Boxline MCP server
Boxline MCP server gives any MCP client isolated cloud machines with a real Chrome browser, a bash shell and a shared disk, plus session-free web tools and password-safe sign-in — 26 tools in all.
Sessions — create a browser, shell or combined session (optionally with a proxy, ad blocking, cookie-banner rejection, a saved browser profile, a time limit, and exported credentials), list sessions to find an id again, stop one (saving it and stopping billing), resume it as it was, or delete it for good.
Browser — navigate to URLs; do one or many steps in plain English or as exact actions (click, hover, scroll, drag, right/double click, evaluate); click by selector or coordinates; type text or a saved credential; press keys and combinations; read the page as Markdown or text; take screenshots; sign in with a saved password in one call; run screenshot-driven computer-use actions.
Shell — run bash commands in a persistent session shell (cd/export persist), with a workspace and browser downloads folder, up to an hour per command.
Files — list, read, write (overwrite) and delete files or whole folders on the session's disk; stopped sessions' saved files can be read and listed without resuming.
Web (no session needed) — fetch a page through a real browser as Markdown/HTML/text, search the web (optionally returning top pages as Markdown), screenshot a page, extract structured JSON from up to 10 pages via prompt or JSON Schema, and crawl a site or section (robots.txt respected) with paginated retrieval.
Credentials — list saved passwords and secrets (names, types, allowed sites, 2FA code source, exportability — never values) so an agent can type them or sign in without ever seeing them; credentials themselves are created outside the chat.
Deployment — run locally over stdio via
npx @boxline/mcp, or self-host over stateless HTTP (POST /mcp) with per-request bearer API keys or OAuth sign-in, host/origin checks, concurrency limits, health checks and adirectorytool mode that hides credential tools.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@Boxline MCP serveropen news.ycombinator.com and list the top 5 stories as markdown"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Boxline MCP server
Give your AI agents the infrastructure they need: browsers, shells, storage and isolated machines.
This server gives any MCP client (Claude, Cursor, VS Code and others) an isolated cloud machine with a real browser, a shell and a disk, through Boxline. The agent can open pages, click and type, read a page as Markdown, run commands, read and write files, fetch pages and search the web.
Set it up
You need a Boxline API key (console → API keys) and Node 20 or newer.
Claude Desktop, Cursor and other clients that take a JSON config:
{
"mcpServers": {
"boxline": {
"command": "npx",
"args": ["-y", "@boxline/mcp"],
"env": { "BOXLINE_API_KEY": "bxl_your_key" }
}
}
}Claude Code:
claude mcp add boxline --env BOXLINE_API_KEY=bxl_your_key -- npx -y @boxline/mcpBOXLINE_API_URL points it at another API (default https://api.boxline.dev).
Related MCP server: noxgild-cli
Tools
The server keeps nothing between calls: session_create returns a sessionId, and every tool that works in a session
takes it as a required sessionId (session_list finds an id again; a tool that acts resumes a stopped session first, as it
was; browser_read and browser_screenshot say to call session_resume instead, because a resume starts a machine and billing;
files_list and files_read read a stopped session's saved files without resuming it). session_create, session_list, credentials_list and the web_* tools need no session.
A session is a browser, a shell or both: session_create takes browser and shell (both true unless you say otherwise).
browser: false with a shell is a shell-only session, with no live view: the browser_* tools answer browser_disabled.
Every tool says what it does to the world in its MCP annotations (a title, and read-only, destructive and open-world hints), so a client can decide what to ask you about. There are 26 tools:
Group | Tools |
Sessions |
|
Browser |
|
Shell |
|
Files |
|
Web |
|
Credentials |
|
browser_act is the tool for everything the others do not cover. A plain-English step ("click the Sign in link") is carried
out by a model, like a step of an agent run: it is billed as one and needs a plan that includes plain-English steps. An exact
action ({"action": "hover", "selector": "text=Products"}) uses no model. Each step gets one line saying what happened; an
evaluate step also gives the value it returned ({"action": "evaluate", "expression": "document.title"}). There are no agent-run tools: an MCP client is
already an agent.
Signing in without showing the agent a password
Save a website password (or a secret) as a credential in the Boxline console, the CLI or an SDK.
The agent calls credentials_list to see what exists (names, types and the sites each may be typed on; never a value), then
types it with browser_type:
browser_type { "sessionId": "<id>", "credential": "SHOP", "field": "username", "selector": "#email" }
browser_type { "sessionId": "<id>", "credential": "SHOP", "field": "password", "selector": "#password" }
browser_type { "sessionId": "<id>", "credential": "SHOP", "field": "otp", "selector": "#code" } // the current 2FA code, if the password has a 2FA keyOr sign in in one call with browser_login { "sessionId": "<id>", "credential": "SHOP", "url": "https://shop.example.com/login" }: a short run in the
session types the credential on its sites only, and the agent sees neither the password nor any code. A password whose
codeSource (in credentials_list) is push or url waits for the code or sign-in link that your system sends, up to its
timeout (the agent should tell you a code is needed); you send it with the CLI (boxline credentials push-code SHOP) or
an SDK (credentials.pushCode), never through the chat.
The platform types the value into the field itself, only on the sites the credential was saved for, and never shows it to
the agent, the chat or the logs: wherever a result would show it (browser_read, the page's elements, a screenshot, an
error), the text is replaced by %SHOP.password% and the field is covered. This hides a value; it does not protect
it. It is a guard against showing a credential by accident, not a boundary: code that runs in the page or the session
(an evaluate action in browser_act, a command in shell_exec) can still read a field and print it, for example reversed or in base64. Use a
password only in sessions whose pages and scripts you trust, and save it with the narrowest sites. session_create can also start from a saved browser profile (cookies and logins from an
earlier sign-in; persistProfile saves new ones back) and export credentials into the session's shell as environment
variables, for those credentials_list marks exportable (scope shell or all, or shell: true); others are refused. With a
shell, the password a profile signs in with is exported too when it is exportable. No tool creates or changes a credential, so a password never passes
through the chat: add them yourself, outside the conversation.
Sessions are billed while they run: stop them with session_stop when the work is done, or let them stop at their time
limit. A stopped session is free and is kept for your plan's retention days (7 on Free, 30 on Hobby and Startup, 90 on
Scale): session_resume brings it back with its tabs and files, and session_delete removes it at once, with its
recording and logs. A tool that acts, given the id of a stopped session, resumes it first; browser_read and browser_screenshot say to call session_resume; files_list and files_read read the saved files as they are.
Self-hosting over HTTP
boxline-mcp --http serves the same tools over HTTP at POST /mcp, for clients that connect to a URL instead of starting a
process. It speaks the MCP revision 2026-07-28 and, without sessions, the 2025-era protocol older clients still use.
MCP_ALLOWED_HOSTS=mcp.example.com BOXLINE_API_URL=https://api.boxline.dev npx -y @boxline/mcp --httpSign-in: every request carries its own Boxline API key as
Authorization: Bearer <API key>, or the OAuth access token an MCP client got when a person clicked "Connect" (below). The server holds no key of its own, never logs a token, and calls the API with the token of the request it is serving. Before a request is served the token is checked against the API (oneGET /v1/auth/me, remembered for a minute by its hash): a token the API refuses (expired, revoked, unknown) is401, so a client signs in again or refreshes it instead of getting a tool error. Without a token the answer is401withWWW-Authenticate: Bearer.OAuth sign-in (for ChatGPT, Claude and other clients that offer "Connect" instead of a key field) is for Boxline's hosted server,
https://mcp.boxline.dev/mcp. Boxline's sign-in issues tokens for that address only. A server you host yourself takes API keys (Authorization: Bearer bxl_…). The hosted server setsMCP_RESOURCE(its public URL) andMCP_AUTH_SERVER(the issuer,https://api.boxline.dev), then publishes protected resource metadata (/.well-known/oauth-protected-resource, RFC 9728) and answers a missing or refused token with401and aWWW-Authenticate: Bearer resource_metadata="…"challenge, which is what those clients follow to sign the person in. An OAuth token (bxo_…) always gets thedirectorytools (no saved credentials); abxl_API key getsMCP_TOOLS.Stateless: each request is served on its own, so any number of copies behind a load balancer can answer any request, and a restart loses nothing. Nothing is remembered between calls: the
sessionIdthatsession_createreturns is the only handle (as above).GET /mcpandDELETE /mcpanswer405.Put it behind HTTPS (a reverse proxy or load balancer).
