequate but with gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the primary action, followed by the use case and mechanism. Every sentence earns its place with no fluff or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple wait tool with 100% schema coverage and no output schema, the description covers what, when, and how. Missing details like timeout behavior and return value are minor given the simplicity, but the lack of annotations means slightly more context would be ideal.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents both parameters (timeout and url_pattern) with useful descriptions. The tool description adds no extra parameter meaning beyond what the schema provides, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description uses a specific verb+resource: 'Wait for a network request to complete.' It clearly distinguishes itself from generic browser_wait by specifying network-level waiting and adds the CDP mechanism. An agent can immediately understand what this tool accomplishes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides clear context: 'Useful after clicking buttons that trigger API calls - ensures data is loaded before reading the page.' This tells the agent when to use it. It does not explicitly name alternatives like browser_wait or say when not to use it, but the use case is unambiguous enough.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
7 tool updates
v1.30.2- Changed
browser_extract_list1 field changed- changed
Input schema / properties / stable_rounds / descriptionPrevious value: -"Consecutive scrolls with no new rows before stopping (default 3)"New value: +"Rounds in a row with no new rows, growth or movement before stopping, and at the bottom before reached_end (default 3)"
- Changed
browser_extract_token1 field changed- changed
Input schema / properties / provider / descriptionPrevious value: -"Provider slug (stripe, hubspot, slack, etc.)"New value: +"One of: stripe, hubspot, slack, shopify, mailchimp, pipedrive, calendly, google, linkedin"
- Changed
browser_navigate4 fields changed- changed
Input schema / properties / eget_vindue / descriptionPrevious value: -"Requires new_tab. Opens the page in its own Chrome window. On its own this does NOT make input work: measured 19 Sept, an unfocused window delivers no keystrokes at all, exactly like a background tab - what decides it is whether the WINDOW has the operating system's focus, not whether the tab is the visible one in it. What this is genuinely for: on a machine with more than one display, put the window on a screen nobody is looking at and pass fokuser:true. Then Chrome delivers input and nothing covers the person's work."New value: +"Requires new_tab. Opens the page in its own Chrome window, without focus unless you pass fokuser:true. Whether Chrome delivers mouse and keyboard input to a window without focus is unmeasured in desktop Chrome (a measurement on 19 Sept probably tested a background tab, because the tab was moved back into the session's first window; fixed in 1.30.2), so read landed in each input tool's answer. On a machine with more than one display, you can put the window on a screen nobody is looking at and pass fokuser:true - but focus is exclusive: while this window has it, whatever the person types lands in it. Use that only on a machine nobody is typing on." - changed
Input schema / properties / fokuser / descriptionPrevious value: -"With eget_vindue: ASK for the new window to get the operating system's focus, which keyboard and mouse input needs. ⛔ Measured 21 Sept: Chrome often refuses, and the window was on none of the machine's three screens. The reply now carries what actually happened - read `fokuseret` and `placeret_som_bedt` rather than assuming this worked. Do not rely on vindue_x to keep a run off the user's screen."New value: +"With eget_vindue: ASK for the new window to get the operating system's focus. Chrome can refuse it. The reply carries what actually happened - read `fokuseret` and `placeret_som_bedt` rather than assuming this worked. Do not rely on vindue_x to keep a run off the user's screen." - changed
Input schema / properties / new_tab / descriptionPrevious value: -"Open in new tab instead of reusing current (default: false)"New value: +"Open in new tab instead of reusing current (default: false). If the session's only tab is still an empty about:blank placeholder, that tab is used instead of opening another." - changed
Input schema / properties / vindue_x / descriptionPrevious value: -"With eget_vindue: the window's left edge in global screen points. A NEGATIVE value is a display to the left of the main one - that is how you put it on another screen. Read the displays first; do not guess."New value: +"With eget_vindue: the window's left edge in global screen points. A NEGATIVE value is a display to the left of the main one - that is how you put it on another screen. No tool lists the displays: use a coordinate you know is on an unused screen, and read `placeret_som_bedt` in the reply."
