Weavetab
NPM · @WEAVETAB/MCP
Open automation engine for AI agents. Control live browsers and desktop apps locally.
Available components
Last scanned (8 hours ago)
Scores higher than 37% of npm servers
Category Browser Automation
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security81
- No malware found by supply-chain analysis.Pass
- CVE check failed: a known high-severity CVE affects sharp 0.34.5, a direct dependency. A fixed version is available. View diagnostics → Fail
- No install/post-install scripts declared.Pass
- 91 of 253 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency48
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (AGPL-3.0-only).Pass
- Actively maintained (last published 4 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability75
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 7497 tokens (~178/item across 42 items; 42 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management0
- Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "browser_eval" implies "eval" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
- An AI judge read all 42 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Unverified: 1 category
A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 22 Oct 26 0
- CVE-2026-114113 affects this package: high ▼ security
- CVE-2026-114111 affects this package: high ▼ security
- CVE-2026-114112 affects this package: high ▼ security
- GHSA-wq5f-xc86-pv6w no longer affects this package ▲ security
- GHSA-rgj7-g3m4-5g8c no longer affects this package ▲ security
- GHSA-f88m-g3jw-g9cj no longer affects this package ▲ security
- 18 Oct 26 +15
- Malware scan: unverified → pass ▲ security
- 17 Oct 26 49
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 23 Oct 2026 · Analysed npm/@weavetab/mcp@2.5.0
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Vulnerabilities 6 findings
| ID | CVE | Severity | Vector | Fix available |
|---|---|---|---|---|
| GHSA-8cw4-87c7-c6xx | CVE-2026-85063 | medium | yes | |
| GHSA-f88m-g3jw-g9cj | CVE-2026-114113 | high | yes | |
| GHSA-rgj7-g3m4-5g8c | CVE-2026-114112 | high | yes | |
| GHSA-wq5f-xc86-pv6w | CVE-2026-114111 | high | yes | |
| GHSA-4r6h-8v6p-xvw6 | CVE-2023-30533 | high | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | no |
| GHSA-5pgg-2g8v-p4x9 | CVE-2024-22363 | high | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | no |
Background: What a vulnerability scan can and cannot prove →
Dependencies 253 packages
| Packages resolved | 253 |
|---|---|
| Stale | 91 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
browser_automation ~133
Inject self-running background script for monitoring/polling. Cleared on tab close. Don't use persistent scripts for expensive ops.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform. |
| app | string | – | Electron app name configured in config.json under 'electron'. |
| id | string | – | Unique script identifier (required for start/stop). |
| onResult | string | – | How to handle script results (default 'store'). |
| persistent | boolean | – | If true, the script re-runs in a loop (default false). |
| script | string | – | JavaScript code to inject and run (required for start). |
No output schema declared.
No examples provided.
browser_burst ~347
HIGH-SPEED MULTI-ACTION PIPELINE: Executes 2 or more sequential browser actions in a single round-trip without waiting for LLM turns between steps. PREFER THIS over individual single-action calls (e.g. typing + pressing Enter, filling multiple form fields, clicking tabs/buttons then waiting, searching, navigating + reading) to drastically slash latency and token burn. Supports native primitives (browser_click, browser_fill, browser_type, browser_type_secret, browser_navigate, browser_key, browser_scroll, browser_wait, browser_map, etc.) plus ergonomic macro steps (type_and_send, click_and_wait, navigate_and_read, scroll_and_read, fill_form). If compile_from_history: true is passed, automatically compiles recent successful session trail actions into a burst macro.
| Name | Type | Req | Description |
|---|---|---|---|
| actions | array | – | Alias for 'steps'. |
| app | string | – | Electron app name configured in config.json under 'electron'. |
| batch | boolean | – | If true, defers action map generation until all steps are complete to maximize throughput. |
| compile_from_history | boolean | – | Compile recent successful session trail actions into a macro. If steps are omitted, executes the compiled macro directly. |
| dry_run | boolean | – | If true with compile_from_history, returns the compiled steps without executing them. |
| history_limit | number | – | Number of recent session trail entries to consider when compile_from_history is true (default: 20). |
| steps | array | – | Ordered array of tool calls or macros to execute serially. Either 'steps' or 'actions' may be passed. |
| stop_on_error | boolean | – | Halt execution immediately if a step fails to prevent cascading failures (default: true). |
No output schema declared.