GET /healthzanswers200 okfor health checks, on any host.Environment:
Variable | Default | |
|
| Port to listen on ( |
|
| Address to bind. |
|
| The Boxline API the server calls. |
| none | Comma-separated host names the server answers to ( |
| none | Both or neither: turn on OAuth sign-in discovery (above; Boxline's hosted server only). |
| none | The token ChatGPT's domain verification expects at |
|
| How long a token's check against the API is remembered ( |
|
|
|
Request bodies are limited to 4 MiB (413), at most 32 requests run at once (MCP_MAX_IN_FLIGHT; more get 503), and at most 8 per bearer token (MCP_MAX_IN_FLIGHT_PER_TOKEN; more get 503, so one caller cannot hold every slot). Live view URLs are left out of tool results. Long tool calls keep their connection alive with SSE comment frames every 15 seconds.
Links
Docs: docs.boxline.dev
Node SDK: Boxline-dev/sdk-node · Python SDK: Boxline-dev/sdk-python
MIT licence.
This repository holds the Boxline MCP server (@boxline/mcp). It is copied from Boxline's main repository on every change. Issues and pull requests are welcome here; accepted changes are made there and arrive with the next copy.
Available Tools
26 toolsbrowser_actDo steps in the browserA
Do one or more steps on the session's browser page, in order, and stop at the first one that fails. Each step is a sentence in plain English ("click the Sign in link", "scroll to the pricing table") or an exact action object such as {"action": "click", "selector": "text=Sign in"}, {"action": "hover", "selector": "text=Products"}, {"action": "goto", "url": "https://example.com"}, {"action": "scroll", "deltaY": 600}, {"action": "evaluate", "expression": "document.title"}, {"action": "click", "selector": "#file", "button": "right"} or {"action": "drag", "from": {"x": 10, "y": 10}, "to": {"x": 200, "y": 10}}. A plain-English step is carried out by a model (like a step of an agent run: it is billed as one and needs a plan that includes plain-English steps); an action object uses no model. Use it to do several things in one call, or when saying what to click is easier than finding its selector. Coordinates are CSS pixels of the viewport. Returns one line per step saying what happened; an evaluate step also gives the value it returned, extract the data, elements the page's numbered elements.
| Name | Required | Description | Default |
|---|---|---|---|
| actions | Yes | The steps, 1 to 100: a plain-English sentence, or an action object with an `action` field | |
| sessionId | Yes | Id of the session, from session_create |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=false, destructiveHint=false, openWorldHint=true, so the agent knows this is a non-destructive mutation on the open web. The description adds genuinely useful behavior beyond that: fail-fast termination, that plain-English steps consume a model and are billed while action objects are free, and that coordinates are viewport CSS pixels. Strong additions, though return/pagination detail is thin.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loads the core purpose and fail-fast rule, then layers in examples and the cost distinction. It is dense and example-heavy, but every clause (billing, coordinates, return format) carries information an agent needs given the polymorphic input, so it largely earns its length.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description still explains return behavior ('one line per step saying what happened', plus the evaluate return value). For a two-param, high-complexity polymorphic tool, an agent has what it needs to select and invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, but the description adds substantial meaning: concrete action-object shapes (click, hover, goto, scroll, evaluate, right-click, drag), the 1-to-100 step contract, and the plain-English-vs-object distinction with its different execution/cost model. This far exceeds what the schema alone conveys.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource ('do one or more steps on the session's browser page') plus the fail-fast semantics ('in order, and stop at the first one that fails'). It implicitly distinguishes itself from single-action siblings like browser_click ('when saying what to click is easier than finding its selector') but never names them explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives clear when-to-use context: batching several things in one call, or when natural-language targeting beats finding a selector, plus the constraint that plain-English steps require a plan that includes them. It stops short of naming the alternative single-step tools or stating when-not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browser_clickClick an elementA
Click an element (Playwright selector such as text=Sign in or #submit) or at page coordinates x and y. For a right or double click, or a click with a key held, use browser_act with a click action.
| Name | Required | Description | Default |
|---|---|---|---|
| x | No | ||
| y | No | ||
| selector | No | ||
| sessionId | Yes | Id of the session, from session_create |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=false, openWorldHint=true, and destructiveHint=false, so the safety profile is partly covered. The description adds selector format and click-variant routing but says nothing about side effects (navigation, form submission) or failure behavior when a selector matches nothing, which are meaningful for a mutation-capable click.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, zero waste, with the primary input forms front-loaded and the alternative-tool routing placed second. Every clause earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 4-param click tool with annotations covering safety and no output schema, the description covers input forms and the key sibling boundary. Missing only edge-case behavior such as what happens on an unmatched selector or whether the click may trigger navigation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is only 25% (just sessionId), so the description must compensate. It does: it identifies selector as a Playwright selector with concrete examples (`text=Sign in`, `#submit`) and clarifies x/y are page coordinates, and that selector and coordinates are alternatives. sessionId is left to the schema reference.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (click) and resource (an element via Playwright selector, or page coordinates), and explicitly names the sibling (browser_act) it is not for right/double/modified clicks. An agent can distinguish it from browser_act, browser_type, and browser_press without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly routes the agent away for right-click, double-click, and key-held clicks, naming browser_act as the alternative. It does not fully spell out selector-vs-coordinate preference, so guidance is clear context but not exhaustive.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browser_computerRun a computer-use actionA
Run ONE computer-use action as a model's computer tool gives it, in Anthropic's shape ({action:'left_click', coordinate:[x, y]}) or OpenAI's ({type:'click', x, y, button}), then see the screen. Coordinates are pixels of the screenshot; with maxWidth the screenshot is scaled down and coordinates are scaled back.
| Name | Required | Description | Default |
|---|---|---|---|
| action | Yes | The provider's action object | |
| maxWidth | No | ||
| sessionId | Yes | Id of the session, from session_create | |
| screenshot | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only declare the safety profile (readOnlyHint=false, openWorldHint=true, destructiveHint=false); the description adds genuine behavioral context beyond them: that the action executes against the live browser and the screen is then captured, that coordinates are screenshot pixels, and that maxWidth rescales both the screenshot and the coordinates. It stops short of describing failure modes or what exactly the returned screen payload contains.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, the core verb and the single-action constraint front-loaded, with the payload-shape examples and coordinate scaling packed efficiently into the second. Dense but no filler; the parenthetical examples are load-bearing rather than decorative.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a nested-object, side-effecting tool with no output schema, the description covers the two things the schema cannot: the shape of the opaque action payload and the coordinate/scale invariant. It briefly signals the return ('then see the screen'), leaving the response structure and error behavior unstated, which is the only notable gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is only 50%, and the free-form 'action' object (additionalProperties: {}, propertyNames: string) is nearly meaningless from the schema alone — the description rescues it by naming both accepted provider shapes. It also explains maxWidth's scaling contract and the coordinate frame, though it never explains the 'screenshot' boolean or its default.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource — run one computer-use action — and pins down the exact payload shapes accepted (Anthropic {action:'left_click', coordinate:[x,y]} vs OpenAI {type:'click', x, y, button}). It does not explicitly contrast itself with the many close siblings (browser_act, browser_click, browser_press, browser_type), so an agent must infer the distinction from the provider-shape framing.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The capitalized 'ONE' conveys that actions must be issued singly rather than batched, which is real usage guidance, and 'as a model's computer tool gives it' implies this is the passthrough path for provider-native action objects. However, there is no explicit when-to-use-this vs browser_click/browser_act/browser_type, and no prerequisite callout (the schema, not the description, carries the session_create dependency).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browser_loginSign in with a saved credentialA
Sign the session's browser in with a saved password credential (a name from credentials_list), in one call: a short run in the session types the credential on its own sites only, and you never see the password or any 2FA code or sign-in link. Give url to start from the site's sign-in page (it must be one of the credential's sites; default: the first). A credential whose codeSource is push or url waits for the code or link the user's system sends, up to its timeout: the call can take a few minutes, so tell the user a code is needed. Returns the page it ends on. Needs a session with a browser.
