Skip to main content
Glama
YogevKr

Wraith MCP Server

by YogevKr

๐ŸŒ€ Wraith

A stealth, identity-borrowing, MCP-native agent browser.

CI License: MIT Python 3.10+

Website: wraithbrowser.dev ยท the landing page lives in site/.

Wraith is a Python toolkit that gives an autonomous agent a real browser that is hard to fingerprint and easy to drive. It pairs a hardened Firefox engine (Camoufox) with identity borrowing โ€” reusing a warmed, already-authenticated session from one of your own real browser profiles โ€” and exposes the whole thing as both a CLI and an MCP server so an LLM can perceive and act on pages by index.


Wraith is a dual-use tool. Like the established projects in its category (Camoufox, nodriver, browser-use, undetected-chromedriver), it can be used well or badly. It is published for legitimate purposes:

  • Accessing your own accounts and data, on your own machine, with your own warmed browser profile.

  • Authorized security testing and bot-defense research (where you have permission to test the target).

  • Personal automation, scraping of data you are entitled to, and reproducible research into anti-bot / WAAP systems.

Please use it responsibly:

  • Respect each target site's Terms of Service and all applicable laws (e.g. CFAA and its equivalents).

  • Identity borrowing reads only your own local browser profiles. Do not use it against accounts or sessions that are not yours.

  • Do not use Wraith for fraud, account takeover, credential stuffing, mass abuse, spam, or to circumvent access controls you are not authorized to bypass.

You are responsible for how you use this software. If your use isn't clearly covered by the legitimate cases above, don't do it. Wraith is released under the MIT License with no warranty.


Related MCP server: Real Browser MCP

Why identity borrowing (not "solving")

Modern defenses like reCAPTCHA-v3 and Reblaze/Link11 ac_v2 are reputation systems, not puzzles. reCAPTCHA-v3 has no client-side solver: it returns a 0.0..1.0 score derived from your Google-account cookies, aged browsing history, and IP reputation. A fresh automated profile scores ~0.1โ€“0.3 ("bot") no matter how good the stealth engine is, because it has no history to vouch for it. You cannot fake reputation.

So Wraith doesn't try. For your own sites and accounts, it borrows a warmed identity: it reads your live session cookies straight out of your real Firefox or Zen profile on disk (or harvests a live bearer token from network traffic) and injects them into the stealth context. The agent then navigates as the already-authenticated user โ€” the reputation comes along for free.

For sites with a solvable JS interstitial (e.g. Reblaze ac_v2), no identity is needed at all: a real Firefox engine clears the challenge natively, and clear_challenge() just waits for the clearance cookie to appear.

Features

  • Stealth-first engine โ€” Camoufox (hardened Firefox) primary, patchright Chromium fallback; enforces the playwright==1.55 pin Camoufox needs.

  • Identity borrowing โ€” discover and read cookies from your own Firefox / Zen / Chrome profiles and inject them into the stealth context.

  • No-browser TLS fast path โ€” wraith.fastpath (curl_cffi) replays a borrowed/harvested session with a real-browser TLS+HTTP/2 fingerprint and no browser: do the expensive challenge-clear/login once in Camoufox, then drive authenticated requests cheaply. wraith fetch / MCP fetch. (pip install 'wraith[fastpath]'.)

  • Live session harvesting โ€” latch the first request carrying both an Authorization header and a named auth cookie, for tokens never stored on disk. Export a portable Playwright storageState from any cleared session.

  • WAAP/bot-defense fingerprinting โ€” identify_waap() recognises Reblaze/ Link11, Akamai, reCAPTCHA, DataDome, Imperva/Incapsula, Kasada, SiteMinder; classify_response() / is_blocked() tell the fast path when to escalate.

  • Challenge solving โ€” a vendor-dispatching Challenge + solve_challenge() (Turnstile / hCaptcha / reCAPTCHA v2+v3 / FunCaptcha / AWS-WAF via CapSolver / 2Captcha) and inject_token() to feed a solved token back into the page. clear_challenge fails fast on a hard block instead of burning the timeout.

  • Stealth self-test โ€” wraith selftest runs the rebrowser leak suite and exits non-zero on a critical automation leak (CI/regression gate).

  • Agent perception layer โ€” browser-use-style indexed DOM snapshots with change-observation (what each action did), new-element marking, and signature self-heal for stale indices; act by index (click, type, scroll, read) across multiple tabs.

  • Opaque secret fills โ€” registered providers resolve secret handles only after Wraith checks the origin, field kind, expiry, and use limit. Snapshot output omits editable value attributes.

  • MCP-native โ€” a stdio MCP server (wraith-mcp) exposing the agent browser as tools (per-call snapshot control, inline screenshots, tabs, fetch) for any MCP client.

  • Residential proxy support โ€” a ProxyPool health state machine (cooldown / backoff / half-open / dead / recovery) plus first-class DataImpulse and anyIP providers for rotating/sticky residential (and anyIP mobile) exits.

  • Human-like behavior helpers โ€” curved/eased mouse movement and per-key typing cadence.

  • Resilient import โ€” a missing optional browser dep never breaks import wraith; it's recorded in wraith.missing_imports.

Install

Wraith uses uv:

uv sync                            # core deps (camoufox, playwright==1.55, patchright, httpx, mcp)
uv run camoufox fetch              # fetch the Camoufox Firefox build (primary engine)
uv run patchright install chromium # (optional) fetch patched Chromium for the fallback engine

Or with pip:

pip install wraith
camoufox fetch                     # fetch the Camoufox Firefox build
patchright install chromium        # (optional) fallback engine

Verify the install:

uv run python -c "import wraith; print(wraith.__version__)"
uv run wraith --help

โš ๏ธ Camoufox 0.4.x crashes on playwright >= 1.60 (a Firefox pageError serialization bug). Wraith pins playwright == 1.55.x and detects a mismatch up front with an actionable error. patchright is independently versioned and unaffected.

