Browser tools for the whole task.

Request, list, or cancel a bounded human decision in your workspace, including when no tab is open. An approve-action review may describe one exact mutation or 2–4 ordered browser_click steps with declarative postconditions. Acknowledgment and resolution require the trusted local UI. Waiting blocks consequential dispatch; cancellation does not clear continuity review or replay an action. IDs are correlation handles, never capabilities.

Create an explicit continuity checkpoint, inspect changes after a pause or reconnect, or reconcile an exact fresh review. Review handles expire after 30 seconds; read status again before confirming an expired review. Checkpoint-only markerSelector is optional (at most 256 UTF-8 bytes): it must match exactly one element with at most 512 UTF-8 bytes of text. Marker text is compared privately and never returned or persisted. A new checkpoint without markerSelector removes the marker check. A checkpoint handle never grants workspace access. Reconciliation does not replay a tool or resolve unknown prior side effects. After explicit acknowledgement, an unknown prior outcome remains WARN with priorOutcomeAcknowledged true; recheck before making a fresh decision. A later interruption requires review again. Requires the workspace private resume capability after reconnect.

Check your workspace before navigation or a consequential action. Returns bounded PASS, WARN or BLOCKED checks for ownership, tab readiness, expected origin, site policy and human attention. Does not wake tabs or navigate. Session identity is unverified and write safety is never established by this check. No page contents, origins, policy rules or account data are returned. Recheck fresh state before acting; nothing is retried automatically.

Explicitly start or stop privacy-bounded action receipts for your authorized workspace, list retained runs, read a sanitized JSON report, or resolve an opaque retained evidence reference to the existing report tool that can open it. Recording is off by default. Keeps three runs of at most 1 MiB / 1000 entries each; starting a fourth retires the oldest whole run. Reports contain tool names, opaque identifiers, access decisions and outcomes, never raw tool arguments, results, URLs or page contents. Live references expire after process, control, navigation, observation, or tab changes. Native events may be uncorrelated; omitted evidence is counted. Interrupted actions are never replayed. Audit-control, workspace-lifecycle and wallet tools are outside this recording scope.

Save, preview, start, heartbeat, inspect, complete, or report privacy-safe review metrics for a bounded browser-workflow contract. Reusable definitions keep runtime inputs separate from exact tab, origin, navigation, observation, and workspace-control bindings. Previews show declared capabilities, evidence, human gates, and read-only-only retry limits without returning input values. Saved runs revalidate context on heartbeat and completion; stale or unavailable context blocks blind retry. Hronaut derives success from current-page or retained-audit checks, never caller narration. Stores no runtime input value, page text, URL, result body, credential, cookie, or arbitrary artifact content. This workflow contract is separate from the MCP Tasks extension for deferred execution of one tool call.

Perform a bounded, read-only lookup of one logical item and target before a visible browser write. Returns new, already_present, changed, not_found, blocked, or unknown from exact isolated-world origin, account, and target comparisons. Identifiers and page values are returned only as domain-separated fingerprints. Repeat the same reconciliation as a browser_click precondition to prevent stale preparation from dispatching a write.