| Name | Required | Description | Default |
|---|---|---|---|
| url | No | The sign-in page, on one of the credential's sites | |
| sessionId | Yes | Id of the session, from session_create | |
| credential | Yes | Name of a saved password credential (credentials_list) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Adds substantial context beyond the annotations: the password, 2FA code, and sign-in link are never exposed to the caller, the credential is restricted to its own sites, and push/url codeSource variants can block for minutes. It also states the return value ('the page it ends on') and the browser-session prerequisite, none of which the annotations convey.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single dense paragraph that front-loads the core action, then the secrecy guarantee, then the url constraint and timeout caveat. Nearly every clause earns its place, though the sentence runs long and could be split for fast scanning.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Complete for a 3-param browser action: it covers the session prerequisite, the credential source, the url constraint and default, the long-running timeout case, and the return value despite there being no output schema. An agent has everything needed to call it correctly and to warn the user about codes.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% so the baseline is 3, but the description adds real meaning: credential is a name from credentials_list, and url must be on one of the credential's sites with the first site as the default. That default and the site-restriction constraint go beyond the schema text.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('sign the session's browser in with a saved password credential') and immediately scopes it as a one-call operation that types on the credential's own sites only. This clearly distinguishes it from browser_type/manual typing and from credentials_list, which merely enumerates.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives strong context: the url must be one of the credential's sites (default the first), and that push/url codeSource credentials wait up to the timeout so the call may take minutes and the user should be told a code is needed. It also notes 'Needs a session with a browser.' No competing sibling is named explicitly, but the routing is inferable.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browser_pressPress keysA
Press keys on the session's browser page: one key (Enter, Escape, ArrowDown, Tab), a combination held together with + (Control+A, Shift+Tab, Meta+C), or several combinations one after the other separated by spaces ("ctrl+a Delete"). Key names are Playwright's; common spellings such as ctrl, cmd and Return work too, and a capital letter is typed with Shift. The machines run Linux: select-all is Control+A (ControlOrMeta+A works everywhere). The keys go to the page, never to the machine's desktop.
| Name | Required | Description | Default |
|---|---|---|---|
| keys | Yes | The keys: Enter, Control+A, or several separated by spaces | |
| sessionId | Yes | Id of the session, from session_create |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations cover the safety profile (readOnlyHint=false, destructiveHint=false, openWorldHint=true), so the bar is lower. The description adds genuinely useful behavioral context beyond them: keys are delivered to the page and never the desktop, and the target environment is Linux. It stops short of saying what happens when no element has focus or what is returned.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Roughly five sentences, front-loaded with the core action before the syntax detail. Every sentence carries real information about the keys format, though the key-syntax guidance could be tightened slightly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 2-param, no-output-schema tool whose annotations already carry the safety profile, the definition is nearly complete: key syntax, aliases, platform conventions and delivery target are all covered. The only gap is explicit when-to-use guidance against sibling interaction tools.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% (baseline 3), and the description exceeds it substantially, documenting combo syntax with '+', space-separated sequences, Playwright naming, accepted aliases (ctrl, cmd, Return), Shift-for-capital behavior, and ControlOrMeta portability. Only sessionId is left unexplained, but its schema note ('from session_create') is sufficient.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: pressing keys on the session's browser page, with the scope narrowed by 'never to the machine's desktop'. It distinguishes itself implicitly from shell_exec/browser_computer via that desktop distinction, but never names the closest siblings (browser_type, browser_click) to make the boundary explicit.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description thoroughly explains how to form the keys argument but never says when to choose browser_press over browser_type, browser_click or browser_computer. Usage is implied by the key syntax rather than stated as selection guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browser_readRead the pageBRead-only
Read the current page as markdown or plain text.
| Name | Required | Description | Default |
|---|---|---|---|
| format | No | ||
| sessionId | Yes | Id of the session, from session_create |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, destructiveHint=false, and openWorldHint=true, so the safety profile is covered. The description adds only the format options and says nothing about truncation, length limits, or the need for an active session, so it contributes limited behavioral context beyond the structured fields.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single short sentence with the verb and output scope front-loaded and no filler. It is efficient, though arguably under-specified rather than optimally concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description should carry more of the return-shape burden; it does indicate the output format but omits the session prerequisite and any truncation behavior. Adequate but with clear gaps for a content-extraction tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 50%: sessionId is documented in the schema ("from session_create") while format is left to its self-explanatory enum. The description's phrase "markdown or plain text" merely restates the enum values rather than adding meaning, so the baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (read) and resource (the current page) plus the output formats it produces. It implicitly distinguishes itself from browser_screenshot (image capture) and fetch_url (arbitrary URL), but never names or contrasts those siblings explicitly, so an agent must infer the boundary.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
"Current page" implies it operates on a page already loaded via browser_navigate, but there is no explicit when-to-use statement and no mention of alternatives like fetch_url or browser_screenshot. No exclusions or prerequisites are given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browser_screenshotScreenshot the pageCRead-only
Screenshot the current tab.
| Name | Required | Description | Default |
|---|---|---|---|
| fullPage | No | ||
| sessionId | Yes | Id of the session, from session_create |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, openWorldHint=true and destructiveHint=false, so the safety profile is covered, but the description adds nothing beyond that. It does not say whether the image is returned inline or written to disk, what format/size it is, or that an active session is required.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The single sentence is front-loaded and free of padding, so it is not bloated. But at five words it is under-specified rather than genuinely concise, leaving essential behavior unstated.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema and no annotations covering return behavior, the description should explain the result format and the effect of fullPage, and should note the session dependency. None of that is present for a 2-parameter tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 50%: sessionId is documented but the fullPage boolean has no description anywhere. The description never explains that fullPage switches between viewport and full-page capture, so it fails to compensate for the gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description contains a clear verb-and-resource pair ('Screenshot the current tab'), so the basic action is unambiguous. However, it does not distinguish this tool from the very similar sibling 'screenshot_url', nor does it clarify that 'current tab' means the tab belonging to the session identified by sessionId.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this versus building a URL screenshot with screenshot_url, nor any note about needing an active session first. The agent must infer all routing from the tool name alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browser_typeType textA
Type text, optionally into the element matched by selector. To type a saved password or secret, give credential (a name from credentials_list) instead of text: the platform types it without you seeing it. For a password also give field: username, password or otp (the current 2FA code, when credentials_list says it has 2FA; with codeSource push or url it waits for the code the user's system sends). A password goes only into the field selector names, and only on the sites it was saved for. Never ask the user to paste a password into the chat.
| Name | Required | Description | Default |
|---|---|---|---|
| text | No | ||
| field | No | Which part of a password credential to type | |
| selector | No | ||
| sessionId | Yes | Id of the session, from session_create | |
| credential | No | Name of a saved credential (credentials_list) to type instead of text |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Goes well beyond the annotations (which only say non-read-only, non-destructive, open-world) by disclosing that secrets are typed without the agent seeing them, that passwords are confined to the named field and the sites they were saved for, that otp with codeSource push/url blocks until the user's code arrives, and a hard rule against asking users to paste passwords.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loads the core action and the credential alternative, and every sentence carries information. The password/otp sentences are dense and slightly run-on, which costs a point on structure but not on relevance.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 5-param mutation tool with no output schema, the description covers the risky credential path thoroughly. It leaves out success/failure signaling and any field-clearing behavior, and never mentions sessionId, but nothing essential to invoking it correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With only 60% schema coverage, the description carries real weight: it defines 'credential' as a name from credentials_list, explains the 'field' enum values including that otp is the current 2FA code, and clarifies that text/credential are alternatives. This is meaningfully more than the schema conveys.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Type text') plus the optional targeting mechanism ('into the element matched by selector'), which cleanly separates it from siblings like browser_press, key, and browser_login. An agent can identify the action without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly routes between two modes: plain 'text' versus 'credential' from credentials_list, and specifies when to add 'field' and which enum value applies. It doesn't address when to prefer this over browser_press/key or browser_login, so it falls short of full alternative routing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
credentials_listList saved credentialsARead-only
List the project's saved credentials (passwords and secrets): name, type, the sites each may be typed on, and for a password which fields browser_type can type and where its 2FA codes come from (codeSource: totp, push, url, or null for no 2FA). Never shows a value. browserType: whether browser_type may type it (scope agent or all). exportable: whether session_create's credentials may put it in the shell (scope shell or all, or shell: true, which also lets the AI put it into bash commands). Use a name with browser_type's credential, a password's name in browser_login (a secret cannot sign in), or an exportable name in session_create's credentials. Credentials are added by the user in the Boxline console, the CLI or an SDK, not here.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations cover the safety profile (readOnly, non-destructive, closed-world), and the description adds genuinely new behavioral facts: "Never shows a value" (no secret leakage), the meaning of codeSource values (totp, push, url, null), and the exportable scope semantics including the dangerous "shell: true, which also lets the AI put it into bash commands" case.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the core action and the returned field list before the dense scope/flag explanations. The middle sentences pack multiple nested clauses (browserType, exportable, shell: true) into one run-on, which costs some readability, but each sentence carries distinct information with no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description has to carry the return shape itself, and it does: name, type, sites, browserType, codeSource with enumerable values, and exportable. Combined with the annotation-covered safety profile, an agent has everything needed to call and interpret this tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so there is no parameter semantics to explain; the per-field semantics provided instead describe return values rather than inputs. Baseline 4 applies for a parameterless tool.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Opens with a specific verb+resource ("List the project's saved credentials") and immediately enumerates what each entry contains. It also names the sibling tools that consume credentials (browser_type, browser_login, session_create), so an agent can place it precisely in the credential lifecycle.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
States explicitly where you would use a returned name — browser_type's credential, a password's name in browser_login (a secret cannot sign in), or an exportable name in session_create's credentials — and closes with a when-not (credentials are added via console/CLI/SDK, not here). It does not spell out a trigger condition for calling this list itself, so it falls short of an explicit when-to-use.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
files_deleteDelete a file or folderADestructive
Delete a file, or a folder with everything in it, from the session workspace. It cannot be brought back. A path that does not exist is not an error.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | ||
| sessionId | Yes | Id of the session, from session_create |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true and readOnlyHint=false, so irreversibility is signposted. The description adds real value beyond that: it discloses recursive deletion ('a folder with everything in it') and the non-obvious idempotent-like behavior that a missing path is not an error, both of which the agent needs.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, all earning their place, with the destructive scope and irreversibility front-loaded and the non-error edge case last. No filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive two-parameter mutation with no output schema, the description covers scope, recursion, irreversibility, and the missing-path edge case. It could still say what comes back (or that nothing does) and any session/permission dependencies, but the essential behavioral picture is complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 50%: sessionId is documented but path is not. The description references path behavior (non-existent path tolerated) but adds no format or syntax guidance for it, so with the schema doing half the work a baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb (delete) and resource (file or folder, recursively) and scopes it to the session workspace, which cleanly separates it from siblings like files_write and files_read. It also disambiguates recursive folder deletion from single-file deletion.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied by the scope ('session workspace'), but there is no explicit statement of when to use this versus alternatives like files_write, nor prerequisites or warnings about permissions. It also doesn't say how to reach the destructive target beyond the path concept.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
files_listList filesARead-only
List files in the session workspace. A stopped session's saved files are listed without resuming it.
