# Weavetab (npm · @weavetab/mcp)

Open automation engine for AI agents. Control live browsers and desktop apps locally.

- Trust score: 64/100 (medium)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-10-23

## Components

- npm · `@weavetab/mcp`: 64/100 (this document), [markdown](https://verifymcp.io/servers/dev-weavetab-mcp/weavetab-mcp.md), [page](https://verifymcp.io/servers/dev-weavetab-mcp/weavetab-mcp)

## Channel facts

- Registry: `npm`
- Package: `@weavetab/mcp`
- Version: `2.5.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-10-23.

- **Supply Chain Security**: 81/100
  - No malware found by supply-chain analysis.
  - CVE check failed: a known high-severity CVE affects sharp 0.34.5, a direct dependency. A fixed version is available.
  - No install/post-install scripts declared.
  - 91 of 253 dependencies flagged as unhealthy.
- **Provenance & Transparency**: 48/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (AGPL-3.0-only).
  - Actively maintained (last published 4 days ago).
  - Publishes a security disclosure policy (SECURITY.md).
- **Schema Quality & AI Usability**: 75/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 7497 tokens (~178/item across 42 items; 42 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Tool Safety**: 75/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - 0 of 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "browser_eval" implies "eval" and declares no destructiveHint at all, which the MCP spec reads as destructive by default.
  - An AI judge read all 42 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

**Unverified: 1 category.** A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

## Install

### How do I install the Weavetab MCP server?

Weavetab runs locally as an npm package, launched with npx -y @weavetab/mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add dev-weavetab-mcp -- npx -y @weavetab/mcp
```

### Cursor

```json
{
  "mcpServers": {
    "dev-weavetab-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@weavetab/mcp"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "dev-weavetab-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@weavetab/mcp"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add dev-weavetab-mcp -- npx -y @weavetab/mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "dev-weavetab-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@weavetab/mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add dev-weavetab-mcp --command npx --arg -y --arg @weavetab/mcp
```

### Hermes

```yaml
mcp_servers:
  dev-weavetab-mcp:
    command: "npx"
    args: ["-y", "@weavetab/mcp"]
```

### Netclaw

```json
{
  "McpServers": {
    "dev-weavetab-mcp": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "@weavetab/mcp"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add dev-weavetab-mcp -t stdio -c npx -a -y @weavetab/mcp
```

### Other

```json
{
  "mcpServers": {
    "dev-weavetab-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@weavetab/mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-10-22 (score 64, 0)

- [security regression] CVE-2026-114113 affects this package: high
- [security regression] CVE-2026-114111 affects this package: high
- [security regression] CVE-2026-114112 affects this package: high
- [security improvement] GHSA-wq5f-xc86-pv6w no longer affects this package
- [security improvement] GHSA-rgj7-g3m4-5g8c no longer affects this package
- [security improvement] GHSA-f88m-g3jw-g9cj no longer affects this package

### 2026-10-18 (score 64, +15)

- [security improvement] Malware scan: unverified → pass

### 2026-10-17 (score 49)

First indexed and scored.

## MCP tools (42)

### `browser_map` (~507 tokens)

Snapshot interactive DOM with volatile ref IDs that invalidate after DOM mutations. For complex SPAs (e.g. GitHub dashboards), use `scope` or `query` to reduce tokens. For forms/pagination/sequential loops, ALWAYS use `delta: true` to save 97% tokens. For canvas/WebGL/Figma pages where the DOM has < 5 interactive elements, use `visual: "auto"` to get a numbered screenshot — then use browser_click({ mark: N }) to interact.

Input parameters:

- `app` (string): Electron app name configured in config.json under 'electron'.
- `ax_tree` (boolean): Bypass the extension entirely and read raw Chrome Accessibility Tree. Use this if Shadow DOMs hide elements.
- `delta` (boolean): Diff mode: return ONLY elements that changed since the last browser_map call (added, removed, or modified). Diffs across time — distinct from prune. Cuts prompt tokens by up to 97% on consecutive cal…
- `force` (boolean): Force a full DOM map rebuild even if loop detection says nothing changed. Bypasses the map skip guard and resets loop strikes.
- `full` (boolean): Set to true to return a full markdown table (heavier context) instead of the lite list.
- `prune` (boolean): Semantic DOM pruning: compress the current snapshot before returning. Drops hidden elements with no interactive descendants and not referenced by any toggle trigger (aria-controls etc.). Replaces SVG…
- `query` (string): Filter returned elements by label or role substring. Useful on dense dashboards.
- `scope` (string): Restrict parsing to a semantic page area to save tokens. Useful on dense dashboards.
- `show_overlays` (boolean): Default false. Debug only — draws colored element borders via extension (ugly). The blue edge glow is the standard visual indicator, shown automatically during reading states. Only enable this for de…
- `tab_id` (string): Read a specific background tab instead of the active one.
- `visual`: Set-of-Marks visual grounding. true = always inject numbered badges + return annotated screenshot. "auto" = only activate when DOM interactive count < 5 (canvas/WebGL/Figma pages). After receiving ma…

### `browser_navigate` (~138 tokens)

Navigate to a URL or launch/focus a configured Electron app.