- Changed
browser_provide_feedback1 field changed- added
Input schema / properties / workedAdded value: +{ + "description": "The route that did work in the end, if any. This is the most useful part.", + "type": "string" +}
- Changed
browser_screenshot1 field changed- added
Input schema / properties / bring_to_frontAdded value: +{ + "description": "Raise Chrome in front of the user if its window is covered, and leave it there. Takes the user's screen: only after the user agreed (browser_ask_user). Default false.", + "type": "boolean" +}
- Changed
browser_solve_captcha4 fields changed- changed
Input schema / properties / action / descriptionPrevious value: -"Action to take. \"detect\" scans for CAPTCHAs. \"click_checkbox\" clicks the reCAPTCHA checkbox. \"click_grid\" clicks specific grid cells (pass cells param). \"ask_human\" shows overlay to user. Default: \"detect\""New value: +"Action to take. \"detect\" scans for CAPTCHAs. \"click_checkbox\" clicks the reCAPTCHA checkbox. \"click_grid\" clicks specific reCAPTCHA grid cells (pass cells, and grid 3 or 4). \"ask_human\" returns the message to show the user with browser_ask_user; it shows nothing itself. Default: \"detect\"" - changed
Input schema / properties / cells / descriptionPrevious value: -"Grid cell indices to click (0-indexed, left-to-right, top-to-bottom) for image challenges. E.g. [2, 5, 7] to click cells 3, 6, 8."New value: +"Grid cell indices to click (0-indexed, left-to-right, top-to-bottom) for image challenges. E.g. [2, 5, 7] to click cells 3, 6, 8. Pass grid to say which grid you see; without it, the grid is read as 4x4 only when an index is 9 or higher." - changed
Input schema / properties / cells / items / typePrevious value: -"number"New value: +"integer" - added
Input schema / properties / gridAdded value: +{ + "description": "For click_grid: the size of the reCAPTCHA image grid in your screenshot, 3 (3x3) or 4 (4x4).", + "enum": [ + 3, + 4 + ], + "type": "number" +}
- Changed
browser_switch_tab2 fields changed- added
Input schema / properties / bring_to_frontAdded value: +{ + "description": "Also bring the Chrome window in front of the user. Takes the user's screen: only after the user agreed (browser_ask_user). Default false.", + "type": "boolean" +} - changed
Input schema / properties / tab_id / descriptionPrevious value: -"Tab ID to activate"New value: +"Tab ID to switch to"
1 tool update
v1.30.0- Changed
browser_navigate6 fields changed- added
Input schema / properties / eget_vindueAdded value: +{ + "description": "Requires new_tab. Opens the page in its own Chrome window. On its own this does NOT make input work: measured 19 Sept, an unfocused window delivers no keystrokes at all, exactly like a background tab - what decides it is whether the WINDOW has the operating system's focus, not whether the tab is the visible one in it. What this is genuinely for: on a machine with more than one display, put the window on a screen nobody is looking at and pass fokuser:true. Then Chrome delivers input and nothing covers the person's work.", + "type": "boolean" +} - added
Input schema / properties / fokuserAdded value: +{ + "description": "With eget_vindue: ASK for the new window to get the operating system's focus, which keyboard and mouse input needs. ⛔ Measured 21 Sept: Chrome often refuses, and the window was on none of the machine's three screens. The reply now carries what actually happened - read `fokuseret` and `placeret_som_bedt` rather than assuming this worked. Do not rely on vindue_x to keep a run off the user's screen.", + "type": "boolean" +} - added
Input schema / properties / vindue_breddeAdded value: +{ + "description": "With eget_vindue: window width in points.", + "type": "number" +} - added
Input schema / properties / vindue_hoejdeAdded value: +{ + "description": "With eget_vindue: window height in points.", + "type": "number" +} - added
Input schema / properties / vindue_xAdded value: +{ + "description": "With eget_vindue: the window's left edge in global screen points. A NEGATIVE value is a display to the left of the main one - that is how you put it on another screen. Read the displays first; do not guess.", + "type": "number" +} - added