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | ||
| sessionId | Yes | Id of the session, from session_create |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, non-destructive, and closed-world, so the safety profile is covered. The description adds real behavioral context beyond that: a stopped session's saved files remain listable without resuming it, which affects how the agent sequences calls.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, front-loaded with the core purpose and followed immediately by the one non-obvious constraint. No filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only list tool with no output schema, the definition covers purpose and one session-state edge case, but leaves the path parameter's semantics and the shape of the returned listing unexplained. Adequate but with visible gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 50%: sessionId is documented ('from session_create') but the 'path' parameter has no schema description at all. The description says nothing about what 'path' means (a directory filter? relative to workspace root?), so it fails to compensate for the coverage gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Names a specific verb ('List') and resource ('files in the session workspace'), which cleanly separates it from sibling operations like files_read, files_write, and files_delete. It stops short of naming a sibling alternative the way a 5 would, but the purpose is unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The stopped-session sentence implicitly tells the agent it does not need session_resume to enumerate a stopped session's files, which is genuinely useful routing guidance. However, there is no explicit when-to-use/when-not-to-use statement relative to files_read or session_list.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
files_readRead a fileARead-only
Read a text file from the session workspace. A stopped session's saved files are read without resuming it.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | ||
| sessionId | Yes | Id of the session, from session_create |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, destructiveHint=false, and openWorldHint=false, so the safety profile is covered. The description adds real behavioral context beyond that: it reads text (not binary) from the session workspace, and crucially that a stopped session's files are read without resuming — a non-obvious trait an agent would otherwise have to guess.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, no filler. The core action is front-loaded and the second sentence carries only the non-obvious stopped-session behavior, so every clause earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple two-parameter read tool with no output schema, the description covers what the tool does and its notable session-state behavior. It does not describe what is returned or error behavior for a missing path, but those gaps are minor for a straightforward read.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 50%: sessionId is documented in the schema, but path has no description. The phrase 'from the session workspace' adds implicit meaning about how path is rooted, but format details (relative vs absolute, path separators) are left unspecified in both the schema and the description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Read a text file') and constrains the scope to 'the session workspace,' which naturally separates it from the write/delete siblings. It stops short of explicitly naming an alternative, but the purpose is unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no explicit when/when-not statement or named alternative, but the second sentence functions as an implicit usage rule: files from a stopped session can be read without resuming, telling the agent it need not call session_resume first. Guidance is present but implied rather than spelled out.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
files_writeWrite a fileBDestructive
Write a text file into the session workspace. An existing file at that path is overwritten.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | ||
| content | Yes | ||
| sessionId | Yes | Id of the session, from session_create |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotations already declare destructiveHint=true and readOnlyHint=false, but the description adds the concrete consequence: an existing file at that path is overwritten. That is exactly the kind of detail annotations cannot convey. It stops short of mentioning permission or workspace-boundary constraints.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, front-loaded with the action and its scope, then the destructive consequence. No filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema exists, so return behavior is undefined but not required. For a mutating write tool the description covers the overwrite risk but omits path format rules, size/encoding limits, and error behavior - adequate but with clear gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 33% - just sessionId is documented. The description adds nothing about path semantics (relative vs absolute, whether it must stay inside the workspace) or content encoding, so it fails to compensate for the coverage gap even though the parameter names are largely self-explanatory.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (Write) and resource (text file) with the scope clarified as the session workspace, which distinguishes it from files_read, files_list and files_delete. It does not explicitly name a sibling or contrast itself with shell_exec, but the purpose is unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this over alternatives such as shell_exec for file creation, nor any stated prerequisites beyond the implied session context. Usage is left entirely to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
session_createCreate a sessionA
Create a new isolated session: a Chrome browser, a bash shell or both, and a shared /workspace disk. Returns its sessionId: pass it to every other session tool. browser (default true) and shell (default true) choose the kind: browser: false with a shell is a shell-only session (no live view; the browser_* tools are refused). Optionally browse through a proxy: proxyType residential (home IPs) or datacenter, with proxyCountry (two letters) and, for residential, proxyCity. blockAds: refuse ad and tracker sites (faster, less clutter). cookieBanners: "reject" (default) answers cookie consent banners with Reject all, "off" leaves them. profile: the id of a saved browser profile to start from (its cookies and logins); persistProfile saves what the session signs in to back into it when it ends. timeout: seconds the session may run before it stops (at least 60; default the plan's longest, up to 1800); billing runs until it stops. credentials: names of saved credentials (see credentials_list) to export into the shell as environment variables; only those credentials_list marks exportable (scope shell or all, or shell: true), others are refused; needs a shell. With a shell, the password a profile signs in with is exported too when it is exportable, even if not listed. To sign in on a page, do not export anything: use browser_type with a credential.
| Name | Required | Description | Default |
|---|---|---|---|
| shell | No | ||
| browser | No | Give the session a browser (default true). false needs a shell: a shell-only session | |
| profile | No | Id of a saved browser profile to start from | |
| timeout | No | Seconds the session may run before it stops (at least 60; default the plan's longest, up to 1800) | |
| blockAds | No | ||
| proxyCity | No | ||
| proxyType | No | ||
| credentials | No | Names of saved credentials to export into the shell (needs a shell) | |
| proxyCountry | No | ||
| cookieBanners | No | ||
| persistProfile | No | Save the session's logins back into the profile when it stops |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Goes well beyond the annotations (readOnlyHint=false, destructiveHint=false, openWorldHint=false), disclosing billing behavior ('billing runs until it stops'), timeout floor and default ceiling, the fact that browser_* tools are refused in shell-only mode, and the exportability constraints on credentials. These are real operational consequences an agent cannot infer from structured fields.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with purpose and the sessionId contract, and every clause is informative for an 11-parameter tool. It is, however, a dense run-on paragraph that would be easier to scan as structured bullets; length is justified but the structure is not optimal.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description still covers the return value (sessionId and how to use it), all parameter behaviors, and the cross-tool constraints (credential exportability, browser_* refusal). Nothing an agent needs to invoke this correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is only 45%, so the description carries the burden and does: it explains browser/shell defaults, blockAds and cookieBanners semantics (including the 'reject' default), proxyType/proxyCountry/proxyCity including the two-letter country format, profile vs persistProfile, timeout bounds, and the credentials export rules. Nearly every undocumented parameter is filled in.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Create a new isolated session') and enumerates exactly what is provisioned (Chrome browser, bash shell, shared /workspace disk). It also names the return value (sessionId) and its downstream role, which distinguishes it from siblings like session_resume and session_stop.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives clear conditional guidance: 'browser: false with a shell is a shell-only session (no live view; the browser_* tools are refused)' and routes sign-in to 'browser_type with a credential' instead of credential export. However, it never states when to create a new session versus resuming an existing one (session_resume), the most relevant sibling choice.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
session_deleteDelete a sessionADestructive
Delete a session for good: what it saved, its recording and its logs are deleted now. This cannot be undone; use session_stop to keep it.
