Loading ToolBench
Chrome automation layer for Claude Code — drop-in replacement for Chrome MCP that keeps DOM and screenshots OUT of the LLM context
CHROMAN has 4 tools with basic schemas and descriptions, but critical gaps prevent production use. All tools lack proper input schema validation in the MCP sense, parameters are documented in descriptions but not formally declared as JSON Schema with types. Descriptions are present but minimal (50-120 chars), below the 194-char baseline for A+ tools. No output schemas documented. Error handling is present but generic. Tools are single-purpose (good), but naming is non-standard (snapshot, click, fill, auth lack verb_noun clarity). No parameter type constraints (enums, ranges, patterns). Security risk: auth tool opens visible Chrome and stores credentials in plaintext directories.
Abre una ventana Chrome VISIBLE con perfil persistente. El CEO loguea manualmente la plataforma (Shopify, Meta, Google, Odoo, etc). Al cerrar la ventana, las cookies y localStorage quedan guardados en CHROMAN_PROFILES/<nombre>
Navega a una URL, hace click en un selector, captura snapshot post-click. Devuelve JSON minimal. El HTML post-click se guarda en CHROMAN_CACHE.
Navega a URL, rellena un input/textarea, opcionalmente hace submit o click en otro selector
Toma un snapshot (HTML + PNG) de una URL y lo guarda en CHROMAN_CACHE/. Devuelve JSON minimal por stdout (solo lo imprescindible para el contexto de Claude)
No JSON Schema input definitions visible. Tools document parameters in descriptions only (url, selector, profile, wait), but no formal schema with type, required, properties, or constraints. MCP requires explicit input schemas.
Tool names lack action verbs. 'snapshot', 'click', 'fill', 'auth' are vague. Should be 'capture_page_snapshot', 'click_element', 'fill_form_field', 'authenticate_with_browser' to signal intent clearly to LLMs.
No output schemas documented. Tools return JSON (ok, error, htmlPath, pngPath, etc.) but LLMs cannot plan downstream calls without knowing response structure. Document all return fields and types.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 34 | 2026-07-28+ | v2 |
Credentials stored in plaintext. auth tool saves cookies and localStorage to CHROMAN_PROFILES/<name> on disk without encryption. If the server is compromised, all stored credentials are exposed. Use encrypted vaults or OS credential stores.
Descriptions too brief (40-120 chars vs 194-char baseline). 'Toma un snapshot...' and 'Navega a una URL...' lack context on when to use each tool, what they return, and prerequisites. Expand to 150-250 chars with actionable guidance.