"Claude AI Extension or App for Safari Browser" matching MCP tools:

• extension_connectA

  animaA

  Create a short-lived, single-use connect URL that links a browser extension (or a headless Puppeteer worker) to an Anima agent. Returns `connectUrl` — hand it to the extension to complete the handshake before `exchangeExpiresAt`. The response carries no token or secret. Auth: with a master key you MUST pass `agentId`; with an agent key OMIT `agentId` (the server resolves it from the key). `ttl` is optional; a value above the org's maximum is rejected.

  ConnectorOAuth

• ios_safari_navigateA

  Robot Actions — Remote Device ControlB

  Navigate Safari to a URL on an iOS device. If a page is already inspectable, navigates the active tab in place; if Safari has no inspectable page (closed), cold-opens it to the URL (needs Settings → Safari → Advanced → Remote Automation). VERIFIES the resulting URL and returns { navigated, requestedUrl, finalUrl, pageId, method } — never a silent no-op. On success the page it landed on becomes this device's current page, so you can call ios_safari_get_dom / _evaluate / _elements / _console_logs / _capture_network / _cookies straight afterwards WITHOUT pageId and stay on this tab — no ios_safari_list_pages round trip needed. The returned pageId is only needed to come back to this tab after driving a different one. Prefer this over ios_navigate_url for Safari.

  ConnectorOAuth

• deep_scan_appA

  7IT SolutionsA

  Use this when the user, or the agent building the app, wants to check an app they control for exposed files and leaked secret keys before launch. A deeper security scan than check_app_security, for an app the caller controls (for example one the agent itself is building). It looks for sensitive things left publicly reachable: an environment (.env) file, an exposed .git folder, a directory listing, or a published source map. It also reads the app's own public code (the home page and its scripts) for the Supabase project it uses and for secret keys shipped to the browser (a Supabase service role or secret key, a database password, a paid AI key). It never contacts the app's database, never writes, and never stores, logs or returns any key; it reports the exposed PATH or the KIND of key, never a file's contents or a secret value. Because it probes an app directly, each scan runs only after ownership is proven now: call it once to receive a one-time code and a check id, add the code to the app (a meta tag on the home page, or a line in /7it-verify.txt), then call again with the check id and the scan runs.

  ConnectorNo auth

• list_appsA

  AutarioA

  List the autario data apps (the app catalog): id, name, what each app does, its live page URL, and data_scope (private = the app works on the caller's own connected data from Google Search Console, GA4, Meta Ads, Google Ads, YouTube, TikTok, Instagram, Facebook, Shopify or LinkedIn; public = it runs on public autario datasets only). Includes AI Visibility 360 (which brands ChatGPT, Claude, Gemini and Perplexity recommend), SEO 360, Social 360, Audience 360 and Bubble Or Not. When the caller is authenticated (API key or OAuth) each app also carries connected=true/false, whether YOUR data is already behind it (a connector instance the app consumes, or artifacts you saved in it). Start here when a user mentions an app by name ("my Audience 360", "my projects") or asks what apps exist, then call get_app_context(app_id) for the data map of one app. Read-only, no cost.

  ConnectorNo auth

• taskbounty_check_deployed_appA

  TaskBountyB

  Queue a permission-based outside-in check of a deployed app and create a private TaskBounty repair lead. Built for Lovable and other AI app builders. You MUST ask the user to confirm they own the app or are authorized to test it, then pass authorization_confirmed:true. Requires a TaskBounty API key. Returns a request id, status, and private Fix it URL. It never charges automatically.

  ConnectorNo auth

• get_browsersA

  FlowseryA

  Get visitors grouped by browser name (Chrome, Safari, Firefox, Edge, and others), ranked by visitors descending, for a date range. Names only: use get_breakdown with dimension browser_version for versions, get_operating_systems for the OS split, and get_devices for desktop versus mobile. Pass filter_browser to other tools to scope them to one browser. Rows carry value, visitors, revenue, and percentage with pagination.total; limit defaults to 100 (max 1000). Dates default to the last 30 days; all filter_* arguments apply. Requires websiteId or domain with a workspace token.

