stealth-browser-mcp
stealth-browser-mcp
AI 어시스턴트에게 로그인 상태가 유지되는 실제 Chrome 브라우저를 제공하는 MCP 서버입니다.
대부분의 브라우저 자동화 도구는 모델에게 새롭고 빈 브라우저를 제공합니다. 하지만 이 도구는 영구 Chrome 프로필을 구동하므로, 2FA, CAPTCHA 또는 기기 승인 등 사이트가 요구하는 모든 절차를 직접 통과하여 한 번 로그인하면, 모델은 이후 실행에서도 비밀번호를 노출하지 않고 해당 세션을 계속 사용할 수 있습니다.
스크립트 로그인을 허용하지 않는 사이트를 위해 두 가지 탈출구를 제공합니다: 입력 시점에 macOS 키체인에서 가져오는 자격 증명, 그리고 Chrome의 가상 인증기를 통해 재생되는 WebAuthn 패스키입니다.
[!WARNING] 이것은 강력한 도구입니다. 언어 모델에게 사용자의 실시간 세션을 보유한 브라우저의 제어권을 부여하며, 모델이 선택한 페이지에 저장된 비밀번호를 입력할 수 있습니다. 중요한 것을 대상으로 사용하기 전에 SECURITY.md와 책임 있는 사용을 읽으십시오.
목차
Related MCP server: byob
작동 방식
MCP client (Claude Code, Claude Desktop, Cursor, …)
│
│ JSON-RPC over stdio
▼
┌───────────────────────────┐
│ stealth-browser-mcp │
│ 16 tools, one browser │
└─────┬───────────────┬─────┘
│ │
credentials │ │ CDP + Puppeteer
▼ ▼
┌───────────────────┐ ┌───────────────────────┐
│ macOS Keychain │ │ Google Chrome │
│ stealth-mcp:* │ │ + stealth plugin │
│ passwords, │ │ + WebAuthn virtual │
│ passkey material │ │ authenticator │
└───────────────────┘ └───────────┬───────────┘
│
▼
┌─────────────────────────┐
│ Persistent profile dir │
│ cookies · localStorage │
│ IndexedDB · sessions │
└─────────────────────────┘세 가지 구성 요소가 작동합니다:
영속성. Chrome은 임시 디렉토리 대신 고정된 userDataDir로 실행됩니다. 한 번 대화형으로 로그인하면 쿠키가 이후 모든 실행에서 유지됩니다 — 실제 사이트에서 자동화가 실패하는 일반적인 원인이 사라집니다.
스텔스. puppeteer-extra-plugin-stealth가 잘 알려진 자동화 탐지 신호를 패치하고, 서버는 몇 가지를 추가로 적용합니다: navigator.webdriver는 undefined, window.chrome.runtime은 존재, HeadlessChrome은 사용자 에이전트에서 제거, --disable-blink-features=AutomationControlled 설정. 클릭은 대상 내부의 지터된 지점까지 마우스를 경로를 따라 이동시키며, 입력은 30–100ms 간격으로 문자 하나씩 수행됩니다.
세션 생성이 아닌 세션 재사용. 설계 목표는 로그인 자동화를 피하는 것입니다. 키체인 자동 입력과 패스키 재생은 불가피한 경우를 위해 존재합니다.
요구 사항
Node.js 18 이상
Google Chrome. Puppeteer에 번들된 Chromium도 작동하지만, 실제 Chrome 빌드가 탐지 가능성이 현저히 낮습니다.
macOS — 키체인 및 패스키 기능을 원하는 경우. 그 외 모든 기능(탐색, 추출, 스크린샷, 영구 프로필)은 크로스 플랫폼입니다. 키체인 계층은
/usr/bin/security를 호출하므로 다른 플랫폼에서는 실패합니다. 브라우저 도구는 이를 사용하지 않습니다.
설치
git clone https://github.com/lauyuen/stealth-browser-mcp.git
cd stealth-browser-mcp
npm install선택적으로 예제 환경 파일을 복사하고 편집합니다:
cp .env.example .env브라우저가 실행되고 회피 기능이 활성화되었는지 확인합니다:
npm run check-stealthMCP 클라이언트에 연결
서버는 stdio를 사용합니다. 절대 경로로 src/server.js를 클라이언트에 지정하십시오.
Claude Code
claude mcp add stealth-browser -- node /absolute/path/to/stealth-browser-mcp/src/server.jsClaude Desktop — ~/Library/Application Support/Claude/claude_desktop_config.json
{
"mcpServers": {
"stealth-browser": {
"command": "node",
"args": ["/absolute/path/to/stealth-browser-mcp/src/server.js"]
}
}
}기타 MCP 클라이언트 — 동일한 형식에 선택적 프로필 재정의 추가:
{
"mcpServers": {
"stealth-browser": {
"command": "node",
"args": ["/absolute/path/to/stealth-browser-mcp/src/server.js"],
"env": {
"BROWSER_PROFILE_DIR": "/absolute/path/to/a/private/profile/dir"
}
}
}
}이후 클라이언트를 다시 시작하십시오. browser_status가 연결 상태를 확인하는 가장 빠른 방법입니다.
