# Aginx Browser (remote · browser.aginx.net)

Stealth web browser for agents: search, fetch, click, download and type in persistent MCP sessions.

- Trust score: 75/100 (medium)
- Change this week: +3
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-09-20

## Components

- remote · `browser.aginx.net`: 75/100 (this document), [markdown](https://verifymcp.io/servers/net-aginx-aginxbrowser/browser.md), [page](https://verifymcp.io/servers/net-aginx-aginxbrowser/browser)

## Channel facts

- Endpoint: `https://browser.aginx.net/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `0.5.1`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-09-20.

- **Endpoint Security**: 57/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation not fully verified: no authorisation is required to call this server, and 37 tool(s) never declared a destructiveHint. The MCP spec treats an absent hint as destructive by default, so we cannot call this surface safe.
  - HTTPS is enforced; there's no plaintext access path.
  - HSTS check failed: the Strict-Transport-Security header is absent.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 67/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 8647 tokens (~233/item across 37 items; 37 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 100/100
  - No destabilizing schema changes in the last 30 days.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Tool Safety**: 75/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - 0 of 3 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "account_delete" implies "delete" and declares no destructiveHint at all, which the MCP spec reads as destructive by default.
  - An AI judge read all 37 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a current MCP spec version (2026-07-28).

## Install

### How do I install the Aginx Browser MCP server?

Aginx Browser is a hosted endpoint at https://browser.aginx.net/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add --transport http net-aginx-aginxbrowser 'https://browser.aginx.net/mcp'
```

### Cursor

```json
{
  "mcpServers": {
    "net-aginx-aginxbrowser": {
      "url": "https://browser.aginx.net/mcp"
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "net-aginx-aginxbrowser": {
      "type": "http",
      "url": "https://browser.aginx.net/mcp"
    }
  }
}
```

### Codex

```toml
[mcp_servers.net-aginx-aginxbrowser]
url = "https://browser.aginx.net/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "net-aginx-aginxbrowser": {
      "type": "remote",
      "url": "https://browser.aginx.net/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add net-aginx-aginxbrowser --url 'https://browser.aginx.net/mcp' --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  net-aginx-aginxbrowser:
    url: "https://browser.aginx.net/mcp"
```

### Netclaw

```json
{
  "McpServers": {
    "net-aginx-aginxbrowser": {
      "Transport": "http",
      "Url": "https://browser.aginx.net/mcp"
    }
  }
}
```

### Vellum

```bash
assistant mcp add net-aginx-aginxbrowser -t streamable-http -u 'https://browser.aginx.net/mcp'
```

### Other

```json
{
  "mcpServers": {
    "net-aginx-aginxbrowser": {
      "type": "http",
      "url": "https://browser.aginx.net/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-09-20 (score 75, 0)

- [security] Stability: 0.97 → pass
- [security] Tool “session_challenges” rewrote its description, which is the text the model reads
- [functional] Server version: 0.5.0 → 0.5.1

### 2026-09-19 (score 75, +1)

- [security] Tool “session_click” rewrote its description, which is the text the model reads
- [security] Tool “session_drag” rewrote its description, which is the text the model reads
- [security] Tool “session_input” rewrote its description, which is the text the model reads
- [functional] Server version: 0.4.5 → 0.5.0
- [cosmetic] “session_drag” added an optional parameter “humanize”
- [cosmetic] “session_drag” reworded the description of “delay_ms”
- [cosmetic] “session_drag” reworded the description of “steps”

### 2026-09-18 (score 74, 0)

- [functional] MCP protocol: Implements a current MCP spec version (2026-07-28).
- [functional] MCP protocol version: 2025-11-25 → 2026-07-28
- [functional] Server version: 0.4.4 → 0.4.5

### 2026-09-17 (score 74, 0)

- [functional] Server version: 0.4.3 → 0.4.4

### 2026-09-16 (score 74, +1)

No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-15 (score 73, 0)

- [functional] Server version: 0.4.2 → 0.4.3

### 2026-09-14 (score 73, +1)

No change was recorded against any check on this day. Stability & Change Management went from 77 to 80. That category is still filling its 30-day observation window: 23 days of observed history at the previous scan, 24 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-13 (score 72, 0)

- [security] Tool “render_markdown” rewrote its description, which is the text the model reads
- [security] Tool “render_video” rewrote its description, which is the text the model reads
- [security] Tool “session_export” rewrote its description, which is the text the model reads
- [functional regression] Schema quality: 6575 → 8387
- [functional] Server version: 0.4.1 → 0.4.2
- [functional] New tool “account_verify”
- [functional] New tool “account_delete”
- [functional] New tool “account_list”
- [functional] New tool “flow_run”
- [functional] New tool “session_challenges”
- [functional] New tool “session_set_files”
- [cosmetic] “import_curl” added an optional parameter “account”
- [cosmetic] “render_markdown” added an optional parameter “motion”
- [cosmetic] “render_video” added an optional parameter “burn_subtitles”
- [cosmetic] “session_create” added an optional parameter “account”
- [cosmetic] “session_eval” added an optional parameter “timeout_ms”
- [cosmetic] “session_export” reworded the description of “format”

## MCP tools (37)

### `account_delete` (~82 tokens)

Delete a named login identity: stored record AND live jar. Cookie values are credentials — delete means gone. Sessions currently running as the account keep their in-process jar handle, but nothing writes back. Returns {deleted: name}, or an error naming the account if it does not exist.

