Loading ToolBench
MCP server and native messaging host for controlling Chromium browsers (Chrome, Brave, Edge) via the OpenBrowser extension. Enables tab management, navigation, form input, page reading, JavaScript evaluation, network inspection, and source code downloading.
OpenBrowser MCP defines 20 tools with mostly complete schemas and descriptions. Naming follows verb_noun conventions (tabs_context, tabs_create, navigate, computer, read_page, find, etc.). Descriptions are present and contextual (avg ~120 chars), explaining WHAT each tool does and WHEN to use it. However, parameter descriptions are sparse or missing for many tools. The 'computer' tool is a mega-tool combining 11 distinct actions (click, type, scroll, screenshot, etc.) into one, violating single-responsibility. Error handling is minimal, no recovery guidance or actionable error messages visible in schemas. Output schemas are not documented in the provided code. Risk annotations (READ_ONLY, WRITE, DESTRUCTIVE) are present but not formalized as tool annotations in the MCP sense.
Pins a browser as this session's default so later calls need no browserId. Pass null to clear.
Lists the connected browsers and profiles with their ids, brands, labels and tab counts.
Mouse, keyboard and screenshots. Prefer `ref` from read_page or find over `coordinate`: exact, and ~15x cheaper than a screenshot. `coordinate` only for canvas, WebGL, drag paths and elements with no ref. Screenshot only to see rendering, never to locate a target.
Finds elements by description or visible text.
Sets a form element by ref; boolean for checkboxes, option value for selects.
The page's readable text. For reading, not locating elements.
computer tool violates single-responsibility principle: combines 11 distinct actions (left_click, right_click, double_click, triple_click, hover, type, key, scroll, scroll_to, left_click_drag, zoom, wait, screenshot) into one mega-tool. LLMs cannot reason about which action to invoke without extensive trial-and-error. Should split into separate tools: click_element, type_text, scroll_page, take_screenshot, etc.
Parameter descriptions are missing or minimal for most tools. E.g., tabs_create_mcp has 'group' with description 'Name for the new group' (too vague, what format? max length?), 'tabId' with 'Join this tab's group instead' (unclear what happens if tabId doesn't exist). LLMs cannot validate inputs without explicit constraints.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 61 | 2026-07-28+ | v2 |
Evaluates JavaScript in the page. Preinjected __ob: forms/links/inputs/scripts/sinks/shadow/storage/surface.
Navigates a tab to a URL, or back/forward.
Headings, landmarks, forms and tables with refs and y-offsets; flat in page size.
Attack surface, all frames: forms, hidden inputs, links, params, scripts, iframes, storage, CSP, listeners.
Console messages. Always pass a regex pattern; unfiltered logs are noise.
One part of a request from read_network_requests.
Paginated request index; XHR/Fetch/Document/WebSocket/Other by default.
Accessibility tree with element refs. Use it, not a screenshot, to locate elements.
Resizes the tab's emulated viewport.
Downloads what the tab loaded to a tree on disk and returns counts and the manifest path; read the files with Read and Grep.
DevTools-style tree of everything the tab loaded, by origin with sizes. Pick an origin, then sources_download.
Closes one tab by tabId, or every tab of groupId.
Every tab group with windowId, groupId, name and tab IDs, plus any popup window a group's own pages opened. Only these tabs can be driven.
Opens a background tab in a new tab group, or in tabId's group. Start each task with your own group and keep its tab IDs; names are only labels.
No output schemas documented. Tools like read_page, read_network_requests, sources_list return complex nested structures (accessibility trees, request metadata, file manifests) but the response format is not specified. LLMs cannot plan downstream tool calls or extract required fields without knowing the output shape.
No error handling guidance. Schemas do not document what errors are possible, when they are retryable, or what the LLM should do next. E.g., navigate might fail if the URL is invalid, the tab is closed, or the network is down, but the tool definition provides no recovery hints.
Risk annotations (READ_ONLY, WRITE, DESTRUCTIVE) are present in metadata but not formalized as MCP tool annotations (readOnlyHint, destructiveHint, idempotentHint). Modern MCP clients use these hints to guide agent behavior and prevent accidental data loss. Should be added to tool definitions.