WebRun Browser Automation
REMOTE · API.WEBRUN.AI
Run multi-step tasks in a real Chrome browser: persistent environments, live view, human takeover.
Available components
Last scanned (19 hours ago)
Scores higher than 98% of remote servers
Reachable. Last reached 16 Oct 2026.
Category Browser Automation
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security97
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation is enforced on tool calls, advertised via RFC 9728 protected-resource metadata. Discovery is public, which costs nothing: no tool can be invoked without a token. View diagnostics → Pass
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- The HSTS (Strict-Transport-Security) header is present. View diagnostics → Pass
- DNSSEC is configured correctly; the domain's records validate against the full chain to the root. View diagnostics → Pass
- The authorisation server offers only Dynamic Client Registration (RFC 7591), which MCP 2026-07-28 deprecated in favour of Client ID Metadata Documents. View diagnostics → Partial
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability60
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 9034 tokens (~430/item across 21 items; 21 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
- Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 3 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 22 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities60
- Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28. See how to fix → Fail
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 28 Sept 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 25 Sept 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 24 Sept 26 0
- “create_workflow” reworded the description of “requiredFiles” cosmetic
- “update_workflow” reworded the description of “environmentId” cosmetic
- “update_workflow” reworded the description of “requiredFiles” cosmetic
3 cosmetic changes on this day. Switch on “Show cosmetic changes” to see them.
- 16 Sept 26 −1
No change was recorded against any check on this day. Endpoint Security went from 100 to 97.
- 15 Sept 26 +1
No change was recorded against any check on this day. Endpoint Security went from 97 to 100.
- 8 Sept 26 0
- Stability: 0.97 → pass security
- 7 Sept 26 0
- The server rewrote its instructions, which are the text every model session reads security
- “browser_task” reworded the description of “files” cosmetic
- “browser_task” reworded the description of “timezone” cosmetic
- “create_session” reworded the description of “timezone” cosmetic
- “create_workflow” reworded the description of “timezone” cosmetic
- “guardrail_response” reworded the description of “files” cosmetic
- “send_task” reworded the description of “files” cosmetic
- “update_workflow” reworded the description of “timezone” cosmetic
- 2 Sept 26 0
- The server rewrote its instructions, which are the text every model session reads security
- “create_agent” added an optional parameter “proxy” cosmetic
- “browser_task” reworded the description of “proxy” cosmetic
- “create_session” reworded the description of “proxy” cosmetic
- “create_workflow” reworded the description of “proxy” cosmetic
- “update_workflow” reworded the description of “proxy” cosmetic
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 16 Oct 2026 · Probed https://api.webrun.ai/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=webrun.ai | CN=WE1,O=Google Trust Services,C=US | 10 Oct 2026 | 8 Jan 2027 | ECDSA 256 | ECDSA-SHA256 | f0e21c45823211ed0eb8ac9e0d0a8595 |
| SANs: webrun.ai, *.webrun.ai | ||||||
| CN=WE1,O=Google Trust Services,C=US (CA) | CN=GTS Root R4,O=Google Trust Services LLC,C=US | 13 Dec 2023 | 20 Feb 2029 | ECDSA 256 | ECDSA-SHA384 | 7ff31977972c224a76155d13b6d685e3 |
| CN=GTS Root R4,O=Google Trust Services LLC,C=US (CA) | CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE | 15 Nov 2023 | 28 Jan 2028 | ECDSA 384 | SHA256-RSA | 7fe530bf331343bedd821610493d8a1b |
Background: What to check on a remote MCP endpoint →
DNSSEC secure
Validation of api.webrun.ai. — Secure
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| ai. | present | 3799 | 8 | Verified |
| webrun.ai. | present | 2371 | 13 | Verified |
| api.webrun.ai. | Verified address RRset verified with the apex keys |
Authentication Enforced and verified
The endpoint asked for a token and published valid RFC 9728 metadata describing how to get one.
| Result | Enforced and verified |
|---|---|
| Enforced | On tool calls |
| HTTP status | 200 |
WWW-Authenticate challenge Bearer resource_metadata="https://api.webrun.ai/.well-known/oauth-protected-resource/mcp", scope="task:create task:read task:terminate"
Bearer resource_metadata="https://api.webrun.ai/.well-known/oauth-protected-resource/mcp", scope="task:create task:read task:terminate" | Header | Value |
|---|---|
| strict-transport-security | max-age=31536000; includeSubDomains |
| content-security-policy | default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests |
| x-content-type-options | nosniff |
| x-frame-options | SAMEORIGIN |
| referrer-policy | no-referrer |
Protected resource metadata
| Document | https://api.webrun.ai/.well-known/oauth-protected-resource/mcp |
|---|---|
| Retrieved | Yes |
| Resource | https://api.webrun.ai/mcp |
| Authorisation server | https://app.webrun.ai |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://api.webrun.ai/mcp | Verified | 200 | |
| http (plaintext) | http://api.webrun.ai/mcp | HTTPS enforced | 301 | https://api.webrun.ai/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
browser_task Run browser task ~728
Execute a browser automation task in a real Chrome browser running in a WebRun cloud environment (docs.webrun.ai). Creates a session, runs the task, and auto-terminates. Best for simple one-off tasks that no saved workflow covers. May navigate, fill forms, and submit data on third-party websites as the task requires. Do NOT use this to run or test a saved workflow — use trigger_workflow instead: only a workflow run carries the workflow's own rules, tracking and memory, so a session run will behave differently. If the user says "run it", "run it once", "test it" or "try it" about a workflow, that means trigger_workflow, not this tool.