첫 로그인
모델이 사이트를 사용하기 전에 프로필을 직접 시드하십시오:
npm run login -- https://example.comMCP 서버가 사용할 동일한 프로필로 보이는 Chrome 창이 열립니다. 비밀번호 관리자, 2FA 프롬프트, CAPTCHA, "이 기기 기억하기" 등 모든 절차를 정상적으로 수행하여 로그인하십시오. 완료되면 터미널에서 Enter를 누르면 세션이 디스크에 저장됩니다.
이후 모든 MCP 실행은 해당 세션을 상속합니다. 사이트별로 반복하십시오. 세션은 사이트 자체 일정에 따라 만료되므로, 사이트가 로그아웃되면 이 과정을 다시 실행하십시오.
도구 참조
탐색 및 상호작용
도구 | 인수 | 참고 |
|
|
|
|
| 요소를 뷰포트로 스크롤한 후, 내부의 지터된 지점으로 마우스를 이동한 다음 클릭합니다. |
|
| 무작위 지연으로 한 번에 한 문자씩 입력합니다. |
|
|
|
|
| 요소를 기다리거나, 대기하거나, 둘 다 수행합니다. |
페이지 읽기
도구 | 인수 | 참고 |
|
| 스크립트와 스타일을 제거하고 텍스트와 구조화된 링크 및 양식 필드를 반환합니다. 모델이 페이지를 읽게 하는 가장 저렴한 방법입니다. |
|
| 원시 |
|
| PNG를 MCP 이미지 콘텐츠로 반환합니다. |
|
| 페이지 컨텍스트에서 JavaScript를 실행하고 결과를 반환합니다. SECURITY.md의 경고를 참조하십시오. |
세션 및 인증
도구 | 인수 | 참고 |
|
| 키체인에서 비밀번호를 읽어 입력합니다. 비밀번호는 모델에게 반환되지 않습니다. |
|
|
|
|
| 두 인수를 모두 지정하면 저장된 패스키를 주입합니다. 인수 없이 호출하면 등록 준비가 된 빈 인증기를 연결합니다. |
|
| 새로 등록된 자격 증명을 캡처하여 저장합니다. |
브라우저 수명 주기
도구 | 인수 | 참고 |
| — | 연결 상태, 탭 수, 현재 URL, 프로필 경로, 인증기 연결 여부. |
|
| 현재 세션을 보이는 창에서 다시 열어 CAPTCHA를 해결하거나 2FA 프롬프트를 직접 승인한 후 제어권을 되돌려줍니다. |
| — | 정상적으로 종료하고 쿠키를 디스크에 저장합니다. |
브라우저는 기본적으로 헤드리스로 실행되며 호출 간에 재사용됩니다.
browser_open_interactive_window는 보이는 창으로 전환하는 유일한 도구입니다.
키체인에 자격 증명 저장
비밀번호는 stealth-mcp: 서비스 접두사로 macOS 키체인에 저장됩니다 — 이 저장소의 파일이나 모델의 컨텍스트에는 절대 저장되지 않습니다.
npm run keychain set github you@example.com # prompts; input is not echoed
npm run keychain get github you@example.com # confirms presence, prints length only
npm run keychain delete github you@example.com그러면 모델은 비밀번호를 알지 못한 채 로그인을 트리거합니다:
// browser_autofill_login
{
"service": "github",
"account": "you@example.com",
"usernameSelector": "#login_field",
"passwordSelector": "#password",
"submitSelector": "input[type='submit']"
}service는 사용자가 선택하는 임의의 레이블입니다 — CLI와 도구 호출 간에 일치하기만 하면 됩니다.
스크립팅을 위해 비밀번호를 후행 CLI 인수로 전달할 수도 있지만, 셸 히스토리와 프로세스 목록에 남게 되므로 명령이 경고를 표시합니다.
패스키
Chrome은 DevTools 프로토콜을 통해 WebAuthn 가상 인증기를 노출합니다 — WebAuthn 흐름 테스트를 위한 소프트웨어 인증기입니다. 이 서버는 이를 구동하고 결과 키 자료를 키체인에 저장하여 실행 간에 유지되도록 합니다.
자동화 패스키 등록
인수 없이
passkey_enable_virtual_authenticator호출.사이트의 "패스키 추가" 흐름으로 이동하여 완료합니다. 가상 인증기가 챌린지에 응답하며 OS 프롬프트가 나타나지 않습니다.
사이트의
rpId와 계정으로passkey_save_registration호출.
이후 사용
rpId와 account로 passkey_enable_virtual_authenticator를 호출하면 탐색 전에 저장된 자격 증명이 주입되고, 사이트는 프롬프트 없이 로그인을 완료합니다.