Start with action=list to see existing workspaces marked forkOnly, or action=list-fork-sources to inspect all reusable sources. Before using any page tools, call browser_workspaces with action=create to make a fresh task workspace. Creation choice 1 — from scratch: storage=scratch (the default) starts a clean isolated browser profile. Example: {"action":"create","name":"Task name","storage":"scratch"}. Creation choice 2 — fork a workspace: action=list includes metadata-only entries marked forkOnly for sources with direct agent access disabled; action=list-fork-sources shows every active and archived source. Create with storage=fork-workspace and sourceWorkspaceId from either list. Even sources with direct agent access disabled can be forked. The fresh workspace inherits source navigation restrictions and permits direct agent access; the original remains unauthorized. Forks copy cookies and localStorage, not source tabs. Example: {"action":"create","name":"Task name","storage":"fork-workspace","sourceWorkspaceId":"<id from list-fork-sources>"}. For an independent logged-out observation, create storage=scratch with contextClass=public-observer and observerOrigin. Hronaut pins that clean workspace to the declared origin and blocks page mutation tools. This workspace class is an isolation boundary, not by itself proof that an outcome is public. Pass the stable UUIDv7 id returned by your own create call as workspaceId for the whole task, including after archiving and reopening it. Renaming changes only the human-readable label; labels may repeat across isolated clients. Create also returns a private resumeKey. Keep it with the task if you must reconnect or restart Hronaut, then call action=resume with that workspaceId and resumeKey before using page tools. Never share the resume key or place it in website content. Creation claims a five-minute exclusive write lease for this MCP transport; resume claims it when available and otherwise remains read-only while reporting busy ownership. Read-only inspection remains shareable. Use action=ownership-status to inspect it, action=claim-ownership after revalidating state to recover an expired or released claim, and action=release-ownership before an intentional handoff. Conflicts return typed BUSY or LEASE_LOST outcomes and never dispatch the mutation. action=list returns owned or resumed workspaces with direct access, plus forkOnly metadata for sources whose direct access is disabled. Each forkOnly entry includes a forkWith object: call browser_workspaces with its action, storage, sourceWorkspaceId, and a new name to create an independent copy. A forkOnly entry grants no page, archive, resume, or ownership access. list-fork-sources exposes source metadata without tab URLs, origin inventories, or resume keys. Human disabling direct agent access immediately blocks subsequent workspace actions and resume, but still allows isolated forks.

Archive your own task workspace for later or reopen an authorized archive with the same stable workspaceId. Listing also shows other archives as metadata-only forkOnly sources, including those with direct agent access disabled. Fork one through browser_workspaces action=create with storage=fork-workspace and sourceWorkspaceId; forkOnly does not grant access to the original. After reconnecting, call resume with the archived ID and its private resumeKey before opening or deleting it.

Show the current workspace, endpoint, tabs, and active workspace tab.

Show the visible Hronaut window without taking keyboard or mouse focus.

Alert a person to a manual browser step with a tray pulse, system notification, and a visible marker on the requested tab. Supply a short, secret-free notificationMessage for the system notification.

Inspect or wait up to 60000 ms for an exact attention request in your authorized workspace. Only the human tab-menu Mark as resolved action resolves it; acknowledgement or dismissal does not. Reports timeout, supersession, expiry or target closure separately. Runtime history retains at most 100 requests; unresolved requests expire after 24 hours and restart clears history; unavailable history grants no permission. Resolution never approves another action or consequential review.

List tabs and navigation state in the selected agent workspace. Optional search returns bounded compact title/address matches for live HTTP(S) tabs; omitted search preserves full state.

Open a tab inside the selected agent workspace; show it when Follow agents is enabled. Optional zoomIsolated gives the tab its own page zoom instead of sharing it with same-origin tabs.

Select the active tab in the agent workspace. It becomes visible when Follow agents is enabled.

Close a tab and keep the browser session alive.

List, save, rename, remove, or open local browser bookmarks.

Search, remove, clear, or reopen locally recorded web visits.

Inspect or clear selected cookies, storage, cache, or history for one explicit website origin inside the selected workspace.

Inspect or edit bounded local storage, session storage, and non-HttpOnly cookies in one workspace tab.

Set a volatile per-origin baseline and compare bounded local storage, session storage, and applicable cookie changes after an action. Values are omitted by default and HttpOnly cookie values are never returned.

Inspect aggregate usage, quota, and browser-defined storage-category byte counts for one workspace tab. The report is read-only and never returns stored keys, values, filenames, or response bodies.

Inspect bounded IndexedDB databases, object-store schemas, indexes, counts, keys, and optional record previews for one workspace tab. Values are omitted by default and the tool is read-only.

