Tool reference

Every MCP tool the daemon can serve, grouped by the profile it belongs to, with what each one does and which of them change something.

All 68 of them. Which ones your daemon actually serves is decided by its configuration: see the tool set.

Every table on this page is generated from the daemon's own tool registry, so it cannot drift from what your client will see in tools/list.

The profiles

Profile	Tools	Served by default
`core`	21	yes
`extended`	17	no
`management`	22	no
`workflows`	3	no
`credentials`	5	no

A tool outside the served set does not exist as far as a client is concerned: it is absent from the listing and refused on call.

Two naming rules

Both are properties of the catalog rather than habits, and reading a name tells you what it takes.

A snake_case name takes a handle and works on the page in front of it. A dotted name takes a profile id and manages the fleet. Anything that shows typed text or saved files hangs on the handle, never on an id, because a history addressed by id would show one agent what another one typed.

A dot is not a namespace. profile.list and profile.create are two names, not one tool with a method.

`core`

The default set, on its own, and the only one small enough to serve alone: a model picks accurately from a short list and starts guessing from a long one.

Tool	What it does
`lease_profile`	Reserve a free profile, start its browser, bind a tab, and return the handle.
`lease_fleet`	The same for several profiles at once, one handle each.
`lease_renew`	Push the reservation's deadline out without losing the handle.
`start_run`	Say in one sentence what this stretch of work is for, so the operator sees it.
`release_profile`	End the reservation and stop the browser. Records how the work went.
`open_page`	Navigate to a public http or https address, and get the full page map back.
`snapshot`	What is on the page now. A diff, unless you ask for a full map.
`click`	Click an element, optionally a point inside it, for a picture rather than a control.
`press_and_hold`	The whole press-and-hold gesture, in one call.
`type_text`	Click a field and type into it at this profile's own cadence.
`fill_form`	Several fields in one call.
`press_key`	A key, including modifier chords.
`scroll`	A real wheel gesture with momentum, not a jump.
`wait_for`	Wait for text or an element to appear, to go, or for the page to go quiet.
`screenshot`	Capture the page or one element, for when the text map cannot describe it.
`record`	Start or stop recording what the browser is doing.
`video`	Turn a recording into a film, and check on one that is rendering.
`read_value`	Read one thing from an element: text, an allowed attribute, a count, a table.
`read_text`	Read the page's prose verbatim, for an article or a thread of comments.
`interruption_respond`	Answer what the browser itself is asking: a permission prompt, a device chooser.
`secret_list`	Which values this profile holds that the agent may use but not read.

`extended`

Operating the page beyond a click, plus the reading and measuring tools. This is the set most people add second.

Tool	What it does
`interact`	Hover, drag, upload a file, or choose from a native dropdown.
`navigate`	History and tabs, including the popup a click just opened.
`measure_frames`	How a moving element behaves over time, for a slider or an animation.
`measure_gap`	The distance between two elements, for a puzzle piece and its slot.
`transcribe_audio`	Turn an audio challenge into text, through the operator's own command.
`measure_rotation`	How far an image is turned, for a rotation challenge.
`interruption_list`	What the browser is currently asking, if anything.
`passkey_list`	Which sites this profile can sign in to without a password.
`passkey_retire`	Stop this profile from offering one passkey, for good.
`cookie_list`	The shape of the cookie jar. Never a value.
`cookie_delete`	Remove one cookie, or every cookie of one site.
`page_report`	Console messages and a request summary. Never headers, cookies or bodies.
`clipboard`	Read or write the clipboard of the bound tab.
`save_pdf`	Save the current page as a PDF artifact.
`download_file`	Follow a download and keep the result as an artifact.
`artifact_list`	What this profile has produced: screenshots, downloads, PDFs, recordings.
`run_list`	This profile's earlier runs, so an agent can see what was already tried.

The four measuring tools exist for verification challenges, which is the one place a text map is not enough.

`management`

The fleet, addressed by id rather than by handle. An agent with core alone cannot even list a profile, so this is the set that makes an agent self-sufficient.