No examples provided.
browser_canvas ~260
For ALL canvas content (charts, games, graphs). Use 'get_image' to read pixels, 'draw' to simulate gestures. Do NOT use browser_click here.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | 'get_image' — exports the canvas as a base64 image so you can analyze its visual content (prices, chart patterns, etc). 'draw' — simulates drag/pointer events across canvas points (for drawing, selec… |
| app | string | – | Electron app name configured in config.json under 'electron'. |
| backendNodeId | number | – | Raw CDP backendNodeId for direct targeting. |
| id | string | – | Ref ID from browser_map (e.g. 'w:42') for the canvas element. |
| label | string | – | Visible text or aria-label of the canvas element. |
| points | array | – | Array of {x,y} points relative to canvas viewport for 'draw' action. Simulates a drag path across the canvas. |
| ref | string | – | Alternative ref identifier for the canvas element. |
| selector | string | – | CSS Selector for the target <canvas> element. Use 'canvas' to select the first canvas on the page, or a more specific selector like 'canvas#chart'. |
No output schema declared.
No examples provided.
browser_captcha ~40
Autonomous CAPTCHA detection and solving.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform. |
| timeout | number | – | Timeout in ms (default 120000). |
No output schema declared.
No examples provided.
browser_checkpoint ~138
Snapshot and restore browser state (cookies, localStorage, sessionStorage, and scroll/URL) into named checkpoints to time-travel and rollback failed automation branches.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform: 'save' a new checkpoint, 'restore' an existing checkpoint, 'list' all checkpoints, or 'delete' a checkpoint. |
| app | string | – | Electron app name configured in config.json under 'electron'. |
| includeDom | boolean | – | Whether to include a lightweight DOM snapshot during 'save' (default false). |
| name | string | – | Checkpoint name identifier (required for 'save', 'restore', 'delete'). |
No output schema declared.
No examples provided.
browser_click ~408
Click a DOM element. Use browser_canvas for charts/canvas. If stuck_warning=true, stop and use browser_map. Pass mark: N to click a numbered element from browser_map({ visual: true/"auto" }) without any DOM re-scan.
| Name | Type | Req | Description |
|---|---|---|---|
| app | string | – | Electron app name configured in config.json under 'electron'. |
| backendNodeId | number | – | Raw CDP backendNodeId for direct hardware targeting. |
| id | string | – | Ref ID from browser_map (e.g. 'w:42'). Primary targeting method. DO NOT SPAM. If stuck_warning is returned, stop retrying and call browser_map first. |
| include_map | boolean | – | Set true to include a full updated page_map in the response. Default false — omit when you already have ref IDs or don't need a DOM refresh. |
| intent | string | – | Semantic description of the action (e.g. 'submit login form'). WeaveTab checks learned memory first — if a high-confidence selector is found it clicks immediately without DOM resolution. Falls throug… |
| label | string | – | Visible text or aria-label to click. |
| mark | integer | – | Mark number from browser_map({ visual: true/"auto" }). Clicks the center of the numbered badge seen in the annotated screenshot. Zero DOM walk — instant coordinate dispatch. Use when the page is canv… |
| ref | string | – | Alias for id (e.g. 'w:42'). |
| selector | string | – | CSS selector of the element to click. |
| tab_id | string | – | Execute in a specific tab instead of active. |
| target | string | – | CSS selector or query string. Alias for selector. |
| x | number | – | Raw X coordinate. Use for precise positional clicks when element ID is not available. |
| y | number | – | Raw Y coordinate. Use for precise positional clicks when element ID is not available. |
No output schema declared.
No examples provided.
browser_clipboard ~120
Read or write to the system clipboard.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform. |
| app | string | – | Electron app name configured in config.json under 'electron'. |
| dataUrl | string | – | Base64 data URL of an image to write to clipboard (e.g. 'data:image/png;base64,...'). |
| mimeType | string | – | MIME type override for image write (auto-detected from dataUrl by default, e.g. 'image/png'). |
| text | string | – | Text to write to clipboard (for write action). |
No output schema declared.
No examples provided.
browser_console ~61
1-5ms latency. Read or clear buffered console API messages, JS exceptions, and network errors.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform on the console buffer. |
| app | string | – | Electron app name configured in config.json under 'electron'. |
No output schema declared.
No examples provided.
browser_cookies ~106
Manage browser cookies.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform on cookies. |
| app | string | – | Electron app name configured in config.json under 'electron'. |
| domain | string | – | Domain for the cookie. |
| name | string | – | Cookie name. |
| path | string | – | Path for the cookie. |
| url | string | – | URL scope for 'get' action (defaults to current page). |
| value | string | – | Cookie value (required for 'set'). |
No output schema declared.