[!CAUTION] 이렇게 보관된 패스키는 하드웨어 키가 아닌 파일입니다. 복사가 가능하며, 이는 실제 패스키가 방지하기 위해 존재하는 바로 그 속성입니다. 자동화 전용 패스키만 등록하십시오. 이메일, 은행 또는 분실 시 중대한 영향을 미치는 다른 것의 패스키에는 사용하지 마십시오.
구성
모든 설정은 환경 변수이며, 프로세스 환경 또는 .env 파일에서 읽습니다. .env.example을 참조하십시오.
변수 | 기본값 | 용도 |
|
| 영구 Chrome 프로필. 실시간 세션을 보유 — 비공개로 유지하고 버전 관리에서 제외하십시오. |
| 플랫폼 기본값 | 구동할 Chrome 바이너리. 경로가 없으면 Puppeteer의 Chromium으로 대체됩니다. |
|
| 탐색 및 선택자 제한 시간(밀리초). |
Chrome 실행 플래그와 기본 1280×800 뷰포트는 src/config.js에 있습니다. 여러 플래그가 보안과 호환성을 맞바꿉니다 — SECURITY.md에서 어떤 플래그인지와 제거해야 하는 이유를 설명합니다.
스텔스 검증
npm run check-stealthnavigator.webdriver, window.chrome, window.chrome.runtime, 플러그인 수, navigator.languages 및 실제 사용자 에이전트를 보고한 다음, 확정된 프로필과 Chrome 경로를 출력합니다.
더 엄격한 확인을 위해 browser_navigate로 브라우저를 핑거프린팅 페이지(예: bot.sannysoft.com 또는 abrahamjuliot.github.io/creepjs)로 이동시킨 후 browser_screenshot을 호출하세요.
어떤 스텔스 설정도 감지되지 않을 수는 없습니다. 잘 방어된 사이트는 핑거프린팅을 행동 분석, IP 평판, 계정 이력과 결합하므로 여전히 자동화를 알아챌 수 있습니다. 이는 "명백한 검사를 유발하지는 않는다"는 의미이지, "완전히 감지되지 않는다"는 의미가 아닙니다.
문제 해결
"Failed to launch the browser process" / 프로필이 잠겨 있음. Chrome은 프로필 디렉터리당 하나의 프로세스만 허용합니다. 같은 디렉터리를 대상으로 수동으로 시작한 Chrome이 있다면 모두 닫으세요. 서버는 시작 시 오래된 Singleton* 잠금 파일을 정리하고 DevTools 포트를 통해 실행 중인 인스턴스에 다시 연결하지만, 프로필을 소유한 실행 중인 Chrome이 우선합니다.
사이트가 모델을 로그아웃시키거나 차단함. 저장된 세션이 만료된 것입니다. npm run login -- <url>을 다시 실행하세요.
선택자가 일치하지 않음. 좁은 선택자로 browser_extract_html을 호출해 모델이 추측하는 대신 실제 마크업을 읽게 하세요. 단일 페이지 앱은 입력 요소를 늦게 마운트하는 경우가 많으므로 먼저 browser_wait_for를 호출하세요.
CAPTCHA가 나타남. browser_open_interactive_window를 호출해 직접 해결한 다음 계속 진행하세요. 해결된 상태는 프로필에 유지됩니다.
Linux 또는 Windows에서 Keychain 오류. 예상된 동작입니다. 이 계층은 macOS 전용입니다. 브라우저 도구는 모든 플랫폼에서 작동하지만, 자격 증명 및 패스키 도구는 작동하지 않습니다.
책임 있는 사용
이 프로젝트는 어시스턴트가 사용자가 이미 계정을 보유한 사이트에서 사용자가 직접 설정한 세션을 사용해 작업할 수 있도록 하기 위해 존재합니다. 이것이 의도된 범위이며, 영구 프로필 설계도 이를 반영합니다.
안티 탐지 및 자격 증명 자동화는 분명히 다른 용도로 사용될 수 있습니다. 사이트에 적용하기 전에 다음을 고려하세요:
사이트의 서비스 약관. 많은 사이트가 자동화된 접근을 명시적으로 금지합니다. 봇 방어를 우회하는 것은 사용자가 체결한 계약을 위반하는 것일 수 있으며, 일부 관할권에서는 무단 접근이 형사 책임을 수반합니다. 통제를 우회할 수 있다는 것은 그렇게 할 권한이 있다는 뜻이 아닙니다.
동의. 자신의 계정 또는 서면으로 승인받은 계정만 자동화하세요. 다른 사람의 자격 증명이 Keychain에 있다는 것은 동의가 아닙니다.
부하. 요청 속도를 제한하세요. 적용되는 곳에서는
robots.txt를 준수하세요. 사이트에 실제 비용을 발생시키는 자동화는 이 기법이 모두에게 금지되는 지름길입니다.타인의 데이터. 모델이 읽는 페이지는 MCP 클라이언트의 제공자로 전달됩니다. 제3자의 개인 정보를 이 경로로 흘려보내지 마세요.
