Tool reference

Every MCP tool the daemon can serve, grouped by the profile it belongs to, with what each one does and which of them change something.

Last updated Oct 23, 2026

All 77 of them. Which ones your daemon actually serves is decided by its configuration: see the tool set.

Every table on this page is generated from the daemon's own tool registry, so it cannot drift from what your client will see in tools/list.

The profiles

Profile	Tools	Served by default
`core`	21	yes
`extended`	26	no
`management`	22	no
`workflows`	3	no
`credentials`	5	no

A tool outside the served set does not exist as far as a client is concerned: it is absent from the listing and refused on call.

Profiles say what kind of tool it is. Groups say whether an agent sees it by default. Of the tools its profiles hold, the daemon serves the basic group, and every other group is one switch in the desktop app under Settings, Agent tools. Agents that connect after the switch see the new tools.

Group	Tools	What it adds
`basic`	36	Always on: leasing, seeing and operating the page, reading it, logins and the inbox.
`video`	2	`record` and `video`: a film of what the agent did.
`tasks`	5	The task list across all profiles.
`fleet`	16	Profile management: creating, changing, starting and stopping profiles, groups, presets, proxies and sessions.
`captcha`	4	Captcha helpers: measuring a picture or an audio challenge.
`extras`	5	Cookies, passkey retirement, PDFs and earlier runs.
`developer`	9	Reading the page's own markup and structure, and seeing its requests by shape: `dom_html`, `selector_for`, `query_selector`, `computed_style`, `net_capture`.

Why most groups start off. Every tool in the list costs tokens on every request an agent makes. In a month of the desktop app, agents used 31 of its 65 tools, and two models chose the right tool as often from 33 tools as from 65. The basic group alone costs about half the tokens.

A call to a tool whose group is off is refused with tool_group_off, naming the switch. The same switches are on GET and PUT /v1/agent-tools for a machine without a screen.

What a tool takes

A management tool takes a profile id and manages the fleet. Every other tool takes the handle from lease_profile and works on the page in front of it. Anything that shows typed text or saved files hangs on the handle, never on an id, because a history addressed by id would show one agent what another one typed. The one exception is video with action=status: after release_profile it takes the profile_id plus the video_id your own render returned.

Every name is snake_case. Before October 2026 the management tools carried a dot (profile.list). That spelling still works when you call it, so older scripts keep running.

`core`

The default set, on its own: leasing a browser, seeing and operating the page.

Tool	What it does
`lease_profile`	Reserve a free profile, start its browser, bind a tab, and return the handle.
`lease_fleet`	The same for several profiles at once, one handle each.
`lease_renew`	Push the reservation's deadline out without losing the handle.
`start_run`	Say in one sentence what this stretch of work is for, so the operator sees it.
`release_profile`	End the reservation and stop the browser. Records how the work went.
`open_page`	Navigate to a public http or https address, and get the full page map back.
`snapshot`	What is on the page now. A diff, unless you ask for a full map.
`click`	Click an element, optionally a point inside it, for a picture rather than a control.
`press_and_hold`	The whole press-and-hold gesture, in one call.
`type_text`	Click a field and type into it at this profile's own cadence.
`fill_form`	Several fields in one call.
`press_key`	A key, including modifier chords.
`scroll`	A real wheel gesture with momentum, not a jump.
`wait_for`	Wait for text or an element to appear, to go, or for the page to go quiet.
`screenshot`	Capture the page or one element, for when the text map cannot describe it.
`record`	Start or stop recording what the browser is doing.
`video`	Turn a recording into a film, and check on one that is rendering.
`read_value`	Read one thing from an element: text, an allowed attribute, a count, a table.
`read_text`	Read the page's prose verbatim, for an article or a thread of comments.
`interruption_respond`	Answer what the browser itself is asking: a permission prompt, a device chooser.
`secret_list`	Which values this profile holds that the agent may use but not read.

`extended`

Operating the page beyond a click, plus the reading and measuring tools. This is the set most people add second.