| Name | Required | Description | Default |
|---|---|---|---|
| sessionId | Yes | Id of the session to delete, from session_create |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true and readOnlyHint=false, so the safety profile is known. The description adds genuinely new context beyond them: the scope of destruction (saved data, recording, logs) and the irreversibility warning. It stops short of noting permission requirements or whether deletion of an active/stopped session behaves differently.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, front-loaded with the consequence of deletion and closed with the safer alternative. Every clause carries information; nothing is filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema exists, and the description plus annotations together convey destruction scope, irreversibility, and the alternative. It does not address error behavior (e.g. invalid or already-deleted sessionId) or whether deletion of an in-progress session is allowed, which are the remaining minor gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Only one parameter and schema description coverage is 100%, with the schema itself explaining the sessionId and its origin (session_create). The description adds no parameter-level detail, which is acceptable given the schema fully documents the single input.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource ('Delete a session') and immediately scopes it ('for good: what it saved, its recording and its logs are deleted now'). It is clearly distinguishable from session_stop and session_resume among the siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly routes the agent: 'This cannot be undone; use session_stop to keep it.' That names the alternative and the condition under which it should be chosen instead, which is exactly the when/when-not guidance needed for a destructive tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
session_listList sessionsARead-only
List the project's sessions, newest first: id, status (RUNNING, STOPPED, DELETED, ERROR), kind (browser, shell or combined) and when it was created. Use it to find a session id again. Filter by status (several joined with commas, e.g. RUNNING,STOPPED), kind, or q (an id prefix or text in the session's userMetadata); limit (1 to 100, default 20); when there are more, the last line gives the after to pass to read the next ones. Stopped sessions are listed too: session_resume brings one back.
| Name | Required | Description | Default |
|---|---|---|---|
| q | No | An id prefix, or text in the session's userMetadata | |
| kind | No | ||
| after | No | The cursor from the last line of the previous answer | |
| limit | No | How many sessions, 1 to 100 (default 20) | |
| status | No | Only these statuses, comma-separated: RUNNING, STOPPED, DELETED, ERROR |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, destructiveHint=false and openWorldHint=false. The description adds real behavioral context beyond that: newest-first ordering, that the last line yields the 'after' cursor for the next page, and that stopped sessions are included and revivable via session_resume. Missing only explicit default page size framing outside the parameter list.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the core purpose and return shape, then filters, then pagination and the resume pointer. Information-dense with little waste, though a couple of clauses (return-field enumeration, comma example) slightly overlap the schema.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema exists, so the description correctly enumerates the returned fields (id, status, kind, created) and explains pagination via the trailing cursor. Nothing an agent needs to call or interpret results is missing for a five-parameter list tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is already 80%, yet the description reinforces filter semantics with the comma-joined example ('RUNNING,STOPPED'), the q behavior (id prefix or userMetadata text) and the limit range with default. It adds a worked example and the cursor-pagination flow that the schema alone does not connect.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource (list the project's sessions) plus the exact return fields (id, status, kind, created) and default ordering (newest first). An agent can tell it apart from session_create, session_stop, session_resume and session_delete without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives an explicit use case ('Use it to find a session id again') and routes stopped-session recovery to session_resume. It clarifies that stopped sessions appear here too, but stops short of an explicit when-not-this-tool rule, so it is strong context rather than complete routing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
session_resumeResume a stopped sessionA
Resume a stopped session on a fresh machine, as it was when it stopped (same id, tabs and files). The other session tools also do this on their own when given the id of a stopped session.
| Name | Required | Description | Default |
|---|---|---|---|
| sessionId | Yes | Id of the stopped session, from session_create |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=false, destructiveHint=false and openWorldHint=false, so the safety profile is covered structurally. The description adds real value beyond that by disclosing that resume happens 'on a fresh machine', which explains the non-read-only hint. It does not say what happens to the original stopped session (consumed, replaced, deleted) or whether the returned session id is reused.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, no filler, and the core behavior is front-loaded before the sibling caveat. Every clause carries information an agent can act on.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
One required parameter with 100% schema coverage, no output schema, and annotations already carrying the safety profile, so little more is demanded of the description. The remaining gap is the lifecycle outcome (what happens to the old session and whether its id stays valid), which would matter for an agent chaining calls.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and the schema already documents sessionId ('Id of the stopped session, from session_create'), so a baseline 3 is warranted. The description adds a constraint beyond the schema by twice emphasizing the id must belong to a stopped session, which guards against passing a live session id.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (resume) and resource (stopped session) plus the outcome ('as it was when it stopped (same id, tabs and files)'), which tells an agent exactly what state is restored. It also positions itself relative to the other session tools, so it is distinguishable from siblings like session_create and session_stop.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The second sentence ('The other session tools also do this on their own when given the id of a stopped session') is a genuine when-not hint: an agent learns this tool is often unnecessary because other session tools auto-resume. It stops short of an explicit 'use this only when...' directive, and there is no guidance on prerequisites or the fresh-machine side effect.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
session_stopStop a sessionA
Stop a session: it is saved exactly as it is (every tab, the files) and billing stops. Resume it later with session_resume; it is kept for the plan's retention days, then deleted.
| Name | Required | Description | Default |
|---|---|---|---|
| sessionId | Yes | Id of the session, from session_create |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare non-readonly, non-destructive, closed-world behavior, and the description adds material context beyond them: what is preserved (every tab, the files), that billing stops, and the retention-then-deletion lifecycle. It doesn't cover idempotency (what happens if the session is already stopped) or auth prerequisites, which keeps it from a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence pair with zero filler: effect, reversal path, and lifecycle are packed into two clauses and nothing is repeated from the schema or annotations.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a lifecycle mutation with a single required param and no output schema, the description covers preservation, billing, resume path, and eventual deletion – enough for correct invocation. Minor gaps (idempotency on repeat calls, and the vague 'plan's retention days' without a definite value) keep it below 5.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Only one parameter, and schema description coverage is 100% – the schema already documents sessionId and its origin. The description adds no format or validation meaning beyond the schema, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Stop a session') and immediately distinguishes the operation from a hard delete by noting the session is saved intact and only later deleted. Naming session_resume as the reversal path lets an agent separate it from session_delete without opening either schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly names the companion tool and condition ('Resume it later with session_resume'), which tells the agent this is the reversible-pause choice. It stops short of an explicit when-to-use-this-vs-session_delete exclusion, so the agent must infer the delete alternative from the 'then deleted' clause.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
shell_execRun a shell commandADestructive
Run a bash command in the session's persistent shell (cd and export persist). Working directory starts at the workspace; browser downloads are in ./downloads. Needs a session with a shell. For a job longer than timeoutMs, start it in the background (nohup … > job.log 2>&1 &) and read job.log later with files_read.
| Name | Required | Description | Default |
|---|---|---|---|
| command | Yes | ||
| sessionId | Yes | Id of the session, from session_create | |
| timeoutMs | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true and openWorldHint=true, but the description adds non-obvious behavior the schema cannot convey: state persistence (cd and export persist), initial working directory, the ./downloads location, and the timeout escape hatch. It omits what happens on timeout (killed vs. returned) and the default timeout, which are meaningful for a destructive tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three tight sentences, all front-loaded: capability first, then environment context, then the long-running escape hatch. Nothing is padding, though the downloads-location aside is the least essential sentence for the primary invocation decision.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For an open-ended shell tool with no output schema and no annotations until now, the description covers prerequisites, state semantics, and long-job handling well. It is missing return-value behavior (stdout/stderr/exit code) and timeout outcome, which an agent calling this tool would want.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is only 33% (only sessionId documented), so the description must compensate. It references timeoutMs semantically ('longer than timeoutMs') and implies command is free-form bash, but it never documents the default, the 1-hour cap, or failure semantics on timeout. Partial compensation only, so baseline 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
'Run a bash command in the session's persistent shell' gives a specific verb (run) plus resource (bash command/shell) with the key qualifier 'persistent'. That qualifier alone separates it from every sibling (files_read, browser_*, session_*), so an agent can identify it without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It states the prerequisite ('Needs a session with a shell'), the working-directory context, and an explicit alternative path for long jobs: background with nohup and read job.log later via files_read. It does not say when to prefer this over e.g. files_write or browser tools, so it falls short of the when/when-not bar at 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
web_crawl_getGet a crawl's pagesARead-only
The state of a crawl started with web_crawl_start and its next pages (10 at a time; pass the after it gives to go on). It only reads.