Explicitly start, get, stop or clear bounded service-worker lifecycle observations for a top-level HTTP(S) page. No worker lifecycle mutations, messages, source evaluation or cache/permission changes. Registrations belong to the origin and workspace, not exclusively the tab. Records observed callback timestamps and capture-local worker identities; history is always incomplete. Discovery polls once per second and may miss early/short-lived transitions. Maximum 100 events, 20 registrations, 100 workers and two minutes; five captures retained in memory, oldest stopped first. Navigation, closure, debugger or authority loss interrupts and retains the last drained evidence. get is read-only and returns the last drained snapshot. Use captureId with another live tab in the same workspace to read a closed tab capture. No universal worker-lifetime guarantee.

Inspect service-worker registrations and bounded Cache Storage entries for one workspace tab. Cached response bodies and headers are omitted by default, and the tool is read-only.

Read a compact page snapshot with stable element refs, use capture frameSelector for a bounded read-only same-origin direct-child iframe observation without refs or context changes (unsupported history fails closed; maxChars at most 16000), set and compare a volatile bounded semantic baseline, or assess whether the rendered observation is usable before reasoning. Quality assessment separates candidate content from empty shells, login walls, soft 404s, wrong origins, and structural noise. Visible-challenge classification is human-controlled in Settings, off by default; challengeDetectionEnabled reports the effective state. This setting does not solve or bypass challenges; caller-provided text or selector evidence is checked privately and never returned. Delta results distinguish unchanged, changed, truncated, and invalidated context; navigation or workspace-control drift requires a fresh baseline. Live form values, URL credentials, fragments, and recognized secret-bearing query values are excluded. A snapshot, candidate assessment, or baseline is not authority or proof of an external postcondition.

Compare one exact target in a standard writer workspace and a distinct clean public-observer workspace. Returns an audience-separated, privacy-bounded receipt with writer_context_verified, publicly_observed, not_publicly_observed, unknown, or reconciliation_required outcomes. The target is represented only by a connection-keyed opaque fingerprint; raw URLs, expected markers, page content, credentials, cookies, and account identifiers are never returned. This read-only observation never retries or widens either workspace authority.

Search the bounded sanitized page snapshot for literal text and return compact matching snippets and element refs without sending the full snapshot. Optionally use rootSelector for one component; no matches then describes only that scope, not the whole page.

Inspect one snapshot ref or CSS selector for bounded computed box model, layout, typography, contrast, accessibility properties and current :focus/:focus-within state without returning form values. Optional cssProperties requests bounded CSS declaration candidates and generated source locations for 1–8 supported layout/typography properties, with no full cascade winner claim or stylesheet bodies. Optional includeFonts reports up to 20 rendered-font records for an ordinary leaf element; form controls, editors, containers and shadow hosts are excluded. Names can contain private font metadata. Optional includeValidity reports willValidate and fixed native validity booleans for one unique rendered native input/select/textarea selected by CSS; sensitive controls are excluded, values/constraints/messages are omitted, and native validity is not exact-value or submission acceptance. It requires an active tab and cannot combine with password occupancy, CSS provenance or fonts. Optional includePasswordOccupancy reports only empty/nonempty/unknown for one unique rendered native password input in an already active top-level document, using transient page-side reduction without exporting its value or length. It does not wake/select tabs or establish authentication. CSS provenance/rendered fonts cannot be combined with occupancy. Optional includeSizingInputs reports eight allowlisted computed sizing inputs (flex-basis/grow/shrink, min/max width/height, align-self) for one unique selected element in an active tab; no parent collection or flex participation, applicability, cause, resolved base size or cascade winner claim. Unsupported values are null. Cannot combine with refs, validity, occupancy, CSS provenance or fonts. Optional expectedValue (≤4,096 UTF-16 code units) compares one unique rendered native text input or textarea, selected by CSS, with that exact string and returns only match, mismatch or unavailable; neither value, its length nor a mismatch position is returned, sensitive controls are excluded, and it cannot combine with refs or other guarded options. Optional includeScroll reports physical CSSOM offsets and dimensions, direction/writing mode, and document scroller identity for only the selected element; this does not infer scrollability or virtual content. Omit optional flags for computed-only inspection. Top-level selectors do not pierce frames or shadow roots.

