browser-use-relay-mcp
Allows observing and controlling a Brave browser instance through the MCP server, including page snapshots, DOM queries, clicks, form filling, and other browser actions.
Allows observing and controlling a Vivaldi browser instance through the MCP server, including page snapshots, DOM queries, clicks, form filling, and other browser actions.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@browser-use-relay-mcpOpen https://example.com and get the page title"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Browser Use Relay MCP
A standalone Model Context Protocol server, Manifest V3 extension, and Native Messaging host for observing and controlling one selected Chromium browser. It supports local and trusted-LAN agents, multiple installed browser families, revision-aware page targeting, browser-generated input, browser APIs, and operating-system fallback behind one action catalog.
Architecture
AI agent
↕ MCP over stdio
MCP server on the agent device
↕ WebSocket using the selected relay URL
Native Messaging host on the browser device
↕ Chromium Native Messaging
MV3 service worker
├─ Browser/CDP engine
├─ Content-script DOM engine
└─ Native OS engine through the hostThe browser device and agent device can be the same computer. For LAN use, the extension and Native Messaging host stay on the browser device; the MCP server runs wherever the agent runs.
The content engine assigns element IDs in memory. It does not add marker IDs or classes to website DOM. Targets are revisioned and revalidated after SPA, frame, resize, intersection, input, focus, scroll, and DOM changes.
Related MCP server: OLTestStack
Requirements
Node.js 20.19 or newer and npm.
Chrome, Microsoft Edge, Chromium, Brave, or Vivaldi based on Chromium 130 or newer.
Windows, macOS, or Linux, including Ubuntu.
A graphical desktop session for native mouse, keyboard, dialog, and clipboard actions.
User-level permission to register a Native Messaging host.
macOS can request Accessibility, Input Monitoring, or Screen Recording permission for native interaction. Linux native input requires an accessible graphical session; compositor and Wayland policies can restrict synthetic OS input.
Build
Run commands from this package directory:
npm ci --workspaces=false
npm run typecheck
npm run buildBuild output:
extension/dist— unpacked MV3 extension.dist/mcp/entry.js— MCP stdio server.dist/native/entry.js— Native Messaging host and WebSocket relay.
Install on a browser device
1. Load the extension
Open
chrome://extensionsin Chrome oredge://extensionsin Edge. Other Chromium browsers expose an equivalent extensions page.Enable Developer mode.
Select Load unpacked and choose this package's
extension/distdirectory.Copy the extension ID shown by the browser. The included manifest key should produce
eacicnagoagiekpfomdocomknbjhmalh; always use the ID actually displayed by that browser.
The browser can require separate user approval for incognito access or file:// URLs.
2. Register the Native Messaging host
Run one command for each browser family in which the extension will be installed:
npm run native:install --workspaces=false -- chrome eacicnagoagiekpfomdocomknbjhmalh
npm run native:install --workspaces=false -- edge eacicnagoagiekpfomdocomknbjhmalhSupported browser values are chrome, edge, chromium, brave, and vivaldi. Replace the sample extension ID if the browser displays a different one.
The installer verifies the native build and creates a user-scoped browser manifest and launcher. It writes to the current user's browser Native Messaging configuration and, on Windows, its documented per-user registry key. Re-run installation if this package directory moves.
3. Enable the relay
Reload the extension after registering the host.
Open the extension popup and turn Browser relay on.
For same-device use, copy the local
ws://127.0.0.1:<port>address.For another device on the same trusted network, open Settings, enable External Access, apply the desired port, and copy the displayed LAN address.
The first run requests port 32145. If that port is unavailable, the host selects a free port and persists the actual port shown by the extension. A host firewall can require approval for trusted private-network access.
Install the extension in any supported browsers you need, but keep only the selected browser relay enabled. The MCP server controls the single relay URL configured for it.
Configure an MCP client
Use an absolute path and the exact address copied from the extension.
{
"mcpServers": {
"browser-use-relay": {
"command": "node",
"args": [
"/absolute/path/to/browser-use-relay-mcp/dist/mcp/entry.js"
],
"env": {
"BROWSER_RELAY_URL": "ws://127.0.0.1:32145"
}
}
}
}On Windows, use an escaped absolute path such as C:\\path\\to\\browser-use-relay-mcp\\dist\\mcp\\entry.js.