특정 사이트의 보호 조치를 무력화하거나, 자격 증명을 수집하거나, 남용을 확대하는 것을 주된 목적으로 하는 기여는 병합되지 않습니다.
라이선스
MIT © Yuen Lau
Available Tools
16 toolsbrowser_autofill_loginA
Automatically fill and submit a login form using credentials stored securely in macOS Keychain.
| Name | Required | Description | Default |
|---|---|---|---|
| account | Yes | Account username or email (e.g. "alex@example.com") | |
| service | Yes | Service identifier in Keychain (e.g. "github", "reddit", "workportal") | |
| submitSelector | No | CSS selector for the submit button to click after filling | |
| passwordSelector | Yes | CSS selector for the password input field | |
| usernameSelector | No | CSS selector for the username/email input field |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations present, the description carries the disclosure burden. It clearly states the core behaviors—filling and submitting a login form—and the credential source, but it does not explain failure behavior, side effects of form submission, or what happens when optional selectors are omitted.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single well-structured sentence that front-loads the core action. It contains no filler or unnecessary detail.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description is adequate but incomplete for a tool with 5 parameters and no output schema or annotations. It does not explain the significance of optional selectors, the behavior when submitSelector is missing, or expected outcomes after the submit action.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the parameters are already individually documented. The description adds high-level purpose but does not clarify how usernameSelector and submitSelector interact with the core behavior, such as whether password-only filling is possible.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a specific verb and resource: automatically fill and submit a login form using Keychain-stored credentials. This clearly differentiates it from sibling tools like browser_type, keychain_store_credential, and passkey_save_registration.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies a prerequisite: credentials must already exist in macOS Keychain, and that suggests when this tool applies. However, it gives no explicit when-to-use versus when-not-to guidance and does not mention alternatives such as browser_type or passkey flows.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browser_clickA
Click an element on the page using human-like mouse movement and click delays.
| Name | Required | Description | Default |
|---|---|---|---|
| selector | Yes | CSS selector of the element to click (e.g. "button.submit", "#login-btn") |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses that the tool uses human-like mouse movement and click delays, which implies it takes time and may be slower than a direct click. However, it does not mention potential side effects like triggering navigation, opening new tabs, or requiring the element to be visible. For a click action, these are useful to know, but the human-like behavior is a notable disclosure that sets expectations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that is concise and front-loaded with the core action (click an element) followed by the behavioral nuance (human-like movement and delays). No wasted words; it earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple click tool with one parameter and no output schema, the description is adequate. It covers what it does and hints at the human-like behavior. However, it lacks any mention of what happens after the click (e.g., page navigation, waiting for page load) or any prerequisites (e.g., element must be visible/interactable). Given the tool's simplicity, a 3 is appropriate; it's minimally sufficient but not rich.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the schema fully describes the selector parameter. The description doesn't add additional parameter semantics, but it does mention in the schema example the format of the selector (CSS). Since coverage is high, baseline is 3. The description adds a bit more by implying the selector must target an element that is clickable, but it doesn't go beyond the schema. Given the schema is already thorough, a 4 is justified due to the clear example in the schema and the description's focus on the click behavior.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action (click) and the target (an element on the page), and mentions the specific behavior of human-like movement and delays. It distinguishes from siblings like browser_navigate and browser_type by focusing on clicking existing elements. However, it doesn't explicitly differentiate from other element-interaction tools like browser_evaluate or browser_scroll, though those are semantically different enough that the purpose is clear.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage: when you need to click an element on the page. However, it provides no when-not-to-use guidance or mentions alternatives like browser_type for typing or browser_evaluate for programmatic interaction. The human-like clicking nuance suggests it's meant for realistic user simulation, but this is not explicitly tied to use cases like testing or automation that requires stealth. Minimal guidance beyond the core action.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browser_closeA
Gracefully close the browser and flush session cookies/storage to disk.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It discloses that the action flushes session cookies and storage to disk, which is a meaningful side effect beyond the simple name. It does not mention irreversibility or behavior if called multiple times, but for a simple close operation this is adequate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that front-loads the primary action and then adds a crucial detail (cookie/storage flushing). There is no wasted language, and every word earns its place. It is optimally concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter tool with no output schema, the description is fully sufficient. It explains what the tool does and a key behavioral nuance. There is no missing information that an agent would need to correctly invoke this tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so per calibration guidance the baseline is 4. The description adds no parameter-specific details because none exist, and the schema already confirms no inputs. The description appropriately focuses on behavior rather than parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a precise verb ('close') and resource ('browser'), and adds meaningful nuance ('gracefully', 'flush session cookies/storage to disk'). It clearly distinguishes itself from sibling navigation and interaction tools since no other sibling performs a close operation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use it—when the user is done with the browser—and there are no competing close tools. However, it does not explicitly state conditions or alternatives, such as 'use browser_open_interactive_window if you need to keep the session' or any when-not-to-use guidance. Given the absence of alternatives, this is acceptable but not explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browser_evaluateB
Execute a custom JavaScript expression in the active page context and return the result.
