Browser Session MCP

Overview Schema Source Related Servers Discussions Admin

request_human_takeover

Hands the active browser page to a human for login when passwords or passkeys must stay private, returning a limited-use URL to share and a token for awaiting completion.

Instructions

Hand the session's active page to a human to log in themselves (passwords/passkeys the agent must not see). Use it only when a login needs a person; for a site you've logged into before, try load_browser_state first. Show the returned url to the user and keep the token for await_human_takeover. Does NOT block. STRONGLY ADVISED: after showing the URL, run await_human_takeover in a BACKGROUND task (subagent/job) — not your main loop — because the human may take many minutes and you should stay responsive. The URL is a bearer credential that gives live control of the tab until ttlMinutes passes, so share it only with the intended person. Fails if TAKEOVER_BASE_URL isn't configured on the server.

Input Schema

Name	Required	Description	Default
`sessionId`	Yes	The id returned by open_browser_session. Errors if no open session has it.
`ttlMinutes`	No	Minutes the link stays valid, 1 to 60 (larger values are capped). The link is a bearer credential, so keep it short. Default 30.

Output Schema

Name	Required	Description
`url`	Yes	The link to show the person who will log in.
`token`	Yes	Pass to await_human_takeover.
`expiresAtMs`	Yes	When the link stops working, in milliseconds since the Unix epoch.

Schema Changelog

Changes observed during successful MCP inspections.

Changed1 schema field changedv0.1.5Oct 24, 2026

changedOutput schema / (root)

Previous value: -nullNew value: +{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "properties": {
+    "expiresAtMs": {
+      "description": "When the link stops working, in milliseconds since the Unix epoch.",
+      "format": "uint128",
+      "minimum": 0,
+      "type": "integer"
+    },
+    "token": {
+      "description": "Pass to await_human_takeover.",
+      "type": "string"
+    },
+    "url": {
+      "description": "The link to show the person who will log in.",
+      "type": "string"
+    }
+  },
+  "required": [
+    "url",
+    "token",
+    "expiresAtMs"
+  ],
+  "type": "object"
+}

Changed2 schema fields changedOct 23, 2026

addedInput schema / properties / sessionId / description

Added value: +"The id returned by open_browser_session. Errors if no open session has it."

addedInput schema / properties / ttlMinutes / description

Added value: +"Minutes the link stays valid, 1 to 60 (larger values are capped). The link is a bearer credential, so keep it short. Default 30."

First observedv0.1.2Oct 23, 2026

TDQS

A4.8/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only flag it as non-read, non-idempotent, open-world and non-destructive; the description goes well beyond that by disclosing that it does NOT block, that the returned URL is a bearer credential granting live control of the tab until ttlMinutes expires, that it fails when TAKEOVER_BASE_URL is unconfigured, and that the token must be retained for await_human_takeover.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with purpose, then usage gating, then operational warnings; every sentence carries actionable content. It is dense and slightly long, with the bearer-credential point and the background-task advice each taking a full clause, but nothing is expendable.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return-value detail is not required, and the description still tells the agent what to do with the returned url and token. Combined with the failure mode, non-blocking behavior and concurrency guidance, an agent has everything needed to call this correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3, but the description adds real meaning: it frames the URL/token lifecycle around ttlMinutes (short-lived because the URL is a credential) and clarifies that it acts on the session's active page rather than any page. It does not restate the 1-60 cap or default, leaving that to the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: hand the session's active page to a human to log in themselves. It draws a sharp line against sibling tools by naming the parenthetical reason (passwords/passkeys the agent must not see), so it is unmistakable versus click/type/evaluate or load_browser_state.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives both when-to-use ('only when a login needs a person') and an alternative to try first ('for a site you've logged into before, try load_browser_state first'). It also sequences the follow-up tool and prescribes how to run it (await_human_takeover in a background subagent/job, not the main loop).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.