| Name | Type | Req | Description |
|---|---|---|---|
| debugC | boolean | – | Enable debug mode on the instance (default: false) |
| environmentId | string | – | Environment ID for persistent profile session. Use list_environments to find available IDs. Without this, a disposable instance is used. |
| files | array | – | Optional file IDs to attach: ids returned by POST /files/upload, or any file already in one of the user's environment catalogs (GET /environments/:id/files). Max 5 files. |
| maxDuration | number | – | Max duration in minutes (default: 20, max: 60) |
| model | string | – | Optional model name or profile key (from global config). Falls back to the configured default. |
| outputSchema | object | – | JSON Schema for structured output (required if outputType is structured_json) |
| outputType | string | – | Response format (default: text) |
| policyId | string | – | Policy ID to apply automation guardrails (domain restrictions, capability controls, LLM role). Optional. |
| prompt | string | yes | Task description in natural language |
| proxy | object | – | Proxy configuration. WebRun-managed: { source: "WebRun", country: "GB" }. Custom: { source: "custom", type: "http"|"socks", host, port, username?, password? }. Omit for no proxy. Social/messaging aut… |
| reach_out_mode | string | – | Controls proactive chat-platform messages (Telegram/WhatsApp/Slack/Discord/Teams) to bot users on the same environment. Default: "off" — no messages are sent unless this is set explicitly. "guardrail… |
| secrets | array | – | Domain-matched secrets [{match, fields}] passed to instance (not stored) |
| startingUrl | string | – | Optional starting URL |
| timezone | string | – | IANA timezone name for the session, e.g. "America/New_York", "Europe/London", "Asia/Tokyo". Date/time-sensitive instructions (e.g. "tomorrow morning", "today", "in 2 hours") are interpreted in this t… |
| webhook | object | – | Webhook configuration for task completion notification |
| Name | Type | Req | Description |
|---|---|---|---|
| data | object | – | Task output payload (instance-authored shape) |
| environment | object | – | – |
| error | string | – | – |
| liveViewURL | string | – | Page for watching the run live, present while it is still running or awaiting input. The only URL here that is safe to show a user or open in a browser. |
| message | string | – | – |
| pending | boolean | – | True when the task is still running — poll get_task_status |
| sessionId | string | – | – |
| status | string | – | Present on guardrail results: 'awaiting_input' |
| success | boolean | – | – |
| taskId | string|null | – | – |
| type | string | – | Result type, e.g. 'task_completed', 'task_failed', 'guardrail_trigger' |
No examples provided.
create_agent Create scheduled agent ~1,106
Create a scheduled agent — a recurring or one-time automation that runs on a timer in a real Chrome browser. Two modes. WORKFLOW MODE: pass workflowId plus a schedule — the platform copies everything else (prompt, starting URL, output contract, model, proxy, policy, files) from the workflow and bakes your variables into the prompt; results and memory stay centralised on the workflow. STANDALONE MODE: omit workflowId and provide name, prompt (a Goal / Ground rules / Stages / Output browsing runbook — see the prompt field description), and a schedule; the connection's environment is used automatically. Ask the user only what it should do and when it should run, in plain language — pick sensible defaults for everything else and state them; never ask about environments or technical settings. Results are delivered to your connected chat and appear in session history.