Input parameters:

- `app` (string): Electron app name configured in config.json under 'electron' (e.g. 'example' or 'my-dev-app'). When specified, targets or launches the Electron app.
- `force` (boolean): If true, overwrites current tab even if it's protected (anchor tab). Otherwise opens a new tab automatically.
- `tab_id` (string): Target a specific tab ID for navigation instead of the active tab.
- `url` (string): Absolute URL to navigate to (must include https:// or app URL). Optional if 'app' is specified.

### `browser_click` (~408 tokens)

Click a DOM element. Use browser_canvas for charts/canvas. If stuck_warning=true, stop and use browser_map. Pass mark: N to click a numbered element from browser_map({ visual: true/"auto" }) without any DOM re-scan.

Input parameters:

- `app` (string): Electron app name configured in config.json under 'electron'.
- `backendNodeId` (number): Raw CDP backendNodeId for direct hardware targeting.
- `id` (string): Ref ID from browser_map (e.g. 'w:42'). Primary targeting method. DO NOT SPAM. If stuck_warning is returned, stop retrying and call browser_map first.
- `include_map` (boolean): Set true to include a full updated page_map in the response. Default false — omit when you already have ref IDs or don't need a DOM refresh.
- `intent` (string): Semantic description of the action (e.g. 'submit login form'). WeaveTab checks learned memory first — if a high-confidence selector is found it clicks immediately without DOM resolution. Falls throug…
- `label` (string): Visible text or aria-label to click.
- `mark` (integer): Mark number from browser_map({ visual: true/"auto" }). Clicks the center of the numbered badge seen in the annotated screenshot. Zero DOM walk — instant coordinate dispatch. Use when the page is canv…
- `ref` (string): Alias for id (e.g. 'w:42').
- `selector` (string): CSS selector of the element to click.
- `tab_id` (string): Execute in a specific tab instead of active.
- `target` (string): CSS selector or query string. Alias for selector.
- `x` (number): Raw X coordinate. Use for precise positional clicks when element ID is not available.
- `y` (number): Raw Y coordinate. Use for precise positional clicks when element ID is not available.

### `browser_type` (~320 tokens)

Type text into an input field or currently focused element. If id/selector/label is omitted, automatically types directly into document.activeElement without needing a redundant click or browser_map. If target is already focused, skips click to prevent unfocus bugs.

Input parameters:

- `app` (string): Electron app name configured in config.json under 'electron'.
- `clearFirst` (boolean): Wipe existing field content before typing.
- `id` (string): Ref ID from browser_map (e.g. 'w:42'). If omitted, types directly into the currently focused element or single page input.
- `include_map` (boolean): Set true to include a full updated page_map in the response. Default false.
- `intent` (string): Semantic description of the field (e.g. 'search box', 'username field'). Checked against learned memory first.
- `label` (string): Field label or placeholder text. Used for fuzzy matching.
- `paste` (boolean): Instant paste mode via clipboard. Auto-enabled for text longer than 8 chars.
- `ref` (string): Alias for id (e.g. 'w:42').
- `selector` (string): CSS selector of the input field.
- `tab_id` (string): Execute in a specific tab instead of active.
- `target` (string): CSS selector or query string. Alias for selector.
- `text` (string, required): Text to type into the field.
- `x` (number): Raw X coordinate to focus before typing.
- `y` (number): Raw Y coordinate to focus before typing.

### `browser_type_secret` (~94 tokens)

Inject a secret from an environment variable.

Input parameters:

- `app` (string): Electron app name configured in config.json under 'electron'.
- `envKey` (string, required): The environment variable key containing the secret.
- `id` (string): Ref ID from browser_map.
- `ref` (string): Alias for id (e.g. 'w:42').
- `target` (string): Alternative target input element identifier or CSS selector.

### `browser_key` (~112 tokens)

Press a keyboard key.

