An MCP server that drives a REAL, logged-in Chrome over CDP (Chrome DevTools Protocol). Attaches to an existing Chrome instance started with --remote-debugging-port, allowing agents to operate inside an already-authenticated session with cookies, extensions, and anti-bot reputation intact.
cdp-browser provides 9 well-named, action-verb tools (navigate, click, fill, evaluate) with clear descriptions (avg ~80 chars). All tools have input schemas with type definitions. However, parameter descriptions are minimal or absent in several tools (press_key, wait_for lack detail on valid key names and timeout behavior). Output schemas are undocumented, LLMs cannot predict return structure. Error handling is absent: no guidance on what happens when selectors don't match, timeouts occur, or CDP disconnects. No pagination, no structured output beyond plain strings. Security: evaluate() runs arbitrary JavaScript, creating injection risk if agent input is unsanitized. Overall: solid naming and basic schemas, but lacks LLM-optimized descriptions, output documentation, and error recovery patterns.
Click the first element matching a CSS selector.
Run a JavaScript expression in the page; returns the JSON result. Example: evaluate("document.querySelectorAll('a').length")
Return the innerText of EVERY element matching a selector, one per line.
Type a value into the input/textarea matching a CSS selector.
Return the visible innerText of an element (default = whole page body).
Navigate the active tab to a URL; returns the final URL and page title.
Press a key on the active page, e.g. 'Enter', 'ArrowDown', 'Escape'.
No output schema documentation. LLMs cannot predict return types (strings vs objects vs arrays). Breaks downstream tool chaining and forces parsing guesses.
evaluate() accepts arbitrary JavaScript with no input sanitization. If agent input is unsanitized, malicious expressions could exfiltrate data or modify page state. Requires prompt injection defense.
No error handling guidance. When selectors don't match, timeouts occur, or CDP disconnects, tools return raw exceptions. LLMs cannot determine if errors are retryable or require user intervention.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | B | 71 | 2026-07-28+ | v2 |
Check the CDP connection and list open tabs (URL + title).
Wait until a selector is visible (use instead of fixed sleeps).
Parameter descriptions incomplete. press_key lacks detail on valid key names (Enter, ArrowDown, etc.). wait_for doesn't explain timeout_ms range or default behavior. Ambiguous descriptions force LLM guessing.
No idempotency guarantees. Agents retry on ambiguous failures, repeated click() or fill() calls risk duplicate actions (double-submit, duplicate text). Needs idempotent-operation pattern.