On a remote agent device, use the browser device's LAN relay address instead of 127.0.0.1. The agent device needs the built MCP package, but it does not need that browser's Native Messaging registration.
Equivalent command-line configuration is available:
node dist/mcp/entry.js --relay-url ws://127.0.0.1:32145Optional environment settings:
BROWSER_RELAY_CONNECT_TIMEOUT_MS— WebSocket connection timeout; default10000.BROWSER_RELAY_ACTION_TIMEOUT_MS— default action timeout; default60000.BROWSER_RELAY_ACTION_DELAY_MIN_MSandBROWSER_RELAY_ACTION_DELAY_MAX_MS— optional minimum and maximum intervals between browser actions, in milliseconds. The equivalent flags are--action-delay-min-msand--action-delay-max-ms; each flag takes precedence over its environment setting.
Set action delays in the MCP JSON env object or the target browser extension's Settings. For example, "BROWSER_RELAY_ACTION_DELAY_MIN_MS": "500" and "BROWSER_RELAY_ACTION_DELAY_MAX_MS": "1000" select a random interval from 500 to 1000 milliseconds. One supplied endpoint means a fixed interval. An explicit MCP range overrides the extension's entire range; an explicit zero disables the delay when supplied alone or for both endpoints. Without MCP values, the browser uses its saved extension values. With neither configured, no delay is imposed.
Delays are enforced on the browser device, including over LAN, before each action and each browser_batch member. Time already spent since the previous dispatch or completion counts toward the interval, so slow model responses do not add another full wait. Concurrent observation waits remain active while later actions are dispatched. Internal file-transfer chunks, finalization, and cleanup are not paced. Delay time counts toward the action timeout. Extension delay changes apply to subsequent actions without restarting the relay.
If the browser device has several physical or virtual adapters, set BROWSER_USE_RELAY_NETWORK_ADDRESS in the browser process environment to the assigned LAN IPv4 address that External Access should display.
The server supports current MCP discovery and compatible 2025-era initialization through the official TypeScript SDK.
MCP tools
Tool | Purpose |
| Return the protocol, target grammar, parameter guides, action catalog, and selected browser's runtime availability. |
| Return page state and revisioned element catalogs across permitted frames. |
| Execute one catalog-defined read action; some observations can attach the debugger or temporarily activate a tab. |
| Execute one action with automatic or explicit engine routing. |
| Run an ordered workflow and optionally stop on the first action failure. |
| Read buffered relay, navigation, DOM, network, download, and page-error events with sequence cursors and overflow reporting. |
| Transfer local files or isolated directory trees to the browser device, verify SHA-256 integrity, and set a file input. |
| Copy a browser-device file to the MCP device with chunk integrity verification. |
Call browser_capabilities before using unfamiliar actions. Its target and category guides are the authoritative runtime-facing contract.
Targeting and routing
A target can contain:
{
"tabId": 42,
"frameId": 0,
"documentId": "optional-document-id",
"elementId": "element-id-from-a-snapshot",
"locator": {
"selector": "button[type=submit]",
"text": "Continue",
"exactText": true,
"role": "button",
"name": "Continue",
"label": "Email",
"placeholder": "name@example.com",
"nth": 0
},
"x": 640,
"y": 420
}Target precedence is element ID, locator, then coordinates. Browser and DOM coordinates use the selected frame's viewport; explicit native actions use OS screen coordinates.
Use engine: "auto" unless a workflow specifically needs browser, dom, or native. Automatic routing follows each action's catalog metadata and returns the engine that actually completed it.
For change-sensitive actions, pass the latest snapshot expectedRevision. A stale target is fingerprint-revalidated before execution or returned as a retryable failure.