Input parameters:

- `name` (string, required): The account to delete: stored record AND live jar.

### `account_list` (~91 tokens)

List named login identities (the multi-account layer) with metadata only: name, cookie domains, cookie count, updated_at, the last account_verify verdict, and the identity's persona User-Agent (each account is one stable device: its own UA and hardware fingerprint, drawn once and reused). Cookie values are credentials and never leave the server. Use to see which identities exist before session_create {account} picks one.

### `account_verify` (~199 tokens)

Check whether a named account is still logged in. Teach-once: the first call passes url + predicate (a JS expression truthy on a logged-in page, e.g. !!document.querySelector('.user-nick')); the spec is remembered and later calls can be bare. Runs in a scratch session AS the account (private jar), so the probe doubles as a cookie refresh. Returns {name, logged_in, url, checked_at}.

Input parameters:

- `name` (string, required): The account to check.
- `predicate` (string|null): Teach-once: a JS expression that is truthy when logged in, e.g. `!!document.querySelector('.user-nick')`. Remembered after the first call — later calls can pass neither and rerun the spec.
- `url` (string|null): Teach-once: the page that shows login state (its login wall if the account is logged out). Remembered after the first call.

### `cache` (~276 tokens)

Query the LOCAL CACHE of every page this server has fetched and every search it has run. Check here BEFORE re-fetching or re-searching — a hit is instant and free while a fresh fetch costs 5-60s. Use query for full-text search (works for Chinese substrings and English words), get to pull a page's full cached content, stats for counts, clear to delete rows.

Input parameters:

- `all` (boolean): With clear: delete everything cached for this caller
- `clear` (boolean): Delete matching rows instead of returning them (requires url, since_hours, or all)
- `get` (string|null): Return the FULL cached content of this exact URL instead of listing hits
- `kind` (string|null): Which rows to search: "auto" (default, pages + searches), "pages", or "searches"
- `limit` (integer): Maximum rows returned (default: 10, max 100)
- `query` (string|null): Full-text search over cached page contents, titles, URLs and past search queries. Omit to list the latest rows.
- `since_hours` (integer|null): Only rows stored within the last N hours
- `stats` (boolean): Return row counts and database size instead of rows
- `url` (string|null): Only rows whose URL contains this substring

### `click` (~162 tokens)

Click an element on a one-off page: loads `url` in a fresh browser context (stateless — no cookies unless passed, no shared state with other calls), waits `wait_secs` after load before clicking, then fires a DOM click on the first CSS-selector match. The click may trigger navigation (link, form submit) — the response `url` and `text_after` are read after that navigation lands. Returns `clicked:false` when the selector matches nothing. For multi-step interaction on a shared page use session_click instead.

Input parameters:

- `selector` (string, required): CSS selector of element to click
- `url` (string, required): The URL to load
- `wait_secs` (integer|null): Seconds to wait for the page to settle after load, before clicking

### `download` (~190 tokens)

Download a file over HTTP(S) with streaming to disk (no memory buffering), SHA-256 integrity hash, and optional resume of interrupted transfers. Filename resolution: explicit param → Content-Disposition → URL tail. Use for binaries, archives, datasets, documents - anything where the agent wants the FILE saved, not its text content read.

Input parameters:

- `cookies` (array): Cookies to send with the request: `"name=value"` strings or CDP-style objects `{"name","value","domain",...}` for gated downloads
- `filename` (string|null): Explicit output filename. When omitted: Content-Disposition → URL tail → "download"
- `resume` (boolean): Resume an interrupted download when a local partial file exists
- `url` (string, required): URL of the file to download (http/https)
- `use_proxy` (boolean): Route through proxy (default: false; auto-enabled for known blocked domains)

### `eval` (~145 tokens)

Execute JavaScript on a one-off page: loads `url` in a fresh browser context, optionally waits `wait_secs` for the page to settle, evaluates `script` (async/Promise supported) and returns `{url, result}`. Script-driven navigation (location.href, form submit) is drained and reflected in the returned `url`. Stateless — no cookies or page state shared with other calls; when the script needs prior page state or a login, use session_eval.