No examples provided.
browser_detect ~51
CRITICAL INITIALIZATION TOOL. Detect available browsers and configured desktop apps (Discord, Slack, etc.). Call this FIRST before interacting with the environment to know if apps are online/offline and what tabs they have open.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
browser_dialog ~54
Accept or dismiss JS dialogs (alert, confirm, prompt). Browser sessions only.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform on the dialog. |
| promptText | string | – | Text to enter if it is a prompt dialog. |
No output schema declared.
No examples provided.
browser_emulate ~166
Emulate browser conditions over CDP: network throttling (Slow 3G, Fast 3G, 4G, Offline), CPU throttling rate, Geolocation coordinates, Timezone, and User Agent string overrides.
| Name | Type | Req | Description |
|---|---|---|---|
| app | string | – | Electron app name configured in config.json under 'electron'. |
| cpuThrottlingRate | number | – | CPU slowdown multiplier (e.g. 2 = 2x slowdown, 4 = 4x slowdown, 1 = disable) |
| geolocation | object | – | Override geolocation coordinates |
| network | – | – | Network throttling profile or custom parameters |
| timezoneId | string | – | Override browser timezone (e.g. 'America/New_York') |
| userAgent | string | – | Override User Agent string |
No output schema declared.
No examples provided.
browser_eval ~82
Run arbitrary JS via CDP. Good for extracting app state. Cannot traverse shadow DOM/cross-origin iframes.
| Name | Type | Req | Description |
|---|---|---|---|
| app | string | – | Electron app name configured in config.json under 'electron'. |
| expression | string | yes | JavaScript code to evaluate in the context of the page. |
| timeout | number | – | Timeout in ms (default 5000). |
No output schema declared.
No examples provided.
browser_extract_design ~252
Extract design tokens (colors, typography, spacing, shadows, CSS variables), semantic HTML layouts, and clean CSS into structured files and an LLM design blueprint. Ideal for cloning websites, UI components, and design systems with 100% pixel fidelity.
| Name | Type | Req | Description |
|---|---|---|---|
| app | string | – | Electron app name configured in config.json under 'electron'. |
| format | string | – | Format preset for extracted styles: 'tailwind' (default, generates tailwind.theme.json), 'vanilla_css' (generates scoped styles), or 'tokens_only' (design tokens only). |
| hideOverlay | boolean | – | Whether to hide Weavetab overlay during capture (default true). |
| includeAssets | boolean | – | Whether to capture inline SVGs and asset references (default true). |
| name | string | – | Optional custom name for the saved design folder (e.g. 'resend-hero', 'pricing-section'). |
| outputDir | string | – | Optional custom directory to write extracted files into. If omitted, uses configured designDir (~/.weavetab/designs/<domain>-<timestamp>/). |
| selector | string | – | CSS selector of the container element to extract (default 'main', falls back to 'body'). |
No output schema declared.
No examples provided.
browser_fill ~195
Smart multi-field form-filling and input inspector. Call with scan:true (or empty) to get a lightweight list of all editable inputs on the page without dumping the full DOM. Fill multiple fields in a single turn.
| Name | Type | Req | Description |
|---|---|---|---|
| app | string | – | Electron app name configured in config.json under 'electron'. |
| blast_mode | boolean | – | Fill all fields simultaneously in a single CDP eval round-trip. |
| fields | array | – | Array of field ref+value pairs to fill sequentially. |
| inputs | boolean | – | Alias for scan. |
| scan | boolean | – | Set true to discover and return all fillable inputs on the page (with ref IDs, types, and values) in ~30 tokens without full browser_map. |
| scan_only | boolean | – | Validate field types without mutating DOM. |
| submit | string | – | Optional ref ID (w:NN) of a submit button to click after filling all fields. |
No output schema declared.
No examples provided.
browser_find ~111
Instant text & keyword search across page text, labels, and placeholders. Returns matched element coordinates, selectors, and ref IDs.
| Name | Type | Req | Description |
|---|---|---|---|
| all | boolean | – | Set true to return all matching elements on the page (default false returns first match). |
| app | string | – | Electron app name configured in config.json under 'electron'. |
| limit | number | – | Max number of matches to return when all: true (default 10). |
| query | string | yes | Text or keyword query to search for on the page. |
No output schema declared.