| Name | Required | Description | Default |
|---|---|---|---|
| after | No | ||
| crawlId | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The 'It only reads' clause merely restates readOnlyHint=true and earns no credit. The genuine addition is pagination behavior: pages come back 10 at a time and the returned `after` token continues the walk. That is useful operational context beyond the annotations, though it omits what signals the end of a crawl or how invalid crawlIds fail.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One sentence, front-loaded with what is returned and the pagination rule packed into a parenthetical. Every clause carries information; only the slightly broken grammar of the opening fragment costs a point.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema and no parameter descriptions, the description has to cover the return shape, and it only loosely does ('the state ... and its next pages'). An agent must call it to learn the response fields, how to detect completion, and what happens on an expired or invalid crawl. Adequate but with real gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must carry the load. It does clarify that `after` is a continuation token returned by the previous call rather than an offset or page number, which is meaningful, but `crawlId` is left entirely undefined (presumed to come from web_crawl_start). Partial compensation for a two-parameter tool.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific resource (the state and next pages of a crawl) and ties it to the producing sibling, web_crawl_start, so an agent can distinguish it from web_search/web_extract/web_fetch. The phrasing is a sentence fragment ('The state of a crawl...') rather than a clean verb+resource, but the intent is unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It establishes sequencing with web_crawl_start and describes the pagination loop ('pass the after it gives to go on'), which is real usage guidance. It never states when not to use this tool or how it relates to other read siblings such as web_fetch or browser_read, so usage is implied rather than fully specified.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
web_crawl_startCrawl a websiteA
Crawl a website from a start URL (no session needed): follow its links, read each page in a real browser and return the pages as markdown, text or HTML. Respects robots.txt and stays on the start page's host unless sameHost is false. Waits up to waitSeconds (default 45) and returns the pages read so far; while it is still running, web_crawl_get gives the rest. Public pages only.
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | ||
| format | No | ||
| exclude | No | Never follow URLs that match one of these regular expressions | |
| include | No | Only follow URLs that match one of these regular expressions | |
| maxDepth | No | Link depth from the start page, 0 to 10 (default 3) | |
| maxPages | No | Pages to read, 1 to 1000 (default 20; the plan's crawl limit applies) | |
| sameHost | No | Stay on the start page's host (default true) | |
| waitSeconds | No | How long to wait for the crawl before answering (default 45) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations declare openWorldHint=true and destructiveHint=false, so the safety profile is partly covered; the description adds the non-obvious behaviors: robots.txt compliance, same-host scoping by default, a bounded wait of waitSeconds, and the asynchronous partial-result contract with web_crawl_get. Only missing detail is whether an in-flight crawl can be cancelled or resumed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, no filler, and the critical facts (what it does, default scope, partial-return behavior) are front-loaded. Every clause carries distinct information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For an 8-parameter asynchronous crawl tool with no output schema, the description covers scope, safety, timing, output formats, and the two-phase retrieval pattern. An agent has everything needed to start a crawl and know what to expect back.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 75%, and the description fills the gaps for the undescribed parameters: format (markdown/text/HTML), sameHost (host scoping), and waitSeconds (default 45). It adds no semantics for exclude/include/maxDepth/maxPages beyond what the schema already documents, but those are already well-described.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource (crawl a website from a start URL), names the output formats, and explicitly contrasts itself with the session-based siblings ("no session needed"). It also names web_crawl_get as the continuation path, so an agent can place it precisely among web_fetch/web_extract/web_crawl_get.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives real routing context: no session required, public pages only, and "while it is still running, web_crawl_get gives the rest" tells the agent exactly what to do next. It does not explicitly say when to prefer web_fetch or web_extract over a crawl, so it stops short of full when-not guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
web_extractExtract data from pagesARead-only
Read up to 10 pages in a real browser and return the data asked for as JSON (no session needed): give url or urls, and a prompt saying what to collect or a JSON Schema for exact fields. A page that does not show a value gives null, never a guess. Uses a model, billed like other model calls. Public pages only.
| Name | Required | Description | Default |
|---|---|---|---|
| url | No | ||
| urls | No | ||
| prompt | No | What to collect, in words | |
| schema | No | A JSON Schema the result must match |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the readOnly/destructive/openWorld annotations, the description discloses rich behavior: cost model ('Uses a model, billed like other model calls'), a hard scope limit ('Public pages only'), and output fidelity ('A page that does not show a value gives null, never a guess'). These are exactly the traits annotations cannot express.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Dense and front-loaded: the core action leads, then inputs, then output/cost/scope caveats. Every clause earns its place with no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only tool with no output schema, it covers return format, missing-value behavior, cost, session needs, and page scope. It omits failure/error behavior and does not resolve the 'at least one of url/urls and prompt/schema' requirement left implicit by the zero required params.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 50% schema coverage, the description carries meaningful param meaning: it clarifies url-vs-urls (single vs up to 10) and frames prompt and schema as alternative ways to specify fields. It does not document the url/urls exclusivity rules further, but it adds real value over the bare schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb+resource+scope: 'Read up to 10 pages in a real browser and return the data asked for as JSON'. This is concrete and actionable. It implicitly separates itself from session-based browser tools ('no session needed') but never names a sibling like web_fetch or web_crawl_start, so the differentiation is not explicit.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It tells the agent how to supply inputs ('give url or urls, and a prompt... or a JSON Schema') and notes 'no session needed', which hints at the class of tool. However, there is no explicit when-to-use-this-vs-alternatives statement naming web_fetch, web_search, or web_crawl_start, so usage is only implied.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
web_fetchFetch a web pageARead-only
Fetch a web page through a real browser and return markdown, HTML or text (no session needed). blockAds: refuse ad and tracker sites while loading it.
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | ||
| format | No | ||
| blockAds | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover the safety profile (readOnly, openWorld, non-destructive), but the description adds genuine behavioral context: rendering happens 'through a real browser', no session state is required or created, and blockAds is disclosed as a load-time refusal of ad/tracker sites rather than a post-fetch filter. It does not mention timeouts, failure behavior, or page-size limits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences, front-loaded with the core action and return types, followed by the one non-obvious option. Nothing redundant; every clause carries information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a stateless read-only fetch with no output schema, the description covers the action, output formats, browser-based behavior, session independence, and the ad-blocking flag. Remaining gaps (error/empty handling, redirects, timeouts) are modest for a tool of this complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description carries the full burden and largely succeeds: it enumerates the three format values and explains blockAds as refusing ad and tracker sites during load, which adds meaning beyond the bare boolean name. The 'url' parameter is only implied ('a web page'), not characterized for expected input form.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb and resource ('Fetch a web page') plus the return representations ('markdown, HTML or text'), and the phrase 'through a real browser' separates it from a plain HTTP fetcher. It never names a sibling tool explicitly, so the differentiation from web_extract, browser_read, or browser_navigate is left for the agent to infer.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'(no session needed)' gives a real selection signal against the session-based browser_* siblings, and blockAds is contextualized. However there is no explicit when-to-use/when-not statement and no alternative is named, so the routing guidance remains implied rather than stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
web_screenshotScreenshot a web pageARead-only
Take a screenshot of a web page in a fresh browser (no session needed). fullPage captures the whole page instead of the first screen. To see the page a session is on, use browser_screenshot.