Input parameters:

- `app` (string): Electron app name configured in config.json under 'electron'.
- `key` (string, required): Key name: Enter, Escape, Tab, ArrowDown, F5, etc. DO NOT SPAM. If action fails or loops, STOP calling this tool and use browser_map to re-evaluate the page state.
- `modifiers` (array): Array of modifier keys to hold during the press.
- `tab_id` (string): Execute in a specific tab instead of active.

### `browser_scroll` (~202 tokens)

Scroll the page.

Input parameters:

- `app` (string): Electron app name configured in config.json under 'electron'.
- `direction` (string, required): Scroll direction.
- `distance` (number): Pixels to scroll (default 400).
- `id` (string): Ref ID to scroll into view or scroll inside of. DO NOT SPAM. If action fails or loops, STOP calling this tool and use browser_map to re-evaluate the page state.
- `label` (string): Element label to scroll into view.
- `ref` (string): Alias for id (e.g. 'w:42').
- `selector` (string): CSS Selector of the element to scroll into view.
- `tab_id` (string): Execute in a specific tab instead of active. DO NOT SPAM. If action fails or loops, STOP calling this tool and use browser_map to re-evaluate the page state.
- `target` (string): Alternative element identifier or query to scroll into view.

### `browser_dialog` (~54 tokens)

Accept or dismiss JS dialogs (alert, confirm, prompt). Browser sessions only.

Input parameters:

- `action` (string, required): Action to perform on the dialog.
- `promptText` (string): Text to enter if it is a prompt dialog.

### `browser_burst` (~347 tokens)

HIGH-SPEED MULTI-ACTION PIPELINE: Executes 2 or more sequential browser actions in a single round-trip without waiting for LLM turns between steps. PREFER THIS over individual single-action calls (e.g. typing + pressing Enter, filling multiple form fields, clicking tabs/buttons then waiting, searching, navigating + reading) to drastically slash latency and token burn. Supports native primitives (browser_click, browser_fill, browser_type, browser_type_secret, browser_navigate, browser_key, browser_scroll, browser_wait, browser_map, etc.) plus ergonomic macro steps (type_and_send, click_and_wait, navigate_and_read, scroll_and_read, fill_form). If compile_from_history: true is passed, automatically compiles recent successful session trail actions into a burst macro.

Input parameters:

- `actions` (array): Alias for 'steps'.
- `app` (string): Electron app name configured in config.json under 'electron'.
- `batch` (boolean): If true, defers action map generation until all steps are complete to maximize throughput.
- `compile_from_history` (boolean): Compile recent successful session trail actions into a macro. If steps are omitted, executes the compiled macro directly.
- `dry_run` (boolean): If true with compile_from_history, returns the compiled steps without executing them.
- `history_limit` (number): Number of recent session trail entries to consider when compile_from_history is true (default: 20).
- `steps` (array): Ordered array of tool calls or macros to execute serially. Either 'steps' or 'actions' may be passed.
- `stop_on_error` (boolean): Halt execution immediately if a step fails to prevent cascading failures (default: true).

### `browser_tabs` (~212 tokens)

Manage browser and Electron app tabs/windows (open, switch, close, list). Specify 'app' when targeting desktop apps (e.g. app: 'discord') to avoid opening web browser.

Input parameters:

- `action` (string, required): Action to perform. 'consolidate' deduplicates tabs. 'heal' recovers crashed tabs.
- `app` (string): Optional Electron app name configured in config.json under 'electron'.
- `force` (boolean): Force close protected (anchor) tabs. Use with extreme caution.
- `reuse` (boolean): Default true. When opening a URL already loaded in another tab, focus that tab instead of opening a duplicate.
- `tabId` (string): Target Tab ID (required for 'switch' or 'close').
- `tabIds` (array): Multiple Tab IDs for batch 'close' action.
- `url` (string): URL to open (required for 'open' action).
- `windowId` (number): Window ID to focus (required for 'focus_window').

### `browser_wait` (~120 tokens)

Pause until a condition is met.

Input parameters:

- `app` (string): Electron app name configured in config.json under 'electron'.
- `for` (string, required): 'stable' = DOM stops mutating, 'network' = 0 pending requests. 'auto' tries to guess.
- `tab_id` (string): Execute in a specific tab instead of active.
- `timeout` (number): Max wait in ms (default 8000).
- `value` (string): CSS selector, text string, or URL pattern. Not needed for 'stable'/'network'.

### `browser_captcha` (~40 tokens)

Autonomous CAPTCHA detection and solving.