Quickstart

(a) Library โ€” AgentBrowser

The agent browser is the highest-level entry point: navigate, perceive an indexed snapshot, and act on elements by index.

from wraith import agent_browser

# Self-launches a stealth Camoufox session; closes it on exit.
with agent_browser(engine="camoufox", headless=True) as ab:
    snap = ab.navigate("https://example.com")
    print(snap.to_text())          # [12]<button role=button>Search</button> ...

    ab.type(3, "wraith", enter=True)  # type into element [3] and press Enter
    ab.click(12)                       # click element [12]
    print(ab.read())                   # current page as markdown

Opaque secret capabilities

Use fill_secret() when an agent must fill a secret field. Do not give the agent the secret value. Give it an opaque capability from your secret broker.

The capability contains these fields:

Field

Purpose

provider

Selects a registered provider.

handle

Identifies provider-owned secret material. Wraith redacts it from representations.

allowed_origins

Lists exact HTTP or HTTPS origins. Scheme, host, and non-default port must match.

field_kind

Limits the target field to password, username, email, otp, card-number, card-expiry, card-cvc, or text.

expires_at

Sets an optional ISO 8601 expiry with a time zone.

max_uses

Sets the browser-side use limit. The default is one.

capability_id

Carries an optional provider audit identifier. Wraith always counts uses by provider and handle.

Secret targets must use main-frame input or textarea elements. Wraith does not accept contenteditable targets because readable page text can expose them. Username and OTP fields must declare autocomplete="username" or autocomplete="one-time-code".

Register the provider before the fill. A provider must return SecretMaterial. It must authenticate and consume the handle. It must also enforce trusted policy at the broker boundary.

from wraith import SecretMaterial, agent_browser, register_secret_provider


class BrokerProvider:
    def resolve(self, capability, context):
        # broker.consume() must authenticate the opaque handle.
        # It must check context.origin and its own policy.
        value = broker.consume(capability.handle, context=context)
        return SecretMaterial(value)


register_secret_provider("broker", BrokerProvider())

with agent_browser(engine="camoufox", headless=True) as ab:
    ab.navigate("https://accounts.example.com/login")
    ab.fill_secret(7, {
        "provider": "broker",
        "handle": "opaque-capability-token",
        "allowed_origins": ["https://accounts.example.com"],
        "field_kind": "password",
        "expires_at": "2030-09-01T12:00:00Z",
        "max_uses": 1,
    })

You can also pass secret_providers={"broker": BrokerProvider()} to agent_browser(). This keeps the provider on one browser instance.

A successful fill marks the session as secret-tainted. Wraith then blocks save_storage_state() and screenshot() by default. Library callers can set allow_secret_tainted=True to accept either risk.

For embedded MCP, register the provider in the MCP server process before app.run():

from wraith import register_secret_provider
from wraith.mcp import app

register_secret_provider("broker", BrokerProvider())
app.run()

The MCP agent calls fill_secret(index, capability). The tool accepts and returns no secret value. The normal wraith-mcp command has no provider by default. A provider registration in another process does not affect it.

Wraith has no Instinct Vault provider. Direct use needs an Instinct provider or broker adapter that Wraith can reach. See Security Policy for trust limits and observed Instinct behavior.

Lower-level: launch a session and borrow a warmed identity from your own profile.

import wraith

with wraith.browser(engine="camoufox", geoip=True) as s:
    # Borrow your own warmed identity from a real Zen/Firefox profile on disk.
    profile = wraith.find_zen_profiles()[0]
    cookies = wraith.extract_cookies(profile, domain_filter="example.com")
    wraith.inject_cookies(s.context, cookies)

    s.page.goto("https://example.com")            # navigate as the logged-in user

    # Optionally harvest a live bearer token the app mints per session.
    h = wraith.SessionHarvester(target_url="api.example.com", auth_cookie="session")
    h.attach(s.context)
    s.page.goto("https://example.com/dashboard")
    h.wait(timeout=60)
    h.save_session("example.session.json")

import wraith is resilient: if an optional browser dependency is missing, the affected symbols are omitted and wraith.missing_imports records why.

(b) CLI โ€” wraith

The wraith console script groups its subcommands below. The default engine is camoufox; pass --engine chromium for the patchright fallback or --engine auto to let Wraith choose.

# agent   โ€” open a URL and print a browser-use-style indexed snapshot
uv run wraith agent https://example.com
uv run wraith agent https://example.com --json

# borrow  โ€” inject your own warmed cookies, open the site as that logged-in user
uv run wraith borrow https://example.com --host example.com
uv run wraith borrow https://example.com --profile "~/Library/Application Support/zen/Profiles/xxxx.default"

# harvest โ€” capture a live {Authorization, Cookie, User-Agent} session
uv run wraith harvest https://example.com --target api.example.com --cookie session -o example.session.json

# fetch   โ€” no-browser TLS-impersonation replay of a harvested session (fast path)
uv run wraith fetch https://api.example.com/me --session example.session.json --show-body

# selftest โ€” run the stealth leak suite; exit non-zero on a critical leak
uv run wraith selftest
uv run wraith selftest --json

# score   โ€” read this identity's reCAPTCHA-v3 reputation (fresh -> ~0.1-0.3)
uv run wraith score
uv run wraith score --engine chromium --json