No examples provided.
browser_github ~266
Interact with GitHub repositories without burning browser turns. Analyze repo trees, read raw source files, search/inspect issues, and examine PR diffs and review comments.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | GitHub operation: 'analyze' (repo structure & README), 'read' (raw file contents), 'issues' (list/search/inspect issues), 'pr' (PR details, diff files & comments). |
| labels | array | – | For action: 'issues'. Filter issues by labels. |
| limit | number | – | For action: 'issues'. Max number of issues to list (default 5). |
| line_range | array | – | For action: 'read'. Optional [start, end] line range (1-indexed). |
| number | number | – | For action: 'issues' or 'pr'. Issue or PR number to fetch details and comments. |
| paths | array | – | For action: 'read'. File paths relative to repo root. |
| repo | string | – | Optional 'owner/repo' slug or GitHub URL. If omitted, uses active tab's repository. |
| search | string | – | For action: 'issues'. Search query to find issues. |
| state | string | – | For action: 'issues'. Filter issues by state. |
No output schema declared.
No examples provided.
browser_highlight ~305
Highlight elements on page. Supports single or multiple candidates (refs) with styles ('consideration' for candidate evaluation, 'target' for lock-on, 'danger' for destructive actions, 'success', or 'shimmer'), floating badges, and configurable duration.
| Name | Type | Req | Description |
|---|---|---|---|
| app | string | – | Electron app name configured in config.json under 'electron'. |
| color | string | – | Custom CSS color to use for the overlay (e.g. 'rgba(255,0,0,0.5)'). |
| duration | number | – | Duration in ms to keep highlight visible (default: 2000ms for consideration/target, 600ms for shimmer). |
| id | string | – | Alternative element Ref ID from browser_map (e.g. 'w:42'). |
| label | string | – | Floating label badge text to display above the element(s). |
| nodeId | number | – | CDP backendNodeId to highlight directly. |
| ref | string | – | Alternative element Ref ID (e.g. 'w:42'). |
| refs | array | – | Array of element Ref IDs to highlight concurrently (e.g. ['w:12', 'w:15', 'w:23']). |
| selector | string | – | CSS Selector of the element to highlight. |
| style | string | – | Visual highlight style. Defaults to 'shimmer' (or 'consideration' when refs provided). |
| target | string | – | Alternative element identifier, CSS Selector, or query. |
No output schema declared.
No examples provided.
browser_inspect ~95
15-35ms latency, zero waste. Deep DOM inspection. Useful for debugging failed clicks, verifying z-index & visibility, or computed styles.
| Name | Type | Req | Description |
|---|---|---|---|
| app | string | – | Electron app name configured in config.json under 'electron'. |
| nodeId | number | – | CDP backendNodeId. |
| ref | string | – | Ref ID (e.g. 'w:42'). |
| selector | string | – | CSS Selector. |
No output schema declared.
No examples provided.
browser_key ~112
Press a keyboard key.
| Name | Type | Req | Description |
|---|---|---|---|
| app | string | – | Electron app name configured in config.json under 'electron'. |
| key | string | yes | Key name: Enter, Escape, Tab, ArrowDown, F5, etc. DO NOT SPAM. If action fails or loops, STOP calling this tool and use browser_map to re-evaluate the page state. |
| modifiers | array | – | Array of modifier keys to hold during the press. |
| tab_id | string | – | Execute in a specific tab instead of active. |
No output schema declared.
No examples provided.
browser_map ~507
Snapshot interactive DOM with volatile ref IDs that invalidate after DOM mutations. For complex SPAs (e.g. GitHub dashboards), use `scope` or `query` to reduce tokens. For forms/pagination/sequential loops, ALWAYS use `delta: true` to save 97% tokens. For canvas/WebGL/Figma pages where the DOM has < 5 interactive elements, use `visual: "auto"` to get a numbered screenshot — then use browser_click({ mark: N }) to interact.