| Name | Type | Req | Description |
|---|---|---|---|
| environmentId | string | – | STANDALONE MODE, rarely needed — OMIT it: the connection-bound environment (or your only one) is applied automatically; never ask the user to choose. Workflow mode always uses the workflow's deployed… |
| expiresAt | string | – | ISO 8601 date-time after which the agent auto-pauses (recurring schedules). |
| memory | string | – | STANDALONE MODE: the agent's private notebook, shown to it every run and updated automatically after each run. Seed ONLY durable facts the next run must know (target descriptions, preferences, known… |
| name | string | – | Agent name. Required standalone; defaults to the workflow title in workflow mode. |
| outputSchema | object|array | – | STANDALONE MODE: JSON Schema object (structured) or column-name array (structured_csv). |
| outputType | string | – | STANDALONE MODE: output contract (same rules as create_workflow). |
| prompt | string | – | STANDALONE MODE (required there): The task the browser agent runs, written as a BROWSING RUNBOOK. Structure it as: `Goal:` — one sentence naming the outcome. `Ground rules (every stage, every turn):`… |
| proxy | object | – | STANDALONE MODE (workflow mode inherits the workflow proxy instead): Proxy for runs. {source:"WebRun", country?} or {source:"custom", type:"http"|"socks", host, port, username?, password?}. Custom pa… |
| schedule | object | yes | When the agent fires. Required. |
| startingUrl | string | – | STANDALONE MODE: page Chrome opens at the start of each run. |
| variables | object | – | WORKFLOW MODE, and only when the workflow's prompt actually contains {{variables}}: values for them, BAKED IN at deploy and reused every run (stored variableValues defaults fill gaps). Every template… |
| workflowId | string | – | WORKFLOW MODE: 24-hex id of the workflow to deploy (from list_workflows). The prompt, starting URL, output contract, model, proxy, policy, and files are all copied from it. |
| Name | Type | Req | Description |
|---|---|---|---|
| agentId | string | yes | – |
| mode | string | yes | – |
| name | string | yes | – |
| nextRunAt | string|null | – | ISO 8601 timestamp of the first fire |
| notes | array | – | – |
| schedule | string | – | Humanized schedule |
| success | boolean | yes | – |
| timezone | string | – | – |
| workflow | object | – | Present in workflow mode: the workflow this agent was deployed from |
No examples provided.
create_session Create browser session ~537
Create a persistent session in a real Chrome browser running in a WebRun cloud environment (docs.webrun.ai), for multi-step interactive work. Returns a sessionId for subsequent commands. With an initial task the browser may act on third-party websites immediately. Do NOT use this to run or test a saved workflow — use trigger_workflow instead: only a workflow run carries the workflow's own rules, tracking and memory, so a session run will behave differently.
| Name | Type | Req | Description |
|---|---|---|---|
| debugC | boolean | – | Enable debug mode on the instance (default: false) |
| environmentId | string | – | Environment ID for persistent profile session. Use list_environments to find available IDs. Without this, a disposable instance is used. |
| mode | string | – | Session mode (default: default) |
| model | string | – | Optional model name or profile key (from global config). Falls back to the configured default. |
| policyId | string | – | Policy ID to apply automation guardrails (domain restrictions, capability controls, LLM role). Optional. |
| proxy | object | – | Proxy configuration. WebRun-managed: { source: "WebRun", country: "GB" }. Custom: { source: "custom", type: "http"|"socks", host, port, username?, password? }. Omit for no proxy. Social/messaging aut… |
| reach_out_mode | string | – | Controls proactive chat-platform messages (Telegram/WhatsApp/Slack/Discord/Teams) to bot users on the same environment. Default: "off" — no messages are sent unless this is set explicitly. "guardrail… |
| task | object | – | Initial task configuration |
| timezone | string | – | IANA timezone name for the session, e.g. "America/New_York", "Europe/London", "Asia/Tokyo". Date/time-sensitive instructions (e.g. "tomorrow morning", "today", "in 2 hours") are interpreted in this t… |
| Name | Type | Req | Description |
|---|---|---|---|
| environment | object | – | Environment this session is bound to, when one was requested |
| message | string | – | – |
| sessionId | string | yes | Session ID for subsequent commands |
| streaming | object | – | Endpoints for watching the running browser. Only liveViewURL is a web page — the other two are machine endpoints on a non-standard port. |
| taskId | string|null | – | Task ID when an initial task was provided |
No examples provided.
create_workflow Create workflow ~1,980
Create a new saved workflow. READINESS BAR: if you could not execute the prompt yourself as a human in a browser — which site, which records, which fields, delivered where, matched to each recipient how — it is not ready; first collect the missing business facts from the user (see the TASK INTERVIEW in the server instructions), then create. Requires title and promptTemplate — write the prompt as a browsing runbook following the Goal / Ground rules / Stages / Output contract in the promptTemplate field description. For tasks that must handle each new item exactly once (new messages, forward once, skip seen), memoryContract is REQUIRED — three plain-English fields addressed to the agent: groundRules, memoryInstruction and itemIdentity (see the field descriptions); the platform wires the tracking itself — never write memory or tracking steps into the prompt. Created in the connection's environment automatically — omit environmentId and never ask the user to choose one. Write the user's concrete values (names, URLs, numbers) directly into the prompt; use {{variables}} ONLY when the user explicitly wants a reusable template with per-run inputs. Everything else is optional and defaults sensibly — do not quiz the user about settings. A supplied schedule is stored as a setting only — the workflow does not run on a timer until deployed via create_agent. To run or TEST the workflow, use trigger_workflow ONLY — never browser_task or create_session.