# detect  โ€” fingerprint a URL's bot/WAAP defenses
uv run wraith detect https://example.com
uv run wraith detect https://example.com --json

# launch  โ€” just open a stealth browser, held open (headed)
uv run wraith launch https://example.com
uv run wraith launch https://example.com --headless --no-wait

# profile โ€” sync a local login to a remote Wraith over an encrypted dead-drop
uv run wraith profile sync --relay https://<name>.workers.dev --from chrome --domain elal.com
uv run wraith profile receive <pairing-code> --open https://www.elal.com/   # remote: inject + browse
uv run wraith profile receive <pairing-code> --out session.json             # remote: save the jar
uv run wraith profile revoke  <pairing-code>                                # burn a mis-sent drop

# mcp     โ€” run the MCP server over stdio (see below)
uv run wraith mcp

The base borrow / extract_cookies path reads Firefox/Zen profiles (plaintext cookie store, same engine family as Camoufox) and still raises ChromeEncryptionError for Chrome, on purpose. To use a Chrome login, reach for wraith profile sync --from chrome below โ€” it opts into the OS keychain decryptor (wraith.chrome) explicitly.

Profile sync โ€” a laptop login on a remote Wraith

wraith profile sync moves a domain-scoped login from your laptop to a remote Wraith (a headless box, tmm, a cloud VM) over an anonymous, login-free, end-to-end-encrypted dead-drop. No account, no inbound port, no long-lived key โ€” the agent never sees the jar.

LAPTOP                                   RELAY (Cloudflare Worker)        REMOTE (wraith-mcp)
  wraith profile sync --from chrome โ”€โ”   stores 1 sealed blob per         receive_profile(code)
    read + decrypt cookies           โ”‚   random slot, ~10 min TTL,        โ”€ pulls + opens in RAM
    scope to --domain                โ”œโ”€โ”€โ–ถ hands it over exactly once โ”€โ”€โ”€โ”€โ”€โ–ถ injects into live context
    seal under an ephemeral secret   โ”‚   (sees only ciphertext + IPs)      navigate() as that user
    print a one-shot pairing code โ”€โ”€โ”€โ”˜
  • Source (--from): chrome, firefox, zen, or login (open a window, sign in by hand โ€” works on any OS, needs no keychain).

  • Transport: one ephemeral secret per transfer derives an unguessable relay slot and a ChaCha20-Poly1305 key; the blob is size-padded and freshness-gated. Move the pairing code out of band (ssh, password manager, QR). The relay is a SQLite-backed Durable Object (atomic single pickup, Free-plan) deployed from deploy/ with wrangler deploy โ€” no KV namespace.

  • Revoke: holding the secret also lets you burn a drop โ€” wraith profile revoke <code> deletes it at the relay if you mis-sent it or the code leaked.

  • Over Tailscale instead? Skip the relay: ssh <host> wraith profile receive <code>.

A cookie jar is the session past 2FA โ€” keep syncs domain-scoped, and see SECURITY.md for the trust limits.

(c) MCP server

Wraith ships a stdio MCP server (wraith-mcp) that exposes the agent browser as tools โ€” navigate, snapshot, click, type_text, fill_secret, scroll, read, screenshot, detect_waap, borrow, and receive_profile. Wire it into an MCP client such as Claude Code:

claude mcp add wraith -- uv run --directory /path/to/wraith wraith-mcp

(Equivalently, the server starts via uv run wraith mcp or uv run wraith-mcp.)

Architecture

Wraith is a set of focused, mostly-independent modules under wraith/:

Module

Responsibility

engine

Stealth launcher & engine selection. launch() / browser() return a Session (.page, .context, .browser); clear_challenge() is the cookie-free WAAP front door. Camoufox primary, patchright Chromium fallback; enforces the playwright==1.55 pin.

identity

Signature feature. Discover Firefox/Zen/Chrome profiles, extract_cookies(), normalize them, and inject_cookies() into a context. Firefox/Zen plaintext; Chrome raises ChromeEncryptionError (opt into chrome to decrypt).

chrome

Opt-in Chrome/Chromium cookie decryptor for profile sync: recovers the os_crypt key (macOS Keychain, Linux Secret-Service/peanuts, Windows DPAPI), decrypts v10/v11 values, strips the Chrome 130+ host hash, refuses app-bound v20.

deaddrop

Anonymous, login-free, end-to-end-encrypted transport. One ephemeral secret per transfer โ†’ an unguessable relay slot + ChaCha20-Poly1305 key; seal/open_sealed, push/pull, and a dot-joined base64url pairing code. Relay: deploy/worker.js.

profile

Ties it together: gather_cookies (chrome/firefox/zen) or capture_login_jar (manual sign-in) โ†’ domain-scoped jar โ†’ sync_profile (push) / receive_profile (pull + inject).

harvest

Live session capture. SessionHarvester latches the first request carrying an Authorization header + auth cookie; harvest_session() is the high-level helper.

detect

Diagnostics: identify_waap() (vendor fingerprinting), recaptcha_v3_score() (reputation read), bot_detector() (rebrowser automation tells), fingerprint().

behavior

Human-like helpers: human_move() (curved/eased/jittered mouse), human_type() (per-key cadence), dwell().

agent

The perceive/act-by-index browser wrapper. AgentBrowser / agent_browser() built on the snapshot layer.

snapshot

Agent perception: take_snapshot() builds an indexed, browser-use-style DOM Snapshot of interactive Elements.