Input parameters:

- `script` (string, required): JavaScript code to execute (supports async/Promise)
- `url` (string, required): The URL to load
- `wait_secs` (integer|null): Seconds to wait before executing

### `fetch` (~445 tokens)

Fetch a webpage and return clean markdown/html/text. Use whenever the agent needs to READ any web page - blogs, docs, articles, JS-rendered SPAs, Cloudflare-protected sites. Static pages are served over plain HTTP (~100ms tier:"http"); pages that need JS get the full browser (tier:"browser"). render_tier selects auto (default) / http (pure HTTP, refuses the upgrade) / obscura (always browser).

Input parameters:

- `auto_bypass_challenge` (boolean): Auto-detect and bypass Cloudflare Turnstile challenges (default: true)
- `capture_xhr` (array|null): Capture script-initiated API responses: a list of URL substrings (e.g. ["/api/"]) whose matching fetch/XHR bodies come back in an `xhr` array; an empty list captures every XHR/Fetch. Forces browser r…
- `format` (string): Output format: "markdown", "html", or "text" (default: markdown)
- `js_extract`: JS expression to extract from the page after rendering
- `max_chars` (integer): Maximum characters to return (default: 50000)
- `render_tier`: Rendering strategy: "auto" (default), "http", or "obscura"
- `sanitize` (boolean): Strip prompt-injection payloads from the text output (default true): zero-width/steganographic characters, instruction-shaped lines ("ignore previous instructions", chat markup tokens, CJK variants),…
- `selector` (string|null): CSS selector to extract specific content
- `tls_fingerprint` (string|null): TLS fingerprint override (stealth mode only): "chrome145", "firefox133", etc.
- `url` (string, required): The URL to fetch
- `use_proxy` (boolean): Route through proxy (for blocked foreign sites)
- `wait_secs` (integer|null): Seconds to wait for JS rendering

### `flow_run` (~333 tokens)

Run a flow — a recorded, editable JSON browser-session script — deterministically, with zero model tokens. Steps are {op, args, expect?, save?}: ops cover navigate/click/click_xy/input/scroll/eval/wait/screenshot/state/cookies; {{var}} placeholders in args are filled from vars; expect asserts (url_contains | selector | text_contains | eval_truthy) abort with evidence on failure; save collects a step's output into the receipt. Source the flow inline via "flow", or by "name" from the server's workflow/<name>/flow.json (unknown name → error lists installed workflows). Pass session_id to reuse a live session (e.g. from import_curl) so login state and flows compose. The receipt carries status ok/failed, saved outputs, the session_id (kept alive), and on failure the failing step, reason and a diagnostic screenshot — fix the flow or take the session over from there.

Input parameters:

- `flow`: Inline flow document: {create?, vars?, steps:[{op, args, expect?, save?}]}
- `name` (string|null): Or run a server-side workflow/<name>/flow.json asset. An unknown name errors back with the list of installed workflows — that error is the discovery call.
- `session_id` (string|null): Reuse a live session (e.g. from import_curl) instead of creating a fresh one — that's how login state and flows compose.
- `vars`: Values for {{placeholders}} in step args; wins over the flow's own vars defaults.

### `import_curl` (~237 tokens)

Import login state from a real browser in one paste. The human logs into a site in their own Chrome (solving the CAPTCHA/SMS once), opens DevTools → Network, right-clicks any authenticated request → "Copy as cURL", and passes the command here. Returns a live session_id already carrying that site's cookies and sitting on the copied request's URL — the agent continues from where the human left off, no password or second login needed. Works with bash, PowerShell and cmd copy flavors.

Input parameters:

- `account` (string|null): Attach the session to a named account: the imported login lands in the account's private jar and is written back under its name after every action — one import per identity, no clobbering.
- `curl` (string, required): A "Copy as cURL" command pasted from Chrome DevTools (Network panel → right-click any authenticated request). bash, PowerShell and cmd flavors all parse; the cookie set is injected and the session na…
- `use_proxy` (boolean): Route the session's traffic through the engine proxy.

### `render_markdown` (~1213 tokens)

Render a markdown document into a deterministic, self-contained HTML artifact - the document layer, so the agent never writes HTML by hand. Prose rides a plain offline shell (no fonts, no scripts); archify fenced code blocks carry typed zero-coordinate diagram JSON (sequence, workflow, architecture, dataflow, lifecycle families) and render to inline SVG via the layout engine. Same input, same bytes: the receipt carries the sha256 so determinism is verifiable. theme picks light (default) or dark; preset picks the palette family — classic (default), signal-flow, blueprint, editorial — orthogonal to theme; colors bake at generation time (presentation attributes, not CSS variables), and the receipt records both preset and theme. quality picks the composition audit profile — standard (default) or showcase, the delivery gate: the receipt's diagrams[].composition grades route crossings, ambiguous corridors, label clearance (2px standard / 4px showcase), route rhythm, and node text projected to the 930px reader width; the audit never changes the artifact bytes. Mermaid sources are the agent's job to translate, not the engine's: flowchart/graph → workflow (lanes + columns), sequenceDiagram → sequence, stateDiagram-v2 → lifecycle (bands), erDiagram/class → architecture (grid + boundaries) — read the topology and emit the matching zero-coordinate archify JSON; the engine accepts only archify JSON. A broken diagram degrades to a visible code block and lands in receipt.diagnostics; an authored route preset that cannot be honored is self-repaired to a verified semantic substitute and disclosed in receipt diagrams[].repairs - the document still renders. A fence may also carry views: [{id,label,nodes,note?}] (node ids of the active family), emitted as guided-view tabs above the diagram plus an inlined viewer script - clicking a tab lights the member nodes and the routes between them (subgraph), clicking a node lights it with its direct neighbors (ego graph), everything else dims;…

