Skip to main content
Glama

elsm-mcp — local MCP bridge for Easy Local Storage Manager

@elsm/mcp is a local MCP (Model Context Protocol) server that lets any AI agent — Claude Code, Cursor, Codex, Gemini CLI, ZCode, OpenCode or anything that speaks stdio MCP — read and write the real browser storage (localStorage, sessionStorage, cookies, IndexedDB) of the tab you're looking at, through the ELSM browser extension.

Requires the browser extension. The bridge has no storage access of its own — the extension is what reads and writes your browser. Install Easy Local Storage Manager from the Chrome Web Store (Firefox: build it from the extension repo and load extension/build/firefox unpacked).

Your AI agent (Claude, Codex, Cursor, ...)
        │ stdio (MCP protocol)
        ▼
  elsm-mcp  ← port 39231, pairing token in ~/.elsm-bridge/token
        │ ws://127.0.0.1:39231 (token + protocol version handshake)
        ▼
  ELSM extension (offscreen document / background page)
        │ privileged APIs (chrome.cookies, tabs, page access)
        ▼
  The active tab you are working on — its real storage

Install

Three steps, in this order — the bridge is useless until the extension is installed and paired.

1. Install the extension

Install Easy Local Storage Manager from the Chrome Web Store — that's where agent access, the pairing token and the Connected agents screen live. Firefox: build from the extension repo.

2. Run the bridge

npx @elsm/mcp --port 39231

The first run creates a pairing token at ~/.elsm-bridge/token (mode 0600). Open the ELSM sidebar → Agent access and paste that token once per browser.

3. Point your MCP client at it

{
  "mcpServers": {
    "elsm": {
      "command": "npx",
      "args": ["-y", "@elsm/mcp", "--port", "39231"]
    }
  }
}

The setup guide has the exact stanza for Claude Code, Codex, Cursor, ZCode, OpenCode and a generic mcpServers example, and npx @elsm/mcp --print-config prints them with your real paths.

Related MCP server: agent-chrome

Tools

Nine tools, scoped to the active tab's origin:

Tool

Plan

What it does

get_target

Free

Tab id, URL, origin, title of the active tab

list_storage_areas

Free

Origin, storage areas present, IndexedDB database names

read_storage

Free

Read localStorage/sessionStorage — one key, a prefix, or everything

read_cookies

Free

All cookies for the tab; values <redacted> unless raw-value consent is granted in the UI

read_indexeddb

Free

Cursor-paged, JSON-safe read of an object store

export_state

Free

Snapshot localStorage/sessionStorage + cookie metadata (always redacted)

write_storage

Pro

Write {key, value} entries; every write lands in the sidebar changelog

delete_keys

Pro

Delete keys from localStorage/sessionStorage

clear_area

Pro

Wipe an area — needs confirm: true on a retry after the user armed Clear-all in the sidebar (60s window)

Free plans are read-only and capped at 50 agent calls per day; Pro is unlimited. On the extension's Connected agents screen you can see every agent that called in (last used, total calls, last action), block one, or revoke it.

Safety model

  • The WebSocket server binds loopback only (127.0.0.1) — never a routable interface.

  • Every connection must authenticate with the pairing token as its first frame; non-hello frames are dropped, and token/protocol mismatches are hard refusals (no downgrade).

  • Token comparison is hashed and constant-time; the token file is written atomically with mode 0600.

  • No code: injection — all page access goes through chrome.scripting.executeScript with functions and JSON args.

  • The bridge only ever talks to loopback. Note that your agent itself may send retrieved data to its LLM provider; that's between you and your agent.

CLI

elsm-mcp [--port <n>] [--token-file <f>] [--print-config] [--selftest]
  • --port — fixed WS port (default 39231)

  • --token-file — pairing token file (default ~/.elsm-bridge/token, or ELSM_TOKEN_FILE)

  • --print-config — print paste-ready config stanzas for common clients

  • --selftest — run the internal smoke test (real WS roundtrip: handshake, auth refusal, protocol-mismatch refusal, pre-auth frame dropping, agent attribution, session replacement) and exit

Development

bun install
bun run build      # tsc → dist/
bun run typecheck
bun run test       # dist/cli.js --selftest

The wire contract with the extension is duplicated by design: the canonical protocol types live in src/types.ts, and the ELSM extension repo keeps a hand-mirrored copy (extension/src/shared/types/agent-bridge.types.ts). Change both in the same change and bump the protocol version in both files — mismatches are refused at the handshake.