secrets

Opaque secret capabilities, provider registration, short-lived secret material, and policy errors.

recaptcha

v3 token harvesting from a warmed/borrowed session (harvest_token, score) + solver-service skeletons (SolverService, CapSolver, TwoCaptcha).

proxy

Dependency-free ProxyPool (round-robin / random), normalize_proxy(), and to_playwright_proxy() (URL string โ†’ Playwright/Camoufox proxy dict) for clear_challenge rotation.

providers

First-class residential-proxy integrations. DataImpulse and AnyIP build proxy URLs (rotating/sticky) and ProxyPools (pool) for launch(proxy=...) / clear_challenge(proxy_pool=...).

mcp

The wraith-mcp stdio server exposing the agent browser as MCP tools (runs on the mcp SDK 1.x FastMCP or 2.x MCPServer via a shim).

cli

The wraith command. Lazily imports each component so --help works on a partial install.

Runnable, heavily-commented examples live in examples/: borrow_session.py, score_check.py, detect_waap.py.

How it gets past defenses (honest tiers)

Wraith uses the cheapest mechanism that works for each tier โ€” there is no magic universal bypass:

  1. Engine stealth (Camoufox / Firefox). Firefox skips the Chrome-specific isChrome() detection cluster entirely, so the bulk of fingerprint tells never run. This alone clears solvable JS interstitials like Reblaze/Link11 ac_v2 โ€” clear_challenge() just navigates and polls for the clearance cookie. No cookies, no proxy needed.

  2. Identity borrowing. For reputation defenses (reCAPTCHA-v3) and already-authenticated areas of your own accounts, inject a warmed session from your real on-disk profile (extract_cookies โ†’ inject_cookies), or harvest a live bearer token (SessionHarvester). You borrow the reputation rather than trying to fake it.

  3. Residential exit rotation. IP-reputation tiers (Reblaze 474/481 rate-limit) can't be cleared by waiting or by cookies โ€” they need a different exit IP. ProxyPool and the DataImpulse / AnyIP providers feed rotating/sticky residential (or anyIP mobile) exits into launch(proxy=...) and clear_challenge(proxy_pool=...).

  4. Not solvable. Hard blocks (HTTP 492, non-browser / HeadlessChrome UA) and reCAPTCHA-v3 with no warmed identity are not bypassable by Wraith โ€” they raise actionable errors rather than pretending. reCAPTCHA-v3 has no client solver; recaptcha.py only harvests a token from a warmed session.

Docs

  • docs/DETECTION.md โ€” a WAAP / bot-system taxonomy with a quick-ID cheat sheet (header / cookie / status signals) and per-vendor deep dives (Reblaze/Link11 ac_v2, Akamai, reCAPTCHA-v3, DataDome, Imperva, Kasada, SiteMinder).

  • docs/PLAYBOOK.md โ€” the decision playbook: engine choice, the playwright==1.55 pin, Chromium hardening, identity consistency, cookie extraction, live token harvesting, proxy rotation, and an end-to-end decision flow.

  • docs/AGENTS.md โ€” the agent perception/action layer and the MCP server: snapshot format, acting by index, and wiring Wraith into an MCP client.

Tests

uv run pytest -q

The suite runs fully offline (no browser binaries, no network): it asserts the package imports cleanly, the public API symbols exist, and the detection / identity / proxy logic behaves against synthetic inputs.

Contributing

Contributions are welcome. Please:

  1. Fork and branch from main.

  2. uv sync and keep the suite green (uv run pytest -q).

  3. Lint with uv run ruff check . before opening a PR.

Issues and PRs: https://github.com/YogevKr/wraith.

License

MIT โ€” see LICENSE.

Available Tools

15 tools
borrowA

Borrow a warmed, already-authenticated identity for domain from a real Firefox/Zen profile on this machine and inject its cookies into the live browser, so subsequent navigate calls load as that logged-in user โ€” the core Wraith move for sidestepping reputation-based defenses.

profile optionally selects a profile by a path substring; otherwise the first Zen profile is used, falling back to the first Firefox profile.

ParametersJSON Schema
NameRequiredDescriptionDefault
domainYes
profileNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full burden. It discloses that the tool injects cookies and modifies browser state for subsequent navigate calls, but does not mention side effects, required permissions, or what happens to existing state. The behavioral impact is partially described but lacks completeness.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise with two focused paragraphs. The first paragraph front-loads the core purpose and effect, and the second efficiently covers the optional parameter. Every sentence adds useful information without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has only two parameters, no annotations, and an output schema (whose details are not needed), the description fully covers the tool's effect, parameter meaning, and usage context. It explains the prerequisite for navigate and the fallback logic for profiles, making it complete for the tool's complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description provides clear semantic meaning for both parameters: 'domain' is the target for which to borrow an identity, and 'profile' is an optional path substring with documented fallback behavior (first Zen, then Firefox). This adds significant value beyond the bare input schema, which only gives names and types.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'borrow' and the specific resource: a warmed, already-authenticated identity from a real Firefox/Zen profile. It distinguishes itself from sibling tools by explaining its role in injecting cookies for authenticated navigation, which is unique among the listed tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage context ('core Wraith move for sidestepping reputation-based defenses') but does not explicitly state when to use versus alternatives or when not to use. There is no direct comparison to other tools, so guidance is implied rather than explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

browser_tabsA

Manage tabs. action: list (default), select (by index), new (optionally open url), or close (by index). Returns the tab list, or the new active tab's snapshot for select/new.