Input parameters:

- `action` (string, required): Action to perform.
- `timeout` (number): Timeout in ms (default 120000).

### `browser_thoughts` (~227 tokens)

Agent-to-user communication. Renders in the middle down of the page. Use 'question' mode to ask a free-text question. Use 'feedback' mode to provide status updates, analysis, or decisions. Supports element anchoring (e.g. 'w:15') and presentation styles ('observation', 'decision', 'warning', 'question').

Input parameters:

- `action` (string, required): Action to perform.
- `anchor` (string): Optional element Ref ID (e.g. 'w:15') or CSS selector to visually anchor this thought to on the page.
- `app` (string): Optional Electron app name. (Note: thought HUD overlay is browser-only).
- `input` (string): Input field type for question mode (default: sentence).
- `message` (string, required): The question to ask, or the feedback/analysis to log.
- `style` (string): Thought presentation style. Defaults to 'observation' for feedback and 'question' for question.
- `timeout` (number): Timeout in seconds for question mode before auto-cancel (default: 120).

### `browser_pointer` (~434 tokens)

Advanced pointer control (hover, click, double_click, drag_and_drop, hover_chain). Use hover_chain for Photoshop/Photopea, Figma, and multi-level flyout submenus.

Input parameters:

- `action` (string): Action to perform (default: click, or hover_chain if hover_chain array is provided).
- `app` (string): Electron app name configured in config.json under 'electron'.
- `chain` (array): Advanced chain step array of { action, ref, label, selector, x, y, holdMs }.
- `clickFinal` (boolean): Default true. Whether to click the final element in the hover chain.
- `end_id` (string): Destination element ID (only for drag_and_drop).
- `end_ref` (string): Destination Ref ID (only for drag_and_drop).
- `end_selector` (string): Destination CSS Selector (only for drag_and_drop).
- `end_target` (string): Alternative destination target identifier or query.
- `end_x` (number): Destination X coordinate (only for drag_and_drop).
- `end_y` (number): Destination Y coordinate (only for drag_and_drop).
- `holdMs` (number): Milliseconds to hold the pointer down (only for hover).
- `hover_chain` (array): Array of element ref IDs, selectors, or labels to hover sequentially and click the last one (e.g. ['File', 'Export As', 'PNG']). Perfect for Photoshop/Photopea, Figma, Canva, and multi-level flyout s…
- `id` (string): Alternative element ID / Ref ID from browser_map.
- `label` (string): Target element label or text.
- `ref` (string): Ref ID of the target element (e.g. w:42).
- `selector` (string): CSS Selector of the target element.
- `target` (string): Alternative target element identifier or query.
- `waitForChild` (string): CSS Selector of a child element to wait for (only for hover).
- `x` (number): Raw X coordinate (fallback).
- `y` (number): Raw Y coordinate (fallback).

### `browser_select` (~68 tokens)

Select an option from a native dropdown.

Input parameters:

- `app` (string): Electron app name configured in config.json under 'electron'.
- `nodeId` (number): CDP backendNodeId.
- `selector` (string): CSS Selector.
- `value` (string, required): The exact text value to select.

### `browser_fill` (~195 tokens)

Smart multi-field form-filling and input inspector. Call with scan:true (or empty) to get a lightweight list of all editable inputs on the page without dumping the full DOM. Fill multiple fields in a single turn.

Input parameters:

- `app` (string): Electron app name configured in config.json under 'electron'.
- `blast_mode` (boolean): Fill all fields simultaneously in a single CDP eval round-trip.
- `fields` (array): Array of field ref+value pairs to fill sequentially.
- `inputs` (boolean): Alias for scan.
- `scan` (boolean): Set true to discover and return all fillable inputs on the page (with ref IDs, types, and values) in ~30 tokens without full browser_map.
- `scan_only` (boolean): Validate field types without mutating DOM.
- `submit` (string): Optional ref ID (w:NN) of a submit button to click after filling all fields.

### `browser_highlight` (~305 tokens)

Highlight elements on page. Supports single or multiple candidates (refs) with styles ('consideration' for candidate evaluation, 'target' for lock-on, 'danger' for destructive actions, 'success', or 'shimmer'), floating badges, and configurable duration.

