Loading ToolBench
High-performance browser automation server for LLM agents. Token-efficient perception, stealth, captcha solving and traffic inspection behind the Model Context Protocol.
Navigator MCP demonstrates solid tool design with 26 well-named, action-verb-prefixed tools (browser_*, session_*). All tools have descriptions (avg ~150 chars, within 10-1024 baseline). Input schemas are present and typed for all tools. However, output schemas are not documented, responses are inferred from code but not formally declared in tool definitions. Error handling is present but inconsistent: some tools (captcha_solve) provide recovery guidance; others (network_list) lack actionable error messages. Parameter descriptions are generally good but some lack format/constraint details (e.g., 'timeout_s' lacks min/max bounds). No tool annotations (readOnlyHint/destructiveHint) are visible, missing a key pattern for agent safety.
Detect captcha widgets on the current page (type, evidence, sitekeys).
Wait for a human to solve the captcha (requires a visible browser: NAVIGATOR_HEADLESS=false or VNC). Polls until the captcha disappears.
Solve the captcha on the current page automatically. Needs a provider API key (TWOCAPTCHA_API_KEY or CAPSOLVER_API_KEY). Supports reCAPTCHA v2, hCaptcha, Turnstile and plain image captchas (via ref pointing at the image element).
Respond to a pending manual-mode dialog (accept/dismiss, optional text).
Discover background API endpoints (fetch/XHR) used by the page — including internal/undocumented APIs, from capture or live observation.
List forms and their fields — the map for browser_fill_form.
Output schemas not documented. Tool definitions declare input schemas but no formal output schema is visible in tool registration. LLMs cannot plan downstream calls or extract required fields without knowing response structure.
Tool annotations missing. No readOnlyHint, destructiveHint, or idempotentHint visible in tool definitions. Agents cannot distinguish safe read-only tools from destructive ones (e.g., browser_network_block vs browser_network_list), risking unsafe execution.
Numeric parameter bounds missing. Parameters like 'timeout_s', 'poll_s', 'limit', 'n' lack min/max constraints in descriptions. LLMs may pass absurd values (timeout_s=999999, limit=1000000) causing timeouts or resource exhaustion.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 60 | 2026-07-28+ | v2 |
Extract HTML — whole document or a specific element (by ref).
List all links (deduplicated) with their resolved hrefs.
Extract page metadata: title, meta tags, OpenGraph, canonical.
Extract <table> content as row arrays (token-cheap vs HTML).
Extract text — whole page (smart main-content) or a specific element. Supports pagination via offset/limit for very long pages.
Search the current page for elements matching a text pattern (regex ok) and/or an ARIA role. Returns matching elements with their refs — cheaper than a full snapshot when you know what you're looking for. By default only actionable elements (links, buttons, fields, headings, images) are searched; set include_structural=true to also match containers (banner/navigation/form/...).
Block requests matching URL globs across all sessions. Examples: ["**/*.css", "**/ads.js", "*doubleclick*"]. Blocks ads and trackers to speed up automation dramatically.
Start recording network requests on this tab. Optional filters: resource_types (document/xhr/fetch/script/image/...), url_contains (substring), methods (GET/POST/...). Default records everything.
Stop recording network requests (buffer is kept until next start).
Fetch full details + response body of a captured request (by index).
List captured network requests (most recent first).
Remove all URL blocking rules.
Read console messages and page errors (JS errors, logs, failed asserts). Set drain=true to clear the buffer after reading.
Read captured alert/confirm/prompt dialogs.
Close a session and all its tabs (cookies/storage are discarded unless saved with browser_session_save_auth).
List all active sessions with their tabs, fingerprints and proxies.
Create a new isolated browser session. - stealth: apply anti-detection fingerprinting (default on) - profile: restore a saved auth profile (from browser_session_save_auth) - proxy: per-session proxy server (e.g. http://user:pass@host:port) - fingerprint: specific fingerprint name (see stealth docs), random by default - bypass_csp: disable CSP enforcement (for pages that block inline scripts) - record_har: file path to record a HAR archive of all traffic
Persist the session's cookies + localStorage to a named profile. Restore later via browser_session_new(profile=profile_name) — survives restarts, perfect for staying logged in across engagements.
Set dialog handling: "auto" (accept + record — default) or "manual" (pause dialogs so browser_dialog_respond can answer them).
Capture the page as a compact, ref-annotated accessibility snapshot. Elements get stable refs (e.g. [ref=e12]) that interaction tools accept. If the page is unchanged since the last snapshot, returns a short "unchanged" notice instead of re-sending the tree (major token savings). Set force=true to always re-render, deep=true to include child frames.
Error recovery guidance inconsistent. browser_captcha_solve provides actionable recovery ('Try manual flow'); most other tools lack guidance. Agents hitting errors have no clear next step.
Parameter relationships undocumented. browser_session_new has interdependent params (stealth + fingerprint, geolocation + timezone) but no description notes which combinations are valid or mutually exclusive.