License

MIT

Available Tools

9 tools
clear_areaA

Clear an entire area (every key) for the active tab's origin. Destructive: requires BOTH (1) confirm: true in the call — pass it on the retry after receiving needsConfirmation — and (2) the user pressing 'Clear' in the ELSM sidebar Agent panel within 60s before the retry. Params: area (required), confirm (boolean).

NameRequiredDescriptionDefault
areaYes
confirmNo

TDQS

A4.3/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full behavioral burden and does so well: it discloses that the operation is destructive, requires both confirm: true on retry and a user press within 60s, and explains the needsConfirmation retry pattern. This is unusually complete for a destructive mutation tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with purpose and destructiveness, then gives the confirmation protocol, then lists parameters. It is compact with no wasted sentences.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a destructive tool with no annotations and no output schema, it provides enough context to invoke correctly: scope, destructiveness, confirmation prerequisites, retry behavior, and parameters. Missing return-value details are minor because no output schema exists.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must add parameter meaning. It identifies area as required and confirm as boolean, and explains confirm's workflow, but it does not explain the area enum values (localStorage/sessionStorage) beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: clear an entire area (every key) for the active tab's origin. That scope implicitly separates it from selective siblings like delete_keys, but it does not explicitly name or compare against them.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It clearly explains the intended use case—clearing all keys in a storage area—and gives the required confirmation workflow, including the retry and user-approval steps. It does not explicitly state when to use a sibling such as delete_keys instead.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

delete_keysC

Delete keys from localStorage or sessionStorage on the active tab's origin. Params: area (required), keys (required array).

NameRequiredDescriptionDefault
areaYes
keysYes

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden, yet it never says whether deletion is permanent/irreversible, what happens to keys that don't exist, or whether errors are raised. The origin-scoped targeting is useful behavioral context, but the destructive profile of a delete operation goes undisclosed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences with the purpose front-loaded and no padding. The second sentence is largely redundant with the schema, which keeps it from a 5.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no annotations, no output schema, and zero schema description coverage, the description should cover irreversibility, missing-key behavior, and what is returned (e.g., count deleted). It covers none of these, leaving an agent under-informed for a destructive 2-param tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate, but it only restates that area and keys are required — information already in the schema's required array and enum. Nothing explains key format, duplicate handling, or behavior for absent keys.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource (delete keys) plus the storage areas and the origin scope, which clearly separates it from clear_area (whole-area wipe) and write_storage. It never names those siblings explicitly, so the differentiation is inferable rather than stated.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The origin/tab scoping implies when this applies, but there is no explicit guidance on when to prefer this over clear_area or list_storage_areas, and no stated prerequisites. Usage must be inferred from the verb alone.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

export_stateA

Export the storage snapshot of the active tab's origin: origin, localStorage, sessionStorage, and cookie metadata (cookie values always redacted). Params: rawCookieValues (boolean, ignored — kept for compatibility).

NameRequiredDescriptionDefault
rawCookieValuesNo

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does well: it discloses the scope (active tab's origin), a meaningful privacy trait (cookie values always redacted), and that rawCookieValues is a no-op. It stops short of stating read-only semantics, permission prerequisites, or snapshot size limits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with the payload contents and followed by the parameter caveat. No filler, and the most decision-relevant fact (redacted cookies, ignored param) is not buried.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Without an output schema, the description usefully enumerates the returned fields (origin, localStorage, sessionStorage, cookie metadata), so the agent knows what comes back. Minor gaps remain around permissions needed for the active tab and the response shape (object vs. file download).