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | ||
| fullPage | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, destructiveHint=false and openWorldHint=true, so the safety profile is covered by structured data. The description adds genuinely useful context beyond that — the fresh, session-less browser (isolated context, no cookies/state carryover) — but says nothing about output format, image size, wait-for-load behavior, or timeouts for a rendering tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, zero filler, with the fresh-browser context and the sibling routing instruction front-loaded. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a two-parameter, no-output-schema tool with full annotation coverage, this covers the routing decision and the one ambiguous parameter. Return-value detail isn't needed in the description, and nothing an agent needs to call it correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description carries the burden; it fully explains the non-obvious parameter with "fullPage captures the whole page instead of the first screen," which is exactly the ambiguity an agent would hit. The remaining url parameter is self-evident from its name, so the gap is minor.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource ("take a screenshot of a web page") and immediately scopes it as running "in a fresh browser (no session needed)," which cleanly separates it from browser_screenshot among the siblings. An agent can pick the right tool without opening either schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly names the alternative ("To see the page a session is on, use browser_screenshot") and gives the condition that selects it, plus the precondition that no session is required for this tool. Both the when and the when-not are covered.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
web_searchSearch the webARead-only
Search the web (no session needed). Returns titles, URLs and snippets of the top results; open one with browser_navigate or web_fetch. Set fetch to also get the top 1 to 5 pages as Markdown in the same call. Each search counts against the plan's monthly searches (the same search within an hour is free).
| Name | Required | Description | Default |
|---|---|---|---|
| fetch | No | Also return the top N pages as Markdown (0 to 5) | |
| limit | No | Results, 1 to 20 (default 10) | |
| query | Yes | ||
| country | No | Two-letter country code the results come from, e.g. DE | |
| recency | No | ||
| language | No | Language of the results, e.g. de |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly/openWorld/non-destructive, so the safety profile is covered. The description adds real behavioral context beyond that: the return shape (titles, URLs, snippets) and a concrete cost model (counts against monthly searches, same search within an hour is free) that an agent cannot infer from annotations or schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three compact sentences, front-loaded with the identity and scope, then return shape, then the fetch/cost details. Nearly every clause earns its place, with only mild density packing two distinct ideas into the final sentence.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema exists, so the description correctly carries the return-format burden and does so (titles, URLs, snippets). With annotations handling safety and the schema handling most params, the remaining gap is only the undescribed query/recency parameters, which is minor.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 67% and the description reinforces the fetch semantics ('top 1 to 5 pages as Markdown in the same call'), which slightly exceeds the schema's bare wording. However, query and recency are undocumented in the schema and the description says nothing about recency values, keeping this at the baseline for a partially-covered schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource ('Search the web') and immediately differentiates scope with 'no session needed', which separates it from the many session-based sibling tools (browser_login, session_create, etc.). It also names the follow-up siblings (browser_navigate, web_fetch), so an agent can place it precisely in the toolset.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says no session is required and routes the agent to browser_navigate or web_fetch to open a result, and to the fetch parameter to get pages inline in one call. It does not compare against other content-retrieval siblings (web_extract, web_crawl_start), so the 'when not' side is incomplete.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
33 tool updates
v3.1.0- Added
browser_act - Added
browser_computer - Changed
browser_press3 fields changed- removed
Input schema / properties / keyRemoved value: -{ - "type": "string" -} - added
Input schema / properties / keysAdded value: +{ + "description": "The keys: Enter, Control+A, or several separated by spaces", + "minLength": 1, + "type": "string" +} - changed
Input schema / requiredPrevious value: -[ - "sessionId", - "key" -]New value: +[ + "sessionId", + "keys" +]
- Removed
computer - Removed
crawl_results - Removed
crawl_site - Removed
delete_file - Removed
extract_data - Removed
fetch_url - Added
files_delete - Added
files_list - Added
files_read - Added
files_write - Removed
hover - Removed
key - Removed
list_files - Removed
mouse_click - Removed
mouse_drag - Removed
mouse_move - Removed
read_file - Removed
run_command - Removed
run_playwright - Removed
screenshot_url - Changed
session_create2 fields changed- added
Input schema / properties / browserAdded value: +{ + "description": "Give the session a browser (default true). false needs a shell: a shell-only session", + "type": "boolean" +} - added
Input schema / properties / timeout / descriptionAdded value: +"Seconds the session may run before it stops (at least 60; default the plan's longest, up to 1800)"
- Added
session_list - Removed
session_move - Added
shell_exec - Added
web_crawl_get - Added
web_crawl_start - Added
web_extract - Added
web_fetch - Added
web_screenshot - Removed
write_file
32 tool updates
v2.1.0- Changed
browser_click4 fields changed- changed
Input schema / $schemaPrevious value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema" - changed
Input schema / properties / sessionId / descriptionPrevious value: -"Session id; omit to use the default session"New value: +"Id of the session, from session_create" - added
Input schema / properties / sessionId / minLengthAdded value: +1 - added
Input schema / requiredAdded value: +[ + "sessionId" +]
- Changed
browser_login4 fields changed- changed
Input schema / $schemaPrevious value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema" - changed
Input schema / properties / sessionId / descriptionPrevious value: -"Session id; omit to use the default session"New value: +"Id of the session, from session_create" - added
Input schema / properties / sessionId / minLengthAdded value: +1 - changed
Input schema / requiredPrevious value: -[ - "credential" -]New value: +[ + "sessionId", + "credential" +]
- Changed
browser_navigate4 fields changed- changed
Input schema / $schemaPrevious value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema" - changed
Input schema / properties / sessionId / descriptionPrevious value: -"Session id; omit to use the default session"New value: +"Id of the session, from session_create" - added
Input schema / properties / sessionId / minLengthAdded value: +1 - changed
Input schema / requiredPrevious value: -[ - "url" -]New value: +[ + "sessionId", + "url" +]
- Changed
browser_press4 fields changed- changed
Input schema / $schemaPrevious value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema" - changed
Input schema / properties / sessionId / descriptionPrevious value: -"Session id; omit to use the default session"New value: +"Id of the session, from session_create" - added
Input schema / properties / sessionId / minLengthAdded value: +1 - changed
Input schema / requiredPrevious value: -[ - "key" -]New value: +[ + "sessionId", + "key" +]
- Changed
browser_read4 fields changed- changed
Input schema / $schemaPrevious value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema" - changed
Input schema / properties / sessionId / descriptionPrevious value: -"Session id; omit to use the default session"New value: +"Id of the session, from session_create" - added
Input schema / properties / sessionId / minLengthAdded value: +1 - added
Input schema / requiredAdded value: +[ + "sessionId" +]
- Changed
browser_screenshot4 fields changed- changed
Input schema / $schemaPrevious value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema" - changed
Input schema / properties / sessionId / descriptionPrevious value: -"Session id; omit to use the default session"New value: +"Id of the session, from session_create" - added
Input schema / properties / sessionId / minLengthAdded value: +1 - added
Input schema / requiredAdded value: +[ + "sessionId" +]
- Changed
browser_type4 fields changed- changed
Input schema / $schemaPrevious value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema" - changed
Input schema / properties / sessionId / descriptionPrevious value: -"Session id; omit to use the default session"New value: +"Id of the session, from session_create" - added
Input schema / properties / sessionId / minLengthAdded value: +1 - added
Input schema / requiredAdded value: +[ + "sessionId" +]
- Changed
computer4 fields changed- changed
Input schema / $schemaPrevious value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema" - changed
Input schema / properties / sessionId / descriptionPrevious value: -"Session id; omit to use the default session"New value: +"Id of the session, from session_create" - added
Input schema / properties / sessionId / minLengthAdded value: +1 - changed
Input schema / requiredPrevious value: -[ - "action" -]New value: +[ + "sessionId", + "action" +]
- Added
crawl_results - Added
crawl_site - Changed
credentials_list1 field changed- changed
Input schema / $schemaPrevious value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema"
- Added
delete_file - Added
extract_data - Changed
fetch_url1 field changed- changed
Input schema / $schemaPrevious value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema"
- Changed
hover4 fields changed- changed
Input schema / $schemaPrevious value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema" - changed
Input schema / properties / sessionId / descriptionPrevious value: -"Session id; omit to use the default session"New value: +"Id of the session, from session_create" - added