Read sampled native complete, naturalWidth, naturalHeight and hasSelectedSource for one unique top-level light-DOM HTML image in an already active authorized tab. Hidden images allowed; refs rejected. No source URLs, alt text or bytes; no decode(), reload, scrolling, focus, tab selection or waking. complete also includes broken/no-source images; dimensions are density-corrected CSS pixels, not necessarily encoded pixels. Limits: 1000 selector characters, 5000 light-DOM elements, eight unsettled inspections per tab, five-second publication deadline. These are not CPU or transient native-string allocation bounds. Original element identity is checked at the final renderer sample; changes after it, or detach/reinsert and source ABA between samples, may be undetected. Not atomic delivery-time DOM identity, rendered-pixel proof, exact responsive variant identity or future readiness.

Read bounded native scalar state for one unique current top-level light-DOM audio or video selected by a required unique selector, including hidden audio. Snapshot ref input is explicitly unsupported and rejected, including with selector; selectors resolve the current document rather than historical snapshot identity. Reports paused/ended/seeking/muted, volume, playbackRate, currentTime, explicit finite/unknown/infinite duration, readyState, networkState and native error code or null. No source URLs, error messages, metadata or media content. Does not play, pause, seek, focus, scroll, select or wake tabs; requires an already active document. Element state is distinct from tab audibility and does not prove sound heard or diagnose autoplay denial.

Generate a unique Playwright locator for one snapshot ref or CSS selector, preferring semantic and explicit test contracts without returning page source or form values.

Reproduce responsive, network, cache, service-worker, Data Saver, CPU, animation-playback, CSS media, vision, locale, time-zone, JavaScript-disabled, location, request-header, and user-agent conditions, or show paint, layout-shift, layer, frame, and scrolling diagnostics in one tab. Reads distinguish unconfirmed native application from retained settings; recover:true explicitly restores the last committed settings without replaying a failed request.

Inspect, freeze, or explicitly resume the main document in one live tab without selecting, sleeping, or reloading it. A freeze is a QA hold, not a security boundary or complete browser snapshot.

Set or reset the page viewport for responsive UI testing.

Inspect or change page zoom from 50% to 400% without resizing the browser chrome.

Return a viewport, full page, element, or selected rectangle as a chat-ready PNG or compact JPEG. Optionally label up to 50 selected current snapshot refs in a viewport image with a bounded geometry legend.

Save the rendered page as a collision-safe PDF in the download directory.

Audit a page or element with local axe-core rules, save a volatile tab baseline, and compare stable rule-and-target fingerprints after a fix.

Run one bounded local audit across accessibility, observed Web Vitals, metadata and SEO, transport security, PWA readiness, and retained Chromium issues without inventing a synthetic score.

Measure local Core Web Vitals plus navigation, resources, long tasks, and bounded Long Animation Frame script attribution. Save a per-tab baseline and compare later measurements with explicit URL and environment compatibility checks.

Summarize bounded computed colors, typography, media queries, and likely text-contrast issues without returning page text or CSS source.

Inspect bounded title, canonical, robots, social cards, alternates, icons, headings, and structured-data types without returning body content or full JSON-LD.

Inspect the current main document transport, TLS connection, and bounded certificate metadata without returning raw certificates.

Explicitly enable, inspect or disable bounded ReactDOM 19.2.4 production topology in one top-level workspace tab. Enabling requires a subsequent user-requested navigation or reload; never navigates automatically. Names/version claims are untrusted. Returns activation/readiness, partial limits and ephemeral subtree IDs; no props, state, context, keys, source or DOM text. Disabled hook residue remains until reload. This mixed tool requires write ownership.

Record bounded JavaScript and CSS usage in one workspace tab and report unused bytes without returning source code.

Record bounded JavaScript CPU samples in one workspace tab and report the hottest functions by direct self time without returning source code, arguments, or page content.