Usage examples
Observe all permitted frames:
{
"includeScreenshot": false,
"allFrames": true,
"maxElements": 5000
}Extract visible matching elements:
{
"action": "querySelectorAll",
"target": {
"locator": {
"selector": "article"
}
},
"params": {
"limit": 200
}
}Click a revisioned element with browser input:
{
"action": "clickElement",
"engine": "auto",
"target": {
"tabId": 42,
"elementId": "element-id-from-the-latest-snapshot"
},
"expectedRevision": 17
}Fill a field:
{
"action": "fillField",
"target": {
"locator": {
"label": "Email"
}
},
"params": {
"value": "person@example.com"
}
}Transfer local files and set a remote file input with browser_upload_files:
{
"paths": [
"C:\\Users\\person\\Documents\\report.pdf"
],
"target": {
"locator": {
"selector": "input[type=file]"
}
}
}The result always includes every staging ID in transferIds. Its pathMetadata contains the returned file paths, directory roots, encoded byte limit, actual encoded bytes, returned and omitted counts, and PATH_METADATA_BYTE_BUDGET_EXCEEDED when the 8 MiB result budget requires truncation. After the website has consumed a file, uploadFile with engine: "native" and params: { "operation": "cancel", "transferId": "…" } releases it. A client can stage at most 4,096 files and 8 GiB; the MCP preflights those limits before transferring. Unfinalized groups have a renewable 24-hour inactivity lease with a seven-day absolute limit. The high-level tool refreshes prior groups during active transfer progress, then atomically validates and finalizes every real directory group and its synthetic standalone-file group with one shared nonrenewing 30-minute deadline. Retrying the same consistent bulk finalization is idempotent and cannot extend that deadline. All owner staging is removed when that relay client disconnects or the native host stops. File and directory names are preserved exactly; names unsupported by the browser device's operating system or filesystem are rejected and are never silently rewritten.
Copy a completed browser-device download back with browser_download_file:
{
"remotePath": "C:\\Users\\browser\\Downloads\\result.zip",
"destinationPath": "C:\\Users\\agent\\Downloads\\result.zip",
"overwrite": false
}Capability notes
CDP browser input is higher fidelity than script-dispatched events, but attaching
chrome.debuggerdisplays Chromium's debugger notice. Opening DevTools for the same target or dismissing the notice can detach the session.Native actions control the focused desktop and are used for browser chrome, file choosers, Save As, permission prompts, and other UI outside webpage content.
chrome://, extension-store pages, browser-owned viewers, and other protected surfaces restrict content scripts or debugger access.Cross-origin frame access depends on host permission and Chromium restrictions. The extension reports frame-specific failures rather than silently targeting the wrong frame.
Tab audio/video capture and some browser UI operations remain subject to Chromium user-activation rules.
Website defenses can observe debugger attachment or automation-relevant behavior. This package does not claim invisibility.
Network security
This release is intentionally unauthenticated. External Access binds the relay to the browser device's network interfaces and uses unencrypted ws:// transport.
Use External Access only on a trusted private network.
Do not expose or forward the relay port to the public internet.
Disable the extension relay when it is not in use.
Anyone who can reach the relay can request the capabilities granted to the extension and native host.
Uninstall the native host
Run the matching command for each registered browser:
npm run native:uninstall --workspaces=false -- chrome
npm run native:uninstall --workspaces=false -- edgeThen remove the unpacked extension from the browser.
Troubleshooting
Native host not found: confirm
npm run buildcompleted, install the host for the correct browser family and displayed extension ID, then reload the extension.Relay address is absent: enable the extension and inspect the status message. The local endpoint uses
127.0.0.1with the saved port; the LAN endpoint appears only after the native host reports a network address.LAN connection fails: enable External Access, use the displayed LAN address, and allow the selected Node process/port through the browser device's private-network firewall.
Action targets the wrong page state: take a new snapshot and send its element ID and revision.
Debugger action fails: close DevTools for the target tab, keep the debugger session attached, and retry with a fresh snapshot.
Native input misses the target: focus the intended browser window and verify display scaling and OS permissions.
Package directory moved: rebuild if needed and reinstall the Native Messaging host so its absolute launcher paths are current.