Input parameters:

- `app` (string): Electron app name configured in config.json under 'electron'.
- `color` (string): Custom CSS color to use for the overlay (e.g. 'rgba(255,0,0,0.5)').
- `duration` (number): Duration in ms to keep highlight visible (default: 2000ms for consideration/target, 600ms for shimmer).
- `id` (string): Alternative element Ref ID from browser_map (e.g. 'w:42').
- `label` (string): Floating label badge text to display above the element(s).
- `nodeId` (number): CDP backendNodeId to highlight directly.
- `ref` (string): Alternative element Ref ID (e.g. 'w:42').
- `refs` (array): Array of element Ref IDs to highlight concurrently (e.g. ['w:12', 'w:15', 'w:23']).
- `selector` (string): CSS Selector of the element to highlight.
- `style` (string): Visual highlight style. Defaults to 'shimmer' (or 'consideration' when refs provided).
- `target` (string): Alternative element identifier, CSS Selector, or query.

### `browser_upload` (~71 tokens)

Upload files to a file input.

Input parameters:

- `app` (string): Electron app name configured in config.json under 'electron'.
- `filePaths` (array, required): List of absolute system file paths to upload.
- `nodeId` (number, required): CDP backendNodeId of the target <input type='file'> element.

### `browser_find` (~111 tokens)

Instant text & keyword search across page text, labels, and placeholders. Returns matched element coordinates, selectors, and ref IDs.

Input parameters:

- `all` (boolean): Set true to return all matching elements on the page (default false returns first match).
- `app` (string): Electron app name configured in config.json under 'electron'.
- `limit` (number): Max number of matches to return when all: true (default 10).
- `query` (string, required): Text or keyword query to search for on the page.

### `browser_storage` (~92 tokens)

Manage localStorage and sessionStorage.

Input parameters:

- `action` (string, required): Action to perform on the storage.
- `app` (string): Electron app name configured in config.json under 'electron'.
- `key` (string): Key name (required for 'get' and 'set' actions).
- `scope` (string, required): Storage scope to manipulate.
- `value` (string): String value (required for 'set' action).

### `browser_network_intercept` (~181 tokens)

Intercept/stub network responses (e.g. mock APIs, block tracking) OR retrieve detailed raw protocol network telemetry (TLS/SSL certificate info, microsecond timing breakdown, and OS-level failure reasons).

Input parameters:

- `action` (string, required): Action to perform: 'enable'/'disable' network response interception, 'get_telemetry' to read captured requests with TLS/SSL certs & timing breakdown, or 'clear_telemetry' to reset buffer.
- `app` (string): Electron app name configured in config.json under 'electron'.
- `mockBody` (string): JSON or plaintext body payload to return in the mocked response.
- `mockStatus` (number): HTTP status code to return when enabling mock (default 200).
- `pattern` (string): URL glob pattern to intercept or filter telemetry (e.g. '*api/login*').

### `browser_console` (~61 tokens)

1-5ms latency. Read or clear buffered console API messages, JS exceptions, and network errors.

Input parameters:

- `action` (string, required): Action to perform on the console buffer.
- `app` (string): Electron app name configured in config.json under 'electron'.

### `browser_pdf` (~113 tokens)

Print the current page to a PDF file.

Input parameters:

- `app` (string): Electron app name configured in config.json under 'electron'.
- `filename` (string): Output filename (e.g. 'report.pdf'). Defaults to capture_<timestamp>.pdf.
- `landscape` (boolean): Print in landscape orientation (default false).
- `pageRanges` (string): Page ranges to print (e.g. '1-5'). Leave empty for all pages.
- `scale` (number): Scale factor (default 1.0).

### `browser_eval` (~82 tokens)

Run arbitrary JS via CDP. Good for extracting app state. Cannot traverse shadow DOM/cross-origin iframes.

Input parameters:

- `app` (string): Electron app name configured in config.json under 'electron'.
- `expression` (string, required): JavaScript code to evaluate in the context of the page.
- `timeout` (number): Timeout in ms (default 5000).

### `browser_cookies` (~106 tokens)

Manage browser cookies.

Input parameters:

- `action` (string, required): Action to perform on cookies.
- `app` (string): Electron app name configured in config.json under 'electron'.
- `domain` (string): Domain for the cookie.
- `name` (string): Cookie name.
- `path` (string): Path for the cookie.
- `url` (string): URL scope for 'get' action (defaults to current page).
- `value` (string): Cookie value (required for 'set').

### `browser_canvas` (~260 tokens)

For ALL canvas content (charts, games, graphs). Use 'get_image' to read pixels, 'draw' to simulate gestures. Do NOT use browser_click here.