  ConnectorOAuth

• appstore_searchA

  GO AI ToolsA

  Searches one Apple App Store country storefront by term, via Apple's public iTunes Search API (the same request the GO AI "App Store storefront checker" tool makes from the browser), and returns matching apps with title, seller, price, rating and a direct App Store link. Returns up to 200 results, Apple's own per-request maximum -- a result of exactly 200 likely means more exist. Results are ordered by Apple's internal relevance, which does not match the ranked list shown in the App Store app, so this cannot be used to track keyword rank.

  ConnectorNo auth

• ios_safari_mock_addA

  Robot Actions — Remote Device ControlB

  Add (or update in place, when `id` matches an existing route) a mock/abort rule for Safari/WKWebView requests on this device. mode "mock" (default) serves the given status/headers/body without the request leaving the device; mode "abort" fails it so the page sees a network error. Routes apply immediately and survive navigation. WEB CONTENT ONLY: this intercepts requests made by browser/WebView pages. Requests made by native app code are NOT intercepted and never will be by this tool. Nothing device-wide is changed and no certificate is installed — the effect is scoped to the page. For requests made by native app code use ios_traffic_mock_add instead.

  ConnectorOAuth

• count_tokensA

  inktomd MCP ServerA

  Count the exact number of tokens in a text string for a specific AI model. Uses tiktoken for OpenAI models and estimates for others. Args: text: The text to count tokens for model: The AI model to count tokens for. Options: gpt-4o, gpt-4o-mini, gpt-4.1, claude-sonnet, claude-haiku, gemini-pro, gemini-flash, llama-4, deepseek-v3, mistral-large. Default: gpt-4o Returns: Token count information including count, context window, and fit status

  ConnectorNo auth

• webpage_clear_cookiesA

  Robot Actions — Remote Device ControlB

  Expire all NON-HttpOnly cookies visible to the current page origin in the device browser (iOS Safari or Android Chrome, auto-detected), via document.cookie. PREFER webpage_clear_browsing_data: it reaches HttpOnly cookies (which this cannot — and a session cookie is usually exactly the HttpOnly one you wanted gone), verifies the result by re-reading the cookie jar, and can clear localStorage/sessionStorage/caches in the same call. This tool remains for callers that specifically want the document.cookie behaviour. Returns { cleared } — the count of cookies expired, NOT verified afterwards.

  Connector

  Destructive

  OAuth

• webpage_clear_browsing_dataA

  Robot Actions — Remote Device ControlB

  Clear cookies, localStorage, sessionStorage and/or the Cache Storage API for the page in the device browser (iOS Safari or Android Chrome, auto-detected). USE THIS to get a genuinely clean session between test cases: webpage_reload deliberately PRESERVES localStorage, so a reload keeps you logged in and carries app state into the next case. Every scope is VERIFIED by re-reading it afterwards and the result reports before/after counts, so a scope that could not be cleared says so instead of being assumed. On iOS cookies are removed one at a time through the Web Inspector (Page.deleteCookie), which reaches HttpOnly cookies that document.cookie cannot; on Android Network.clearBrowserCookies clears them in one call. HTTP cache: Android clears it via Network.clearBrowserCache (the browser reports no count, so it is returned as issued rather than verified); iOS has no Web Inspector equivalent, so only the Cache Storage API is cleared there and the HTTP cache is reported unsupported rather than silently skipped. DOES NOT LOG YOU OUT OF HTTP BASIC AUTH. Those credentials live in the browser credential store, which is none of these scopes — verified on qa.tms-hmpu.com, where an authenticated session shows 0 cookies, 0 localStorage and 0 sessionStorage. To force a Basic-auth challenge again, terminate the browser (ios_terminate_app com.apple.mobilesafari) and navigate afresh.

  Connector

  Destructive

  OAuth

• get_demo_guideA

  Slop StoreA

  Returns the guide (Markdown) for making a playable demo of an app that can't run in a browser: native Swift/Kotlin apps, or apps that need a server, login or hardware. No arguments, no auth. Call it before publish_app for such apps.

