Loading ToolBench
The server defines 9 browser automation tools with explicit JSON schemas and descriptions. However, the quality is uneven: tool naming follows verb_noun convention (e.g., puppeteer_navigate, puppeteer_click), but descriptions are inconsistent in depth and completeness. Parameter descriptions exist but lack specificity around constraints, formats, and dependencies. Output schemas are not documented, the code returns TextContent and ImageContent but doesn't specify what fields consumers should expect from each tool. Error handling is minimal; no recovery guidance or categorization of error types. The server accepts no credentials as parameters (good), but lacks permission checks and audit trail patterns. No tool annotations (readOnlyHint, destructiveHint, idempotentHint) are present despite several tools having clear write semantics (navigate, click, fill, scroll).
Click an element on the page
Execute JavaScript in the browser console
Fill out an input field
Extract all content from the current page
Hover an element on the page
Navigate to a URL
Take a screenshot of the current page or a specific element
No output schemas documented. Tools return TextContent and ImageContent but the code does not specify what fields are returned, their types, or how to chain results. LLMs cannot plan downstream calls without knowing the response structure.
Tool descriptions lack dependency and usage guidance. Example: 'puppeteer_navigate' does not explain when to use 'waitUntil' enum values or the trade-off between networkidle0 and networkidle2. 'puppeteer_evaluate' lacks warning about injection risks and return type expectations.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-22 | D | 53 | 2026-07-28+ | v2 |
| 2026-03-09 | F | 0 | - | v1 |
Scroll the page to trigger lazy-loading
Select an element on the page with Select tag
No tool annotations present. Write/destructive tools (puppeteer_navigate, puppeteer_click, puppeteer_fill, puppeteer_select, puppeteer_hover, puppeteer_evaluate, puppeteer_scroll) lack destructiveHint: true annotation. Read-only tools lack readOnlyHint: true. Agents cannot distinguish safe from unsafe operations.
Parameter descriptions lack specificity and constraints. 'timeout' in puppeteer_navigate has no min/max bounds; agents could pass 0 or 999999999. 'selector' in multiple tools lacks guidance on CSS selector validity or what happens if the selector matches zero or multiple elements.
No error recovery guidance. Code catches exceptions (e.g., 'Failed to connect to browser', 'Failed to create session') but responses do not guide the agent on retry strategy, whether the error is transient, or what to try next.
puppeteer_evaluate is a severe injection risk. It accepts arbitrary JavaScript and executes it in the browser. No sanitization, no per-call confirmation, no audit trail evident. This tool can exfiltrate data, install malware, or sabotage the page. Requires at least a dry-run confirmation pattern.
puppeteer_navigate and all interaction tools (click, fill, select, hover) are destructive and have side effects on the page state, yet no description mentions this. Agents need to know these are NOT idempotent, calling puppeteer_navigate twice navigates twice; puppeteer_click twice clicks twice.
Return value handling: screenshots are stored in a global Map and returned by name, but there's no documented way for an agent to retrieve stored screenshots or clear the cache. The design forces the agent to remember screenshot names without a discovery tool.
puppeteer_get_content lacks pagination. If the page has thousands of elements, the tool returns all content as one blob. No limit parameter, no cursor, no guidance on chunking. This violates the paginated-result pattern and risks context window exhaustion.