| Name | Required | Description | Default |
|---|---|---|---|
| script | Yes | JavaScript code to evaluate (e.g. "document.title" or "window.location.href") |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations to fall back on, the description must fully disclose behavioral traits. It mentions execution in the active page context and returning a result, but omits critical details: that the script can modify the page (side effects), that the result must be JSON-serializable, that errors may be thrown, and whether execution is synchronous. These gaps are significant for a tool that runs arbitrary code, leaving the agent uncertain about safety and output formatting.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence that front-loads the primary action and outcome. It contains no filler and is easily parsed. While it could benefit from a note about return value constraints, the current length is appropriate for the tool's simplicity. It is slightly under-specified in terms of structure, but that is a minor point given the brevity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool that executes arbitrary JavaScript, the description is notably incomplete. It does not explain what happens to non-serializable results (e.g., functions, undefined), whether errors are propagated, or if the script can have persistent effects. Since there is no output schema, the description should cover return-value behavior. The absence of this information makes the tool risky for agents to use correctly, especially in a browser automation context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema description fully covers the single 'script' parameter with examples (“document.title”, “window.location.href”), so the baseline is 3. The tool description adds little beyond the schema—it restates that the script runs in the page context and that the result is returned, but does not elaborate on how the script's return value is serialized or formatted. Given high schema coverage, the description does not need to duplicate parameter details; it only adds minimal context, so a 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states that this tool executes a custom JavaScript expression in the active page context and returns the result. The verb 'execute' with the resource 'custom JavaScript expression' is specific, and it distinguishes itself from sibling tools like browser_extract_text or browser_click by focusing on arbitrary script evaluation. The purpose is unambiguous even without seeing the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies that this tool is for running arbitrary JavaScript, which is distinct from higher-level browser actions like clicking, typing, or extracting content. However, it does not explicitly say when to prefer this over alternatives or caution against using it when a more specific tool fits. The guidance is implicit rather than explicit, leaving the agent to infer the intended use case.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browser_extract_htmlC
Extract outer HTML of a specific element or the entire page DOM.
| Name | Required | Description | Default |
|---|---|---|---|
| selector | No | CSS selector to extract HTML for | body |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of behavioral disclosure. It states the output is outer HTML but does not explain behavior for multiple selector matches, no matches, or the fact that the default selector 'body' extracts only the body element rather than the entire page DOM, which conflicts with the description's 'entire page DOM' claim.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single front-loaded sentence with no filler. It earns its place but could be slightly more precise about the default selector behavior.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-parameter tool with no output schema, the description adequately conveys the return type (outer HTML). It is incomplete regarding default behavior and edge cases, but the low complexity keeps the gap moderate.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and the single parameter already has a clear description ('CSS selector to extract HTML for'). The description adds the 'outer' qualifier and the element-or-page scope, but it does not clarify how the default 'body' selector relates to the 'entire page DOM' claim.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific action ('Extract outer HTML') and a resource ('a specific element or the entire page DOM'), which distinguishes it from sibling browser_extract_text by output type. However, it does not explicitly differentiate itself from siblings, and the phrase 'entire page DOM' is slightly ambiguous given the default selector is 'body'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given about when to use this tool versus browser_extract_text, browser_evaluate, or browser_screenshot. The only implied signal is the word 'HTML', but there is no explicit when-to-use or when-not-to-use instruction.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browser_extract_textA
Extract cleaned text, links, and forms from the page for LLM reading.
| Name | Required | Description | Default |
|---|---|---|---|
| selector | No | CSS selector to scope extraction (defaults to entire body) | body |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Since no annotations exist, the description carries the full burden of behavior disclosure. It states the output is 'cleaned' and includes text, links, and forms, but does not explain how cleaning works, whether scripts/styles/hidden elements are removed, or what the response structure looks like.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One sentence, front-loaded with the action and resource, with no filler. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple, but with no output schema and no annotations, the description should cover what the agent can expect back. It lists the content categories (text, links, forms) and signals LLM-readiness, but it leaves the exact return format unstated.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The single selector parameter is fully documented in the schema with a default and description, so the baseline of 3 applies. The tool description itself adds no additional parameter-level meaning.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Extract') and a specific resource ('cleaned text, links, and forms from the page'), plus a clear purpose ('for LLM reading'). This distinguishes it from the sibling tool browser_extract_html, which presumably returns raw HTML.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'for LLM reading' provides clear context on when this tool is appropriate, and 'cleaned' implies a contrast with raw HTML extraction. It does not explicitly name alternatives or exclusions, so it stops short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browser_open_interactive_windowA
Opens a non-headless visible Chrome window on the user desktop so the user can manually solve a CAPTCHA or complete 2FA.