ParametersJSON Schema
NameRequiredDescriptionDefault
urlNo
indexNo
actionNolist

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

It discloses the core behaviors: the default action, parameter roles, and return value for select/new actions. However, there are no annotations, and the description does not state what close returns, how side effects like opening a new tab affect the active tab, or error behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded with 'Manage tabs,' then immediately enumerates actions and return behavior. Every sentence carries necessary information, with no filler or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers actions, parameters, and returns for most cases, but leaves gaps: the close action's return value is not specified, and there is no mention of error handling or prerequisites. An output schema exists, which may cover returns, but the missing close behavior still leaves the description slightly incomplete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, but the description fully compensates by explaining all three parameters: action values (list/select/new/close), index (used by select/close), and url (optional for new). It also clarifies the default action, giving agents complete semantic grounding beyond raw schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies the tool as managing browser tabs and enumerates specific actions (list, select, new, close), making its function concrete. It is distinct from sibling tools like navigate or snapshot, though it does not explicitly name alternatives.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explains how each action works and what parameters apply, but gives no guidance on when to use this tool versus sibling tools such as navigate or read. There are no exclusions, preconditions, or routing cues to help an agent choose it over alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

clickA

Click the element with the given index (from the latest snapshot).

Returns the resulting snapshot (or a compact change summary when include_snapshot=false). The result's Changed: line reports what the click did (url change / new elements / nothing).

ParametersJSON Schema
NameRequiredDescriptionDefault
indexYes
include_snapshotNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and explains what the tool returns and how to interpret the Changed line (url change / new elements / nothing). It does not discuss error handling or waiting behavior, but the disclosed effect-reporting is meaningful behavioral transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two focused sentences front-load the core action and then explain the return behavior without any filler. Every clause earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a two-parameter interaction tool with an output schema, the description covers input source, parameter behavior, and result semantics. Minor gaps remain around invalid-index behavior and page-loading side effects, but nothing critical for basic invocation is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description compensates by clarifying that index refers to an element from the latest snapshot and that include_snapshot=false produces a compact change summary. It stops short of specifying indexing details such as zero-based vs one-based, but adds clear meaning to both parameters.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The first sentence uses a specific verb ('Click') and resource ('element with the given index from the latest snapshot'), making the action unambiguous. This distinguishes it from sibling tools like snapshot, navigate, and type_text without needing to name them.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description establishes the prerequisite of using an index from the latest snapshot, so an agent knows it must have a fresh snapshot before calling. It does not explicitly name alternatives or exclusion conditions, but the operational context is clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

detect_waapA

Fingerprint a URL's WAAP / anti-bot defenses (Akamai, Cloudflare, Reblaze/Link11, DataDome, Incapsula, SiteMinder, reCAPTCHA, ...). Returns a list of detected vendor names โ€” empty if none. Passive; no browser needed.

ParametersJSON Schema
NameRequiredDescriptionDefault
urlYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full burden. It declares the tool is passive and returns a list of vendor names (empty if none), implying no side effects. Could be more explicit about no modifications, but sufficient.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences with front-loaded purpose and examples. No unnecessary words; every sentence adds value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Tool is simple (one param, no nested objects), and description clearly states input, behavior, and output (list of vendor names or empty). Output schema exists but description already covers return value.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Single parameter 'url' with 0% schema description coverage. The description clarifies it's the target URL for fingerprinting, which is adequate. Could add format expectations but not critical.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states the tool fingerprints a URL's WAAP/anti-bot defenses with specific vendor examples. Distinguishes from sibling browser interaction tools (click, navigate, etc.).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly notes 'Passive; no browser needed', guiding agents to use it when they want to identify defenses without browser overhead. Lacks explicit when-not-to-use or alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ensure_high_scoreA

Borrow a logged-in Google identity's reputation and open url so a reCAPTCHA-v3 score is minted high.

This is the GENERAL reCAPTCHA-v3 pass: the v3 score is computed inside the google.com reCAPTCHA iframe from the .google.com reputation cookies present in the context, so injecting a warmed Google identity's cookies (delivered 3rd-party with secure+SameSite=None into an un-partitioned context) lifts the score across any sitekey/site. The browser is (re)launched with the un-partition firefox prefs, the reputation cookies are injected, then the URL is navigated (passing any WAAP and dismissing consent first).

profile optionally selects the source Firefox/Zen profile by a path substring; otherwise the first Zen profile is used, falling back to Firefox.

WARNING: borrowing your primary Google identity carries anomalous-session / 2FA risk โ€” this is opt-in. After it returns, VERIFY success against the real protected endpoint (accept vs reject); the v3 score is run-variable and there is no trustworthy score readout for a 3rd-party sitekey. Returns the detected reCAPTCHA params and whether the reload request carried the reputation cookies.

ParametersJSON Schema
NameRequiredDescriptionDefault
urlYes
profileNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden and meets it: it discloses browser relaunch, un-partitioned Firefox prefs, cookie injection, navigation, consent dismissal, anomalous-session/2FA risk, and run-variable score behavior. It also tells the agent what the tool returns regarding reCAPTCHA params and the cookie-bearing reload request. This is thorough and far beyond a generic statement.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is detailed but every sentence carries load: core action, mechanism, generality, profile selection, risk warning, and verification directive. It is front-loaded with the core action before diving into mechanics and caveats. Nothing feels redundant or padded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is complex, involving browser launch, cookie injection, identity risk, and POST-session verification, and the description covers all of it. An output schema exists, so detailed return-shape explanation is not required, but the description still summarizes what comes back. An agent has enough information to call it correctly and to anticipate failure behavior.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Even though schema coverage is 0%, the description supplies complete meaning for both parameters: `url` is the target to be opened, and `profile` is a path-substring selector that defaults to the first Zen profile then falls back to Firefox. It explicitly explains the `null` default behavior. This fully compensates for the empty schema descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with an explicit verb and object: it borrows a logged-in Google identity's reputation and opens a URL to mint a high reCAPTCHA-v3 score. It clearly distinguishes itself as the GENERAL v3 pass, separating it from the sibling navigation and borrow tools. The scope is unambiguous and tells the agent what the tool does.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It tells the agent when to use this tool (general reCAPTCHA-v3 pass) and gives operational context such as launching the browser with un-partitioned prefs and injecting cookies. It adds a WARNING about primary-identity risk and instructs verifying against the real protected endpoint rather than trusting a score readout. It falls just short of a 5 because it does not explicitly name sibling alternatives or state when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