Primary platform references
Available Tools
8 toolsbrowser_actionAct in browserCDestructive
Execute one revision-aware human browser action through automatic DOM, browser-input, or native routing.
| Name | Required | Description | Default |
|---|---|---|---|
| action | Yes | Action name returned by browser_capabilities. | |
| engine | No | auto follows the ordered engines returned for the action by browser_capabilities. | |
| params | No | ||
| target | No | ||
| retries | No | ||
| timeoutMs | No | ||
| retryDelayMs | No | ||
| expectedRevision | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already disclose destructiveHint=true, readOnlyHint=false, and idempotentHint=false, so the safety profile is covered. The description adds 'revision-aware,' which hints at concurrency control via expectedRevision, but doesn't explain the mechanism or consequences. It provides some extra context beyond annotations but remains vague about side effects and failure behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with no filler. Key elements—scope ('one'), routing modes, and revision awareness—are packed in. It is economical and front-loaded, though the jargon ('revision-aware', 'human browser action') may reduce clarity slightly. It earns its place but could be more accessible.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity (8 parameters, nested target object, no output schema) and low schema coverage, the description is far from complete. It doesn't mention that action must come from browser_capabilities, how to specify the target, retry semantics, or the expectedRevision contract. An agent would struggle to invoke this tool correctly based on the description alone.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is low (25%), so the description must compensate for undocumented parameters like params, target, retries, timeoutMs, retryDelayMs, and expectedRevision. It does not describe any of these; the only implicit hint is 'DOM, browser-input, or native routing' for the engine parameter. This fails to help the agent understand how to construct valid invocations.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('execute') and resource ('human browser action'), and the word 'one' distinguishes it from browser_batch. It also mentions routing through DOM, browser-input, or native, which clarifies its scope. However, it doesn't explicitly name siblings or state that action names come from browser_capabilities, so it's clear but not maximally differentiating.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this tool versus alternatives (e.g., browser_batch for multiple actions, browser_query for reading state). It doesn't mention prerequisites like calling browser_capabilities first or supplying expectedRevision. The description simply states what it does, leaving the agent to infer usage context entirely.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browser_batchRun browser action sequenceCDestructive
Execute an ordered sequence against one selected browser, stopping on failure by default.
| Name | Required | Description | Default |
|---|---|---|---|
| actions | Yes | ||
| stopOnError | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true and readOnlyHint=false, so the description does not need to repeat those. It adds the default stop-on-failure behavior, which is not in the annotations, and implies ordered execution. However, it does not disclose other traits like side effects on the browser state or that the sequence may be interrupted. The added context is modest, earning a middle score.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence that front-loads the core purpose and a key default behavior. It contains no wasted words and is appropriately brief for a tool whose schema carries the heavy detail. Every clause earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This is a complex batch tool (up to 100 actions, many subfields) with no output schema, yet the description is minimal. It does not explain when to prefer it over sibling tools, how actions relate to browser_capabilities, or what the stopOnError parameter controls in practice. While the schema provides technical detail, the description fails to provide the usage context an agent needs to decide when to invoke this tool, leaving significant gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% – the description provides no information about the two parameters (actions, stopOnError) or their meaning. The schema itself does contain detailed sub-field descriptions, but the description does not compensate for the low coverage. An agent would have to rely entirely on the schema, and the description adds no semantic help for choosing or structuring the parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action ('execute an ordered sequence') and a clear resource (one selected browser), with a notable behavioral detail (stopping on failure by default). It clearly distinguishes from the sibling browser_action which likely runs a single action, though it does not name that sibling explicitly. This is clear but not maximally explicit about alternative tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no explicit guidance on when to use this tool versus alternatives. It implies use for multiple actions but does not state 'use this instead of browser_action for sequences' or provide exclusions. The 'stopping on failure' default is a behavior, not a usage condition. An agent must infer from the name and schema that this is for batching.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browser_capabilitiesBrowser capabilitiesARead-onlyIdempotent
List browser relay actions and runtime availability. The default returns action names, categories, and compact runtime state. Pass only the intended action names or categories for focused metadata; request full detail only when the entire reference is required.