Tool	What it does
`profile.list`	The profiles on this daemon, with their state.
`profile.create`	Create a profile with a fresh identity.
`profile.start`	Start a profile's browser. Does not give you one you can drive.
`profile.stop`	Stop a profile's browser.
`profile.update`	Change a profile's settings: name, proxy, group, geo mode.
`input.humanize`	Dispatch one humanized gesture at a coordinate, outside the page map.
`session.export`	A profile's session as a password-encrypted bundle.
`session.import`	Unseal such a bundle into a profile.
`credential.list`	Which platforms a profile can log into. Account names, never secrets.
`group.list`	The groups profiles are labelled with.
`profile.batch`	Start, stop, delete, or reassign a proxy or extensions across many profiles.
`preset.instantiate`	Make a fleet from a template: N profiles, each with its own identity.
`task.list`	What is outstanding on a profile.
`task.add`	Put work on a profile's list, for now or for later.
`task.start`	Mark a task as being worked on.
`task.done`	Close a task, with what came of it.
`task.cancel`	Drop a task that no longer applies.
`proxy.list`	The proxy pool. Never credentials.
`extension.list`	The extension library, and what each profile loads.
`preset.list`	The stored templates.
`group.create`	Create a group.
`group.delete`	Delete a group. Its profiles stay.

profile.batch can delete profiles. With action: "delete" it stops the browser, drops the profile and reclaims its disk, which takes every login inside it. It is the one destructive tool the Windows desktop client serves out of the box, and this layer has no confirmation step anywhere.

`workflows`

Tool	What it does
`record_workflow`	Bracket a stretch of ordinary work so it can be replayed later.
`compile_workflow`	Turn a stopped recording into a named, stored routine.
`run_workflow`	Replay a stored routine on a leased profile.

See Workflows.

`credentials`

Not in the daemon's default set: an agent doing research has no business inside anyone's account, so on a daemon you run yourself this is an explicit decision.

The desktop app serves it. Without credential_new nothing in a catalog can produce a password, and an agent asked to create an account is then left to think one up and type it in the clear, which is what this whole set exists to avoid.

Tool	What it does
`credential_fill`	Sign in with this profile's stored login. The agent never receives it.
`credential_new`	Sign up: the daemon draws the password, stores it, and types it.
`credential_store`	Put a login the profile already has into the vault.
`read_inbox`	The profile's confirmation codes, by mail or by text.
`inbox_open_link`	Open a link out of a message, by its number. The address is never shown.

See Credentials & logins and Email inboxes.

What read-only mode leaves

--mcp-read-only removes every tool that changes anything, in the browser, in the store or on disk, from the listing and refuses it if called anyway.

What stays, across every profile:

artifact_list, cookie_list, credential.list, download_file, extension.list, group.list, interruption_list, lease_renew, measure_frames, measure_gap, measure_rotation, page_report, passkey_list, preset.list, profile.list, proxy.list, read_inbox, read_text, read_value, record_workflow, run_list, save_pdf, screenshot, scroll, secret_list, session.export, snapshot, task.list, transcribe_audio, wait_for

lease_profile is not on that list. Reserving a profile starts a browser, so it counts as changing something. An agent under this flag cannot open its own session, which makes read-only a restraint on a connected agent rather than a lighter way to let one in.

The destructive ones

The MCP destructiveHint marks a tool as a destructive update rather than an additive one. Creating a profile is mutating and not destructive; deleting one is both.

Tool	Profile
`release_profile`	`core`
`click`	`core`
`press_and_hold`	`core`
`type_text`	`core`
`fill_form`	`core`
`press_key`	`core`
`passkey_retire`	`extended`
`cookie_delete`	`extended`
`run_workflow`	`workflows`
`profile.stop`	`management`
`input.humanize`	`management`
`session.import`	`management`
`profile.batch`	`management`
`task.cancel`	`management`
`group.delete`	`management`
`credential_fill`	`credentials`
`credential_new`	`credentials`
`credential_store`	`credentials`

A click is on that list on purpose. This layer cannot tell "Add to cart" from "Delete account", and the hint reflects that rather than pretending otherwise.

MCP server: connecting, the loop, and how the page map works.
Errors: the failure shape every one of these can answer with.
Remote access: reaching this catalog from a chat service.