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate entirely for the single parameter, and it does: rawCookieValues is called out as boolean, ignored, and retained only for compatibility, preventing the agent from believing it changes behavior.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (export) and resource (storage snapshot of the active tab's origin) and enumerates the four data classes included, which implicitly distinguishes it from the narrower read_storage/read_cookies siblings. It never names those siblings explicitly, so an agent must infer the boundary.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied by 'active tab's origin' and the aggregate 'snapshot' framing, suggesting it is the one-shot alternative to piecemeal reads. However, there is no explicit when-to-use or when-not-to-use guidance relative to read_storage, read_cookies, or list_storage_areas.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_targetA

Describe the active target the agent is operating on: tab id, URL and origin, title. No secrets.

NameRequiredDescriptionDefault

No parameters

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations and no output schema, the description carries the full burden. It partially meets it by saying what is returned and adding the safety guarantee 'No secrets,' which tells the agent it won't leak credentials. It omits failure behavior (what happens with no active target) and does not explicitly state that the call is a side-effect-free read.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences with the resource and returned fields front-loaded; no filler. The 'No secrets' fragment is terse but earns its place as a privacy note.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter read tool the description covers what the agent gets back, which is the main thing. It is incomplete on error/edge behavior and read-only guarantees, which matter because no annotations or output schema supply that context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so the baseline is 4. The description adds nothing extra because nothing about parameters needs explaining.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description gives a specific verb ('Describe') and resource ('the active target the agent is operating on') and enumerates the fields returned (tab id, URL and origin, title). That clearly distinguishes it from the storage/cookie siblings, though it never explicitly contrasts itself with them.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is only implied: an agent would infer it should call this to learn what page it's on. There is no explicit statement of when to use this versus the storage-reading siblings, nor any exclusion or precondition.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_storage_areasA

List what the bridge can operate on for the current target: origin, storage areas present, IndexedDB database names.

NameRequiredDescriptionDefault

No parameters

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. 'List' implies a safe read operation, and the description discloses the returned inventory fields, but it does not explicitly state side-effect behavior, permissions, or whether a target must already be selected.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single front-loaded sentence that states the action and enumerates the key return contents without any filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description usefully names the returned information (origin, storage areas, IndexedDB database names). For a simple no-parameter discovery tool, this is nearly complete, though it could clarify whether the target must be set first.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so there are no parameter semantics to document. The description correctly does not invent parameters, and the baseline for a no-parameter tool is 4.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a clear verb ('List') and specifies the resource as what the bridge can operate on for the current target. It also names key returned data, which helps distinguish it from content-reading siblings like read_storage, though it does not explicitly name alternatives.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'for the current target' implies usage as a discovery/inventory step, but there is no explicit guidance on when to use this versus get_target, read_storage, or read_indexeddb. Usage is inferable but not stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

read_cookiesA

Read all cookies visible to the active tab (name, domain, path, secure, httpOnly, sameSite, session). Params: rawCookieValues (boolean) — values are returned as "" unless the user has explicitly granted raw-value consent in the extension UI; without consent the call still succeeds but values stay redacted.

NameRequiredDescriptionDefault
rawCookieValuesNo

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full disclosure burden and does well: it reveals the non-obvious privacy gate (values redacted to "<redacted>" without explicit user consent) and that the call still succeeds without consent. It omits permission requirements and any limits on how many cookies are returned, keeping it just short of a 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, zero waste: the scope and return fields come first, then the one parameter's semantics and its consent caveat. Nothing is repeated from structured fields and nothing extraneous is included.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

A read tool with one optional param, no output schema, and no annotations; the description covers the resource scope, the return fields, and the consent behavior, which is nearly everything needed. Minor gaps remain around required extension permissions and any result-size or pagination behavior.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0% and the single parameter is undocumented in the schema, so the description must compensate — and it does, explaining that rawCookieValues is a boolean gate whose effect is redacted vs. raw values and that consent is required for raw values. It effectively implies the default (redacted) behavior.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Read all cookies') plus a clear scope ('visible to the active tab') and enumerates the returned fields (name, domain, path, secure, httpOnly, sameSite, session). It does not explicitly differentiate itself from siblings like read_storage or read_indexeddb, but the resource noun and tab-scoping make the distinction inferable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explains the consent precondition for rawCookieValues, which is genuinely useful usage context, but it never says when to choose this tool over read_storage, read_indexeddb, or export_state. Usage is implied by the resource rather than stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

read_indexeddbA

Cursor-paged, JSON-safe read of an IndexedDB object store on the active tab's origin. Params: db (required), store (required), cursor (number offset from a previous call's nextCursor), limit (default 200, max 1000).

