# io.github.Custodia-Admin/pagebolt (npm · pagebolt-mcp)

Screenshots, PDFs, OG images, page inspection, and narrated video recording for Claude and Cursor.

- Trust score: 69/100 (medium)
- Change this week: +19
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `pagebolt-mcp`: 69/100 (this document), [markdown](https://verifymcp.io/servers/custodia-admin-pagebolt/pagebolt-mcp.md), [page](https://verifymcp.io/servers/custodia-admin-pagebolt/pagebolt-mcp)

## Channel facts

- Registry: `npm`
- Package: `pagebolt-mcp`
- Version: `1.8.1`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 87/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 62 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 72/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 4554 tokens (~379/item across 12 items; 11 tools + 1 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add custodia-admin-pagebolt -- npx -y pagebolt-mcp
```

### Codex

```bash
codex mcp add custodia-admin-pagebolt -- npx -y pagebolt-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "custodia-admin-pagebolt": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "pagebolt-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add custodia-admin-pagebolt --command npx --arg -y --arg pagebolt-mcp
```

### Hermes

```yaml
mcp_servers:
  custodia-admin-pagebolt:
    command: "npx"
    args: ["-y", "pagebolt-mcp"]
```

### Other

```json
{
  "mcpServers": {
    "custodia-admin-pagebolt": {
      "command": "npx",
      "args": [
        "-y",
        "pagebolt-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 69, +1)

No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-08-02 (score 68, +39)

- [security regression] Provenance: unverified → fail
- [security improvement] Install scripts: unverified → pass
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Malware scan: unverified → pass
- [security] Stability: Stability not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet.
- [functional regression] Capabilities: pass → unverified
- [functional improvement] Schema quality: unverified → excellent
- [functional improvement] License: unverified → pass
- [functional improvement] Stability: unverified → 0.23
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Maintenance: unverified → pass
- [functional] Licence: MIT

### 2026-07-31 (score 29, −3)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 32, −18)

- [security regression] Malware scan: pass → unverified

### 2026-07-27 (score 50)

First indexed and scored.

## MCP tools (11)

### `take_screenshot` (~963 tokens)

Capture a screenshot of a URL, HTML, or Markdown content. Supports device emulation, ad/chat/tracker blocking, metadata extraction, geolocation, timezone, styling (macOS/Windows frames, gradient/glass backgrounds, shadows), and more. Returns an image (PNG, JPEG, or WebP).

Input parameters:

- `authorization` (string): Authorization header value (e.g. "Bearer <token>")
- `blockAds` (boolean): Block advertisements on the page
- `blockBanners` (boolean): Hide cookie consent banners (default: false)
- `blockChats` (boolean): Block live chat widgets on the page
- `blockRequests` (array): URL patterns to block (array of strings)
- `blockResources` (array): Resource types to block (e.g. ["image", "font"])
- `blockTrackers` (boolean): Block tracking scripts on the page
- `bypassCSP` (boolean): Bypass Content-Security-Policy on the page
- `click` (string): CSS selector to click before capturing the screenshot
- `clip` (object): Crop region { x, y, width, height } in pixels
- `cookies` (array): Cookies to set — array of "name=value" strings or { name, value, domain? } objects
- `darkMode` (boolean): Emulate dark color scheme (default: false)
- `delay` (integer): Milliseconds to wait before capture (default: 0)
- `deviceScaleFactor` (number): Device pixel ratio, use 2 for retina (default: 1)
- `extractMetadata` (boolean): Extract page metadata (title, description, OG tags) alongside the screenshot
- `format` (string): Image format (default: png)
- `fullPage` (boolean): Capture the full scrollable page (default: false)
- `fullPageMaxHeight` (integer): Maximum pixel height cap for full-page captures
- `fullPageScroll` (boolean): Auto-scroll page before capture to trigger lazy-loaded images
- `fullPageScrollBy` (integer): Pixels to scroll per step (default: viewport height)
- `fullPageScrollDelay` (integer): Delay between scroll steps in ms (default: 400)
- `geolocation` (object): Emulate geolocation { latitude, longitude, accuracy? }
- `headers` (object): Extra HTTP headers to send with the request
- `height` (integer): Viewport height in pixels (default: 720)
- `hideSelectors` (array): Array of CSS selectors to hide before capture
- `html` (string): Raw HTML to render (required if no url/markdown)
- `injectCss` (string): Custom CSS to inject before capturing (max 50KB)
- `injectJs` (string): Custom JavaScript to execute before capturing (max 50KB)
- `markdown` (string): Render Markdown content as a screenshot
- `mediaType` (string): Emulate CSS media type
- `navigationTimeout` (integer): Navigation timeout in ms (default: 25000)
- `omitBackground` (boolean): Transparent background (PNG/WebP only)
- `quality` (integer): JPEG/WebP quality 1-100 (default: 80)
- `reducedMotion` (boolean): Emulate prefers-reduced-motion to disable animations
- `selector` (string): CSS selector to capture a specific element
- `session_id` (string): Persistent session ID (Starter+ only). Reuse a live browser page created with create_session — browser state (cookies, localStorage, auth) carries over from previous requests in this session.
- `style` (object): Screenshot styling options — add a macOS/Windows frame, gradient/glass background, shadow, and rounded corners. Use the "theme" shortcut for one-click presets, or customize individual properties.
- `timeZone` (string): Override browser timezone (e.g. "America/New_York")
- `url` (string): URL to capture (required if no html/markdown)
- `userAgent` (string): Override the browser User-Agent string
- `viewportDevice` (string): Device preset for viewport emulation (e.g. "iphone_14_pro", "macbook_pro_14"). Use list_devices to see all presets.
- `viewportHasTouch` (boolean): Enable touch event emulation
- `viewportLandscape` (boolean): Landscape orientation
- `viewportMobile` (boolean): Enable mobile meta viewport emulation
- `waitForSelector` (string): Wait for this CSS selector to appear before capturing
- `waitUntil` (string): When to consider navigation finished (default: networkidle2)
- `width` (integer): Viewport width in pixels (default: 1280)

### `generate_pdf` (~316 tokens)

Generate a PDF from a URL or HTML content. Supports custom margins, headers/footers, page ranges, and scaling. Saves the PDF to disk and returns the file path.

Input parameters:

- `delay` (integer): Milliseconds to wait before rendering (default: 0)
- `displayHeaderFooter` (boolean): Show header and footer (default: false)
- `footerTemplate` (string): HTML template for page footer
- `format` (string): Paper format: A4, Letter, Legal, Tabloid, A3, A5 (default: A4)
- `headerTemplate` (string): HTML template for page header (uses Chromium templating)
- `html` (string): Raw HTML to render as PDF (required if no url)
- `landscape` (boolean): Landscape orientation (default: false)
- `margin`: CSS margin — string for all sides (e.g. "1cm") or object { top, right, bottom, left }
- `pageRanges` (string): Page ranges to include, e.g. "1-5, 8"
- `printBackground` (boolean): Include CSS backgrounds (default: true)
- `saveTo` (string): Output file path (default: ./output.pdf)
- `scale` (number): Rendering scale 0.1-2 (default: 1)
- `url` (string): URL to render as PDF (required if no html)
- `width` (string): Page width (overrides format) — CSS value like "8.5in"

### `create_og_image` (~221 tokens)

Generate an Open Graph / social card image. Returns an image using built-in templates or custom HTML.

Input parameters:

- `accentColor` (string): Accent color as hex, e.g. "#6366f1"
- `bgColor` (string): Background color as hex, e.g. "#0f172a"
- `bgImage` (string): Background image URL
- `format` (string): Image format (default: png)
- `height` (integer): Image height in pixels (default: 630)
- `html` (string): Custom HTML template (overrides template parameter, Growth plan+)
- `logo` (string): Logo image URL
- `subtitle` (string): Subtitle text
- `template` (string): Built-in template name (default: "default")
- `textColor` (string): Text color as hex, e.g. "#f8fafc"
- `title` (string): Main title text (default: "Your Title Here")
- `width` (integer): Image width in pixels (default: 1200)

### `run_sequence` (~228 tokens)

Execute a multi-step browser automation sequence. Navigate pages, interact with elements (click, fill, select), and capture multiple screenshots/PDFs in a single browser session. Each output counts as 1 API request.