| Name | Type | Req | Description |
|---|---|---|---|
| compatibleTools | array | – | Sites/tools the workflow uses: [{ name, loginUrl, domain, role }]. |
| conciergeNotify | string | – | Where the concierge announces results (e.g. 'Telegram', 'Slack', 'WhatsApp', 'Microsoft Teams', 'concierge'). |
| department | string | – | Free-text department label (e.g. "inventory"). |
| deployedPolicyId | string | – | Policy id to run under (must be owned by you). |
| destination | object | – | Result destination chip: { type, sub, description }. Types seen: 'custom-api', 'slack', 'sheets', 'email', 'messaging', 'telegram', 'crm'. |
| environmentId | string | – | Rarely needed — OMIT it: the connection's bound environment (or your only environment) is applied automatically. Pass only when the user explicitly names a different environment. Never ask the user t… |
| fileDeferred | boolean | – | Dashboard flag: file selection deferred to run time. |
| flow | object | – | Dashboard flow diagram: { trigger: {kind, phrase}, steps: [{ primary: {label, domain}, verb }] }. |
| listType | string | – | Advanced — defaults automatically ('monitor' when memoryContract is supplied); leave unset. |
| memory | string | – | The agent's private notebook: shown to it at the start of every run, updated automatically after each run. Seed it ONLY with durable facts the next run must already know — the exact description of a… |
| memoryContract | object | – | How this workflow should behave and what it must remember between runs. REQUIRED whenever the task handles each thing once — new messages, forward once, skip anything already done. Write all three fi… |
| memoryEnabled | boolean | – | Persist per-workflow agent memory across runs (default true). |
| model | string | – | Model profile key. Omit for the account default. |
| orchestrateFirst | boolean | – | Discovery mode: one run gathers the WHOLE work list up front, later runs claim one item each. |
| outputSchema | object|array | – | JSON Schema object (outputType "structured") or array of column-name strings (outputType "structured_csv"). |
| outputType | string | – | Output contract: 'text' (default), 'structured' (JSON matching outputSchema), 'structured_csv' (rows for the outputSchema column names). |
| policyOptedOut | boolean | – | Opt this workflow out of the environment's default policy. |
| promptTemplate | string | yes | The task the browser agent runs, written as a BROWSING RUNBOOK. Structure it as: `Goal:` — one sentence naming the outcome. `Ground rules (every stage, every turn):` — bullet invariants when the task… |
| proxy | object | – | Proxy for runs. {source:"WebRun", country?} or {source:"custom", type:"http"|"socks", host, port, username?, password?}. Custom passwords are encrypted at rest and never returned. Social/messaging wo… |
| publicDraftId | string | – | Dashboard public-draft correlation id. |
| reachOutMode | string|null | – | Proactive-chat policy for runs: 'off', 'guardrail_only', or 'full'. Omit (or pass null) to inherit the account default (MCP-initiated runs treat inherit as 'off'). |
| refineMessages | array | – | Dashboard builder refinement thread rows: [{ role, content }]. |
| requiredFiles | array | – | Files attached to every run (downloaded before the agent starts). Each fileId must already be in the workflow's own environment (GET /environments/:id/files) — a workflow only uses files from its own… |
| roiHourlyRate | number|null | – | Hourly rate for the ROI card. |
| roiMinutesPerTask | number|null | – | Minutes saved per run (dashboard ROI card). |
| schedule | object | – | Saved schedule setting. NOTE: record-only — the workflow does NOT run on a timer until deployed as a scheduled agent (dashboard or Telegram bot). |
| shortDescription | string | – | One-line summary shown in workflow lists. |
| skills | array | – | Workflow-scoped skill entries (dashboard shape). |
| startingUrl | string | – | Page Chrome opens at the start of each run. Omit to let the prompt decide. |
| templateVariables | array | – | ONLY for explicitly dynamic workflows (the user asked for a reusable template): metadata for the {{variables}} used in promptTemplate (drives the dashboard fill-in UI). Omit entirely when the prompt… |
| timezone | string | – | IANA timezone for runs of this workflow (e.g. "America/New_York"). Leave unset to follow the proxy country. |
| title | string | yes | Workflow title (shown on the dashboard). |
| trigger | object | – | How the workflow is meant to be invoked (informational — see notes). Defaults to {type:'manual', source:'manual'}. |
| triggerPhrase | string | – | Natural-language phrase that invokes this workflow in chat. |
| useCaseTags | array | – | Categorisation tags. |
| variableValues | object | – | ONLY for explicitly dynamic workflows: default values for {{variables}}, keyed by variable name. NOTE: applied only when triggering via MCP trigger_workflow (merged under caller-supplied variables);… |
| wizardPreset | object | – | Dashboard wizard preset: { technology, useCases[], destination, destinationSub }. |
| workListEnabled | boolean | – | Advanced — set automatically when memoryContract is supplied; leave unset. |
| Name | Type | Req | Description |
|---|---|---|---|
| environment | object | – | – |
| memoryContract | object | – | Echo of the stored tracking contract (the three authored fields) — absent when the workflow has none |
| nextStep | string | – | How to run or test this workflow (always trigger_workflow) |
| notes | array | – | Caveats the caller should relay (e.g. the schedule is record-only) |
| slug | string | yes | – |
| success | boolean | yes | – |
| title | string | yes | – |
| workflowId | string | yes | – |
No examples provided.
