Loading ToolBench

Reading the current corpus…

webshot-mcp MCP server · C · ToolBench

webshot-mcp

MCP server that gives agents eyes on a web page — full-page or per-element screenshots via an already-running Chrome (CDP), with an SSRF-aware URL policy

2026-07-28+STDIO2 tools

64/100

Definition Quality86

Protocol Readiness50

Supportability35

Spec posture

Inferred effective spec 2026-07-28+·current baseline 2026-07-28

Static source inference · medium confidence

Current-spec patterns detected

Summary

Two well-defined read-only tools with clear, descriptive names and comprehensive input schemas. Both tools have detailed descriptions (150+ chars) explaining purpose, behavior, and security model (SSRF-aware URL policy). Input parameters are typed with constraints (min/max for dimensions, enums implicit via description). Output schemas are documented in descriptions. Main gaps: no tool annotations (readOnlyHint), no error recovery guidance in descriptions, and page_text lacks parameter descriptions for its single 'url' param.

Tools (2)

page_textread onlysource verified82/100

Visible text content of a page (body innerText) — the cheap check when you need to read, not see. Same URL policy as screenshot.

screenshotread onlysource verified90/100

Screenshot a web page (full-page by default) or a single element (pass a CSS selector to crop). Connects to the existing Chrome over CDP — no browser is launched. Private/loopback targets are blocked unless the hostname is in WEBSHOT_ALLOW_HOSTS. Returns the PNG plus final URL, title, and HTTP status.

Issues (4)

HIGHtool-description ↗

page_text tool lacks parameter description for 'url' input. The rubric requires every parameter to have a non-empty description explaining what it controls.

page_text

MEDIUMtool-annotations ↗

No tool annotations (readOnlyHint, destructiveHint, idempotentHint) present. Both tools are read-only and idempotent, these should be declared via tool annotations for client optimization.

screenshotpage_text

MEDIUMrecovery-guide ↗

Error handling returns generic error text without recovery guidance. When URL is blocked or screenshot fails, descriptions should hint at next steps (e.g., 'Check WEBSHOT_ALLOW_HOSTS configuration').

screenshotpage_text

LOWresponse-shaper ↗

screenshot description mentions 'Returns the PNG plus final URL, title, and HTTP status' but does not document the exact output schema structure (image + JSON text fields).

screenshot

Recommendations

Add description to page_text's 'url' parameter: 'http(s) URL to fetch text from (same SSRF policy as screenshot)'
Declare tool annotations in server.tool() calls: add readOnlyHint: true and idempotentHint: true to both tools
Enhance error messages with recovery hints: 'URL blocked by policy: {reason}. Check WEBSHOT_ALLOW_HOSTS env var.' and 'Screenshot failed: {error}. Ensure Chrome is running at {cdpUrl}.'
Document output schema in screenshot description: 'Returns object with image (PNG base64), finalUrl (string), title (string), httpStatus (number)'
Add constraint documentation to width/height params: 'viewport width in pixels (320 - 3840, default 1280)' and similar for height

Score history

Overall score trend

First recorded score · v2 rubric

64/100

Scored	Grade	Overall	Spec posture	Rubric
2026-09-23	C	64	2026-07-28+	v2