Input parameters:

- `markdown` (string, required): Full markdown document. Prose rides a plain offline shell; archify fenced code blocks carry typed zero-coordinate diagram JSON and render to inline SVG.
- `motion` (boolean|null): Bake the entrance choreography into the artifact (default false): pure-declarative CSS animation — headings split into per-glyph/per- word spans that rise in with expo easing, prose blocks stagger up…
- `preset` (string|null): Visual preset: "classic" (default), "signal-flow", "blueprint", or "editorial" — a palette family orthogonal to theme (each preset exists in both light and dark). The receipt records preset and theme…
- `quality` (string|null): Quality profile for the composition audit: "standard" (default) or "showcase" — the delivery gate. The audit grades route crossings, corridors, label clearance, rhythm, and projected text size in the…
- `session_id` (string|null): Optional session ID: also load the rendered HTML into that live session (local and free) so session_screenshot / session_state can verify the artifact
- `theme` (string|null): Color theme: "light" (default) or "dark" — the shell background/ foreground and every SVG palette slot swap together; the receipt records which theme produced the bytes

### `render_pdf` (~445 tokens)

Cut a rendered page into pages and package as PDF, PNGs, PPTX or DOCX. Print mode (no selector) paginates the document into fixed-height pages (default 794x1123, A4 @96dpi), breaking at top-level block boundaries — no half-cut text where a break can land on a block edge. Slides mode (selector set) makes one page per match, sized to that element — generate an HTML deck with one .slide per page and each becomes a deck page. format "pdf" (default) returns base64 image-based PDF; "png" returns one base64 PNG per page in pages_base64; "pptx" returns a base64 PPTX (one slide per page, deck-sized to the largest page); "docx" returns a base64 DOCX (one page-sized section per page, each section keeps its own height). Returns page count and packaging.

Input parameters:

- `format` (string): Output format: "pdf" (default), "png" (one base64 PNG per page), "pptx" (one slide per page, image-based), "pptx-native" (editable: element-level DrawingML — real text runs, gradient shapes, image pa…
- `height` (integer): Page height in CSS pixels — print pagination only. Default 1123.
- `jpeg_quality` (integer): JPEG quality for PDF page embedding (1-100). Default 90.
- `max_pages` (integer): Safety cap on emitted pages. Default 50.
- `selector` (string|null): CSS selector; present → slides mode (one page per match, sized to the element). Absent → print mode (fixed-height pages at block boundaries).
- `tls_fingerprint` (string|null): TLS fingerprint override (stealth mode only)
- `url` (string, required): Page URL to cut into pages.
- `use_proxy` (boolean): Route through proxy (for blocked foreign sites)
- `width` (integer): Page width in CSS pixels. Default 794 (A4 @96dpi).

### `render_video` (~575 tokens)

Render a page's animation timelines to an MP4 video. The page's scripts must expose `window.__timelines` — objects with `duration()` and `pause(t)` (a paused gsap.timeline registered there works as-is). Each frame seeks every timeline to t=i/fps and paints the viewport, so the output is deterministic — no wall clock in the pixel values. Audio: `narration[]` places TTS/voice clips at start times (mixed into one AAC track), `audio` adds looped background music, and `subtitles_srt` muxes an SRT as a soft mov_text track and (by default, `burn_subtitles: false` to opt out) burns the same cues into the frame pixels — QuickTime, WeChat and most social embeds ignore the soft track. Requires ffmpeg on the server. Returns base64 MP4 (H.264, yuv420p) plus frame count and durations.