| Name | Type | Req | Description |
|---|---|---|---|
| app | string | – | Electron app name configured in config.json under 'electron'. |
| ax_tree | boolean | – | Bypass the extension entirely and read raw Chrome Accessibility Tree. Use this if Shadow DOMs hide elements. |
| delta | boolean | – | Diff mode: return ONLY elements that changed since the last browser_map call (added, removed, or modified). Diffs across time — distinct from prune. Cuts prompt tokens by up to 97% on consecutive cal… |
| force | boolean | – | Force a full DOM map rebuild even if loop detection says nothing changed. Bypasses the map skip guard and resets loop strikes. |
| full | boolean | – | Set to true to return a full markdown table (heavier context) instead of the lite list. |
| prune | boolean | – | Semantic DOM pruning: compress the current snapshot before returning. Drops hidden elements with no interactive descendants and not referenced by any toggle trigger (aria-controls etc.). Replaces SVG… |
| query | string | – | Filter returned elements by label or role substring. Useful on dense dashboards. |
| scope | string | – | Restrict parsing to a semantic page area to save tokens. Useful on dense dashboards. |
| show_overlays | boolean | – | Default false. Debug only — draws colored element borders via extension (ugly). The blue edge glow is the standard visual indicator, shown automatically during reading states. Only enable this for de… |
| tab_id | string | – | Read a specific background tab instead of the active one. |
| visual | – | – | Set-of-Marks visual grounding. true = always inject numbered badges + return annotated screenshot. "auto" = only activate when DOM interactive count < 5 (canvas/WebGL/Figma pages). After receiving ma… |
No output schema declared.
No examples provided.
browser_navigate ~138
Navigate to a URL or launch/focus a configured Electron app.
| Name | Type | Req | Description |
|---|---|---|---|
| app | string | – | Electron app name configured in config.json under 'electron' (e.g. 'example' or 'my-dev-app'). When specified, targets or launches the Electron app. |
| force | boolean | – | If true, overwrites current tab even if it's protected (anchor tab). Otherwise opens a new tab automatically. |
| tab_id | string | – | Target a specific tab ID for navigation instead of the active tab. |
| url | string | – | Absolute URL to navigate to (must include https:// or app URL). Optional if 'app' is specified. |
No output schema declared.
No examples provided.
browser_network_intercept ~181
Intercept/stub network responses (e.g. mock APIs, block tracking) OR retrieve detailed raw protocol network telemetry (TLS/SSL certificate info, microsecond timing breakdown, and OS-level failure reasons).
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform: 'enable'/'disable' network response interception, 'get_telemetry' to read captured requests with TLS/SSL certs & timing breakdown, or 'clear_telemetry' to reset buffer. |
| app | string | – | Electron app name configured in config.json under 'electron'. |
| mockBody | string | – | JSON or plaintext body payload to return in the mocked response. |
| mockStatus | number | – | HTTP status code to return when enabling mock (default 200). |
| pattern | string | – | URL glob pattern to intercept or filter telemetry (e.g. '*api/login*'). |
No output schema declared.
No examples provided.
browser_office ~370
Read and extract structured content from office documents (Excel, Word, PDF, CSV). Note: PDF/Word extraction requires local binary dependencies (e.g., poppler) and output is truncated by max_chars/max_rows limits. Two modes: - **url** — fetch a document URL using the browser's live session cookies (works for authenticated downloads, SharePoint, Google Drive exports, etc). Automatically detects format from URL or MIME type. - **file** — parse a file that was already downloaded to the local downloads directory (bare filename only, e.g. 'report.xlsx'). Supported formats: .xlsx/.xls (returns per-sheet JSON tables), .docx (returns extracted text), .pdf (returns page text + metadata), .csv (returns row objects). Use 'list' action first if you don't know what files are in the downloads directory. DO NOT use browser_scrape or browser_map for binary documents — they cannot read inside Excel, Word, or PDF files.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | 'read' — parse a document and return its content. 'list' — show all files in the downloads directory. |
| file | string | – | Bare filename (e.g. 'report.xlsx') of a file already in the local downloads directory. No path separators allowed. |
| max_chars | number | – | Max characters to return for PDF/Word text (default 50000). |
| max_rows | number | – | Max rows to return for Excel/CSV (default 500). Increase if you need more data. |
| url | string | – | URL of the document to fetch and parse in-browser (using active session cookies). Supports .pdf, .xlsx, .xls, .docx, .csv. Use for authenticated downloads, SharePoint links, Google Drive exports. |
No output schema declared.
No examples provided.