Tool	What it does
`interact`	Hover, drag, upload a file, or choose from a native dropdown.
`navigate`	History and tabs, including the popup a click just opened.
`measure_frames`	How a moving element behaves over time, for a slider or an animation.
`measure_gap`	The distance between two elements, for a puzzle piece and its slot.
`transcribe_audio`	Turn an audio challenge into text, through the operator's own command.
`measure_rotation`	How far an image is turned, for a rotation challenge.
`interruption_list`	What the browser is currently asking, if anything.
`passkey_list`	Which sites this profile can sign in to without a password.
`passkey_retire`	Stop this profile from offering one passkey, for good.
`cookie_list`	The shape of the cookie jar. Never a value.
`cookie_delete`	Remove one cookie, or every cookie of one site.
`page_report`	The newest requests the page loaded and the failed ones among them. Not the page's console output; never headers, cookies or bodies.
`dom_html`	The markup of one element or of the document. With the Secret Layer on, only a short list of attributes shows its value, and typed values and the bodies of scripts, styles and comments come back as `[withheld]`; with it off, the markup comes back whole.
`clipboard`	Read or write the clipboard of the bound tab.
`save_pdf`	Save the current page as a PDF artifact.
`download_file`	Follow a download and keep the result as an artifact.
`artifact_list`	What this profile has produced (screenshots, downloads, PDFs, recordings) and the files you dropped on it in the app.
`run_list`	This profile's earlier runs, so an agent can see what was already tried.
`computed_style`	An element's computed CSS, including shorthands and custom properties like `--brand`, and its box in the viewport.
`query_selector`	The elements a CSS selector or an XPath matches, as refs any other tool can act on, fifty at a time, each with a short label. A chain `a >> b` enters open shadow roots and same-origin iframes.
`selector_for`	A CSS selector and an XPath for one element, built from its tag, id, test-hook or position. For an element in a shadow root or an iframe it answers with a chain that `query_selector` follows.
`net_capture`	The requests the page makes, by shape: method, origin and path, status, kind, size and the names of the headers. No header value, query string or body, unless the operator has switched the Secret Layer off: then `seq` reads one request in full, cookie values excepted, and `save` keeps a long body as a file. Recording starts with the first call, covers the whole browser rather than one tab (`page`, `path`, `kind`, `method` and `errors_only` narrow it; `summary` answers with groups instead of rows, `order` newest lists the latest first, and a row is compact unless `full` is set), and runs until `stop` or until the lease ends. A reply holds as many requests as fit; while `has_more` is true, call again with `since` set to `next_since`.
`read_console`	What the page wrote to its console: logs, warnings, errors, uncaught exceptions and rejected promises, from the page, its frames and its workers, kept from the browser's start. Objects appear as `[object Object]`. Needs a browser engine from the next engine release on; an older one says so.
`evaluate_script`	Run a JavaScript function that only reads, in a world the page cannot see, and get its value back as JSON. Any write, request or call with an effect is stopped before it lands, and a run ends after 1 s. Only with the Secret Layer off.
`read_page_variable`	A value from the page's own JavaScript, such as `window.__APP_STATE__.cart`, read without running any of the page's code: getters and proxies are named, never opened. Only with the Secret Layer off.
`performance_trace`	How a page loads: first and largest paint, blocking time, layout shift, the longest tasks and the slowest requests, and a score on Lighthouse's curves without Speed Index. Never reloads the page and takes no screenshots.

The four measuring tools exist for verification challenges, which is the one place a text map is not enough.

A file from your computer reaches an agent through the app. Open the profile, go to Memory, and drop the file under Files for agents. Every agent that holds the profile then sees it with artifact_list and attaches it with interact (action: "upload"). A dropped file is kept for 4 hours. Without the app, POST /v1/profiles/:id/artifacts does the same. A file on the web needs no drop: the agent opens its address in a new tab (navigate, action: "new"), stores it with download_file and switches back.

`management`

The fleet, addressed by id rather than by handle. An agent with core alone cannot even list a profile, so this is the set that makes an agent self-sufficient.