Input parameters:

- `action` (string, required): 'get_image' — exports the canvas as a base64 image so you can analyze its visual content (prices, chart patterns, etc). 'draw' — simulates drag/pointer events across canvas points (for drawing, selec…
- `app` (string): Electron app name configured in config.json under 'electron'.
- `backendNodeId` (number): Raw CDP backendNodeId for direct targeting.
- `id` (string): Ref ID from browser_map (e.g. 'w:42') for the canvas element.
- `label` (string): Visible text or aria-label of the canvas element.
- `points` (array): Array of {x,y} points relative to canvas viewport for 'draw' action. Simulates a drag path across the canvas.
- `ref` (string): Alternative ref identifier for the canvas element.
- `selector` (string): CSS Selector for the target <canvas> element. Use 'canvas' to select the first canvas on the page, or a more specific selector like 'canvas#chart'.

### `browser_scrape` (~145 tokens)

Sub-5ms latency, zero waste extraction. Best for batch list extraction, table parsing, targeted data mining. Prefer this over browser_map for pure data extraction. Note: XPath selectors lack shadow-DOM support; use CSS selectors for shadow DOMs.

Input parameters:

- `app` (string): Electron app name configured in config.json under 'electron'.
- `attributes` (array): Attributes to extract (e.g. ['textContent', 'href'], default ['textContent']).
- `multiple` (boolean): Whether to extract multiple elements (default true).
- `query` (string, required): CSS Selector or XPath query to extract.
- `type` (string): Query type (default 'css').

### `browser_snapshot` (~74 tokens)

Capture or restore an MHTML snapshot. Best for offline archival, replay testing, and compliance audits.

Input parameters:

- `action` (string, required): Action to perform.
- `app` (string): Electron app name configured in config.json under 'electron'.
- `filePath` (string, required): Absolute file path to save/load the .mhtml snapshot.

### `browser_screenshot` (~163 tokens)

95-135ms capture. Best for visual layout validation, canvas/image inspection. For multimodal models only. Text-only models should use browser_map or browser_canvas instead.

Input parameters:

- `app` (string): Electron app name configured in config.json under 'electron'.
- `clip` (object): Clip region. Use to capture only part of the page (e.g. just a chart area) to reduce token cost.
- `format` (string): Capture format. 'jpeg' is smaller and faster for large pages. Default 'png'.
- `fullPage` (boolean): If true, captures the full scrollable page. Default false (viewport only).
- `quality` (number): JPEG quality 0-100 (default 90). Only used when format is jpeg.

### `browser_viewport` (~100 tokens)

Set viewport dimensions and device emulation.

Input parameters:

- `action` (string, required): Action to perform.
- `app` (string): Electron app name configured in config.json under 'electron'.
- `deviceScaleFactor` (number): Device Pixel Ratio (default 1).
- `height` (number): Viewport height in pixels.
- `mobile` (boolean): Whether to emulate a mobile device (default false).
- `width` (number): Viewport width in pixels.

### `browser_clipboard` (~120 tokens)

Read or write to the system clipboard.

Input parameters:

- `action` (string, required): Action to perform.
- `app` (string): Electron app name configured in config.json under 'electron'.
- `dataUrl` (string): Base64 data URL of an image to write to clipboard (e.g. 'data:image/png;base64,...').
- `mimeType` (string): MIME type override for image write (auto-detected from dataUrl by default, e.g. 'image/png').
- `text` (string): Text to write to clipboard (for write action).

### `browser_inspect` (~95 tokens)

15-35ms latency, zero waste. Deep DOM inspection. Useful for debugging failed clicks, verifying z-index & visibility, or computed styles.

Input parameters:

- `app` (string): Electron app name configured in config.json under 'electron'.
- `nodeId` (number): CDP backendNodeId.
- `ref` (string): Ref ID (e.g. 'w:42').
- `selector` (string): CSS Selector.

### `browser_extract_design` (~252 tokens)

Extract design tokens (colors, typography, spacing, shadows, CSS variables), semantic HTML layouts, and clean CSS into structured files and an LLM design blueprint. Ideal for cloning websites, UI components, and design systems with 100% pixel fidelity.

Input parameters:

- `app` (string): Electron app name configured in config.json under 'electron'.
- `format` (string): Format preset for extracted styles: 'tailwind' (default, generates tailwind.theme.json), 'vanilla_css' (generates scoped styles), or 'tokens_only' (design tokens only).
- `hideOverlay` (boolean): Whether to hide Weavetab overlay during capture (default true).
- `includeAssets` (boolean): Whether to capture inline SVGs and asset references (default true).
- `name` (string): Optional custom name for the saved design folder (e.g. 'resend-hero', 'pricing-section').
- `outputDir` (string): Optional custom directory to write extracted files into. If omitted, uses configured designDir (~/.weavetab/designs/<domain>-<timestamp>/).
- `selector` (string): CSS selector of the container element to extract (default 'main', falls back to 'body').