| Name | Required | Description | Default |
|---|---|---|---|
| url | No | URL to open in the visual window (defaults to current page) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden. It discloses the key trait of opening a visible, non-headless window for user interaction, but does not indicate whether the tool blocks or waits for the user to finish, what it returns, or potential side effects like automation suspending. This is adequate but not comprehensive.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, concise sentence that is front-loaded with the core action and purpose. There is no superfluous information, and every word contributes to understanding.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with one optional parameter and no output schema, the description provides enough context for an agent to decide when to invoke it and what it does. It lacks details about post-action behavior (e.g., whether it returns immediately or blocks), but this is a minor gap given the simplicity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The single parameter (url) is fully described in the schema, including its default behavior. The description adds no additional parameter-level details beyond the schema, so it meets the baseline for high coverage without adding extra semantic value.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb 'opens' and a specific resource 'non-headless visible Chrome window' with a clear purpose: enabling the user to manually solve a CAPTCHA or complete 2FA. This distinguishes it from siblings like browser_navigate, which likely operate in a headless or automated context.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the use case—when manual user intervention is required for CAPTCHA/2FA—and clearly situates it as an alternative to automated navigation. However, it does not explicitly state when not to use it or compare it to other tools, so it misses explicit exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browser_screenshotA
Capture a screenshot of the current page for visual inspection.
| Name | Required | Description | Default |
|---|---|---|---|
| fullPage | No | Whether to capture the entire scrollable page height |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description doesn't contradict annotations (there are none), but it also doesn't add behavioral details beyond what's in the schema. The `fullPage` parameter's effect is partially inferred from its schema description, but the tool's side effects (e.g., whether it scrolls, what it returns) are not specified. Since annotations are absent, this could be more transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise and to the point, with no filler or redundant information. It uses a clear structure with a single sentence that directly communicates the tool's function.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simplicity of the tool (single parameter, no output schema), the description is adequate but leaves some gaps. It doesn't mention what the return value looks like (e.g., image data) or any side effects, but these may be implicitly understood in a browser automation context. With no output schema and no annotations, a bit more detail about the expected outcome would improve completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds minimal value for parameters since the schema already covers `fullPage` with its description. However, the schema coverage is 100% (1/1 parameter documented), and the description reinforces the parameter's purpose without conflict. The description doesn't add much beyond what's in the schema, but the schema already provides sufficient clarity.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose with a specific verb ('capture') and resource ('screenshot of the current page'). It distinguishes itself from other browser actions like navigation, clicking, and typing, though it doesn't explicitly name sibling tools or edge cases like capturing specific elements.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It implies usage for visual inspection, which provides some contextual guidance. However, it doesn't explicitly state when to use this over alternatives (e.g., browser_extract_html or browser_extract_text), nor does it mention any prerequisites or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browser_scrollB
Scroll the viewport up or down.
| Name | Required | Description | Default |
|---|---|---|---|
| distance | No | Scroll distance in pixels | |
| direction | No | Direction to scroll | down |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the burden. It does disclose the core behavior (scrolling the viewport up or down) and the scope ('viewport'), but it does not mention whether the scroll is instant or smooth, whether it waits for scrolling to finish, or if any state is affected.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with no filler. It front-loads the action and target, and every word contributes to the meaning.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple two-parameter scrolling tool with no output schema and no annotations, the core action is clear enough to invoke. However, there are gaps such as no behavioral details, no usage guidance, and no mention of alternatives, leaving the description minimal but not fully complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the parameters are already well documented in the schema. The description adds no additional meaning beyond what the schema provides, making the baseline score of 3 appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states a specific action and target: 'Scroll the viewport up or down.' It is understandable and concise, though it does not explicitly differentiate itself from sibling tools like browser_evaluate or browser_wait_for.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this tool versus alternatives, no mention of prerequisites, and no exclusions. The description only states what the tool does, not when it should be selected.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browser_statusB
Check the current status of the browser instance, active tabs, and persistent profile path.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. 'Check' implies read-only behavior, but the description does not explicitly confirm no side effects, whether it launches or connects to a browser, or what happens when no browser instance exists. It names output subjects but leaves key behavioral traits unstated.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with no filler, front-loading the verb and object. Every phrase earns its place by naming distinct informational targets.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter status tool, the description covers the core purpose and likely return areas. However, there is no output schema, and the description does not specify the return format, field structure, or error behavior, leaving some ambiguity for an agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so the empty schema makes parameter semantics trivial. The description still adds value by indicating what the status call will report: active tabs and persistent profile path.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('check') and names three concrete targets: browser instance status, active tabs, and persistent profile path. This clearly distinguishes it from navigation, clicking, and typing siblings, though it does not explicitly name a sibling for comparison.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus siblings. It does not state whether it should be called before navigation, whether it requires an already-open browser, or what conditions make it the right choice. Usage must be inferred from the name and description.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browser_typeB
Type text into an input or textarea with realistic human keystroke timing delays.
