# Deputy (npm · deputy-mcp)

Any web page as a typed tool call, run in your own logged-in Chrome. Free to start; Pro adds more.

- Trust score: 62/100 (medium)
- Change this week: +4
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-10-23

## Components

- npm · `deputy-mcp`: 62/100 (this document), [markdown](https://verifymcp.io/servers/zraisan-deputy/deputy-mcp.md), [page](https://verifymcp.io/servers/zraisan-deputy/deputy-mcp)

## Channel facts

- Registry: `npm`
- Package: `deputy-mcp`
- Version: `0.1.5`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-10-23.

- **Supply Chain Security**: 100/100
  - No malware found by supply-chain analysis.
  - No known CVEs affecting this package version or its production dependencies.
  - No install/post-install scripts declared.
  - No production dependencies, so there is no dependency health to assess.
- **Provenance & Transparency**: 6/100
  - Repository check failed: no source repository is declared.
  - Provenance check failed: no build-provenance attestation is published.
  - License check failed: the license (PolyForm-Shield-1.0.0) isn't a recognized OSI-approved license.
  - Actively maintained (last published 0 days ago).
  - Security-disclosure policy not yet verified: we couldn't inspect the source repository.
- **Schema Quality & AI Usability**: 64/100
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 3325 tokens (~123/item across 27 items; 27 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 84/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 51% of tool parameters carry a description.
- **Tool Safety**: 75/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - 0 of 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "browser_eval" implies "eval" and declares no destructiveHint at all, which the MCP spec reads as destructive by default.
  - An AI judge read all 28 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### How do I install the Deputy MCP server?

Deputy runs locally as an npm package, launched with npx -y deputy-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add zraisan-deputy -- npx -y deputy-mcp
```

### Cursor

```json
{
  "mcpServers": {
    "zraisan-deputy": {
      "command": "npx",
      "args": [
        "-y",
        "deputy-mcp"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "zraisan-deputy": {
      "command": "npx",
      "args": [
        "-y",
        "deputy-mcp"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add zraisan-deputy -- npx -y deputy-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "zraisan-deputy": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "deputy-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add zraisan-deputy --command npx --arg -y --arg deputy-mcp
```

### Hermes

```yaml
mcp_servers:
  zraisan-deputy:
    command: "npx"
    args: ["-y", "deputy-mcp"]
```

### Netclaw

```json
{
  "McpServers": {
    "zraisan-deputy": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "deputy-mcp"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add zraisan-deputy -t stdio -c npx -a -y deputy-mcp
```

### Other

```json
{
  "mcpServers": {
    "zraisan-deputy": {
      "command": "npx",
      "args": [
        "-y",
        "deputy-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-10-23 (score 62, +1)

No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-22 (score 61, 0)

- [security regression] Stability: 0.20 → unverified
- [security regression] Tool safety: pass → unverified
- [functional regression] Capabilities: pass → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional] First check of Schema quality: unverified
- [functional] Package version: 0.1.3 → 0.1.5
- [functional] Package version: 0.1.3 → 0.1.4

### 2026-10-21 (score 61, +16)

- [security improvement] Malware scan: unverified → pass

### 2026-10-20 (score 45, −15)

- [security regression] Malware scan: pass → unverified
- [functional] Package version: 0.1.2 → 0.1.3

### 2026-10-19 (score 60, +1)

No change was recorded against any check on this day. Stability & Change Management went from 10 to 13. That category is still filling its 30-day observation window: 3 days of observed history at the previous scan, 4 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-17 (score 59, +1)

- [functional improvement] Stability: unverified → 0.07
- [functional] Package version: 0.1.1 → 0.1.2

### 2026-10-15 (score 58)

First indexed and scored.

## MCP tools (27)

### `browser_capabilities` (~172 tokens)

What can the browser do right now?

The full contract of every open tab: each form as a typed tool with its JSON Schema (types, allowed values, min/max, required fields), what those fields currently hold, and every button and link with a ref you can click. This is what you read instead of a screenshot — it is complete, so you should not need to probe. Long pages return a window of their links: the reply always states the true total, and you can narrow with actionQuery or page with actionOffset.

Input parameters:

- `actionLimit` (number): How many actions to return (default 25).
- `actionOffset` (number): Skip this many actions, for paging through a long list.
- `actionQuery` (string): Only return buttons/links whose label contains this text. Use it when you know what you want.

### `browser_invoke` (~80 tokens)

Do something on the page

Call one of the tools browser_capabilities listed, with arguments matching its inputSchema. This acts in the real logged-in browser: it fills and submits the actual form.