NameRequiredDescriptionDefault
dbYes
limitNo
storeYes
cursorNo

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden. It usefully discloses pagination behavior, JSON-safe serialization, active-tab origin scoping, and limit defaults/maxima, but it does not state permissions, error handling, empty-store behavior, or the shape of returned records.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two compact sentences, front-loaded with the core operation and followed by essential parameter semantics. There is no filler, and the default/max details earn their place because the schema does not document them.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read tool with no output schema and no annotations, the description should more fully explain what is returned and how to continue paging. It implies nextCursor exists via the cursor parameter and gives good input semantics, but the return payload and edge-case behavior remain underspecified.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate and largely does: it marks db and store as required, explains cursor as a number offset from a previous call's nextCursor, and gives limit's default (200) and maximum (1000). The only gap is that db and store are not explicitly described as database and object-store names beyond their labels.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: a cursor-paged, JSON-safe read of an IndexedDB object store on the active tab's origin. It is clearly distinguishable from write/delete siblings, though it does not explicitly name or contrast with read-only siblings such as read_storage or list_storage_areas.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied by the phrase 'cursor-paged read' and the cursor parameter referring to a previous call's nextCursor, which suggests iterative paging. However, there is no explicit when-to-use guidance versus alternative read tools like read_storage, nor any stated exclusions or prerequisites.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

read_storageA

Read keys from localStorage or sessionStorage of the active tab's origin. Params: area (required), key (single key) or prefix (all keys beginning with the prefix); omit both for everything. (Cookies are not an area here — use read_cookies.)

NameRequiredDescriptionDefault
keyNo
areaYes
prefixNo

TDQS

A4.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must carry the full behavioral burden. It usefully discloses that the read is scoped to the active tab's origin and is non-mutating by implication, but says nothing about what is returned (key/value map vs list), ordering, or size/limit behavior when omitting both filters.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

One compact passage, front-loaded with the core action, then the parameter rules, with the cross-tool caveat in a trailing parenthetical. No sentence is redundant.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 3-param read tool with no output schema and no annotations, the description covers scope, parameter interaction, and sibling disambiguation adequately. The main remaining gap is the shape of the returned data, which the agent would have to discover empirically.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description has to compensate and does: it marks area as required, explains key as a single key, prefix as all keys beginning with a prefix, and specifies that omitting both returns everything — including the mutual-exclusivity rule the schema never states.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Read keys from localStorage or sessionStorage') plus the scope ('of the active tab's origin'), which is information an agent cannot get from the schema. It also pre-empts the closest confusion by naming read_cookies as the wrong tool for cookies.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives an explicit boundary against the sibling read_cookies and an in-tool rule for when to use key vs prefix vs neither. It does not say when reading storage is inappropriate versus list_storage_areas or read_indexeddb, but the routing it does offer is concrete.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

write_storageA

Write entries into localStorage or sessionStorage of the active tab's origin. Params: area (required), entries ([{key, value}] as JSON-serializable strings). Every write is appended to the sidebar changelog so the user sees it.