| Name | Required | Description | Default |
|---|---|---|---|
| text | Yes | Text to type into the field | |
| selector | Yes | CSS selector of the input field | |
| clearFirst | No | Whether to clear existing input content before typing |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must carry the full burden of behavioral disclosure. It mentions realistic keystroke timing, which is a positive behavioral trait, but does not disclose other important traits such as whether it waits for the element to be interactable, what happens if the selector is invalid, or potential side effects like triggering events. This leaves significant gaps for a tool that interacts with a live page.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence with no redundant words. It front-loads the main action and a key behavioral detail. It earns a 4 for being concise and structured well, though it does not quite merit a 5 because it could also mention a usage clause without becoming verbose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (typing into a live browser page), the lack of annotations and output schema means the description should explain more about behavior (e.g., focus handling, typing speed, error scenarios). It provides some context (realistic timing) but is insufficient for an agent to predict all outcomes. A tool with this interaction complexity needs more clarity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Since the schema description coverage is 100%, the baseline is 3, and the description does not add extra meaning beyond what the schema already provides. It does not explain the exact behavior of clearFirst (e.g., whether clearing is immediate or simulated) or the selector syntax (e.g., supporting CSS selectors only). The description adds no value beyond the schema, so a 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Type text into an input or textarea' with a specific verb and resource, and mentions 'realistic human keystroke timing delays' which is a useful specificity. However, it does not differentiate from sibling tools like browser_click or browser_evaluate, so it loses a point for not explicitly distinguishing itself.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies that it is for typing text into form fields, and the realistic timing suggests it is for user-like interaction, which is distinct from browser_evaluate. However, there is no explicit guidance on when to use this versus browser_autofill_login or browser_click, nor does it state when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browser_wait_forB
Wait for a CSS selector to appear or sleep for a specified duration in milliseconds.
| Name | Required | Description | Default |
|---|---|---|---|
| selector | No | CSS selector to wait for | |
| milliseconds | No | Milliseconds to sleep (e.g. 2000) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must carry the full behavioral burden, but it only states the basic wait behavior. It does not disclose what happens if the selector never appears, whether there is a timeout, what the return value is, or how the two modes interact when both parameters are provided. These are material gaps for a tool that can potentially block indefinitely.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that is front-loaded with the core action and wastes no words. It conveys both operational modes in a compact, readable way.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite the tool's low parameter count, the description omits crucial invocational details: there are no required parameters, yet the rationale for calling with neither, either, or both parameters is unexplained. The absence of an output schema makes the lack of return value information more significant, and the timeout/error behavior is unspecified, leaving an agent unable to predict failure modes.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and the description adds little beyond the parameter descriptions: it clarifies that the parameters represent two alternative modes. This matches the baseline of 3 for high schema coverage; the description does not introduce new semantic pitfalls.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the operation ('wait') and the two resources involved: a CSS selector to appear or a sleep duration in milliseconds. It is unambiguous and immediately distinguishes the tool from navigation, clicking, typing, and other browser actions. The verb-resource pairing is specific and informative.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage contexts (wait for an element before interacting, or pause execution) but does not explicitly specify when to prefer this over alternatives or mention any exclusions. There are no sibling wait tools, so the lack of explicit alternatives is a minor gap, but the usage guidance is only implicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
keychain_store_credentialA
Store a username and password securely in macOS Keychain so the browser agent can log in automatically later.
| Name | Required | Description | Default |
|---|---|---|---|
| account | Yes | Username or email address | |
| service | Yes | Service name (e.g. "github", "aws", "internal_portal") | |
| password | Yes | Password to store in Keychain |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of explaining side effects, but it does not mention overwrite behavior, return values, errors, or whether the stored credential is immediately available to the browser. It only states that it stores securely.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence that includes the action, resource, and purpose. No unnecessary words or details are present.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple store operation, the description gives the essential purpose, but it omits behavioral details such as whether existing credentials are overwritten or what the tool returns. Given the lack of annotations and output schema, this is a moderate gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already provides clear descriptions for all three parameters with 100% coverage. The description does not add extra meaning beyond what is already in the schema, so the baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states a specific action (store), a specific resource (macOS Keychain), and the intended purpose (so the browser agent can log in automatically later). It distinguishes the tool from siblings like browser_autofill_login and passkey_save_registration.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use the tool (before an automated login), but it does not explicitly mention alternatives or conditions for not using it. The purpose is strong enough that an agent can infer the primary use case.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
passkey_enable_virtual_authenticatorC
Enables a Chrome DevTools Protocol (CDP) WebAuthn virtual authenticator and optionally injects a stored Passkey credential from Keychain.