### `browser_automation` (~133 tokens)

Inject self-running background script for monitoring/polling. Cleared on tab close. Don't use persistent scripts for expensive ops.

Input parameters:

- `action` (string, required): Action to perform.
- `app` (string): Electron app name configured in config.json under 'electron'.
- `id` (string): Unique script identifier (required for start/stop).
- `onResult` (string): How to handle script results (default 'store').
- `persistent` (boolean): If true, the script re-runs in a loop (default false).
- `script` (string): JavaScript code to inject and run (required for start).

### `browser_recording` (~166 tokens)

Record video screencast for compliance/audit. Compiles captured frames into video/animation (.webp, .gif, .webm, .mp4).

Input parameters:

- `action` (string, required): Action to perform.
- `app` (string): Electron app name configured in config.json under 'electron'.
- `format` (string): Output video format when stopping recording. Default 'webp' (pure Node native compilation).
- `fps` (number): Frames per second (1-10, default 3).
- `keepFrames` (boolean): If true, keeps raw JPEG frames after video compilation (default false).
- `maxFrames` (number): Maximum frames to capture (default 500).
- `sessionId` (string): Unique recording session ID (required for start/stop).

### `browser_detect` (~51 tokens)

CRITICAL INITIALIZATION TOOL. Detect available browsers and configured desktop apps (Discord, Slack, etc.). Call this FIRST before interacting with the environment to know if apps are online/offline and what tabs they have open.

### `browser_performance` (~31 tokens)

Retrieve page performance metrics.

Input parameters:

- `app` (string): Electron app name configured in config.json under 'electron'.

### `browser_pattern_learn` (~367 tokens)

Read, register, update, and record execution outcomes for named workflow patterns and site quirks in ~/.weavetab-system/memory/sites/. Use action='get' at session start to inspect a site profile and decide between fast-path replay (reliability ≥ 0.8) or exploratory navigation. Use action='learn' after completing a multi-step flow to persist it. Use action='record_execution' to update reliability scores after replay attempts.

Input parameters:

- `action` (string): 'get': inspect site profile and known workflow patterns. 'learn': create/update a named pattern. 'record_execution': update reliability after replay. 'record_quirk': store a site quirk.
- `duration_ms` (number): Execution duration in ms (optional for 'record_execution').
- `entry` (string): URL path or pattern where this workflow starts.
- `name` (string): Pattern name in snake_case (required for 'learn' and 'record_execution').
- `origin` (string): Full origin associated with the pattern, e.g. 'https://github.com'. Required for write actions. If omitted with action='get', reads the active tab origin.
- `pattern` (string): With action='get': returns reliability score for this specific named pattern only.
- `quirk_data` (object): Quirk payload object (required for 'record_quirk').
- `quirk_key` (string): Quirk key: 'cookie_banner', 'rate_limit', or 'modal_popups' (required for 'record_quirk').
- `steps` (array): Ordered workflow steps (required for 'learn').
- `success` (boolean): Whether the execution succeeded (required for 'record_execution').
- `success_indicator` (string): CSS selector or URL fragment confirming workflow success.

### `browser_github` (~266 tokens)

Interact with GitHub repositories without burning browser turns. Analyze repo trees, read raw source files, search/inspect issues, and examine PR diffs and review comments.

Input parameters:

- `action` (string, required): GitHub operation: 'analyze' (repo structure & README), 'read' (raw file contents), 'issues' (list/search/inspect issues), 'pr' (PR details, diff files & comments).
- `labels` (array): For action: 'issues'. Filter issues by labels.
- `limit` (number): For action: 'issues'. Max number of issues to list (default 5).
- `line_range` (array): For action: 'read'. Optional [start, end] line range (1-indexed).
- `number` (number): For action: 'issues' or 'pr'. Issue or PR number to fetch details and comments.
- `paths` (array): For action: 'read'. File paths relative to repo root.
- `repo` (string): Optional 'owner/repo' slug or GitHub URL. If omitted, uses active tab's repository.
- `search` (string): For action: 'issues'. Search query to find issues.
- `state` (string): For action: 'issues'. Filter issues by state.