fetchA

No-browser TLS-impersonation request โ€” the cheap fast path.

Replays a captured session against url with a real-browser TLS+HTTP2 fingerprint and NO browser launch. session_file is a JSON file with {headers:{Authorization,Cookie,User-Agent}} (as written by wraith harvest / the borrow flow). Use this to replay an already-authenticated/cleared session cheaply; escalate to navigate only when the returned classification is challenge. Returns the status, classification, and a body preview.

ParametersJSON Schema
NameRequiredDescriptionDefault
urlYes
methodNoGET
impersonateNo
session_fileNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations present, the description carries the full burden and mostly succeeds: it discloses no-browser execution, TLS fingerprinting, session replay semantics, and the returned status/classification/body preview. It does not mention error behavior for a missing session_file, but the core behavioral traits are clear.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences, front-loaded with the most important distinction and no filler. Every sentence contributes either usage guidance, the session-file format, or the routing rule.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the tool's niche, how to obtain a session file, what to do on challenge classification, and what the response contains. Given the output schema exists, return-value detail is appropriately minimal.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It does explain url and session_file, including the JSON shape, but method and impersonate are left undocumented beyond their names and defaults. This leaves a clear gap for two optional parameters.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'No-browser TLS-impersonation request' targeting a URL. It clearly distinguishes this tool from siblings like navigate by emphasizing 'NO browser launch' and 'cheap fast path'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit guidance is provided: 'Use this to replay an already-authenticated/cleared session cheaply; escalate to navigate only when the returned classification is challenge.' This tells the agent exactly when to use this tool and when to switch to an alternative.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

fill_secretA

Fill a field from an opaque secret capability.

The capability names a registered provider and an opaque handle. It also binds the fill to exact origins, one field kind, an expiry, and a use limit. The tool never accepts or returns the secret value.

ParametersJSON Schema
NameRequiredDescriptionDefault
indexYes
capabilityYes
include_snapshotNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It usefully reveals that the tool never accepts or returns the secret value and that fills are constrained by provider, origin, field kind, expiry, and use limit. However, it does not disclose side effects, behavior on expired/mismatched capabilities, or any other runtime effects beyond the act of filling.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three sentences with no filler. The first sentence delivers the core function, and the following sentences provide meaningful constraint and secrecy information. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has three parameters, 0% schema coverage, and no annotations, the description is not complete enough for an agent to invoke it reliably. The output schema exists, so return values need not be explained, but the missing definitions of 'index' and 'include_snapshot', plus the lack of failure/edge-case behavior, leave significant gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate for the bare parameter schema. It adds meaning for the capability object by explaining that it names a provider and an opaque handle, but it says nothing about 'index' or 'include_snapshot'. Since two of three parameters remain effectively undocumented, the description only partially compensates.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states a specific action and object: 'Fill a field from an opaque secret capability.' It also communicates the key distinguishing trait โ€” the secret value is never accepted or returned โ€” which differentiates it from sibling tools like type_text. This is not a tautology; it tells an agent what the tool actually does.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use the tool by explaining that the capability is bound to exact origins, a field kind, an expiry, and a use limit. However, it never explicitly says when to prefer fill_secret over alternatives such as type_text or click, and it gives no exclusions. Usage context is present but left largely to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

readA

Return the current page's readable content as markdown (for extraction / summarisation, as opposed to acting on elements).

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description must cover behavior. It states output is readable content as markdown but doesn't disclose if page loading is required, failure conditions, or that it's a read-only operation. Adequate but could add more behavioral context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

One concise sentence with clear structure, front-loading the purpose and adding contextual use-case. No wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With zero parameters and an existing output schema, the description fully covers the tool's functionality, format, and intended use. Complete for a simple extraction tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

No parameters exist, so schema coverage is 100%. Description correctly adds no param info, as none needed.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states the tool returns readable content as markdown, specifying the format and use case (extraction/summarisation). It distinguishes from acting on elements, providing clear purpose.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly contrasts with acting on elements, giving context when to use this tool vs interaction tools (click, type_text). Could be more explicit about exclusions (e.g., not for navigation or screenshots), but provides sufficient guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

receive_profileA

Pull a synced login from a one-shot pairing code and inject it.

A laptop runs wraith profile sync and hands you the pairing code out of band. This tool pulls the end-to-end-encrypted cookie jar from the dead-drop relay, opens it in memory, and injects the cookies into the live browser context โ€” so subsequent navigate calls load as that already-signed-in user. No password ever reaches you: only the session cookies, scoped to the domain the laptop chose. The drop is single-use and self-destructs after pickup.