browser_pattern_learn ~367
Read, register, update, and record execution outcomes for named workflow patterns and site quirks in ~/.weavetab-system/memory/sites/. Use action='get' at session start to inspect a site profile and decide between fast-path replay (reliability ≥ 0.8) or exploratory navigation. Use action='learn' after completing a multi-step flow to persist it. Use action='record_execution' to update reliability scores after replay attempts.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | – | 'get': inspect site profile and known workflow patterns. 'learn': create/update a named pattern. 'record_execution': update reliability after replay. 'record_quirk': store a site quirk. |
| duration_ms | number | – | Execution duration in ms (optional for 'record_execution'). |
| entry | string | – | URL path or pattern where this workflow starts. |
| name | string | – | Pattern name in snake_case (required for 'learn' and 'record_execution'). |
| origin | string | – | Full origin associated with the pattern, e.g. 'https://github.com'. Required for write actions. If omitted with action='get', reads the active tab origin. |
| pattern | string | – | With action='get': returns reliability score for this specific named pattern only. |
| quirk_data | object | – | Quirk payload object (required for 'record_quirk'). |
| quirk_key | string | – | Quirk key: 'cookie_banner', 'rate_limit', or 'modal_popups' (required for 'record_quirk'). |
| steps | array | – | Ordered workflow steps (required for 'learn'). |
| success | boolean | – | Whether the execution succeeded (required for 'record_execution'). |
| success_indicator | string | – | CSS selector or URL fragment confirming workflow success. |
No output schema declared.
No examples provided.
browser_pdf ~113
Print the current page to a PDF file.
| Name | Type | Req | Description |
|---|---|---|---|
| app | string | – | Electron app name configured in config.json under 'electron'. |
| filename | string | – | Output filename (e.g. 'report.pdf'). Defaults to capture_<timestamp>.pdf. |
| landscape | boolean | – | Print in landscape orientation (default false). |
| pageRanges | string | – | Page ranges to print (e.g. '1-5'). Leave empty for all pages. |
| scale | number | – | Scale factor (default 1.0). |
No output schema declared.
No examples provided.
browser_performance ~31
Retrieve page performance metrics.
| Name | Type | Req | Description |
|---|---|---|---|
| app | string | – | Electron app name configured in config.json under 'electron'. |
No output schema declared.
No examples provided.
browser_pointer ~434
Advanced pointer control (hover, click, double_click, drag_and_drop, hover_chain). Use hover_chain for Photoshop/Photopea, Figma, and multi-level flyout submenus.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | – | Action to perform (default: click, or hover_chain if hover_chain array is provided). |
| app | string | – | Electron app name configured in config.json under 'electron'. |
| chain | array | – | Advanced chain step array of { action, ref, label, selector, x, y, holdMs }. |
| clickFinal | boolean | – | Default true. Whether to click the final element in the hover chain. |
| end_id | string | – | Destination element ID (only for drag_and_drop). |
| end_ref | string | – | Destination Ref ID (only for drag_and_drop). |
| end_selector | string | – | Destination CSS Selector (only for drag_and_drop). |
| end_target | string | – | Alternative destination target identifier or query. |
| end_x | number | – | Destination X coordinate (only for drag_and_drop). |
| end_y | number | – | Destination Y coordinate (only for drag_and_drop). |
| holdMs | number | – | Milliseconds to hold the pointer down (only for hover). |
| hover_chain | array | – | Array of element ref IDs, selectors, or labels to hover sequentially and click the last one (e.g. ['File', 'Export As', 'PNG']). Perfect for Photoshop/Photopea, Figma, Canva, and multi-level flyout s… |
| id | string | – | Alternative element ID / Ref ID from browser_map. |
| label | string | – | Target element label or text. |
| ref | string | – | Ref ID of the target element (e.g. w:42). |
| selector | string | – | CSS Selector of the target element. |
| target | string | – | Alternative target element identifier or query. |
| waitForChild | string | – | CSS Selector of a child element to wait for (only for hover). |
| x | number | – | Raw X coordinate (fallback). |
| y | number | – | Raw Y coordinate (fallback). |
No output schema declared.
No examples provided.
browser_recording ~166
Record video screencast for compliance/audit. Compiles captured frames into video/animation (.webp, .gif, .webm, .mp4).
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform. |
| app | string | – | Electron app name configured in config.json under 'electron'. |
| format | string | – | Output video format when stopping recording. Default 'webp' (pure Node native compilation). |
| fps | number | – | Frames per second (1-10, default 3). |
| keepFrames | boolean | – | If true, keeps raw JPEG frames after video compilation (default false). |
| maxFrames | number | – | Maximum frames to capture (default 500). |
| sessionId | string | – | Unique recording session ID (required for start/stop). |
No output schema declared.
No examples provided.
browser_scrape ~145
Sub-5ms latency, zero waste extraction. Best for batch list extraction, table parsing, targeted data mining. Prefer this over browser_map for pure data extraction. Note: XPath selectors lack shadow-DOM support; use CSS selectors for shadow DOMs.
| Name | Type | Req | Description |
|---|---|---|---|
| app | string | – | Electron app name configured in config.json under 'electron'. |
| attributes | array | – | Attributes to extract (e.g. ['textContent', 'href'], default ['textContent']). |
| multiple | boolean | – | Whether to extract multiple elements (default true). |
| query | string | yes | CSS Selector or XPath query to extract. |
| type | string | – | Query type (default 'css'). |
No output schema declared.
