Return the full Codex Chrome (browser use) API reference for the live browser/tab object graph. Read this before writing browser_exec code.

Run arbitrary async JavaScript against Codex's Chrome API. In scope: agent, browser, tabs (=browser.tabs), user (=browser.user), tab (current or selected tab, else null), console, log. Use return to produce a JSON result; images returned/emitted are attached. Code runs in the MCP server's Node process: Node APIs like fetch work here (no browser cookies), while in-page JS must go through tab.playwright.evaluate (sandboxed, see eval_js). This is the full-power escape hatch.

List the user's real open Chrome tabs (across windows), newest first. Use an entry's id with claim_tab to take control.

List tabs currently controlled by this browser session.

Create a new controlled tab (optionally navigate to url) and make it the active tab.

Take control of one of the user's existing Chrome tabs (id from list_user_tabs) and make it the active tab.

Navigate the active tab (or tab_id) to a URL. Creates a tab if none is active.

Return the active tab's url, title, and a filtered DOM listing interactable elements with node ids. Use a node_id with the click tool.

Capture a screenshot of the active tab (or tab_id).

Click on the active tab. Prefer node_id (from snapshot) or x+y (viewport coordinates); selector/text use Playwright and may be less reliable when Codex shares the page.

Type text. With selector, fills that element; otherwise types at the current focus (click first to focus).

Press a key or chord at the current focus, e.g. keys=['Enter'] or ['Control','a'].

Scroll the active tab by a delta (positive scrollY scrolls down). By default scrolls the page reliably regardless of layout; pass node_id to scroll inside a specific scroll container, x+y to send a mouse wheel at a viewport point, or selector to scrollIntoView a specific element. Returns before/after scroll position, pageHeight, and nearBottom. On virtualized lists (e.g. Discourse post streams) use small steps (<= ~2 viewports) and extract between steps, or content will be skipped.

Evaluate JavaScript in the page via Playwright and return the result (JSON-projected; depth<=8, strings<=200k chars). Pass an expression or () => ... function source as code; top-level await is allowed. The sandbox is READ-ONLY and stripped: DOM reads, getComputedStyle, and scrolling work, but there is NO fetch/XMLHttpRequest/network, NO DOM mutation, no setInterval, and window only exposes an allowlist - use fetch_url or goto for network data. Warns if the tab is on a chrome-error:// page.

Fetch rendered content for one or more URLs through the user's Chrome (their cookies/session) WITHOUT touching the active tab, via browser.tabs.content. Ideal for JSON endpoints (e.g. Discourse /t/.json) or reading pages in bulk - much faster than goto+scroll+DOM scraping. content_type: 'text' (default), 'html', or 'domSnapshot'. May fail if the browser host does not support tabs_content or a content-blocker extension blocks the URL; fall back to goto + eval_js then.

Return recent console log messages captured for the active tab.

Send a raw Chrome DevTools Protocol command to the active tab (or tab_id) via the browser's cdp tab capability, for developer/debugging use. Navigate the tab to its intended http(s) page first; raw CDP is scoped to the tab's current web origin and attaching shows Chrome's 'started debugging' bar. Prefer the higher-level tools for ordinary automation. To observe events for an action, capture a cursor with cdp_events, send the command, then read from that cursor. Requires full CDP access to be enabled (browser/config.toml full_cdp_access_enabled=true).

Read buffered Chrome DevTools Protocol events from the active tab (or tab_id) via the cdp tab capability. Returns { cursor, events, hasMore, truncated }. Page from each returned cursor with after_sequence while hasMore is true; truncated means older events were evicted. Discover child target selectors from Target.attachedToTarget events. Requires full CDP access enabled.

Set the browser session name (shown in the Codex/Chrome UI).

End browser work for now, cleaning up session tabs. Optionally keep specific tabs open (status 'deliverable' or 'handoff').