Loading ToolBench
AI agent-optimized browser CLI — snap + act. Exposes browser automation tools (snap, read, click, fill, type, select, scroll, screenshot, wait, eval) over MCP (JSON-RPC stdio) for AI agents to control Chrome via CDP.
snact provides 10 well-named, action-verb tools (snap, read, click, fill, type, select, scroll, screenshot, wait, eval) with clear descriptions (avg ~120 chars) and complete input schemas. However, output schemas are undocumented, the tool descriptions do not specify what fields are returned, forcing LLMs to infer structure. Parameter descriptions are present but lack detail on constraints (e.g., no min/max for max_lines, no format guidance for CSS selectors). Error handling is minimal, no recovery guidance or categorization. Security is weak: eval() executes arbitrary JavaScript without sandboxing or permission gates, and no audit trail is visible. Composition is strong (single responsibility per tool, clear chaining via @eN references), but missing idempotency guarantees and batch variants.
Click an element by @eN reference from snap output. Returns updated page snapshot automatically (use --no-snap to disable).
Execute JavaScript on the current page and return the result. Use for extracting data that snap/read can't capture (e.g. product cards on Amazon).
Set an input field's value (clears existing). Use for <input>, <textarea>. Returns updated page snapshot automatically.
Read visible text content as structured markdown. Use when you need to understand page content (lists, tables, headings) — not just interactable elements.
Capture a PNG screenshot of the current page
Scroll the page in a direction. Returns updated page snapshot automatically.
Select an option in a <select> dropdown by value. Returns updated page snapshot automatically.
Output schemas completely undocumented. Tool descriptions state what they do but never specify return structure (e.g., snap returns @eN references but format is not formally defined; read returns markdown but field names/types are absent). LLMs cannot plan downstream calls without knowing what fields to extract.
eval() tool executes arbitrary JavaScript with no sandboxing, permission gates, or audit trail. This is a critical security vulnerability, a compromised agent or prompt injection could exfiltrate sensitive data or modify page state maliciously. No scope declaration (e.g., 'requires: execute:javascript') visible.
Parameter descriptions lack actionable constraints. 'max_lines' has no min/max bounds (baseline: 1 - 1000?). CSS selectors in 'focus' have no format guidance or examples. 'condition' in wait accepts three different formats (literal 'navigation', CSS selector, or milliseconds) but the description does not clarify how to distinguish them. LLMs will guess wrong.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 59 | 2026-07-28+ | v2 |
Extract interactable elements as @eN references. Always snap before acting. Output: @e1 [role] "label" attrs — one element per line
Type text character by character with key events. Use for autocomplete/search. Returns updated page snapshot automatically.
Wait for navigation, a CSS selector to appear, or a timeout in ms
No error handling guidance. Tools return errors but descriptions do not explain recovery paths (e.g., if click fails, should the agent retry, re-snap, or try a different element?). No categorization of errors as retryable vs. fatal. No actionable error messages visible in code.
No idempotency guarantees documented. Tools like click, fill, type, select, scroll are write operations but descriptions do not state whether repeated calls with identical inputs produce identical results. Agents retry on ambiguous failures, non-idempotent tools risk duplicate side effects (e.g., typing the same text twice).