  ConnectorNo auth

• get_ai_indexA

  orbator-mcpA

  AI visibility check — which software AI recommends for a category. Returns the full AI Recommendation Index for one software category: the complete measured ranking of products AI assistants (ChatGPT, Claude, Gemini, Perplexity) recommend, with recommendation share %, average answer position, per-engine breakdown, 4-week trend, sample size, and methodology. Use to answer "does AI recommend <product>" (look up its row and rank), "who is winning AI recommendations in <category>", or to cite AI recommendation-share data. Pass category in plain words or as a slug; omit it (or pass "categories") to list all published categories.

  ConnectorNo auth

• get_connection_statusA

  mcpA

  Check whether the user's tweets can be pulled: the X (Twitter) API connection (connected / disconnected), whether the browser extension has synced recently, and a rolled-up can_pull + how (x_api or extension). Use this before a sync, or when the user asks why bookmarks aren't updating. Note: the extension is browser-only and can't be driven by an agent.

  ConnectorNo auth

• fetch_recent_bookmarksA

  mcpA

  Force-pull the user's most recent bookmarks from the X API now (server-side). Requires a connected X account; if the account only syncs via the browser extension, this reports that a browser sync is needed. Use when the user asks to refresh / fetch their latest saves. For Twitter-list freshness, use get_list_tweets instead.

  ConnectorNo auth

• install_extensionA

  Proving LabA

  Install or uninstall the capture extension in Firefox or Chrome without a window, without a click and without administrator rights. Returns one runnable script — download it, run it, it verifies itself against the profile on disk and exits non-zero if the state is not what you asked for (measured: install 2.9 s, uninstall 2.1 s). Call this when a capture route needs the extension present, when a run is finished and it should be gone again, or when asked whether an agent can set up a browser extension by itself. Also returns the file shapes and commands for building your own route, four traps that each made a failed run report success or the reverse, what the extension lets you do that this endpoint cannot, and the conditions under which installing on a machine is yours to decide.

  ConnectorNo auth

• list_topicsA

  Umesh Malik Blog & ProfileA

  List the curated topic hubs (Claude Code, MCP, AI Search, LLM Engineering, AI Coding Agents) with their URLs.

  ConnectorNo auth

• ios_safari_mock_clearA

  Robot Actions — Remote Device ControlB

  Remove ALL Safari/WKWebView routes for this device and un-arm interception. Call this when finished — it restores completely normal networking for the browser on that device.

  Connector

  Destructive

  OAuth

• webpage_tabsA

  Robot Actions — Remote Device ControlB

  List, open, switch and close browser tabs on the device — one tool for what would otherwise be several. `list` works on BOTH iOS Safari and Android Chrome and returns a pageId per tab; pass that pageId to any other webpage_* tool to act on that specific tab, on either platform. `new`, `select` and `close` are ANDROID ONLY and error on iOS rather than pretending — Safari can list and drive tabs remotely but cannot open or close them, and needs no switching since pageId already targets one directly. Stale tabs accumulate across sessions and clutter the list: close what you are done with.

  ConnectorOAuth

• webpage_get_textA

  Robot Actions — Remote Device ControlB

  Get the visible text (innerText, trimmed) of an element in the device browser page, by CSS selector or by a `ref` from a page-elements listing (iOS Safari or Android Chrome, auto-detected). For reading a label/status/result after an action. Throws if the target does not resolve. For full HTML use webpage_get_dom; for many elements at once use webpage_snapshot, or ios_safari_elements / android_devtools_elements.

  ConnectorOAuth

• webpage_set_cookieA

  Robot Actions — Remote Device ControlB

  Set a cookie on the CURRENT page origin in the device browser (iOS Safari or Android Chrome, auto-detected), via document.cookie. Use to seed auth/session state before a flow. LIMITATION: sets a NON-HttpOnly cookie on the current document origin only (cannot set HttpOnly/Secure-only or cross-domain cookies — that needs the browser CDP Network domain, which the iOS bridge does not expose). Defaults path=/ and a 365-day expiry. Returns { set, name, cookie }.

  ConnectorOAuth