ParametersJSON Schema
NameRequiredDescriptionDefault
codeYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full behavioral burden. It discloses the end-to-end encryption of the cookie jar, that it 'opens it in memory' rather than persisting it, injects cookies into the live browser context, that no password ever reaches the agent, and that the drop is 'single-use and self-destructs after pickup.' These details clearly set expectations about security, side effects, and session lifecycle.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the primary action in the first sentence, then each subsequent sentence adds meaningful context: the workflow, security model, and the single-use nature. There is no repetitive filler or irrelevant detail, making it appropriately sized for the technical complexity it conveys.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

This is a single-parameter tool with no annotations but with an output schema present. The description covers the input semantics, the operational process, the security guarantees, and the lifecycle of the drop. Combined with the output schema, the definition is complete enough for an agent to correctly invoke and understand the tool's behavior.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema only defines 'code' with a title and no description, giving 0% schema coverage. The description fully compensates by explaining that the code is a one-shot pairing code provided out of band, and elaborates on the workflow around it. This gives the agent complete semantic understanding of the sole parameter.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific action: 'Pull a synced login from a one-shot pairing ``code`` and inject it.' This clearly identifies the tool's resource (a synced login/pairing code) and the verb (pull/inject), and context about subsequent navigate calls distinguishes it from navigation or browsing tools. It is unambiguous about what the tool accomplishes.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives a concrete usage scenario: 'A laptop runs ``wraith profile sync`` and hands you the pairing code out of band.' It explains when to use the tool (after receiving a pairing code) and its effect on later navigate calls. It does not explicitly name alternatives or when-not-to-use conditions, but it provides clear situational guidance sufficient for an agent to apply it appropriately.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

save_stateA

Export the current session (cookies + localStorage) to a Playwright storageState JSON at path โ€” a portable, reusable authenticated session.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden. It discloses the main side effect (writing cookies + localStorage to a storageState JSON at path), but it does not mention whether the file is overwritten, whether an active authenticated session is required, or what happens if the session has no cookies/localStorage.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, well-paced sentence with no filler. The core action and destination are front-loaded, and the 'portable, reusable authenticated session' addition earns its place by explaining why this export is valuable.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a one-parameter tool with an output schema present, the description covers the essential what and where. However, it is incomplete on edge-case behavior such as overwrites, failure modes, and prerequisites, which an agent might need to invoke it confidently without annotations.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description must compensate. It clarifies that 'path' is the destination for the exported JSON, which is useful, but it does not provide details like file naming conventions, relative vs. absolute paths, or extension expectations beyond the implied JSON.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific action (export), a specific resource (current session cookies + localStorage), a concrete output format (Playwright storageState JSON), and a destination (path). It is clearly distinguishable from sibling tools like navigate, click, or read.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'a portable, reusable authenticated session' gives clear context for when to use this tool: persist auth state for later reuse. It does not explicitly name alternatives or state when not to use it, so it falls just short of a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

screenshotA

Capture a screenshot of the current page.

Returns an inline PNG image (so a multimodal model can see the page and disambiguate by the same element indices). On an SDK without image content support, falls back to saving a temp PNG and returning its path. Wraith blocks this tool after a secret fill.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and handles it well. It discloses the primary return format (inline PNG), the fallback behavior when image content is unsupported (temp PNG path), and the important restriction about Wraith blocking the tool after a secret fill.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded. The main action appears first, followed by three specific, non-redundant behavioral details. Every sentence contributes useful information without filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite having no output schema and no annotations, the description explains what the call returns in both supported SDK modes and notes a critical limitation. For a zero-parameter tool, this is complete enough for an agent to know what will happen and how to interpret the result.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters and the schema already reflects that completely. Since there are no parameters to describe, the baseline of 4 is appropriate, and the description does not need to add parameter-level detail.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a clear verb and resource: 'Capture a screenshot of the current page.' This is unambiguous, but it does not explicitly differentiate from sibling tools like snapshot, so it falls at 'clear but no sibling differentiation.'

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides a concrete use context: returning an inline PNG so a multimodal model can see the page and disambiguate by element indices. It also states a clear exclusion by noting that Wraith blocks the tool after a secret fill, though it does not name alternative tools or when to prefer them.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

scrollA

Scroll the page ("down" or "up") and return a fresh snapshot (or a compact summary when include_snapshot=false).

ParametersJSON Schema
NameRequiredDescriptionDefault
directionNodown
include_snapshotNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It does disclose meaningful behavior: scrolling the page and returning either a fresh snapshot or a compact summary when include_snapshot=false. However, it does not explain side effects, failure cases, or what 'compact summary' entails, so coverage is adequate but not rich.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence with no filler. Every clause adds useful information: the action, the direction options, and the effect of the include_snapshot parameter.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple two-parameter browser action with an output schema present, the description covers the action and both parameter behaviors. It is slightly incomplete only because it does not explicitly route the agent away from sibling tools like snapshot or read, but nothing required to invoke the tool correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate, and it does. It explains the meaningful values of direction ("down" or "up") and clarifies that include_snapshot=false yields a compact summary instead of a snapshot. Both parameters are given semantics beyond their bare schema types.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific action and resource: scroll the page, with direction values "down" or "up". The core verb 'scroll' clearly distinguishes this tool from siblings like navigate, click, snapshot, and read, even without naming them.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies the tool is used when the page needs to be scrolled, but it never explicitly states when to use this versus snapshot, read, or navigate. There are no alternative tool names, exclusions, or prerequisite conditions such as requiring a page to be loaded.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

snapshotA

Re-perceive the current page: a fresh indexed snapshot of its interactive elements (use after the DOM may have changed).