| Name | Required | Description | Default |
|---|---|---|---|
| detail | No | ||
| actions | No | ||
| categories | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| actions | Yes | |
| runtime | Yes | |
| targetGuide | Yes | |
| protocolVersion | Yes | |
| categoryParameterGuides | Yes | |
| actionParameterOverrides | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, openWorldHint, and non-destructive behavior on which the description builds. The description adds useful context about default output (action names, categories, compact runtime state) and how passing filters changes the response, which goes beyond the annotations without contradicting them.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences with no filler. It front-loads the core purpose, then gives clear, compact usage rules. Every clause earns its place and no information is redundant with the schema or annotations.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's low complexity, fully optional parameters, rich annotations, and an output schema, the description is complete enough for an agent to call it correctly. It explains the default behavior, the effect of filters, and when to request full detail, leaving no critical gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must carry the parameter semantics. It explains the roles of 'actions' and 'categories' for focused metadata and 'detail' for full reference retrieval. While it does not exhaustively describe every parameter, it provides meaningful guidance that maps directly to the schema fields.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: 'List browser relay actions and runtime availability.' This clearly identifies the tool as a metadata/listing operation and distinguishes it from siblings like browser_action or browser_snapshot, though the term 'browser relay actions' is somewhat jargon-heavy and the distinction is implied rather than explicit.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides actionable usage guidance: pass only intended action names or categories for focused metadata, and request full detail only when the entire reference is needed. It does not explicitly compare against sibling tools or state exclusions, but the parameter-level guidance is clear and practical.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browser_download_fileCopy browser-device fileADestructive
Copy a completed download or other explicitly supplied browser-device file to the MCP client machine with per-chunk integrity checks.
| Name | Required | Description | Default |
|---|---|---|---|
| overwrite | No | ||
| remotePath | Yes | ||
| destinationPath | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate destructive, non-read-only behavior. The description adds a useful per-chunk integrity-check detail and a source precondition, but does not clarify overwrite behavior, failure cases, or what happens if the source file is not available. This is acceptable but not rich.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence with the operation and destination front-loaded illusion, and the integrity-check detail appended without filler. Every part earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The direction and purpose are clear, and the tool is simple with only three parameters. However, overwrite semantics, destination handling, and return/result behavior are not described, leaving moderate gaps for an agent calling it autonomously.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description provides no meaning for remotePath, destinationPath, or overwrite. The agent must infer path semantics and overwrite behavior purely from parameter names and the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb and resource: 'Copy ... browser-device file' to the MCP client machine. It also scopes the source as a completed download or explicitly supplied file, distinguishing it from sibling tools like browser_upload_files.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context for when to use the tool: to retrieve a completed download or other explicitly supplied device file to the client machine. It does not explicitly name alternatives or state when not to use it, stopping short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browser_eventsRead browser eventsBRead-onlyIdempotent
Read recent relay, navigation, DOM revision, request, download, error, and lifecycle events.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| afterSequence | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the safety profile is covered. The description adds the event categories and the notion of 'recent' events, which is useful context. It doesn't disclose pagination behavior, ordering guarantees, or what happens when no events exist, but the annotations carry the main behavioral burden.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that front-loads the verb and resource, then lists the event categories. It is concise and every word earns its place, though it could be slightly more structured with a second sentence for usage guidance.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only, idempotent tool with no required parameters and no output schema, the description is mostly adequate. The main gap is that it doesn't explain the afterSequence parameter or describe the return format, but the annotations cover the safety profile and the event list gives a good sense of what will be returned.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate for the two parameters. The description mentions 'recent' events, which hints at the limit parameter, but it doesn't explain afterSequence at all. The parameter names are fairly self-explanatory, but the description adds minimal semantic value beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a clear verb ('Read') and resource ('browser events'), and enumerates the event categories (relay, navigation, DOM revision, request, download, error, lifecycle). This distinguishes it from sibling tools like browser_snapshot or browser_action, though it doesn't explicitly name a sibling alternative.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies this is for reading event history rather than taking actions or capturing snapshots, which helps an agent choose it over browser_action or browser_snapshot. However, it doesn't explicitly state when to use this tool versus alternatives, nor does it mention any exclusions or prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browser_queryQuery browserBIdempotent
Run a catalog-defined read query. Some browser observations may activate a tab or attach debugger instrumentation.