Input parameters:

- `args` (object): Arguments matching the tool inputSchema.
- `tabId` (number)
- `tool` (string, required): Tool name exactly as browser_capabilities reported it.

### `browser_fill` (~132 tokens)

Fill one field by ref

Set a single field to a value, addressed by the ref browser_capabilities gave it. Use this on pages Deputy could not graft into a typed tool — apps that build a form out of divs, or inputs sitting outside any <form>. For a checkbox pass "true"/"false"; for a <select> pass an option value or its visible text. When a typed tool exists, browser_invoke is better.

Input parameters:

- `ref` (string, required): Field ref from browser_capabilities actions, e.g. "a13".
- `tabId` (number)
- `value` (string, required): Value to set.

### `browser_click` (~46 tokens)

Click a button or link

Click something browser_capabilities listed under "actions", by its ref.

Input parameters:

- `ref` (string, required): Action ref, e.g. "a10".
- `tabId` (number)

### `browser_read` (~94 tokens)

Read a page as text

Return the page as plain text for you to read yourself. Use browser_ask instead when you only need one fact: with a model (Deputy Pro or OPENROUTER_API_KEY) Deputy reads the page and answers in a sentence. Use this when you genuinely need the content to reason over.

Input parameters:

- `maxChars` (number): Cap the returned text (default 6000).
- `tabId` (number)

### `browser_navigate` (~103 tokens)

Open a URL, or go back, forward or reload

Point a tab at a URL and wait for it to load, or move through its history with action "back" / "forward", or "reload" it. Deputy re-reads what the new page can do, so call browser_capabilities afterwards to see the tools that appeared.

Input parameters:

- `action` (string): Instead of a URL: move through history, or reload.
- `tabId` (number)
- `url` (string): Absolute URL to open.

### `browser_tabs` (~91 tokens)

List, open, switch or close tabs

Work with browser tabs. "list" shows every tab; "open" opens a URL in a new tab and makes it active; "select" makes a tab active (other tools act on the active tab by default); "close" closes one.

Input parameters:

- `action` (string, required)
- `tabId` (number): For "select" and "close".
- `url` (string): For "open".

### `browser_wait` (~141 tokens)

Wait for the page

Wait until text appears, text disappears, or an element becomes visible — for pages that load content after the fact (search results, spinners, SPAs). With no condition, waits timeoutMs. Fails with a clear message on timeout.

Input parameters:

- `selector` (string): Wait until an element matching this CSS selector is visible.
- `tabId` (number)
- `text` (string): Wait until this text is on the page.
- `textGone` (string): Wait until this text is gone (e.g. "Loading…").
- `timeoutMs` (number): Give up after this long (default 10000, max 60000).

### `browser_screenshot` (~220 tokens)

See the page

Take a screenshot and return the image to you. An image costs you roughly 1,000-1,600 tokens, so use it when you need to SEE something: visual or frontend work, layout and styling, charts, images, canvas. For facts on a page prefer browser_ask or browser_read; to act, prefer browser_capabilities. fullPage stitches the whole scrollable page, including anything off the right edge (costs more). ref or selector captures a single element whole, even one wider or taller than the viewport.

Input parameters:

- `format` (string): jpeg (default, small) or png (sharper text, much larger).
- `fullPage` (boolean): Capture the whole scrollable page, not just the viewport.
- `maxDimension` (number): Longest edge in pixels (default 1280).
- `ref` (string): Capture only this element (a ref from browser_capabilities).
- `selector` (string): Capture only the first element matching this CSS selector.
- `tabId` (number)

### `browser_find` (~160 tokens)

Find elements

Find elements by visible text, role (button, link, textbox, checkbox, combobox, option, heading, tab, menuitem, dialog, img, row, cell) or CSS selector. Returns refs you can pass to browser_act, browser_inspect or browser_screenshot, with label, state and value. Reaches inside forms, open and closed shadow roots, and elements off screen.

Input parameters:

- `exact` (boolean): Match the whole text exactly.
- `includeHidden` (boolean)
- `limit` (number): Default 20.
- `role` (string)
- `selector` (string)
- `tabId` (number)
- `text` (string): Visible text or accessible name to match (substring, case-insensitive).

### `browser_act` (~308 tokens)

Act on an element

Do one thing to an element: click, double_click, right_click, hover, focus, type (value; replaces unless append), press (keys like "Enter", "Tab", "Escape", "ArrowDown", "Control+a"; without a target, presses on the focused element), check, uncheck, select (value = option label or value, native or custom dropdown), clear, scroll_into_view. Typing is sent key by key so autocompletes react. The result reports any dialog or error the action caused. For whole forms, prefer browser_invoke with the typed tool.