Input parameters:

- `blockAds` (boolean): Block advertisements on the page
- `blockBanners` (boolean): Hide cookie consent banners (default: false)
- `blockChats` (boolean): Block live chat widgets
- `blockTrackers` (boolean): Block tracking scripts
- `darkMode` (boolean): Emulate dark color scheme (default: false)
- `deviceScaleFactor` (number): Device pixel ratio (default: 1)
- `session_id` (string): Persistent session ID (Starter+ only). Reuse a live browser page created with create_session — browser state (cookies, localStorage, auth) carries over from previous requests in this session.
- `steps` (array, required): Array of steps to execute in order. Must include at least one screenshot or pdf step. Max 20 steps, max 5 outputs.
- `viewport` (object): Browser viewport size

### `record_video` (~619 tokens)

Record a professional demo video of a multi-step browser automation sequence. Produces MP4/WebM/GIF with cursor highlighting, click effects, smooth movement, step notes, browser frame (macOS/Windows), gradient/glass backgrounds, and more. Costs 3 API requests. Saves to disk. BEST PRACTICE: Keep videos concise (5-15 action steps). Do NOT add wait steps between every action — the pace parameter handles timing. Only use wait for page loads or narration holds. Do NOT use zoom unless the user explicitly asks for it.

Input parameters:

- `audioGuide` (object): Audio Guide TTS settings. Two modes: (1) Per-step — add "narration" to individual steps. (2) Script — provide "script" with {{N}} markers for continuous narration synchronized to steps.
- `autoZoom` (boolean): Enable auto-zoom on all clicks (default: false). Only use when user explicitly requests zoom.
- `background` (object): Styled background behind the video. Adds gradient/solid background with padding and rounded corners — creates a "floating window" effect.
- `blockAds` (boolean): Block advertisements on the page
- `blockBanners` (boolean): Hide cookie consent banners (default: true for videos)
- `blockChats` (boolean): Block live chat widgets
- `blockTrackers` (boolean): Block tracking scripts
- `clickEffect` (object): Visual click effect settings
- `cursor` (object): Cursor appearance settings
- `darkMode` (boolean): Emulate dark color scheme (default: false)
- `deviceScaleFactor` (number): Device pixel ratio (default: 1)
- `format` (string): Video format (default: mp4). webm/gif require Starter+ plan.
- `frame` (object): Browser chrome frame around the video. Adds a macOS/Windows-style title bar.
- `framerate` (integer): Frames per second: 24, 30, or 60 (default: 30)
- `pace`: Controls how deliberate the video feels. Number (0.25–6.0, higher = slower) or preset: "fast" (0.5×), "normal" (1×), "slow" (2×), "dramatic" (3×), "cinematic" (4.5×). Default: "normal".
- `saveTo` (string): Output file path (default: ./recording.mp4)
- `steps` (array, required): Array of action steps to record. Keep concise: 5-15 steps is ideal. Do NOT pad with wait steps — pace handles timing.
- `variables` (object): Key-value map for variable substitution in step URLs/values. E.g. { "base_url": "https://example.com" } replaces {{base_url}} in steps.
- `viewport` (object): Browser viewport size
- `zoom` (object): Global zoom settings. Only use when the user explicitly requests zoom. Do NOT enable by default.

### `inspect_page` (~570 tokens)

Inspect a web page and get a structured map of all interactive elements, headings, forms, links, and images — each with a unique CSS selector. Use this BEFORE run_sequence or record_video to discover what elements exist on the page and get reliable selectors. Returns text (not an image), so it is fast and cheap. Costs 1 API request.