### `browser_office` (~370 tokens)

Read and extract structured content from office documents (Excel, Word, PDF, CSV). Note: PDF/Word extraction requires local binary dependencies (e.g., poppler) and output is truncated by max_chars/max_rows limits. Two modes:
\- **url** — fetch a document URL using the browser's live session cookies (works for authenticated downloads, SharePoint, Google Drive exports, etc). Automatically detects format from URL or MIME type.
\- **file** — parse a file that was already downloaded to the local downloads directory (bare filename only, e.g. 'report.xlsx').

Supported formats: .xlsx/.xls (returns per-sheet JSON tables), .docx (returns extracted text), .pdf (returns page text + metadata), .csv (returns row objects).

Use 'list' action first if you don't know what files are in the downloads directory.

DO NOT use browser_scrape or browser_map for binary documents — they cannot read inside Excel, Word, or PDF files.

Input parameters:

- `action` (string, required): 'read' — parse a document and return its content. 'list' — show all files in the downloads directory.
- `file` (string): Bare filename (e.g. 'report.xlsx') of a file already in the local downloads directory. No path separators allowed.
- `max_chars` (number): Max characters to return for PDF/Word text (default 50000).
- `max_rows` (number): Max rows to return for Excel/CSV (default 500). Increase if you need more data.
- `url` (string): URL of the document to fetch and parse in-browser (using active session cookies). Supports .pdf, .xlsx, .xls, .docx, .csv. Use for authenticated downloads, SharePoint links, Google Drive exports.

### `browser_emulate` (~166 tokens)

Emulate browser conditions over CDP: network throttling (Slow 3G, Fast 3G, 4G, Offline), CPU throttling rate, Geolocation coordinates, Timezone, and User Agent string overrides.

Input parameters:

- `app` (string): Electron app name configured in config.json under 'electron'.
- `cpuThrottlingRate` (number): CPU slowdown multiplier (e.g. 2 = 2x slowdown, 4 = 4x slowdown, 1 = disable)
- `geolocation` (object): Override geolocation coordinates
- `network`: Network throttling profile or custom parameters
- `timezoneId` (string): Override browser timezone (e.g. 'America/New_York')
- `userAgent` (string): Override User Agent string

### `browser_checkpoint` (~138 tokens)

Snapshot and restore browser state (cookies, localStorage, sessionStorage, and scroll/URL) into named checkpoints to time-travel and rollback failed automation branches.

Input parameters:

- `action` (string, required): Action to perform: 'save' a new checkpoint, 'restore' an existing checkpoint, 'list' all checkpoints, or 'delete' a checkpoint.
- `app` (string): Electron app name configured in config.json under 'electron'.
- `includeDom` (boolean): Whether to include a lightweight DOM snapshot during 'save' (default false).
- `name` (string): Checkpoint name identifier (required for 'save', 'restore', 'delete').

## Diagnostics

Captured diagnostic sections: Provenance, Vulnerabilities, Dependencies. The full working is on the page: https://verifymcp.io/servers/dev-weavetab-mcp/weavetab-mcp#diagnostics

## Score history

- 2026-10-23: 64
- 2026-10-22: 64
- 2026-10-21: 64
- 2026-10-20: 64
- 2026-10-19: 64
- 2026-10-18: 64
- 2026-10-17: 49

## Common questions

### What is the Weavetab MCP server?

Weavetab is an MCP server listed in the public MCP registry as dev.weavetab/mcp. Open automation engine for AI agents. Control live browsers and desktop apps locally. This page covers its npm package (@weavetab/mcp).

### Is the Weavetab MCP server safe to use?

Weavetab scores 64 out of 100 on VerifyMCP. We recorded 6 known advisories against it as of 23 October 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the Weavetab MCP server expose?

Weavetab exposes 42 tools: browser_map, browser_navigate, browser_click, browser_type, browser_type_secret, and 37 more. Their descriptions and schemas cost roughly 7,497 tokens of context every time the server is loaded.

### Is the Weavetab MCP server still maintained?

Weavetab is still listed as active in the MCP registry. We last reached this channel on 23 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What licence is the Weavetab MCP server under?

Weavetab declares the AGPL-3.0-only licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

## Links

- npm package: https://www.npmjs.com/package/@weavetab/mcp
- Socket report: https://socket.dev/npm/package/@weavetab/mcp
- Repository: https://github.com/Weavetab/mcp
- Changelog RSS feed: https://verifymcp.io/servers/dev-weavetab-mcp/weavetab-mcp.xml
- Changelog JSON feed: https://verifymcp.io/servers/dev-weavetab-mcp/weavetab-mcp.json
- HTML version of this page: https://verifymcp.io/servers/dev-weavetab-mcp/weavetab-mcp