Input parameters:

- `acceptDialog` (boolean): Accept the confirm/prompt dialog this action opens (dialogs are dismissed by default).
- `action` (string)
- `append` (boolean): For type: add to the existing text instead of replacing it.
- `dialogText` (string): With acceptDialog: what to type into a prompt.
- `keys` (string): For press: e.g. "Enter" or "Shift+Tab".
- `ref` (string): Element ref from browser_find or browser_capabilities.
- `selector` (string): CSS selector, if you have no ref.
- `steps` (array): Several actions in order, in one call (e.g. open a dropdown, pick an option, press Join). Stops at the first that fails.
- `tabId` (number)
- `value` (string): Text to type, or the option to select.

### `browser_scroll` (~156 tokens)

Scroll

Scroll the page (or an element) down/up, by pixels, or to top/bottom. untilStable keeps scrolling to the bottom while an infinite feed keeps loading, and reports how much it grew. Finds the real scroll container in app layouts where the window itself does not scroll.

Input parameters:

- `by` (number): Pixels (default: most of a screen).
- `direction` (string)
- `maxRounds` (number): For untilStable (default 10).
- `ref` (string): Element ref from browser_find or browser_capabilities.
- `selector` (string): CSS selector, if you have no ref.
- `tabId` (number)
- `to` (string)
- `untilStable` (boolean)

### `browser_drag` (~70 tokens)

Drag and drop

Drag one element onto another (HTML5 drag-and-drop, or pointer-driven libraries such as kanban boards).

Input parameters:

- `fromRef` (string)
- `fromSelector` (string)
- `tabId` (number)
- `toRef` (string)
- `toSelector` (string)

### `browser_upload` (~79 tokens)

Upload files

Attach local files (absolute paths, 25 MB total) to a file input, or drop them onto a drop zone.

Input parameters:

- `paths` (array, required)
- `ref` (string): Element ref from browser_find or browser_capabilities.
- `selector` (string): CSS selector, if you have no ref.
- `tabId` (number)

### `browser_inspect` (~163 tokens)

Inspect layout and CSS

With a ref or selector: the element's box model, position, computed CSS (or the properties you name), flex/grid layout, visibility, text contrast, overflow, and what is covering it. With no target: a layout audit of the whole page — horizontal overflow and its culprits, clipped text, broken images, missing alt text, small tap targets, low-contrast text, layout shift, fonts. Numbers instead of a screenshot, for CSS debugging.

Input parameters:

- `properties` (array): CSS properties to report, e.g. ["gap", "margin-top"].
- `ref` (string): Element ref from browser_find or browser_capabilities.
- `selector` (string): CSS selector, if you have no ref.
- `tabId` (number)

### `browser_extract` (~128 tokens)

Extract data

Turn a table, or a repeated list (search results, product cards, feed items), into JSON rows; or list the links. kind "auto" picks the biggest table, else the biggest repeated list. Scope it with a ref or selector. Pair with browser_scroll untilStable for infinite feeds.

Input parameters:

- `kind` (string)
- `limit` (number): Rows to return (default 50).
- `ref` (string): Element ref from browser_find or browser_capabilities.
- `selector` (string): CSS selector, if you have no ref.
- `tabId` (number)

### `browser_console` (~106 tokens)

Console and errors

Console messages and page errors: uncaught exceptions with stacks, unhandled rejections, failed resources, and console output from when an agent started driving the tab. Filter by levels (error, warn, info, log, debug). Browser-internal messages (CSP, CORS) are not visible without the debugger.

Input parameters:

- `clear` (boolean): Empty the log after reading.
- `levels` (array)
- `limit` (number)
- `tabId` (number)

### `browser_network` (~125 tokens)

Network requests

Requests the page made: method, URL, status, time, type, size, for fetch/XHR and every resource (documents, scripts, styles, images). failedOnly shows 4xx/5xx and network errors. includeBodies adds text/JSON response bodies (first 4 KB) captured while an agent drives the tab.

Input parameters:

- `clear` (boolean)
- `failedOnly` (boolean)
- `filter` (string): Only URLs containing this.
- `includeBodies` (boolean)
- `limit` (number)
- `tabId` (number)

### `browser_dialog` (~101 tokens)

Answer dialogs

Decide how alert/confirm/prompt dialogs are answered on a tab you are driving. By default they are dismissed (a confirm returns false) and reported in the action result. Call this BEFORE the action that opens the dialog: accept for the next dialog, persist to keep answering that way.

Input parameters:

- `accept` (boolean, required)
- `persist` (boolean)
- `tabId` (number)
- `text` (string): What to type into a prompt.