Input parameters:

- `audio`: Background music: looped to cover the video, volume-scaled, faded out at the tail.
- `burn_subtitles` (boolean|null): Burn the cues into the frame pixels too (hardsub) — on by default when `subtitles_srt` is present; QuickTime, WeChat and most social embeds ignore the soft mov_text track. `false` keeps the soft trac…
- `fps` (number): Frames per second. Default 24.
- `height` (integer): Viewport height in CSS pixels. Default 720.
- `hold_tail_secs` (number): Freeze the final timeline state for this many extra seconds. Default 0.5.
- `max_duration_secs` (number): Safety cap on timeline + hold tail, seconds. Default 120.
- `narration` (array): Voiceover clips, each starting at its own time (any TTS output; mixed into one AAC track).
- `subtitles_language` (string|null): ISO language tag for the subtitle track, e.g. "eng" / "zh".
- `subtitles_srt` (string|null): Inline SRT subtitles muxed as a soft (toggleable) mov_text track.
- `tls_fingerprint` (string|null): TLS fingerprint override (stealth mode only)
- `url` (string, required): Page URL whose scripts register timelines in `window.__timelines` (GSAP-style objects with `duration()` + `pause(t)`).
- `use_proxy` (boolean): Route through proxy (for blocked foreign sites)
- `wait_timelines_ms` (integer): How long to wait for `window.__timelines` to appear, ms. Default 10000.
- `width` (integer): Viewport width in CSS pixels (floored to even — yuv420p). Default 1280.

### `search` (~296 tokens)

Search the web across Baidu/Bing/Sogou/WeChat/Google (aggregated + deduped) and optionally fetch the top results' full content. Use when the agent needs to FIND information online - replaces a search API. Supports image search returning direct image URLs. Optional engines: ["baidu"]-style filter by engine name (invalid names error with the valid list; /doctor lists them with live health). Optional time_range day/week/month/year for news freshness (engines without dated results ignore it). Response carries engine_errors explaining any engine that contributed nothing (CAPTCHA suspension, transient failure).

Input parameters:

- `categories` (string): Search categories (default: general)
- `engines` (array): Restrict to these engine names (e.g. ["baidu"], ["sogou_wechat"]). Empty = all engines serving `categories`. Invalid names return an error listing the valid ones.
- `fetch_top` (integer): Fetch content for top N results
- `max_chars_per` (integer): Max characters per result content
- `max_results` (integer): Maximum number of results (default: 10)
- `q` (string, required): Search query
- `time_range` (string|null): Freshness window: "day" | "week" | "month" | "year". Honored by engines with dated results (e.g. bing_news filters by pubDate); others ignore it.

### `session_challenges` (~218 tokens)

One-call risk-control report: did this session hit an anti-bot wall? Taobao/tmall's x5 risk control answers 200 like a normal response — either a redirect onto a punish page (_____tmd_____/punish, punish.taobao.com) or an MTop API body carrying FAIL_SYS_USER_VALIDATE / RGV587 / x5secdata. Returns {total, events:[{url,method,status,kind,via}]} where via says whether the wall was navigated into ("url") or swallowed by an API response ("body"). When there are hits, the response also carries the account name (which identity got walled) and a `handoff` instruction: the engine detects and surfaces but does not auto-bypass — a human opens the live view (/live?session=<id> on the engine's HTTP port), solves the challenge in this session, and the retry rides the cookie that solving sets. Detection only; no automated solving or bypass.

Input parameters:

- `session_id` (string, required): Session ID

### `session_click` (~211 tokens)

Click an interactive element by its index (from session_state output) inside a live browser session: scrolls it into view and fires a DOM click on the session's current page. Before clicking it re-verifies the element in the same frame — if the page changed since session_state (element detached, disabled, hidden, or covered by an overlay), it returns `clicked:false` with a `reason` ("detached"/"disabled"/"not_visible"/"covered_by") and, when covered, a `covered_by` description of the element that would eat the click — never a silent no-op. A submit click may navigate the session — the returned `url`/`text_after` reflect the page after the action, and session state (cookies, localStorage, globals) persists for follow-up calls. Indexes come from the most recent session_state; re-list after navigation.

Input parameters:

- `index` (integer, required): Element index (from /state output)
- `session_id` (string, required): Session ID

### `session_click_xy` (~150 tokens)

Click at viewport coordinates (CSS pixels) via real mouse events — pointerdown/mousedown, pointerup/mouseup, then click on whatever element is hit there. For canvas/map surfaces with no DOM element to index. click_count 2 adds dblclick.

Input parameters:

- `button` (string|null): Mouse button: "left" (default), "right", "middle"
- `click_count` (integer|null): Click count: 1 single (default), 2 adds dblclick, 3+ sets detail
- `session_id` (string, required): Session ID
- `x` (number, required): Viewport X coordinate in CSS pixels
- `y` (number, required): Viewport Y coordinate in CSS pixels

### `session_clone` (~104 tokens)

Derive a new browser session from a live one, carrying the full login state: cookies, localStorage/sessionStorage, viewport pin, dialog policy, proxy and keepalive flags. The source session stays untouched. Use to snapshot a logged-in state before risky actions, or to run the same login in parallel tabs. Returns {session_id (new), cloned_from, url, viewport}.