Compare bounded JavaScript heap and DOM counters against a per-tab runtime baseline, or sample the functions retaining live allocations, without returning object values, source code, or page content.

Summarize bounded console and network evidence for one workspace tab in a copy-ready, security-filtered report.

Record a specific tab, including a background tab, pause/resume/stop, edit styled annotations and ordered source-time clips, render or export a local WebM/VP9 video. Annotation kinds: text, callout, arrow, highlight, spotlight, click. Text supports caption/title/label presets, safe-margin placement anchors (e.g. bottom-center), or custom normalized x/y coordinates and width. Callouts add a heading, numbered step and pointer to endX/endY; automatic placement uses the opposite side. Use short copy and one main callout per step. Color is an accent; text stays contrasting. Theme, size, alignment, animation and arrow curvature are optional. Spotlights dim outside their rectangle. Overlays use source milliseconds and normalized 0..1 viewport coordinates. edit replaces supplied arrays. Recording captures target page pixels, including sensitive data; explicit start only. Optional original built-in music/SFX and imported PCM16 WAV audio: get lists audioAssets; import-audio requires audioPath and audioProvenance and external-request access; remove-audio removes unused imports. edit audio replaces output-time events (assetId/startMs/endMs, offsetMs, volume 0..1, fadeInMs/fadeOutMs, loop). Camera moves use ordered source-time cameras (normalized focus x/y, zoom 1..3, optional endX/endY/endZoom, easeMs); captions stay screen anchored. transition.durationMs enables fade-through-black cuts, zero disables. Audio exports as Opus with VP9 WebM. No page/microphone capture. Up to two minutes, 1280x720, 12 fps and 64 MiB per recording; three concurrent/retained in memory until cleared or the tab closes. Capture never switches the selected tab, regardless of Follow agent. Same-origin navigation is supported; keep Hronaut visible and each source viewport unchanged. Hiding/minimizing Hronaut, trusted UI occlusion, sleep, loss of authority or a prolonged frame gap pauses capture; resume explicitly. No capture during OS sleep is supported. Stop before editing/exporting. get returns metadata, never video bytes. inspect reads only a stopped nonempty recording: require recordingId, expectedRevision, inclusive source startMs/endMs and maxFrames (1–12). Returns one numbered PNG plus actual retained sequences/timestamps and omissions; empty intervals return metadata only. Sampling is uniform by retained frame index; narrow the interval for detail. Original source pixels only, without edits/composition. Requires current access to the stored tab/workspace/origin; old capture permission is not continuing read authority. Limits: 8 MiB aggregate selected JPEGs, 4 MiB each, 1280x720 intrinsic dimensions, 2048x2048 sheet, 4 MiB returned PNG. One job, no queue; five seconds initiates cancellation, admission remains held through confirmed renderer exit and uncertain cleanup requires restart. These are operational bounds, not RSS or exact native interruption guarantees. timing pairs recording-relative monotonic observedAtMs with sourceTimeMs and a revision; compare only within the same recordingId. lastFrame reports capture-attempt bounds, not exact pixel time; pixelTime is unknown. Pauses freeze source time, not observation time; pause/resume/stop, interruption rollback and edits revise timing. Discard stale observations after revision/identity changes. Transport delay and sparse capture prevent precise event-to-pixel alignment. Export returns a collision-safe local path.