### `browser_resize` (~95 tokens)

Resize the viewport

Set the page viewport to a width and height in CSS pixels, e.g. 375×812 to check a mobile layout. This resizes the user's real window: call with reset: true when done to put it back.

Input parameters:

- `height` (integer)
- `reset` (boolean): Put the window back to its size before Deputy first resized it.
- `tabId` (number)
- `width` (integer)

### `browser_eval` (~107 tokens)

Run JavaScript in the page

Run JavaScript in the page and return its JSON-serialisable result. An expression returns its value; for statements, use return. Promises are awaited. Runs in the page's own world by default (sees its globals); world "isolated" keeps it apart. Needs Chrome's "Allow User Scripts" switch for Deputy; the error says how to turn it on.

Input parameters:

- `code` (string, required)
- `tabId` (number)
- `world` (string)

### `browser_downloads` (~103 tokens)

Downloads

Files the browser downloaded. "list" shows recent downloads; "wait" waits for the one just started (by a click) to finish; "read" returns a finished download by id (the newest if no id): text files as text, PDFs as extracted text, other files as their path, type and size.

Input parameters:

- `action` (string, required)
- `id` (number)
- `timeoutMs` (number): For wait (default 30000).

### `browser_look` (~82 tokens)

Look at the page (Pro)

A vision model looks at the page and answers in text: describe it, or answer your question about what is visible (layout, images, charts, whether something looks broken). Costs you a few hundred tokens instead of an image, and works in clients that cannot show images. Deputy Pro.

Input parameters:

- `question` (string)
- `tabId` (number)

### `browser_ask` (~117 tokens)

Ask about a page instead of looking at it

Ask a question about what is on a browser tab. Deputy reads the page itself and returns a short answer. Use this instead of screenshotting or dumping the DOM — the page never enters your context, so a lookup costs a couple of hundred tokens rather than tens of thousands. Without a model, it returns the passages relevant to your question instead.

Input parameters:

- `question` (string, required): What you want to know, e.g. "what is the cheapest result?"
- `tabId` (number): Tab to read. Defaults to the active tab.

### `delegate_goal` (~98 tokens)

Delegate a goal to the browser

Hand the browser agent a goal in plain language and let it work. It knows the page, the session you are signed into, and what each form accepts. Prefer this over driving the browser yourself — you never need to see the page.

Input parameters:

- `goal` (string, required): What you want done, e.g. "search for a cordless drill under $80".
- `tabId` (number): Tab to work in. Defaults to the active tab.

### `task_status` (~33 tokens)

Check a delegated task

Poll a task by id. Use when a delegation is still running or was interrupted.

Input parameters:

- `taskId` (string, required)

### `answer_task` (~50 tokens)

Answer a paused task

Resume a task that stopped because it needed a human — a confirmation, or a sign-in that has now been completed in the browser.

Input parameters:

- `answer` (string, required)
- `taskId` (string, required)

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/zraisan-deputy/deputy-mcp#diagnostics

## Score history

- 2026-10-23: 62
- 2026-10-22: 61
- 2026-10-21: 61
- 2026-10-20: 45
- 2026-10-19: 60
- 2026-10-18: 59
- 2026-10-17: 59
- 2026-10-16: 58
- 2026-10-15: 58

## Common questions

### What is the Deputy MCP server?

Deputy is an MCP server listed in the public MCP registry as io.github.zraisan/deputy. Any web page as a typed tool call, run in your own logged-in Chrome. Free to start; Pro adds more. This page covers its npm package (deputy-mcp).

### Is the Deputy MCP server safe to use?

Deputy scores 62 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 23 October 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the Deputy MCP server expose?

Deputy exposes 27 tools: browser_capabilities, browser_invoke, browser_fill, browser_click, browser_read, and 22 more. Their descriptions and schemas cost roughly 3,160 tokens of context every time the server is loaded.

### Is the Deputy MCP server still maintained?

Deputy is still listed as active in the MCP registry. We last reached this channel on 23 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What licence is the Deputy MCP server under?

Deputy declares the PolyForm-Shield-1.0.0 licence, which is not on the OSI-approved list. Read the terms before using it at work, and note this covers the source only, not the cost of any service it calls.

## Links

- npm package: https://www.npmjs.com/package/deputy-mcp
- Socket report: https://socket.dev/npm/package/deputy-mcp
- Website: https://razin.ai/deputy
- Changelog RSS feed: https://verifymcp.io/servers/zraisan-deputy/deputy-mcp.xml
- Changelog JSON feed: https://verifymcp.io/servers/zraisan-deputy/deputy-mcp.json
- HTML version of this page: https://verifymcp.io/servers/zraisan-deputy/deputy-mcp