Input parameters:

- `session_id` (string, required): Session ID to derive from (stays alive and untouched)

### `session_close` (~52 tokens)

Close a browser session and free its resources. For a persistent session this also drops the on-disk login snapshot - idle expiry keeps it, an explicit close does not.

Input parameters:

- `session_id` (string, required): Session ID

### `session_console` (~216 tokens)

Read the session's recent page console output (log/info/warn/error) as {url, total, matched, messages:[{ts_ms, level, text, url}]}, newest last. Ring buffer of 500 entries; captures output from page scripts, clicks, evals and navigation alike. Optional filters: level (exact, e.g. "error"), since_ts (epoch ms), url_contains (page URL substring), limit (most recent N matches). The fastest way to see WHY a page misbehaves: click the button, call this, read the error.

Input parameters:

- `level` (string|null): Only entries at this level: "log" | "info" | "warn" | "error"
- `limit` (integer|null): Keep only the most recent N matching entries
- `session_id` (string, required): Session ID
- `since_ts` (integer|null): Only entries logged at or after this Unix epoch millisecond timestamp
- `url_contains` (string|null): Only entries whose page URL contains this substring

### `session_cookies` (~65 tokens)

Export the session's current cookies as ["name=value", ...] for the page's URL. Use to persist a logged-in session and replay it later via session_create with cookies. Round-trips with session_create's cookies field.

Input parameters:

- `session_id` (string, required): Session ID

### `session_create` (~580 tokens)

Create a persistent interactive browser session for multi-step interaction - clicking, typing, scrolling, reading state across page transitions. Use when the agent must INTERACT with a page (login flows, forms, pagination, click-through) rather than read it once. Returns session_id; persists 8 min idle. With persistent:true the login state survives idle eviction and server restarts - the same session_id revives logged-in.

Input parameters:

- `account` (string|null): Run as a named login identity (the multi-account layer): a private cookie jar seeded from the account record, write-back to the account store after every action. Concurrent logins (`taobao-scraper` v…
- `cookies` (array): Cookies to inject before navigation: `"name=value"` strings or CDP-style objects `{"name","value","domain",...}`. Lets the session start already logged-in. Round-trips with session_cookies.
- `height` (integer|null): Initial viewport height in CSS pixels.
- `keepalive` (boolean): Exempt the session from the idle reaper: it lives until session_close or server exit, so a workflow interrupted by long non-browser steps keeps its login state.
- `mobile` (boolean): Mobile device emulation (coarse pointer, no hover) for the initial viewport.
- `persistent` (boolean): Persist the login state (cookies + localStorage/sessionStorage + viewport + dialog policy) to the server's local store after every action. If the session idles out — or the whole server restarts — th…
- `storage`: Web Storage to inject after the initial navigation lands: {"local_storage": {"k":"v"}, "session_storage": {"k":"v"}}. For login states that live in localStorage rather than the cookie jar. Round-trip…
- `ttl_secs` (integer|null): Idle time-to-live in seconds before the session is evicted (default: 480, clamped 60..3600). Raise it for long workflows.
- `url` (string|null): Initial URL to navigate to (optional)
- `use_proxy` (boolean): Route through proxy (default: false)
- `width` (integer|null): Initial viewport width in CSS pixels. Pinned for the session's life (survives navigation) so element rects and media queries anchor to the same layout across every page of the visit.

### `session_dialog` (~174 tokens)

Inspect or flip the session's dialog policy for window.alert/confirm/prompt. Dialogs never block the page: each is auto-answered (default dismiss) and logged into session_console at level "dialog". action "list" reports {policy, prompt_text, dialogs}; "accept" makes subsequent confirm() true and prompt() return prompt_text (or the call's default argument); "dismiss" restores the default.

Input parameters:

- `action` (string, required): "list" reports the policy and dialog history; "accept"/"dismiss" set the answer applied to subsequent window.confirm/prompt calls (alert is always logged, never blocking).
- `prompt_text` (string|null): With action "accept": text window.prompt returns once accepted (omitted keeps the current text).
- `session_id` (string, required): Session ID

### `session_drag` (~257 tokens)

Drag the mouse from one viewport position to another: press at `from`, `steps` mousemove events, release at `to`. The trajectory is humanized by default (eased velocity, wobble, jittered timing, overshoot) — the shapes anti-bot checks score for; pass humanize:false for exact linear interpolation. Moves AMarker-style drag targets, canvas selections and captcha sliders that only track while the pointer travels.