| Name | Required | Description | Default |
|---|---|---|---|
| action | Yes | Action name returned by browser_capabilities. | |
| engine | No | auto follows the ordered engines returned for the action by browser_capabilities. | |
| params | No | ||
| target | No | ||
| retries | No | ||
| timeoutMs | No | ||
| retryDelayMs | No | ||
| expectedRevision | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds important context beyond the annotations by warning that some observations 'may activate a tab or attach debugger instrumentation.' This qualifies the 'read query' label and introduces realistic side effects, which is especially valuable given that readOnlyHint is false. The description does not contradict the annotations; it complements them.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences with no wasted words. The primary purpose is stated first, followed by a concise caveat. Every word contributes to comprehension, and the length is appropriate for the tool's generic dispatching nature.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Even though the schema describes the 'action' parameter as returned by browser_capabilities, the description omits crucial context: how to discover valid actions, what the output format is, how 'params' should be structured per action, and what side effects may be expected beyond the vague note. The tool is complex with nested targets and retry options, and no output schema exists, so the description is insufficient for an agent to invoke it effectively on its own.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description itself explains none of the eight parameters, despite schema description coverage being only 25%. It does not compensate for gaps around 'action,' 'engine,' 'target,' or retry fields一波. The only parameter explanation comes from the schema itself (for 'action' and 'engine'), so the description adds no value to parameter understanding.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action: 'Run a catalog-defined read query.' This clearly identifies the tool's purpose as executing predefined read operations and differentiates it from mutation or snapshot tools by emphasizing the read nature. However, it does not explicitly name a sibling tool or further clarify what distinguishes a 'query' from browser_capabilities or browser_action.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives like browser_action or browser_batch. It never mentions any condition that would select this tool over others, nor does it explain prerequisites such as calling browser_capabilities first to obtain valid actions. The 'catalog-defined' phrase hints at external definitions but leaves the decision entirely to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browser_snapshotObserve browserAIdempotent
Return bounded page state and a sparse, revisioned element catalog without changing the website DOM. Omitted visible/enabled mean true; omitted editable/readonly mean false. Use getBoundingBox when coordinates are needed.
| Name | Required | Description | Default |
|---|---|---|---|
| tabId | No | ||
| allFrames | No | ||
| maxElements | No | ||
| includeHidden | No | ||
| includeScreenshot | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds meaningful behavioral context beyond the annotations: it explicitly states the tool does not change the DOM (non-destructive), and it explains default semantics for omitted properties: 'Omitted visible/enabled mean true; omitted editable/readonly mean false.' This is valuable because the schema has no descriptions for these boolean fields. The annotations already indicate idempotentHint=true and destructiveHint=false, but the description reinforces and adds the default-value semantics, which is beyond what annotations provide.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three sentences, each earning its place: the first states the core function and non-mutation guarantee, the second clarifies default boolean semantics, and the third routes coordinate needs to another tool. It is front-loaded with the most important information and has no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 5 parameters, no output schema, and 0% schema description coverage, the description does a good job of covering the key behavioral aspects: non-mutation, bounded/sparse output, and default boolean semantics. It could be more complete by explaining what 'revisioned' means and how the element catalog relates to other browser tools, but for an observation tool with idempotentHint=true, it covers the essential context an agent needs.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It does partially: it explains the meaning of omitted boolean parameters (visible/enabled/editable/readonly) and mentions 'bounded' and 'sparse' which relate to maxElements. However, it doesn't explain tabId, allFrames, includeHidden, or includeScreenshot in detail. The description adds some semantic value but leaves several parameters to be inferred from their names.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Return bounded page state and a sparse, revisioned element catalog without changing the website DOM.' This is a specific verb ('return') and resource ('page state' and 'element catalog'), and it explicitly distinguishes itself from mutation tools by noting it does not change the DOM. It also differentiates from coordinate-related tools by pointing to getBoundingBox.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context for when to use this tool: when you need page state and an element catalog without DOM changes. It also gives a specific exclusion: 'Use getBoundingBox when coordinates are needed.' However, it doesn't explicitly name sibling alternatives like browser_query or browser_action, nor does it state when not to use it in favor of those. The guidance is clear but not exhaustive.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
browser_upload_filesUpload files to browserADestructive
Transfer files or directory contents to the selected browser device, then set the targeted file input.