Start, inspect, stop, clear, or export a privacy-safe human reproduction timeline for one workspace tab; typed form values are never recorded, and Playwright exports require explicit safe test inputs. While active, get returns checkpointContext; action=checkpoint accepts checkpoint {context, selector, condition: visible|hidden|text|checked|unchecked|count, text only for text, count only for count, reviewed:true}. Supply only intentionally approved expectation text (max240 characters); never copy private page text automatically. Non-count targets must be unique light-DOM elements. Count requires an explicit integer 0–500 and only structural tag selectors with optional :nth-of-type(N) and spaced child combinators, e.g. ul > li; hidden elements and zero matches count. Matching form controls, frames or editable regions reject the checkpoint, as do more than 500 matches or 2000 visited elements. Count exports use formatVersion 3. Alternatively use checkpoint {context, condition:urlPath, path, reviewed:true}, without selector/text/count: compare one reviewed serialized HTTP(S) pathname (max2048 characters), ignoring origin/query/fragment. URL-path records use formatVersion 4; page URL observation is limited to 16384 characters and uses no page JavaScript. Approved paths may be private; do not derive them automatically. This does not verify site identity, authentication or submission success. Text/visibility excludes form controls. Checked/unchecked permits only native checkbox/radio inputs outside editable regions without a mixed state, and reads no form values. Checkpoints store intended results separately from observedMatch and do not prove business success. Refresh and review after navigation/control changes.

Record bounded structural DOM mutations in one workspace tab without returning page text, markup, IDs, classes, or values.

Optionally set a baseline clip in viewport CSS pixels; later comparisons retain that region and reject viewport, zoom, DPR, scroll or document drift. Scope metadata and pixel counts describe only the crop. Set a volatile viewport baseline, compare the same workspace tab later, and return changed-pixel metrics plus a chat-ready diff PNG.

List or clear bounded Chromium Issues such as CORS, CSP, mixed-content, cookie, deprecation, quirks-mode, and stylesheet problems, plus observed HTTP Basic authentication challenges (origin and request kind only; Hronaut cancels them and never supplies credentials).

Read or clear bounded sanitized console entries with repeat counts, distinct uncaught exceptions, and structured call stacks from a tab.

Inspect, preserve across navigation, or clear the bounded Console and Network evidence for one workspace tab.

Read, search, property-filter, sort, limit, or clear bounded network request metadata, including duration, TTFB, and the exact browser, prefetch, disk-cache, or service-worker response source, from a tab.

Wait without polling for a retained or future network request matching a URL pattern and optional method, resource type, status, or lifecycle phase; use a prior request ID cursor when an endpoint may repeat.

Search bounded sanitized URLs, headers, payloads, responses, retained WebSocket text, and server-sent events across recent requests; returns request IDs and short matching snippets for follow-up inspection.

Inspect one HTTP, WebSocket, or EventSource request with bounded bodies or messages, redacted secrets, response source, service-worker and Cache Storage provenance, initiator frames, redirect and Chromium-reported request relationships, browser timing, and parsed Server-Timing metrics; for HTTP(S), optionally return a sanitized cURL or fetch reproduction that must be reviewed before sharing or running.

Return or save a property-filtered, bounded, sanitized HAR 1.2 network log with bodies omitted by default; saved files use collision-safe names in Downloads.

List, add, prioritize, set-enabled, remove, or clear temporary per-tab request mocks, failures, and individual network throttles. set-enabled requires routeId and boolean enabled, retains private configuration/order/budget, and rejects pending or unknown application. Disabling permits future traffic through the next enabled rule or normal destination. Unconfirmed native application requires a separate explicit clear; future matching requests may reach their normal destination. Clear preserves tab-wide network emulation and cannot undo dispatched effects.

List, pause, resume, cancel, or clear downloads created by the selected agent workspace.

Evaluate JavaScript and return a JSON-safe result.

Navigate to a URL or search phrase.

Go back, forward, reload normally or without cache, or stop loading.

Wait for navigation, a matching page URL, visible or disappearing page text, or an element to become attached, detached, visible, or hidden.

Single- or double-click an element by snapshot ref or CSS selector, or click viewport coordinates for canvas and other visual-only surfaces. Set native=true only when a custom control requires trusted pointer and mouse events. Semantic native/double clicks sample the original target before each press and reject covered or unsupported embedded/shadow receivers; sampling is not an atomic routing guarantee. On Linux, explicit button=right with native=true opens a page-authored menu on one explicit, already active visible awake locked tab with default geometry. No coordinates, double-clicks, modifiers, frames or native app menus; selecting a menu item is a separate call. Unsupported platforms reject. Cleanup is best effort and may remain pending indefinitely. Inspect partial failures without replay. With an active audit run, an optional declarative postcondition performs bounded read-back without repeating the click.