get_task_status Get task status ~65
Check the status of a task previously started in a browser session. Use to poll for completion or detect guardrails. Read-only: reports on the task without affecting it.
| Name | Type | Req | Description |
|---|---|---|---|
| sessionId | string | yes | Session ID |
| taskId | string | yes | Task ID to check |
| Name | Type | Req | Description |
|---|---|---|---|
| data | object | – | Task output payload when completed (instance-authored shape) |
| liveViewURL | string | – | Page for watching the run live, present while it is still running or awaiting input. The only URL here that is safe to show a user or open in a browser. |
| message | string | – | – |
| sessionId | string | – | – |
| status | string | yes | Task/session state: 'completed', 'failed', 'awaiting_input', 'pending', 'active', 'paused', 'orphaned', or 'not_found' |
| taskId | string | – | – |
| type | string | – | Raw result type when the task finished |
No examples provided.
get_workflow Get workflow details ~114
Full detail of one workflow: prompt template, {{variables}} and their defaults, trigger + schedule, run settings (starting URL, timezone, model, proxy, output contract, files), memory state, and any pending logins. Identify by workflowId or exact title. Read-only; proxy credentials are masked.
| Name | Type | Req | Description |
|---|---|---|---|
| title | string | – | Exact workflow title (case-insensitive) — alternative to workflowId |
| workflowId | string | – | 24-hex workflow id (from list_workflows or create_workflow) |
| Name | Type | Req | Description |
|---|---|---|---|
| environmentId | string|null | – | – |
| notes | array | – | – |
| outputType | string | – | – |
| promptTemplate | string | yes | – |
| schedule | object|null | – | – |
| scheduleDescription | string|null | – | – |
| slug | string | yes | – |
| title | string | yes | – |
| totalTriggers | number | – | – |
| trigger | object|null | – | – |
| variables | array | – | – |
| workflowId | string | yes | – |
No examples provided.
guardrail_response Answer guardrail prompt ~158
Respond to a guardrail trigger when the browser agent needs human input (credentials, clarification, approval). The response is handed to the live agent, which continues acting on it.
| Name | Type | Req | Description |
|---|---|---|---|
| files | array | – | Optional file IDs to attach: ids returned by POST /files/upload, or any file already in one of the user's environment catalogs (GET /environments/:id/files). Max 5 files. |
| newState | string | – | How to continue: 'resume' (default) provides the requested input and continues the task; 'deny' declines the request (response text optional). |
| response | string | – | Your response/instructions to the agent. Required when newState is 'resume'. |
| sessionId | string | yes | Session ID |
| Name | Type | Req | Description |
|---|---|---|---|
| message | string | – | What happened and what to do next (poll get_task_status) |
| sessionId | string | – | – |
| success | boolean | yes | – |
| taskId | string|null | – | – |
No examples provided.
list_agents List scheduled agents ~92
List the account's scheduled agents (cron deployments): schedule, status, next/last run, and whether each is standalone or deployed from a workflow. Scoped to the bound environment when this connection has one; pass scope "all" for every environment. Read-only.
| Name | Type | Req | Description |
|---|---|---|---|
| scope | string | – | 'environment' (default when bound) lists agents in the bound environment; 'all' lists every agent on the account. |
| Name | Type | Req | Description |
|---|---|---|---|
| agents | array | yes | – |
| count | number | yes | – |
| scope | string | yes | – |
No examples provided.
list_environments List environments ~69
List available browser environments (persistent profiles) for this account. Returns environment IDs needed for persistent sessions in browser_task or create_session. Read-only. NOTE: workflows and agents use the connection's environment automatically — you rarely need this tool for those, and should not ask the user to choose an environment.
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| boundEnvironment | object | – | – |
| count | number | yes | – |
| environments | array | yes | – |
| hint | string | – | – |
No examples provided.
list_sessions List sessions ~20
List all active browser sessions for this account. Read-only.