| Name | Required | Description | Default |
|---|---|---|---|
| paths | Yes | ||
| target | Yes | ||
| timeoutMs | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already state destructiveHint=true and readOnlyHint=false. The description adds that this tool transfers files and sets the input, which is a useful behavioral outcome. It does not disclose potential side effects like overwriting existing state or triggering change events, but the annotations cover the main safety traits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, tightly-worded sentence with zero filler. The action is front-loaded and every word adds meaning.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The nested target object is complex, yet the description offers no guidance on how to specify the target (e.g., by coordinates, locator, or elementId), nor does it mention timeoutMs or return behavior. There is no output schema and the description leaves too much to inference for a tool with this many target options.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description partially compensates by indicating that 'paths' corresponds to files or directory contents and 'target' identifies the file input. However, it does not explain how to choose among the numerous target sub-fields (coordinates, locator, elementId) or what timeoutMs does.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Transfer') and resource ('files or directory contents') and clearly states the subsequent action ('set the targeted file input'). This distinguishes it from the sibling browser_download_file and other browser tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the usage context: it is the tool to use when files need to be placed into a browser device and a file input must be set. The mention of 'selected browser device' and 'targeted file input' gives clear context, though no explicit alternative tools are named.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
8 tool updates
v1.0.0- First observed
browser_action - First observed
browser_batch - First observed
browser_capabilities - First observed
browser_download_file - First observed
browser_events - First observed
browser_query - First observed
browser_snapshot - First observed
browser_upload_files
TDQS
Scored across 8 tools
Each tool targets a distinct aspect of browser interaction: snapshot for state, capabilities for metadata, query for read operations, action for single operations, batch for sequences, events for history, and upload/download for file transfer. No two tools have overlapping purposes.
All tools share a consistent 'browser_' prefix and use snake_case, but the second part mixes nouns (snapshot, capabilities, action, batch, events) and verbs (query, upload, download). The pattern is predictable enough to be unambiguous, though not as uniform as a strict verb_noun convention.
With 8 tools, the set is well-scoped for browser automation. Each tool covers a necessary function without redundancy, and the count is within the ideal range for a domain-specific server.
The surface covers core browser operations: state observation (snapshot), queries, actions, batch execution, event monitoring, and file transfer. Minor gaps exist such as explicit tab management or waiting, but these are likely handled through browser_action and batch sequences, making the coverage adequate.
Maintenance
Related MCP Connectors
Live browser debugging for AI assistants — DOM, console, network via MCP.
MCP server to assist with JxBrowser development.
A paid remote MCP for AI agent browser DevTools MCP, built to return verdicts, receipts, usage logs,
The Remote MCP server acts as a standardized bridge between LLM applications (like Claude, ChatGPT, and Cursor) and external services, enabling AI agents to access external tools and resources. Its primary capability is providing a centralized search tool to discover other MCP servers and their respective tools. Unlike local implementations, it runs remotely with OAuth authentication and permission controls for security.
Related MCP Servers
- AlicenseNot gradedqualityCmaintenanceAn MCP server for browser automation and console log capture via a Chrome extension, enabling AI-driven DOM interaction, navigation, and screenshot capabilities.2MIT
- FlicenseNot gradedqualityDmaintenanceMCP server that enables AI agents to automate browser testing via Chromium, providing tools for navigation, interaction, and inspection.-
- AlicenseAqualityDmaintenanceSelf-hosted MCP server for AI browser automation. Connects to your own Chromium instance via CDP, providing tools for browser control, navigation, interaction, and content extraction.191MIT
- AlicenseAqualityAmaintenanceMCP server that lets AI agents drive your real Chromium browser with your existing signed-in sessions, providing visible, local, and inspectable automation for tasks like navigation, clicking, typing, and form filling.251Apache 2.0