Accept or dismiss an open JavaScript alert or confirmation.

Type into a field and optionally submit its form.

Select one option by value or label, or semantically replace a native multiple-select option set with exact values. An empty values array clears selection; this does not emulate gestures.

Fill several form fields in one tool call.

Hover an element or viewport coordinates to reveal menus, tooltips, canvas details, or hover states.

Drag an element onto another element, or drag between viewport coordinates for canvas and other visual-only surfaces.

Send exactly one native wheel event at explicit viewport CSS x/y to the active visible, explicitly unlocked, child-frame-free page outside split view. Both deltaX and deltaY are required, each within -1000..1000 CSS pixels and at least one nonzero; x/y are nonnegative and at most 16384. Requires default zoom, no emulation overrides and display scale 1. Rejects extra fields, modifiers, refs and selectors. Never unlocks, moves the pointer, focuses, retries or falls back. Returns dispatch acknowledgement only, not proof of scrolling or human input. Use browser_scroll for ordinary CSSOM scrolling.

Scroll the page or a specific scrollable element.

Send a keyboard key or modifier combination to the active page.

Hold one supported nonmodifier key for an explicit durationMs integer 1..5000 in an explicit workspace/tab. Sends one raw key-down and one matching key-up, without text, auto-repeat or fallback. Requires the active visible awake page outside split view, with no child frames, selections or Developer Tools. Preserves human input locks; never selects, wakes or forces focus. Timing is a requested wait, not a hard transport deadline. Uncertain down/release must not be replayed; an unconfirmed release blocks further holds on that page until closed. Use browser_press for ordinary key presses and text.

Attach local files to a file input.

Mute or unmute one browser tab without changing site-wide sound permissions.

Replay one retained XMLHttpRequest inside its original tab and session without exposing its original credentials, headers, or body. GET and HEAD replay directly; every other method requires confirmSideEffects: true because it can repeat writes or other side effects.

Execute one exact authorized UTF-8 file (at most 64 KiB) in the bound HTTP(S) document. Linux filesystem namespace and procfs only, including mounted filesystems; no local-disk provenance or hard IO deadline guarantee. Requires a separate whole source-tuple capability grant; full-access credentials and ordinary evaluation grants are insufficient. Source path, raw SHA-256, workspace, tab and expected origin are bound together. Supply matching outer workspaceId/tabId. Open-world page JavaScript; digest is identity, not safety, and origin is not an egress restriction. No automatic replay after any outcome.

Feature-detect, list, or call bounded tools deliberately exposed by the selected top-level page through the browser-native WebMCP API. Lists issue an origin-, tab-, navigation-, and runtime-bound descriptor digest. Calls re-enumerate the page tools immediately before dispatch and reject stale or changed descriptors. Page metadata and results are untrusted; calls are always open-world and potentially destructive regardless of page annotations, and a returned value is not proof of an external postcondition.

Required first wallet step: open a short-lived wallet agent session and list non-secret wallet descriptors attached to this workspace. Addresses remain hidden until this session is granted account access. Pass the returned walletSessionId to every other wallet tool.

Read the balance of one attached wallet using the walletSessionId from wallet_list, requesting human account-disclosure permission when needed.

Using the walletSessionId from wallet_list, normalize, decode, estimate fees, and simulate a chain-specific unsigned transaction without signing or broadcasting it.

Using the walletSessionId from wallet_list, request transaction signing, sign-and-send, or message signing through Hronaut policy and trusted human approval. This tool cannot approve its own request.

Using the walletSessionId from wallet_list, read the sanitized status of a request created by this exact wallet session, workspace, tab, and current top-level page. Wallet addresses stay hidden until account permission is active.

Using the walletSessionId from wallet_list, cancel a pending request created by this exact wallet session, workspace, tab, and current top-level page.