Input schema / properties / vindue_yAdded value: +{ + "description": "With eget_vindue: the window's top edge in global screen points.", + "type": "number" +}
2 tool updates
v1.29.2- Changed
browser_get_page_content2 fields changed- added
Input schema / properties / max_charsAdded value: +{ + "description": "Cap on returned characters (default: 30000). Over the cap the answer carries truncated: true and total_chars.", + "type": "number" +} - added
Input schema / properties / selectorAdded value: +{ + "description": "CSS selector. Reads only that element instead of the whole page. If it matches nothing the call fails rather than silently returning the whole page.", + "type": "string" +}
- Changed
browser_select_option1 field changed- changed
Input schema / properties / option / descriptionPrevious value: -"Text OR value of the option to select. Exact value match wins, then exact text, then partial text. Aliases: `value`, `label`. Fails loudly with the available options if nothing matches - it never reports success without the field actually changing."New value: +"Text OR value of the option to select. Exact value match wins, then exact text, then partial text. Aliases: `value`, `label`. Fails loudly with the available options if nothing matches. A controlled component may reset the field and store the choice elsewhere, so a success can come with `landed: null` and `maybe_landed: true`: the page changed, but the change does not prove it was the selection. Read the page before selecting again."
3 tool updates
v1.29.1- Changed
browser_ask_user1 field changed- changed
Input schema / properties / title / descriptionPrevious value: -"Dialog title (default: \"Agent360 — Action Required\")"New value: +"Dialog title (default: \"Agent360 - Action Required\")"
- Changed
browser_get_cookies1 field changed- changed
Input schema / properties / domain / descriptionPrevious value: -"Domain to get cookies for (e.g. \".stripe.com\")"New value: +"Domain to get cookies for (e.g. \".stripe.com\"). Must match a tab this session has open."
- Changed
browser_select_option1 field changed- changed
Input schema / properties / option / descriptionPrevious value: -"Text OR value of the option to select. Exact value match wins, then exact text, then partial text. Aliases: `value`, `label`. Fails loudly with the available options if nothing matches — it never reports success without the field actually changing."New value: +"Text OR value of the option to select. Exact value match wins, then exact text, then partial text. Aliases: `value`, `label`. Fails loudly with the available options if nothing matches - it never reports success without the field actually changing."
11 tool updates
v1.28.0- Added
browser_click_xy - Added
browser_double_click - Changed
browser_drop_file1 field changed- changed
Input schema / properties / file / descriptionPrevious value: -"Single absolute file path"New value: +"Single absolute file path. Alias: `file_path`."
- Changed
browser_execute_script1 field changed- changed
Input schema / properties / code / descriptionPrevious value: -"JavaScript expression to evaluate (runs in page context)"New value: +"JavaScript EXPRESSION to evaluate in page context. For multi-statement logic use an IIFE: (() => { ...; return result; })()"
- Added
browser_extract_list - Changed
browser_handle_dialog2 fields changed- changed
Input schema / properties / timeout / descriptionPrevious value: -"Max wait for dialog in ms (default: 10000)"New value: +"How long the arming stays active in ms (default: 60000)" - added
Input schema / properties / waitAdded value: +{ + "description": "Block until a dialog appears instead of arming and returning (default: false). Only use when the dialog is already on its way.", + "type": "boolean" +}
- Added
browser_provide_feedback - Added
browser_reattach_debugger - Added
browser_right_click - Changed
browser_select_option1 field changed- changed
Input schema / properties / option / descriptionPrevious value: -"Text of the option to select (partial match supported)"New value: +"Text OR value of the option to select. Exact value match wins, then exact text, then partial text. Aliases: `value`, `label`. Fails loudly with the available options if nothing matches — it never reports success without the field actually changing."