No examples provided.
browser_screenshot ~163
95-135ms capture. Best for visual layout validation, canvas/image inspection. For multimodal models only. Text-only models should use browser_map or browser_canvas instead.
| Name | Type | Req | Description |
|---|---|---|---|
| app | string | – | Electron app name configured in config.json under 'electron'. |
| clip | object | – | Clip region. Use to capture only part of the page (e.g. just a chart area) to reduce token cost. |
| format | string | – | Capture format. 'jpeg' is smaller and faster for large pages. Default 'png'. |
| fullPage | boolean | – | If true, captures the full scrollable page. Default false (viewport only). |
| quality | number | – | JPEG quality 0-100 (default 90). Only used when format is jpeg. |
No output schema declared.
No examples provided.
browser_scroll ~202
Scroll the page.
| Name | Type | Req | Description |
|---|---|---|---|
| app | string | – | Electron app name configured in config.json under 'electron'. |
| direction | string | yes | Scroll direction. |
| distance | number | – | Pixels to scroll (default 400). |
| id | string | – | Ref ID to scroll into view or scroll inside of. DO NOT SPAM. If action fails or loops, STOP calling this tool and use browser_map to re-evaluate the page state. |
| label | string | – | Element label to scroll into view. |
| ref | string | – | Alias for id (e.g. 'w:42'). |
| selector | string | – | CSS Selector of the element to scroll into view. |
| tab_id | string | – | Execute in a specific tab instead of active. DO NOT SPAM. If action fails or loops, STOP calling this tool and use browser_map to re-evaluate the page state. |
| target | string | – | Alternative element identifier or query to scroll into view. |
No output schema declared.
No examples provided.
browser_select ~68
Select an option from a native dropdown.
| Name | Type | Req | Description |
|---|---|---|---|
| app | string | – | Electron app name configured in config.json under 'electron'. |
| nodeId | number | – | CDP backendNodeId. |
| selector | string | – | CSS Selector. |
| value | string | yes | The exact text value to select. |
No output schema declared.
No examples provided.
browser_snapshot ~74
Capture or restore an MHTML snapshot. Best for offline archival, replay testing, and compliance audits.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform. |
| app | string | – | Electron app name configured in config.json under 'electron'. |
| filePath | string | yes | Absolute file path to save/load the .mhtml snapshot. |
No output schema declared.
No examples provided.
browser_storage ~92
Manage localStorage and sessionStorage.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform on the storage. |
| app | string | – | Electron app name configured in config.json under 'electron'. |
| key | string | – | Key name (required for 'get' and 'set' actions). |
| scope | string | yes | Storage scope to manipulate. |
| value | string | – | String value (required for 'set' action). |
No output schema declared.
No examples provided.
browser_tabs ~212
Manage browser and Electron app tabs/windows (open, switch, close, list). Specify 'app' when targeting desktop apps (e.g. app: 'discord') to avoid opening web browser.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform. 'consolidate' deduplicates tabs. 'heal' recovers crashed tabs. |
| app | string | – | Optional Electron app name configured in config.json under 'electron'. |
| force | boolean | – | Force close protected (anchor) tabs. Use with extreme caution. |
| reuse | boolean | – | Default true. When opening a URL already loaded in another tab, focus that tab instead of opening a duplicate. |
| tabId | string | – | Target Tab ID (required for 'switch' or 'close'). |
| tabIds | array | – | Multiple Tab IDs for batch 'close' action. |
| url | string | – | URL to open (required for 'open' action). |
| windowId | number | – | Window ID to focus (required for 'focus_window'). |
No output schema declared.
No examples provided.
browser_thoughts ~227
Agent-to-user communication. Renders in the middle down of the page. Use 'question' mode to ask a free-text question. Use 'feedback' mode to provide status updates, analysis, or decisions. Supports element anchoring (e.g. 'w:15') and presentation styles ('observation', 'decision', 'warning', 'question').
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform. |
| anchor | string | – | Optional element Ref ID (e.g. 'w:15') or CSS selector to visually anchor this thought to on the page. |
| app | string | – | Optional Electron app name. (Note: thought HUD overlay is browser-only). |
| input | string | – | Input field type for question mode (default: sentence). |
| message | string | yes | The question to ask, or the feedback/analysis to log. |
| style | string | – | Thought presentation style. Defaults to 'observation' for feedback and 'question' for question. |
| timeout | number | – | Timeout in seconds for question mode before auto-cancel (default: 120). |
No output schema declared.