Input parameters:

- `authorization` (string): Authorization header value (e.g. "Bearer <token>")
- `blockAds` (boolean): Block advertisements on the page
- `blockBanners` (boolean): Hide cookie consent banners (default: false)
- `blockChats` (boolean): Block live chat widgets
- `blockRequests` (array): URL patterns to block
- `blockResources` (array): Resource types to block
- `blockTrackers` (boolean): Block tracking scripts
- `bypassCSP` (boolean): Bypass Content-Security-Policy on the page
- `cookies` (array): Cookies to set — array of "name=value" strings or { name, value, domain? } objects
- `darkMode` (boolean): Emulate dark color scheme (default: false)
- `deviceScaleFactor` (number): Device pixel ratio (default: 1)
- `geolocation` (object): Emulate geolocation
- `headers` (object): Extra HTTP headers to send with the request
- `height` (integer): Viewport height in pixels (default: 720)
- `hideSelectors` (array): Array of CSS selectors to hide before inspecting
- `html` (string): Raw HTML to inspect (required if no url)
- `injectCss` (string): Custom CSS to inject before inspecting
- `injectJs` (string): Custom JavaScript to execute before inspecting
- `mediaType` (string): Emulate CSS media type
- `navigationTimeout` (integer): Navigation timeout in ms (default: 25000)
- `reducedMotion` (boolean): Emulate prefers-reduced-motion
- `timeZone` (string): Override browser timezone
- `url` (string): URL to inspect (required if no html)
- `userAgent` (string): Override the browser User-Agent string
- `viewportDevice` (string): Device preset for viewport emulation (e.g. "iphone_14_pro"). Use list_devices to see all presets.
- `viewportHasTouch` (boolean): Enable touch event emulation
- `viewportLandscape` (boolean): Landscape orientation
- `viewportMobile` (boolean): Enable mobile meta viewport emulation
- `waitForSelector` (string): Wait for this CSS selector to appear before inspecting
- `waitUntil` (string): When to consider navigation finished (default: networkidle2)
- `width` (integer): Viewport width in pixels (default: 1280)

### `list_devices` (~47 tokens)

List all available device presets for viewport emulation (e.g. iphone_14_pro, macbook_pro_14). Use the returned device names with the viewportDevice parameter in take_screenshot.

### `check_usage` (~19 tokens)

Check your current PageBolt API usage and plan limits.

### `create_session` (~155 tokens)

Create a persistent browser session (Starter+ plan required). The session keeps a live browser page open so you can reuse cookies, localStorage, and auth state across multiple take_screenshot or run_sequence calls. Pass the returned session_id to those tools. Sessions expire after 10 minutes of inactivity (hard cap: 30 minutes). Useful for AI agent workflows that log in once and then take multiple screenshots of authenticated pages.

Input parameters:

- `cookies` (array): Cookies to pre-load into the session browser page
- `stealth` (boolean): Launch this session with stealth mode (bypasses bot detection). Note: stealth sessions use a dedicated browser and consume more memory.
- `viewport` (object): Viewport dimensions for the session browser page

### `list_sessions` (~43 tokens)

List all active persistent browser sessions for your API key. Returns session IDs, creation times, and expiry times. Useful for checking which sessions are still alive before reusing them.

### `destroy_session` (~58 tokens)

Explicitly destroy a persistent browser session before it expires. Frees the browser page immediately. Use this when you are done with a session to free up capacity.

Input parameters:

- `session_id` (string, required): The session ID to destroy (returned by create_session)

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/custodia-admin-pagebolt/pagebolt-mcp#diagnostics

## Score history

- 2026-08-03: 69
- 2026-08-02: 68
- 2026-08-01: 29
- 2026-07-31: 29
- 2026-07-30: 32
- 2026-07-28: 50
- 2026-07-27: 50

## Links

- npm package: https://www.npmjs.com/package/pagebolt-mcp
- Socket report: https://socket.dev/npm/package/pagebolt-mcp
- Repository: https://github.com/Custodia-Admin/pagebolt-mcp
- Changelog RSS feed: https://verifymcp.io/servers/custodia-admin-pagebolt/pagebolt-mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/custodia-admin-pagebolt/pagebolt-mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/custodia-admin-pagebolt/pagebolt-mcp