Input parameters:

- `delay_ms` (integer|null): Mean delay between moves in ms (default 18 humanized / 30 linear) — per-step timing is jittered around this when humanizing
- `from` (required): Where to press the mouse button down
- `humanize` (boolean|null): Humanize the trajectory: minimum-jerk easing, perpendicular wobble, timing jitter, grip/settle pauses, occasional hesitation and overshoot-and-correct. Set false when a test/tool needs exact linear i…
- `session_id` (string, required): Session ID
- `steps` (integer|null): Interpolated mousemove events between from and to. Default: 24 with humanize on, 10 without
- `to` (required): Where to release it

### `session_eval` (~179 tokens)

Execute arbitrary JavaScript in a live browser session and return the result. Runs in the session's current page, so DOM mutations, globals and storage persist across calls — unlike the stateless eval tool, which loads its own throwaway page each call. Script-driven navigation moves the session's URL. JS exceptions are reported with name, line/column and stack.

Input parameters:

- `script` (string, required): JavaScript code to execute
- `session_id` (string, required): Session ID
- `timeout_ms` (integer|null): Await budget for the script's promise in ms (default 5000, clamped 100..120000). Pass a larger budget for slow page-side work such as uploads through the page's own fetch; on expiry the tool errors w…

### `session_export` (~201 tokens)

Export a browser session's recorded action log. Format "bash" (default) returns a runnable curl script that replays every recorded action (navigate/click/input/scroll/eval) against a fresh session on this server — hand it to a shell or cron, zero model tokens. Format "jsonl" returns the raw action log, one JSON object per line. Format "json" returns a flow.json document — the same recording as editable ops ({op, args}) with cookies/storage stripped — that flow_run replays server-side.

Input parameters:

- `format` (string|null): Output format: "bash" (default) renders a runnable curl script that replays every recorded action against a fresh session; "jsonl" returns the raw action log, one JSON object per line; "json" returns…
- `session_id` (string, required): Session ID

### `session_input` (~179 tokens)

Type text into an input/textarea element by its index (from session_state output), dispatching input/change events (full keyboard cycle per character with events:"full"). A disabled, readonly, or detached field answers `filled:false` with a `reason` instead of a silent write. Hidden inputs are legitimate targets and are filled normally.

Input parameters:

- `events` (string|null): Event fidelity: "full" types one character at a time with a keydown/keypress/input/keyup cycle per character, for pages whose listeners key on keyboard events (e.g. keypress-Enter login forms). Defau…
- `index` (integer, required): Element index (from /state output)
- `session_id` (string, required): Session ID
- `text` (string, required): Text to type into the input field

### `session_list` (~47 tokens)

List live browser sessions with idle age and the time left before auto-eviction. Use to discover a session to reuse instead of creating a new one; sessions expire after 8 min idle.

### `session_navigate` (~39 tokens)

Navigate a browser session to a new URL.

Input parameters:

- `session_id` (string, required): Session ID
- `url` (string, required): URL to navigate to

### `session_network` (~411 tokens)

Read the session's network request log. filter="media" extracts playback/stream URLs (m3u8/HLS, mp4, dash, flv...) actually requested by the page's player at runtime - the reliable way to get a real video link, since links embedded in page HTML are often decoys. Media elements and player iframes the engine never fetches (video/audio/source/iframe src) are merged in as candidates: via="network" entries are confirmed requests, via="dom" entries are candidates carrying their tag (iframes = kind "iframe", navigate into them to sniff). Default returns every request as compact rows (method/url/status/type/size). Navigate to the video page first, let it load, then call this.

Input parameters:

- `body_max_chars` (integer|null): Per-body character cap for the `xhr` array (default 4000).
- `filter` (string|null): "media" extracts playback/stream links (m3u8/HLS, mp4, dash, ...) from the requests the page actually issued - the reliable way to get a real video link, since URLs embedded in page HTML are often de…
- `include_bodies` (boolean|null): Add an `xhr` array of background API responses (the page's own fetch/XHR traffic with retained bodies) alongside the request rows — the page's API face is often the cleanest structured read of its da…
- `session_id` (string, required): Session ID
- `url_contains` (string|null): Narrow the `xhr` array to URLs containing this substring.

### `session_screenshot` (~184 tokens)

Screenshot the session's CURRENT DOM state (mutations from clicks/evals included) as a base64 PNG via the built-in renderer. Width/height default to the session's viewport, so session_viewport + session_screenshot shows the responsive layout. Returns {url, width, height, image_base64, format}.

Input parameters:

- `full_page` (boolean): Capture the full scrollable page instead of the viewport (default: false)
- `height` (integer|null): Render height in CSS pixels; defaults to the session's current viewport
- `selector` (string|null): CSS selector: capture only that element's box
- `selector_all` (boolean): With selector, capture every match (default: first match only)
- `session_id` (string, required): Session ID
- `width` (integer|null): Render width in CSS pixels; defaults to the session's current viewport

### `session_scroll` (~71 tokens)

Scroll the page up or down by a number of viewport-heights.