NameRequiredDescriptionDefault
areaYes
entriesYes

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations exist, so the description carries the full load. It usefully discloses a side effect (every write is appended to the sidebar changelog so the user sees it) and the JSON-serializable string constraint, but says nothing about overwrite semantics for existing keys, permission/auth needs, or error behavior on a full quota.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short sentences, front-loaded with the action and scope, then params, then the notable side effect. No filler and nothing misplaced.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 2-param mutation tool with no annotations and no output schema, the description covers purpose, both parameters, and the user-visible changelog effect. The main gap is what happens when a key already exists or when storage is full.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description compensates well: it marks area as required, names the two enum values implicitly, and expands the opaque `items: object` schema into `[{key, value}]` with values as JSON-serializable strings. Only the exact shape of the entry objects is left slightly implicit.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (write) and resource (entries into localStorage/sessionStorage) plus a precise scope (active tab's origin). This clearly separates it from read_storage, clear_area, and delete_keys without needing their schemas.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no explicit guidance on when to use this versus siblings like clear_area or delete_keys, and no stated prerequisites or exclusions. The scope phrase implies when it applies, but no alternative routing or when-not conditions are given.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 9 tool updatesv0.1.0
    • First observedclear_area
    • First observeddelete_keys
    • First observedexport_state
    • First observedget_target
    • First observedlist_storage_areas
    • First observedread_cookies
    • First observedread_indexeddb
    • First observedread_storage
    • First observedwrite_storage

TDQS

A3.7/5.0

Scored across 9 tools

Disambiguation4/5

Most tools target clearly distinct operations (read_cookies vs read_storage vs read_indexeddb vs get_target vs list_storage_areas), and descriptions explicitly disambiguate, e.g. read_storage notes 'Cookies are not an area here — use read_cookies.' The main overlap is export_state, which produces a full snapshot of the same storage areas read_storage reads, so an agent could reasonably pick either for 'dump everything.'

Naming Consistency5/5

All nine names follow a consistent snake_case verb_noun convention (read_cookies, write_storage, delete_keys, clear_area, export_state, etc.), including the multi-word list_storage_areas and read_indexeddb. No style mixing.

Tool Count5/5

Nine tools sit comfortably in the 3-15 sweet spot and each maps to a concrete capability (read/write/delete/clear across storage areas, cookies, IndexedDB, target introspection, export). Nothing feels padded or missing at the count level.

Completeness4/5

Storage lifecycle is well covered (read/write/delete/clear/list plus export), but the surface is asymmetric: cookies and IndexedDB are read-only with no write/delete counterparts, likely by design for safety. An agent could still be blocked if it needs to set a cookie or modify an IndexedDB store, though those are arguably out of scope for a read-inspection bridge.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    A
    quality
    C
    maintenance
    Enables AI clients to control the user's already-open, logged-in browser pages in real time over a local WebSocket channel, without Playwright, Puppeteer, Selenium, or any browser driver. Exposes tools for navigation, semantic page snapshots, clicking, form filling, JavaScript evaluation, screenshots, network monitoring, cookie handling, and tab management via the CDP.
    20
    MIT
  • A
    license
    Not graded
    quality
    C
    maintenance
    Lets local AI agents drive the Chrome browser a user already has open, including signed-in sessions, by listing tabs, reading page text and actionable elements, then clicking, filling, selecting, scrolling, navigating, and capturing viewport screenshots without exporting cookies. Runs as a dependency-free local stdio process over Native Messaging, with per-tab leases, automatic reconnection, and pause/write-action controls.
    MIT
  • F
    license
    Not graded
    quality
    A
    maintenance
    Exposes a governed, OAuth-gated suite of 38 tools that let web AI assistants like Claude, ChatGPT, and Grok work directly on your local machine — reading and editing files, running whitelisted shell commands, searching, querying SQLite, driving browsers and DevTools, managing background tasks and localhost services, and controlling Git, clipboard, notifications, and Postman. This lets users build, debug, and maintain projects, inspect databases and local APIs, and check on long-running jobs from a browser or phone without granting unrestricted shell access.
    -
  • A
    license
    Not graded
    quality
    A
    maintenance
    Lets AI coding tools drive the real, already-logged-in Chrome browser over local stdio—snapshotting and reading pages, clicking, typing, managing tabs, capturing screenshots, and inspecting network, console, storage, and cookies—without opening a remote-debugging port. It installs as a Chrome extension plus native-messaging bridge, so agents work in the user's authenticated sessions while passing bot detection.
    1 npm
    ISC