Input schema / properties / sessionId / minLengthAdded value: +1 - added
Input schema / requiredAdded value: +[ + "sessionId" +]
- Changed
key4 fields changed- changed
Input schema / $schemaPrevious value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema" - changed
Input schema / properties / sessionId / descriptionPrevious value: -"Session id; omit to use the default session"New value: +"Id of the session, from session_create" - added
Input schema / properties / sessionId / minLengthAdded value: +1 - changed
Input schema / requiredPrevious value: -[ - "keys" -]New value: +[ + "sessionId", + "keys" +]
- Changed
list_files4 fields changed- changed
Input schema / $schemaPrevious value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema" - changed
Input schema / properties / sessionId / descriptionPrevious value: -"Session id; omit to use the default session"New value: +"Id of the session, from session_create" - added
Input schema / properties / sessionId / minLengthAdded value: +1 - added
Input schema / requiredAdded value: +[ + "sessionId" +]
- Changed
mouse_click4 fields changed- changed
Input schema / $schemaPrevious value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema" - changed
Input schema / properties / sessionId / descriptionPrevious value: -"Session id; omit to use the default session"New value: +"Id of the session, from session_create" - added
Input schema / properties / sessionId / minLengthAdded value: +1 - added
Input schema / requiredAdded value: +[ + "sessionId" +]
- Changed
mouse_drag4 fields changed- changed
Input schema / $schemaPrevious value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema" - changed
Input schema / properties / sessionId / descriptionPrevious value: -"Session id; omit to use the default session"New value: +"Id of the session, from session_create" - added
Input schema / properties / sessionId / minLengthAdded value: +1 - added
Input schema / requiredAdded value: +[ + "sessionId" +]
- Changed
mouse_move4 fields changed- changed
Input schema / $schemaPrevious value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema" - changed
Input schema / properties / sessionId / descriptionPrevious value: -"Session id; omit to use the default session"New value: +"Id of the session, from session_create" - added
Input schema / properties / sessionId / minLengthAdded value: +1 - changed
Input schema / requiredPrevious value: -[ - "x", - "y" -]New value: +[ + "sessionId", + "x", + "y" +]
- Changed
read_file4 fields changed- changed
Input schema / $schemaPrevious value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema" - changed
Input schema / properties / sessionId / descriptionPrevious value: -"Session id; omit to use the default session"New value: +"Id of the session, from session_create" - added
Input schema / properties / sessionId / minLengthAdded value: +1 - changed
Input schema / requiredPrevious value: -[ - "path" -]New value: +[ + "sessionId", + "path" +]
- Changed
run_command4 fields changed- changed
Input schema / $schemaPrevious value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema" - changed
Input schema / properties / sessionId / descriptionPrevious value: -"Session id; omit to use the default session"New value: +"Id of the session, from session_create" - added
Input schema / properties / sessionId / minLengthAdded value: +1 - changed
Input schema / requiredPrevious value: -[ - "command" -]New value: +[ + "sessionId", + "command" +]
- Changed
run_playwright4 fields changed- changed
Input schema / $schemaPrevious value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema" - changed
Input schema / properties / sessionId / descriptionPrevious value: -"Session id; omit to use the default session"New value: +"Id of the session, from session_create" - added
Input schema / properties / sessionId / minLengthAdded value: +1 - changed
Input schema / requiredPrevious value: -[ - "code" -]New value: +[ + "sessionId", + "code" +]
- Added
screenshot_url - Removed
session_close - Changed
session_create2 fields changed- changed
Input schema / $schemaPrevious value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema" - changed
Input schema / properties / persistProfile / descriptionPrevious value: -"Save the session's logins back into the profile when it ends"New value: +"Save the session's logins back into the profile when it stops"
- Added
session_delete - Changed
session_move4 fields changed- changed
Input schema / $schemaPrevious value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema" - changed
Input schema / properties / sessionId / descriptionPrevious value: -"Session id; omit to use the default session"New value: +"Id of the session, from session_create" - added
Input schema / properties / sessionId / minLengthAdded value: +1 - added
Input schema / requiredAdded value: +[ + "sessionId" +]
- Added
session_resume - Added
session_stop - Changed
web_search1 field changed- changed
Input schema / $schemaPrevious value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema"
- Changed
write_file4 fields changed- changed
Input schema / $schemaPrevious value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema" - changed
Input schema / properties / sessionId / descriptionPrevious value: -"Session id; omit to use the default session"New value: +"Id of the session, from session_create" - added
Input schema / properties / sessionId / minLengthAdded value: +1 - changed
Input schema / requiredPrevious value: -[ - "path", - "content" -]New value: +[ + "sessionId", + "path", + "content" +]
4 tool updates
v0.3.0- Added
browser_login - Changed
browser_type3 fields changed- added
Input schema / properties / credentialAdded value: +{ + "description": "Name of a saved credential (credentials_list) to type instead of text", + "type": "string" +} - added
Input schema / properties / fieldAdded value: +{ + "description": "Which part of a password credential to type", + "enum": [ + "username", + "password", + "otp" + ], + "type": "string" +} - removed
Input schema / requiredRemoved value: -[ - "text" -]
- Added
credentials_list - Changed
session_create3 fields changed- added
Input schema / properties / credentialsAdded value: +{ + "description": "Names of saved credentials to export into the shell (needs a shell)", + "items": { + "type": "string" + }, + "maxItems": 50, + "type": "array" +} - added
Input schema / properties / persistProfileAdded value: +{ + "description": "Save the session's logins back into the profile when it ends", + "type": "boolean" +} - added
Input schema / properties / profileAdded value: +{ + "description": "Id of a saved browser profile to start from", + "type": "string" +}
22 tool updates
v0.1.0- First observed
browser_click - First observed
browser_navigate - First observed
browser_press - First observed
browser_read - First observed
browser_screenshot - First observed
browser_type - First observed
computer - First observed
fetch_url - First observed
hover - First observed
key - First observed
list_files - First observed
mouse_click - First observed
mouse_drag - First observed
mouse_move - First observed
read_file - First observed
run_command - First observed
run_playwright - First observed
session_close - First observed
session_create - First observed
session_move - First observed
web_search - First observed
write_file
TDQS
Scored across 26 tools
Most tools have clearly distinct roles, and the descriptions explicitly disambiguate the risky pairs (web_screenshot vs browser_screenshot, web_fetch vs web_extract vs web_crawl). The click family (browser_click, browser_act, browser_computer) overlaps somewhat, though browser_click itself points to browser_act for advanced clicks. Boundaries are generally clear but a few tools could still be misselected.
All names use a consistent snake_case domain_prefix_verb pattern: files_*, web_*, browser_*, session_*, plus shell_exec and credentials_list. Verbs are predictable (read/write/list/delete/create/stop/resume) and no conventions are mixed.
26 tools is on the heavy side, but they span six genuinely different sub-domains (sessions, browser control, filesystem, shell, stateless web ops, credentials), and each tool earns its place within its group. Slightly over the ideal range but justified by the platform's breadth.
Strong lifecycle coverage: sessions have create/list/stop/resume/delete, files have read/write/list/delete, and stateless web ops cover fetch/search/extract/crawl/screenshot. Minor gaps remain, e.g. no file append/move/copy or explicit directory creation, and credential management is deliberately external, but core workflows are covered.
Maintenance
Related MCP Connectors
Stealth web browser for agents: search, fetch, click, download and type in persistent MCP sessions.
Hosted Web Crawler MCP server for Claude, ChatGPT and Cursor, with each action switched per account.
Persistent cloud workspaces for AI agents: run commands, edit files, use git and a browser.
- TabfleetOAuthcom.tabfleet
Launch, inspect, control, and share isolated cloud browsers for your agents.
Related MCP Servers
- AlicenseAqualityAmaintenanceEnables assistants such as Claude Code, Codex, and Gemini CLI to drive a real browser over MCP — navigating, clicking, typing, and reading live pages from plain-English instructions. Supports optional proxy routing, persistent profiles for surviving logins, and reproducible browser identities via seeds.121632,241MIT

noxgild-cliofficial
AlicenseNot gradedqualityBmaintenanceConnects MCP-compatible AI clients to an explicitly authorized Windows, macOS, or Linux computer for controlled Machine, Browser, and Desktop execution, including files, shell commands, native apps, and local browser sessions. Also offers a separate hosted Cloud Browser for browser tasks that should run outside the user's own workstation.12 npmApache 2.0- FlicenseNot gradedqualityAmaintenanceEnables AI agents and human operators to drive isolated browser profiles with persistent cookies, fingerprints, and proxies, exposing navigation, clicking, typing, extraction, screenshots, JS evaluation, tabs, cookies, and waits to MCP clients.-
- FlicenseNot gradedqualityAmaintenanceExposes a localhost MCP endpoint that lets AI agents drive isolated browser profiles — navigating, clicking, typing, extracting, screenshotting, evaluating JS, and managing tabs and cookies — so real authenticated workflows can be completed from MCP clients like Cursor or Claude Desktop. Cookies, login state, fingerprints, and proxies persist per profile across launches and AI sessions.-