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| count | number | yes | – |
| sessions | array | yes | – |
No examples provided.
list_workflows List workflows ~104
List the user's saved workflows (prompt-templated browser automations, docs.webrun.ai). Shows each workflow's title, schedule, {{variables}}, and run stats. Scoped to the bound environment when this connection has one; pass scope "all" for every environment. Read-only.
| Name | Type | Req | Description |
|---|---|---|---|
| scope | string | – | 'environment' (default when this connection is bound to one) lists workflows deployed to the bound environment; 'all' lists every workflow on the account. |
| Name | Type | Req | Description |
|---|---|---|---|
| count | number | yes | – |
| scope | string | yes | – |
| workflows | array | yes | – |
No examples provided.
pause_agent Pause scheduled agent ~48
Pause an active scheduled agent — it stops firing until resumed. Get agentId from list_agents.
| Name | Type | Req | Description |
|---|---|---|---|
| agentId | string | yes | 24-hex agent id (from list_agents or create_agent) |
| Name | Type | Req | Description |
|---|---|---|---|
| agentId | string | yes | – |
| message | string | – | – |
| name | string | – | – |
| status | string | yes | – |
| success | boolean | yes | – |
No examples provided.
pause_session_task Pause session task ~37
Pause the task currently running in a browser session. Resume it later with resume_session_task.
| Name | Type | Req | Description |
|---|---|---|---|
| sessionId | string | yes | Session ID |
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | The control action that was applied |
| message | string | yes | – |
| sessionId | string | yes | – |
| success | boolean | yes | – |
No examples provided.
resume_agent Resume scheduled agent ~74
Resume a paused scheduled agent — recomputes its next run and reactivates it. A completed work-list agent restarts with a fresh full pass. Refuses if the agent's expiry has passed (extend it on the dashboard first).
| Name | Type | Req | Description |
|---|---|---|---|
| agentId | string | yes | 24-hex agent id (from list_agents) |
| Name | Type | Req | Description |
|---|---|---|---|
| agentId | string | yes | – |
| message | string | – | – |
| name | string | – | – |
| nextRunAt | string|null | – | – |
| status | string | yes | – |
| success | boolean | yes | – |
No examples provided.
resume_session_task Resume session task ~29
Resume a previously paused task in a browser session.
| Name | Type | Req | Description |
|---|---|---|---|
| sessionId | string | yes | Session ID |
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | The control action that was applied |
| message | string | yes | – |
| sessionId | string | yes | – |
| success | boolean | yes | – |
No examples provided.
screenshot Take screenshot ~41
Capture a screenshot of the current browser page in an active session. Returns the screenshot as an inline image. Read-only.
| Name | Type | Req | Description |
|---|---|---|---|
| sessionId | string | yes | Session ID |
| Name | Type | Req | Description |
|---|---|---|---|
| error | string | – | – |
| message | string | – | – |
| sessionId | string | – | – |
| success | boolean | – | – |
No examples provided.
send_task Send task to session ~298
Send a new task to an existing browser session (from create_session). The real Chrome browser may navigate, fill forms, and submit data on third-party websites as the task requires.
| Name | Type | Req | Description |
|---|---|---|---|
| files | array | – | Optional file IDs to attach: ids returned by POST /files/upload, or any file already in one of the user's environment catalogs (GET /environments/:id/files). Max 5 files. |
| maxDuration | number | – | Max duration for this task in minutes (3-60). Defaults to the value the session was created with. |
| maxInputTokens | number | – | Max input tokens for this task (100-3000000). Defaults to the value the session was created with. |
| maxOutputTokens | number | – | Max output tokens for this task (100-1000000). Defaults to the value the session was created with. |
| outputSchema | object | – | JSON Schema for structured output (required if outputType is structured_json) |
| outputType | string | – | Response format |
| prompt | string | yes | Task description |
| secrets | array | – | Domain-matched secrets [{match, fields}] (not stored) |
| sessionId | string | yes | Session ID from create_session |
| startingUrl | string | – | URL to navigate to before starting this task (optional) |
| terminateOnCompletion | boolean | – | Auto-terminate after task (default: false) |
| webhook | object | – | Webhook configuration |
| Name | Type | Req | Description |
|---|---|---|---|
| data | object | – | Task output payload (instance-authored shape) |
| environment | object | – | – |
| error | string | – | – |
| liveViewURL | string | – | Page for watching the run live, present while it is still running or awaiting input. The only URL here that is safe to show a user or open in a browser. |
| message | string | – | – |
| pending | boolean | – | True when the task is still running — poll get_task_status |
| sessionId | string | – | – |
| status | string | – | Present on guardrail results: 'awaiting_input' |
| success | boolean | – | – |
| taskId | string|null | – | – |
| type | string | – | Result type, e.g. 'task_completed', 'task_failed', 'guardrail_trigger' |
No examples provided.