No examples provided.
browser_type ~320
Type text into an input field or currently focused element. If id/selector/label is omitted, automatically types directly into document.activeElement without needing a redundant click or browser_map. If target is already focused, skips click to prevent unfocus bugs.
| Name | Type | Req | Description |
|---|---|---|---|
| app | string | – | Electron app name configured in config.json under 'electron'. |
| clearFirst | boolean | – | Wipe existing field content before typing. |
| id | string | – | Ref ID from browser_map (e.g. 'w:42'). If omitted, types directly into the currently focused element or single page input. |
| include_map | boolean | – | Set true to include a full updated page_map in the response. Default false. |
| intent | string | – | Semantic description of the field (e.g. 'search box', 'username field'). Checked against learned memory first. |
| label | string | – | Field label or placeholder text. Used for fuzzy matching. |
| paste | boolean | – | Instant paste mode via clipboard. Auto-enabled for text longer than 8 chars. |
| ref | string | – | Alias for id (e.g. 'w:42'). |
| selector | string | – | CSS selector of the input field. |
| tab_id | string | – | Execute in a specific tab instead of active. |
| target | string | – | CSS selector or query string. Alias for selector. |
| text | string | yes | Text to type into the field. |
| x | number | – | Raw X coordinate to focus before typing. |
| y | number | – | Raw Y coordinate to focus before typing. |
No output schema declared.
No examples provided.
browser_type_secret ~94
Inject a secret from an environment variable.
| Name | Type | Req | Description |
|---|---|---|---|
| app | string | – | Electron app name configured in config.json under 'electron'. |
| envKey | string | yes | The environment variable key containing the secret. |
| id | string | – | Ref ID from browser_map. |
| ref | string | – | Alias for id (e.g. 'w:42'). |
| target | string | – | Alternative target input element identifier or CSS selector. |
No output schema declared.
No examples provided.
browser_upload ~71
Upload files to a file input.
| Name | Type | Req | Description |
|---|---|---|---|
| app | string | – | Electron app name configured in config.json under 'electron'. |
| filePaths | array | yes | List of absolute system file paths to upload. |
| nodeId | number | yes | CDP backendNodeId of the target <input type='file'> element. |
No output schema declared.
No examples provided.
browser_viewport ~100
Set viewport dimensions and device emulation.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform. |
| app | string | – | Electron app name configured in config.json under 'electron'. |
| deviceScaleFactor | number | – | Device Pixel Ratio (default 1). |
| height | number | – | Viewport height in pixels. |
| mobile | boolean | – | Whether to emulate a mobile device (default false). |
| width | number | – | Viewport width in pixels. |
No output schema declared.
No examples provided.
browser_wait ~120
Pause until a condition is met.
| Name | Type | Req | Description |
|---|---|---|---|
| app | string | – | Electron app name configured in config.json under 'electron'. |
| for | string | yes | 'stable' = DOM stops mutating, 'network' = 0 pending requests. 'auto' tries to guess. |
| tab_id | string | – | Execute in a specific tab instead of active. |
| timeout | number | – | Max wait in ms (default 8000). |
| value | string | – | CSS selector, text string, or URL pattern. Not needed for 'stable'/'network'. |
No output schema declared.
No examples provided.
How do I install the Weavetab MCP server?
Weavetab runs locally as an npm package, launched with npx -y @weavetab/mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · @weavetab/mcp
claude mcp add dev-weavetab-mcp -- npx -y @weavetab/mcp
What is the Weavetab MCP server?
Weavetab is an MCP server listed in the public MCP registry as dev.weavetab/mcp. Open automation engine for AI agents. Control live browsers and desktop apps locally. This page covers its npm package (@weavetab/mcp).
Is the Weavetab MCP server safe to use?
Weavetab scores 64 out of 100 on VerifyMCP. We recorded 6 known advisories against it as of 23 October 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Weavetab MCP server expose?
Weavetab exposes 42 tools: browser_map, browser_navigate, browser_click, browser_type, browser_type_secret, and 37 more. Their descriptions and schemas cost roughly 7,497 tokens of context every time the server is loaded.
Is the Weavetab MCP server still maintained?
Weavetab is still listed as active in the MCP registry. We last reached this channel on 23 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the Weavetab MCP server under?
Weavetab declares the AGPL-3.0-only licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.