- Changed
browser_upload_file1 field changed- changed
Input schema / properties / file / descriptionPrevious value: -"Single file path (alternative to files array)"New value: +"Single file path (alternative to files array). Alias: `file_path`."
34 tool updates
v1.0.0- First observed
browser_about - First observed
browser_ask_user - First observed
browser_click - First observed
browser_close_tab - First observed
browser_console_logs - First observed
browser_dismiss_overlays - First observed
browser_drop_file - First observed
browser_execute_script - First observed
browser_extract_token - First observed
browser_fetch - First observed
browser_fill - First observed
browser_get_cookies - First observed
browser_get_local_storage - First observed
browser_get_new_tab - First observed
browser_get_page_content - First observed
browser_handle_dialog - First observed
browser_hover - First observed
browser_list_frames - First observed
browser_list_tabs - First observed
browser_navigate - First observed
browser_press_key - First observed
browser_screenshot - First observed
browser_scroll - First observed
browser_select_frame - First observed
browser_select_option - First observed
browser_set_combobox - First observed
browser_set_cookies - First observed
browser_set_date - First observed
browser_set_local_storage - First observed
browser_solve_captcha - First observed
browser_switch_tab - First observed
browser_upload_file - First observed
browser_wait - First observed
browser_wait_for_network
TDQS
Scored across 40 tools
Tools are mostly distinct and descriptions carefully differentiate similar actions (e.g., click vs double_click vs right_click vs click_xy; fill vs set_date vs set_combobox vs select_option). A few areas could cause initial confusion—upload_file vs drop_file, dismiss_overlays vs handle_dialog—but the descriptions provide clear guidance on when to use each.
All 40 tools use the same browser_ prefix and consistent snake_case. Most follow a verb_noun pattern (browser_navigate, browser_get_cookies, browser_set_cookies), with only minor exceptions like browser_about, which still fit the overall convention.
40 tools is excessive for a browser automation MCP; the rubric marks 25+ as too many. While many tools cover specialized edge cases, the sheer number increases the risk of misselection and makes the surface unwieldy for an agent.
The set covers a wide range of browser automation needs: navigation, interaction, tabs, cookies, storage, frames, files, captchas, and debugging. Minor gaps exist (e.g., no explicit drag-and-drop of elements, no direct download handling), but these can be worked around with existing tools.
Maintenance
Related MCP Connectors
Undetectable cloud browser sessions for AI agents and scrapers. Navigate, extract, click, captcha.
Cloud browsers for AI agents: get past bot detection, sign in with MFA, run web tasks at scale.
AI-powered browser automation — navigate, click, fill forms, and extract data from any website.
Web search, browser automation, scraping, crawling and CAPTCHA solving for AI agents.
Related MCP Servers
- AlicenseNot gradedqualityDmaintenanceEnables AI applications to automate your existing browser using your logged-in profile. Provides fast, private browser automation that avoids bot detection by working with your real browser fingerprint.9,336 npmApache 2.0
- FlicenseNot gradedqualityNot gradedmaintenanceEnables AI agents to authenticate with websites using a real Chromium browser with anti-detection measures and human-in-the-loop support for captchas and 2FA. Features stealth browsing, human-like interactions, and persistent session storage to automate and resume login workflows.-
- AlicenseBqualityFmaintenanceEnables AI agents to directly control your real Chrome browser with full context including login sessions, cookies, and open tabs. It provides tools for page scanning, JavaScript execution, CDP control, screenshots, and physical mouse/keyboard input for authentic browser automation.20245MIT
- AlicenseNot gradedqualityBmaintenanceLets AI assistants control your real Chrome browser to perform web tasks like reading pages, taking screenshots, clicking, and typing, using your existing logged-in sessions.143MIT