stop_session_task Stop session task ~37
Cancel the task currently running in a browser session, keeping the session alive for new tasks.
| Name | Type | Req | Description |
|---|---|---|---|
| sessionId | string | yes | Session ID |
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | The control action that was applied |
| message | string | yes | – |
| sessionId | string | yes | – |
| success | boolean | yes | – |
No examples provided.
terminate_session Terminate session ~38
End a browser session and free its resources. The session and any running task cannot be resumed afterwards.
| Name | Type | Req | Description |
|---|---|---|---|
| sessionId | string | yes | Session ID |
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | The control action that was applied |
| message | string | yes | – |
| sessionId | string | yes | – |
| success | boolean | yes | – |
No examples provided.
trigger_workflow Trigger workflow ~241
Run a workflow now in its deployed environment. This is the ONLY correct way to run or TEST a saved workflow — a run started here carries the workflow's rules, tracking and memory; browser_task/create_session runs do not. When the user says "run it", "run it once", "test it" or "try it" about a workflow, this is the tool they mean. Drives a real Chrome browser: the run may navigate, fill forms, and submit data on third-party websites as the workflow's prompt requires. Pass values for the workflow's {{variables}} in `variables` (stored variableValues defaults fill any gaps). Returns a sessionId — poll get_task_status for the result.
| Name | Type | Req | Description |
|---|---|---|---|
| force | boolean | – | Work-list workflows only: when the list reports complete, re-open it for a fresh full pass. |
| title | string | – | Exact workflow title (case-insensitive) — alternative to workflowId |
| variables | object | – | Values for the workflow's {{variables}}, keyed by exact variable name. Merged over the workflow's stored variableValues defaults. |
| workflowId | string | – | 24-hex workflow id |
| Name | Type | Req | Description |
|---|---|---|---|
| listComplete | boolean | – | Work-list workflows: every item has been visited (no run started) |
| liveViewURL | string | – | Page for watching the run live, present when a run started. The only URL here that is safe to show a user or open in a browser. |
| message | string | – | – |
| sessionId | string | – | Poll get_task_status with this id |
| success | boolean | yes | – |
| taskId | string|null | – | – |
| workflowId | string | yes | – |
No examples provided.
update_workflow Update workflow ~1,871
Update an existing workflow. Supply workflowId plus only the fields to change: prompt, trigger, schedule, run settings, variables, presentation. Object and array fields are replaced whole; pass null to clear an optional field. Renaming via title keeps the slug stable. The stored schedule stays a saved setting — scheduled agents already deployed from this workflow keep their own timing. promptTemplate follows the same Goal / Ground rules / Stages / Output runbook contract as create_workflow (see that field's description). memoryContract is the exception to whole-replace: supplying its three fields updates them while platform tracking details are preserved.
| Name | Type | Req | Description |
|---|---|---|---|
| compatibleTools | array | – | Sites/tools the workflow uses: [{ name, loginUrl, domain, role }]. |
| conciergeNotify | string | – | Where the concierge announces results (e.g. 'Telegram', 'Slack', 'WhatsApp', 'Microsoft Teams', 'concierge'). |
| department | string | – | Free-text department label (e.g. "inventory"). |
| deployedPolicyId | string | – | Policy id to run under (must be owned by you). |
| destination | object | – | Result destination chip: { type, sub, description }. Types seen: 'custom-api', 'slack', 'sheets', 'email', 'messaging', 'telegram', 'crm'. |
| environmentId | string | – | Move the workflow to a different environment you own. Refused while that would leave attached files or scheduled agents behind: pass requiredFiles (files in the new environment, or []) in the same up… |
| fileDeferred | boolean | – | Dashboard flag: file selection deferred to run time. |
| flow | object | – | Dashboard flow diagram: { trigger: {kind, phrase}, steps: [{ primary: {label, domain}, verb }] }. |
| listType | string | – | Advanced — defaults automatically ('monitor' when memoryContract is supplied); leave unset. |
| memory | string | – | The agent's private notebook: shown to it at the start of every run, updated automatically after each run. Seed it ONLY with durable facts the next run must already know — the exact description of a… |
| memoryContract | object | – | How this workflow should behave and what it must remember between runs. REQUIRED whenever the task handles each thing once — new messages, forward once, skip anything already done. Write all three fi… |
| memoryEnabled | boolean | – | Persist per-workflow agent memory across runs (default true). |
| model | string | – | Model profile key. Omit for the account default. |
| orchestrateFirst | boolean | – | Discovery mode: one run gathers the WHOLE work list up front, later runs claim one item each. |