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided; description clarifies it produces an indexed snapshot of interactive elements. Could mention performance implications but generally transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence, concise, front-loaded with purpose. No unnecessary words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no parameters and an output schema, the description fully covers when and what the tool does. No gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

No parameters; baseline 4. No additional info needed.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states the tool re-perceives the page and produces a fresh indexed snapshot of interactive elements, distinguishing it from siblings like screenshot or read.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says to use after DOM changes, providing clear context. Could be improved by contrasting with alternatives but sufficient.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

type_textA

Type text into the input with the given index (clears it first; if enter is true, presses Enter to submit). Returns the resulting snapshot (or a compact summary when include_snapshot=false).

ParametersJSON Schema
NameRequiredDescriptionDefault
textYes
enterNo
indexYes
include_snapshotNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden and discloses that the input is cleared before typing and that Enter is pressed when enter=true. It also states return behavior (snapshot vs compact summary), though it does not mention possible page navigation side effects or failure modes.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single dense sentence front-loads the primary action, then adds clearing, Enter submission, and return behavior in order of importance. There is no filler or duplication of schema details.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers all functional aspects needed to invoke the tool: preconditions within the action, conditional behavior, and return variants. The output schema exists, so return specifics are not necessary; the only real gap is where the input index comes from, but this is reasonably inferable in a browser-automation context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema parameter coverage is 0%, but the prose maps every parameter to its effect: text is typed, index selects the input, enter triggers submit, and include_snapshot=false returns a compact summary. It adds meaning that the schema titles lack, though it does not elaborate on what index refers to or the summary's structure.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific action ('Type text into the input') and identifies the resource by index. It adds concrete behavioral details (clears first, Enter submission) that make the tool's job unmistakable and distinguish it from siblings like fill_secret.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is given about when to choose this tool over fill_secret, click, or read. The description explains mechanics but not the context or exclusions that would help an agent select it correctly.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. 11 tool updatesv0.4.0
    • Addedbrowser_tabs
    • Changedclick1 field changed
      • addedInput schema / properties / include_snapshot
        Added value: +{
        +  "default": true,
        +  "title": "Include Snapshot",
        +  "type": "boolean"
        +}
    • Addedensure_high_score
    • Addedfetch
    • Addedfill_secret
    • Changednavigate1 field changed
      • addedInput schema / properties / include_snapshot
        Added value: +{
        +  "default": true,
        +  "title": "Include Snapshot",
        +  "type": "boolean"
        +}
    • Addedreceive_profile
    • Addedsave_state
    • Changedscreenshot1 field changed
      • changedOutput schema / (root)
        Previous value: -{
        -  "properties": {
        -    "result": {
        -      "title": "Result",
        -      "type": "string"
        -    }
        -  },
        -  "required": [
        -    "result"
        -  ],
        -  "title": "screenshotOutput",
        -  "type": "object"
        -}New value: +null
    • Changedscroll1 field changed
      • addedInput schema / properties / include_snapshot
        Added value: +{
        +  "default": true,
        +  "title": "Include Snapshot",
        +  "type": "boolean"
        +}
    • Changedtype_text1 field changed
      • addedInput schema / properties / include_snapshot
        Added value: +{
        +  "default": true,
        +  "title": "Include Snapshot",
        +  "type": "boolean"
        +}
  2. 9 tool updatesv0.1.0
    • First observedborrow
    • First observedclick
    • First observeddetect_waap
    • First observednavigate
    • First observedread
    • First observedscreenshot
    • First observedscroll
    • First observedsnapshot
    • First observedtype_text

TDQS

A4/5.0
Disambiguation4/5

Most tools target clearly distinct actions: navigate/click/type/scroll/read/screenshot all have separate roles. The main ambiguity is among the identity-injection tools (borrow, ensure_high_score, receive_profile), which all involve injecting cookies and could be confused despite detailed descriptions.

Naming Consistency3/5

All names are lowercase snake_case and mostly verb-led, but the pattern is mixed: some are bare verbs (navigate, click, scroll, fetch), some are verb_noun (type_text, fill_secret, save_state), and browser_tabs breaks the verb convention entirely. It is readable but not a uniform pattern.

Tool Count5/5

At 15 tools, the set is at the upper edge of the typical well-scoped range, but each tool addresses a distinct part of the anti-bot browsing workflowโ€”detection, navigation, interaction, identity borrowing, session persistence, and no-browser fetching. The count feels justified for the complexity of the domain.

Completeness4/5

The surface covers the full core lifecycle: detect defenses, navigate, interact, authenticate, persist sessions, and extract content. Minor gaps existโ€”there is no explicit wait-for-element, back/reload, or general DOM query toolโ€”but agents can work around these with snapshot/click/scroll.

Maintenance

ActivityMaintained
ResponsivenessUnresponsive

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers

  • A
    license
    C
    quality
    C
    maintenance
    Provides browser automation and web scraping as MCP tools, enabling autonomous URL ingestion, crawling, extraction, and anti-bot handling with interactive browser control.
    62
    5
    MIT
  • A
    license
    Not graded
    quality
    D
    maintenance
    Provides a real browser that bypasses bot detection (Cloudflare, Turnstile) for AI agents, enabling navigation, clicking, typing, screenshots, and data collection through MCP tools.
    104
    MIT
  • A
    license
    B
    quality
    A
    maintenance
    Provides AI agents with a real browser environment for web automation, memory, and secure credential management through 15 MCP tools.
    15
    MIT

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/YogevKr/wraith'

If you have feedback or need assistance with the MCP directory API, please join our Discord server