Input parameters:

- `amount` (integer): Scroll amount in viewport-heights (default: 3)
- `direction` (string): Scroll direction: "up" or "down" (default: down)
- `session_id` (string, required): Session ID

### `session_set_files` (~132 tokens)

Select files on a file input programmatically (Playwright setInputFiles semantics): builds File objects from base64 content, assigns them to input.files, then dispatches input+change so framework onChange handlers fire. Selector-addressed because file inputs are often hidden and absent from the session_state index.

Input parameters:

- `files` (array, required): Files to select
- `selector` (string, required): CSS selector for the file input, e.g. "input[type=file]". File inputs are often hidden, so this is selector-addressed rather than using the /state index.
- `session_id` (string, required): Session ID

### `session_state` (~46 tokens)

Get the current page state as an indexed list of interactive elements. Returns compact text with [N] indexes for use with click/input tools.

Input parameters:

- `session_id` (string, required): Session ID

### `session_storage` (~90 tokens)

Snapshot the session's localStorage/sessionStorage for the current origin: {url, local_storage, session_storage}. Feed it back via session_create's `storage` field to restore a logged-in state in a new session — the half of login state that cookies can't carry (many sites keep the session token in localStorage). Call before the session idles out.

Input parameters:

- `session_id` (string, required): Session ID

### `session_viewport` (~160 tokens)

Set the session's viewport (device emulation): scripts see innerWidth/innerHeight move, media queries like (max-width: 600px) re-evaluate, element rects re-anchor, and mobile=true flips pointer/hover matchMedia answers to coarse/none. Omitted width/height keeps the current value.

Input parameters:

- `height` (integer|null): Viewport height in CSS pixels; omit to keep the current height
- `mobile` (boolean): Mobile emulation: matchMedia answers pointer:coarse / hover:none and navigator.maxTouchPoints reports 5 (default: false)
- `session_id` (string, required): Session ID
- `width` (integer|null): Viewport width in CSS pixels; omit to keep the current width

### `session_wait` (~192 tokens)

Wait until a CSS selector matches or a JS predicate turns truthy, with a timeout. The page's event loop keeps running while waiting (fetches, timers, promise chains progress), so this replaces blind sleeps for async content: navigate, session_wait for '.price-card', then click/read. Returns {matched, elapsed_ms, detail:{tag,text} or the predicate value}; errors with `timeout ...` naming the selector/predicate on expiry. Exactly one of selector/predicate.

Input parameters:

- `predicate` (string|null): JS expression polled until truthy (e.g. "document.querySelectorAll('.card').length >= 3")
- `selector` (string|null): CSS selector to wait for (e.g. ".price-card")
- `session_id` (string, required): Session ID
- `timeout_ms` (integer): Give up after this many milliseconds (default: 10000, max: 120000)

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/net-aginx-aginxbrowser/browser#diagnostics

## Score history

- 2026-09-20: 75
- 2026-09-19: 75
- 2026-09-18: 74
- 2026-09-17: 74
- 2026-09-16: 74
- 2026-09-15: 73
- 2026-09-14: 73
- 2026-09-13: 72
- 2026-09-12: 72
- 2026-09-11: 71
- 2026-09-10: 71
- 2026-09-09: 71
- 2026-09-08: 71
- 2026-09-07: 70
- 2026-09-06: 71
- 2026-09-05: 70
- 2026-09-04: 70
- 2026-09-03: 70
- 2026-09-02: 69
- 2026-09-01: 69
- 2026-08-31: 69
- 2026-08-30: 68
- 2026-08-29: 68
- 2026-08-28: 67
- 2026-08-27: 67
- 2026-08-26: 66
- 2026-08-25: 66
- 2026-08-24: 65
- 2026-08-23: 65
- 2026-08-22: 64

## Common questions

### What is the Aginx Browser MCP server?

Aginx Browser is an MCP server listed in the public MCP registry as net.aginx/aginxbrowser. Stealth web browser for agents: search, fetch, click, download and type in persistent MCP sessions. This page covers its hosted endpoint (https://browser.aginx.net/mcp).

### Is the Aginx Browser MCP server safe to use?

Aginx Browser scores 75 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the Aginx Browser MCP server expose?

Aginx Browser exposes 37 tools: account_delete, account_list, account_verify, cache, click, and 32 more. Their descriptions and schemas cost roughly 8,647 tokens of context every time the server is loaded.

### Does the Aginx Browser MCP server require authentication?

No. We connected to Aginx Browser without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.

### Is the Aginx Browser MCP server still maintained?

Aginx Browser is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

## Links

- Remote endpoint: https://browser.aginx.net/mcp
- Repository: https://github.com/yinnho/aginxbrowser
- Website: https://browser.aginx.net/
- Changelog RSS feed: https://verifymcp.io/servers/net-aginx-aginxbrowser/browser.xml
- Changelog JSON feed: https://verifymcp.io/servers/net-aginx-aginxbrowser/browser.json
- HTML version of this page: https://verifymcp.io/servers/net-aginx-aginxbrowser/browser