| outputSchema | object|array | – | JSON Schema object (outputType "structured") or array of column-name strings (outputType "structured_csv"). |
| outputType | string | – | Output contract: 'text' (default), 'structured' (JSON matching outputSchema), 'structured_csv' (rows for the outputSchema column names). |
| policyOptedOut | boolean | – | Opt this workflow out of the environment's default policy. |
| promptTemplate | string | – | The task the browser agent runs, written as a BROWSING RUNBOOK. Structure it as: `Goal:` — one sentence naming the outcome. `Ground rules (every stage, every turn):` — bullet invariants when the task… |
| proxy | object | – | Proxy for runs. {source:"WebRun", country?} or {source:"custom", type:"http"|"socks", host, port, username?, password?}. Custom passwords are encrypted at rest and never returned. Social/messaging wo… |
| publicDraftId | string | – | Dashboard public-draft correlation id. |
| reachOutMode | string|null | – | Proactive-chat policy for runs: 'off', 'guardrail_only', or 'full'. Omit (or pass null) to inherit the account default (MCP-initiated runs treat inherit as 'off'). |
| refineMessages | array | – | Dashboard builder refinement thread rows: [{ role, content }]. |
| requiredFiles | array | – | Files attached to every run (downloaded before the agent starts). Each fileId must already be in the workflow's own environment (GET /environments/:id/files) — a workflow only uses files from its own… |
| roiHourlyRate | number|null | – | Hourly rate for the ROI card. |
| roiMinutesPerTask | number|null | – | Minutes saved per run (dashboard ROI card). |
| schedule | object | – | Saved schedule setting. NOTE: record-only — the workflow does NOT run on a timer until deployed as a scheduled agent (dashboard or Telegram bot). |
| shortDescription | string | – | One-line summary shown in workflow lists. |
| skills | array | – | Workflow-scoped skill entries (dashboard shape). |
| startingUrl | string | – | Page Chrome opens at the start of each run. Omit to let the prompt decide. |
| templateVariables | array | – | ONLY for explicitly dynamic workflows (the user asked for a reusable template): metadata for the {{variables}} used in promptTemplate (drives the dashboard fill-in UI). Omit entirely when the prompt… |
| timezone | string | – | IANA timezone for runs of this workflow (e.g. "America/New_York"). Leave unset to follow the proxy country. |
| title | string | – | Workflow title (shown on the dashboard). |
| trigger | object | – | How the workflow is meant to be invoked (informational — see notes). Defaults to {type:'manual', source:'manual'}. |
| triggerPhrase | string | – | Natural-language phrase that invokes this workflow in chat. |
| useCaseTags | array | – | Categorisation tags. |
| variableValues | object | – | ONLY for explicitly dynamic workflows: default values for {{variables}}, keyed by variable name. NOTE: applied only when triggering via MCP trigger_workflow (merged under caller-supplied variables);… |
| wizardPreset | object | – | Dashboard wizard preset: { technology, useCases[], destination, destinationSub }. |
| workListEnabled | boolean | – | Advanced — set automatically when memoryContract is supplied; leave unset. |
| workflowId | string | yes | 24-hex id of the workflow to update (from list_workflows or create_workflow). Required — the title property here is the NEW title for renames, never an identifier. |
| Name | Type | Req | Description |
|---|---|---|---|
| changes | array | yes | Human-readable field: old → new summaries of what was applied (empty when everything supplied matched the current values) |
| notes | array | – | Caveats to relay (record-only schedule, linked scheduled agents, prompt-structure advice) |
| slug | string | – | – |
| success | boolean | yes | – |
| title | string | – | – |
| workflowId | string | yes | – |
No examples provided.
How do I install the WebRun Browser Automation MCP server?
WebRun Browser Automation is a hosted endpoint at https://api.webrun.ai/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · api.webrun.ai
claude mcp add --transport http ai-webrun-webrun 'https://api.webrun.ai/mcp'
What is the WebRun Browser Automation MCP server?
WebRun Browser Automation is an MCP server listed in the public MCP registry as ai.webrun/webrun. Run multi-step tasks in a real Chrome browser: persistent environments, live view, human takeover. This page covers its hosted endpoint (https://api.webrun.ai/mcp).
Is the WebRun Browser Automation MCP server safe to use?
WebRun Browser Automation scores 90 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the WebRun Browser Automation MCP server expose?
WebRun Browser Automation exposes 21 tools: browser_task, create_session, send_task, pause_session_task, resume_session_task, and 16 more. Their descriptions and schemas cost roughly 7,687 tokens of context every time the server is loaded.
Does the WebRun Browser Automation MCP server require authentication?
Yes. WebRun Browser Automation asked us for credentials when we connected, so you will need to authorise it in your MCP client before it can do anything.
Is the WebRun Browser Automation MCP server still maintained?
WebRun Browser Automation is still listed as active in the MCP registry. We last reached this channel on 16 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.