| Name | Required | Description | Default |
|---|---|---|---|
| rpId | No | Relying party ID / domain (e.g. "github.com", "google.com") | |
| account | No | Account username associated with the stored passkey |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of disclosing side effects. It mentions enabling a virtual authenticator and optionally injecting a credential, but does not say whether this alters the current browser session, requires a prior CDP connection, overwrites existing authenticators, or what happens when the optional credential is absent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, well-structured sentence conveys the core capability and optional behavior without wasted words. The main action is front-loaded, and the optional injection is clearly appended.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no annotations and no output schema, the description is too thin for an agent to confidently call this tool. It does not explain the context needed (e.g., a browser/CDP session), when the two optional-looking parameters are actually needed, or what observable effect the tool produces.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema fully documents rpId and account. The description does not add meaning beyond the schema, only implying that both relate to the stored passkey injection, which keeps this at the baseline 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states a specific action ('Enables') and resource ('CDP WebAuthn virtual authenticator'), and adds the optional injection of a stored passkey. It is clearly distinct from the browser_* navigation/automation siblings, though it does not explicitly differentiate itself from passkey_save_registration or keychain_store_credential.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains what the tool does but gives no guidance on when to use it versus alternatives like passkey_save_registration or keychain_store_credential. It also lacks prerequisites or any exclusions, so the agent must infer the intended context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
passkey_save_registrationB
Captures newly registered Passkey credentials from the virtual authenticator and saves them to macOS Keychain for future automated logins.
| Name | Required | Description | Default |
|---|---|---|---|
| rpId | Yes | Relying party domain (e.g. "github.com") | |
| account | Yes | Account username to link to this passkey |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must fully disclose behavioral traits. It does state the main side effect (saving to macOS Keychain), but it does not mention whether the captured credential is consumed/cleared from the virtual authenticator, whether repeated calls overwrite data, or whether any prior setup is required. This is a meaningful gap for a state-changing tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with no filler. It front-loads the action and destination, and every part contributes to understanding what the tool does.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with no output schema and no annotations, the description lacks important context: it does not explain the required ordering relative to passkey_enable_virtual_authenticator, what happens to captured credentials, or how it differs from keychain_store_credential. An agent would struggle to know when exactly to invoke this tool in a multi-step browser/passkey flow.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and the description adds no parameter-specific meaning beyond what the schema already provides. The rpId and account descriptions are sufficient for understanding their values, so a baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states a specific verb ('Captures... and saves') and a specific resource ('newly registered Passkey credentials from the virtual authenticator', 'macOS Keychain'). It is easy to understand what the tool does, though it does not explicitly contrast itself with sibling tools like keychain_store_credential.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'newly registered Passkey credentials' implies this tool is used after a passkey registration flow, but there is no explicit guidance about when to choose it over alternatives like keychain_store_credential or how it fits with passkey_enable_virtual_authenticator. Usage context is only implied, not stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
16 tool updates
v1.1.0- First observed
browser_autofill_login - First observed
browser_click - First observed
browser_close - First observed
browser_evaluate - First observed
browser_extract_html - First observed
browser_extract_text - First observed
browser_navigate - First observed
browser_open_interactive_window - First observed
browser_screenshot - First observed
browser_scroll - First observed
browser_status - First observed
browser_type - First observed
browser_wait_for - First observed
keychain_store_credential - First observed
passkey_enable_virtual_authenticator - First observed
passkey_save_registration
TDQS
Scored across 16 tools
Each tool has a clearly distinct purpose: navigation, login, passkey management, keychain storage, clicking, typing, screenshotting, text extraction, HTML extraction, JS evaluation, scrolling, waiting, interactive window, status, and close. The overlap between extract_text and extract_html is minor and well-explained by their descriptions.
Tool names follow a consistent pattern with functional prefixes (browser_, passkey_, keychain_) and descriptive verb_noun or verb_object combinations. All verbs are clear and consistently styled (snake_case), making the set predictable and scannable.
16 tools is appropriate for a browser automation server covering navigation, interaction, authentication, extraction, and lifecycle management. Each tool earns its place and the count is neither sparse nor bloated for the intended scope.
The tool surface covers core browser automation workflows: navigation, login, passkey handling, interaction, content extraction, and browser lifecycle. Minor gaps exist such as explicit back/forward navigation or download handling, but these do not critically hinder typical automation tasks.
Maintenance
Related MCP Connectors
Let AI agents use your real, signed-in Chrome: tabs, clicks, forms, screenshots and video.
Let your AI agent operate any website through a real, logged-in browser session.
Logs your AI agent into websites, catches verification codes, and asks you before anything risky.
Stealth web automation for AI agents. Login, signup, navigate, screenshot.
Related MCP Servers
- FlicenseNot gradedqualityNot gradedmaintenanceEnables AI agents to authenticate with websites using a real Chromium browser with anti-detection measures and human-in-the-loop support for captchas and 2FA. Features stealth browsing, human-like interactions, and persistent session storage to automate and resume login workflows.-
- AlicenseNot gradedqualityCmaintenanceLets AI assistants control your real Chrome browser to perform web tasks like reading pages, taking screenshots, clicking, and typing, using your existing logged-in sessions.145MIT
- AlicenseAqualityBmaintenanceGives your AI agent a persistent browser identity with anti-detection, credential vault, and multi-persona support for automated web browsing, login, and signup.3110 npm10MIT
- AlicenseNot gradedqualityBmaintenanceEnables AI assistants and terminal users to control a logged-in Chrome browser, performing actions like opening pages, searching, filling forms, and taking screenshots without re-authentication.MIT