Tool	What it does
`profile_list`	The profiles on this daemon, with their state.
`profile_create`	Create a profile with a fresh identity.
`profile_start`	Start a profile's browser. Does not give you one you can drive.
`profile_stop`	Stop a profile's browser.
`profile_update`	Change a profile's settings: name, proxy, group, geo mode.
`input_humanize`	Dispatch one humanized gesture at a coordinate, outside the page map.
`session_export`	A profile's session as a password-encrypted bundle.
`session_import`	Unseal such a bundle into a profile.
`credential_list`	Which platforms a profile can log into, or with `platform` alone, which profiles hold a login for it. Account names, never secrets.
`group_list`	The groups profiles are labelled with.
`profile_batch`	Start, stop, delete, or reassign a proxy or extensions across many profiles.
`preset_instantiate`	Make a fleet from a template: N profiles, each with its own identity.
`task_list`	What is outstanding on a profile.
`task_add`	Put work on a profile's list, for now or for later.
`task_start`	Mark a task as being worked on.
`task_done`	Close a task, with what came of it.
`task_cancel`	Drop a task that no longer applies.
`proxy_list`	The proxy pool. Never credentials.
`extension_list`	The extension library, and what each profile loads.
`preset_list`	The stored templates.
`group_create`	Create a group.
`group_delete`	Delete a group. Its profiles stay.

profile_batch can delete profiles. With action: "delete" it stops the browser, drops the profile and reclaims its disk, which takes every login inside it. It is the one destructive tool the Windows desktop client serves out of the box, and this layer has no confirmation step anywhere.

`workflows`

Tool	What it does
`record_workflow`	Bracket a stretch of ordinary work so it can be replayed later.
`compile_workflow`	Turn a stopped recording into a named, stored routine.
`run_workflow`	Replay a stored routine on a leased profile.

See Workflows.

`credentials`

Not in the daemon's default set: an agent doing research has no business inside anyone's account, so on a daemon you run yourself this is an explicit decision.

The desktop app serves it. Without credential_new nothing in a catalog can produce a password, and an agent asked to create an account is then left to think one up and type it in the clear, which is what this whole set exists to avoid.

Tool	What it does
`credential_fill`	Sign in with this profile's stored login. The agent never receives it.
`credential_new`	Sign up: the daemon draws the password, stores it, and types it.
`credential_store`	Put a login the profile already has into the vault.
`read_inbox`	The profile's confirmation codes, by mail or by text.
`inbox_open_link`	Open a link out of a message, by its number. The address is never shown.

See Credentials & logins and Email inboxes.

What read-only mode leaves

--mcp-read-only removes every tool that changes anything, in the browser, in the store or on disk, from the listing and refuses it if called anyway.

What stays, across every profile:

artifact_list, computed_style, cookie_list, credential_list, dom_html, download_file, evaluate_script, extension_list, group_list, interruption_list, lease_renew, measure_frames, measure_gap, measure_rotation, net_capture, page_report, passkey_list, preset_list, profile_list, proxy_list, query_selector, read_console, read_inbox, read_page_variable, read_text, read_value, record_workflow, run_list, save_pdf, screenshot, scroll, secret_list, selector_for, session_export, snapshot, task_list, transcribe_audio, wait_for

lease_profile is not on that list. Reserving a profile starts a browser, so it counts as changing something. An agent under this flag cannot open its own session, which makes read-only a restraint on a connected agent rather than a lighter way to let one in.

The destructive ones

The MCP destructiveHint marks a tool as a destructive update rather than an additive one. Creating a profile is mutating and not destructive; deleting one is both.

Tool	Profile
`release_profile`	`core`
`click`	`core`
`press_and_hold`	`core`
`type_text`	`core`
`fill_form`	`core`
`press_key`	`core`
`passkey_retire`	`extended`
`cookie_delete`	`extended`
`run_workflow`	`workflows`
`profile_stop`	`management`
`input_humanize`	`management`
`session_import`	`management`
`profile_batch`	`management`
`task_cancel`	`management`
`group_delete`	`management`
`credential_fill`	`credentials`
`credential_new`	`credentials`
`credential_store`	`credentials`

A click is on that list on purpose. This layer cannot tell "Add to cart" from "Delete account", and the hint reflects that rather than pretending otherwise.

MCP server: connecting, the loop, and how the page map works.
Errors: the failure shape every one of these can answer with.
Remote access: reaching this catalog from a chat service.

Run it on your own machine

Seven days to try it with your own agents on your own sites. Starting the trial needs a card.

Get started