Ghostvault
Enables driving Canva.com through Google SSO after signing in with a Google account.
Provides tools to read Gmail messages from signed-in Google accounts.
Allows managing multiple Google accounts, signing in/out, switching accounts, reading Gmail, and driving any website that supports Sign in with Google through a persistent anti-detect browser.
Allows driving Notion.so through Google SSO after signing in with a Google account.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@GhostvaultSign in to my personal Google account and show unread emails from today."
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
๐ป Ghostvault
Source-available MCP server for managing browser sessions on any website through your AI agent โ powered by Camoufox.
Let Claude Desktop, Cursor, Cline, or any MCP-compatible agent sign in to any website โ Google, GitHub, Facebook, your bank, internal apps โ switch between accounts, scrape pages, call APIs, and automate any login-gated flow. Each account gets a locked anti-detect fingerprint and a persistent session that survives restarts.
Quick start ยท How it works ยท Tools ยท Docs ยท FAQ ยท Contributing
Why Ghostvault
Managing multiple accounts across websites from automation is painful:
๐ Anti-bot detection flags headless browsers, datacenter IPs, and behavioral patterns
๐ Account hopping requires re-authentication every time
๐ Login-gated sites don't expose API access
๐ค Detecting login options (SSO vs form) and choosing the right path is manual
Ghostvault solves this by giving your AI agent a real, anti-detect browser per account โ with sessions that persist between restarts, fingerprints that don't drift, and a provider system that works with any website (not just Google).
Related MCP server: browser-auth-mcp
Features
๐ญ Locked fingerprints โ each account always looks like the same device (Camoufox C-level spoofing + persisted noise seeds + advanced injection: locale, timezone, fonts, WebGL, WebRTC gate, battery, media devices)
๐งฉ Presets + advanced config โ
balanced/stealth/minimalpresets + 105 Camoufox config keys + 10 device profile templates (macbook, thinkpad, surface, ...)๐ Provider-agnostic login โ built-in providers (google, github, facebook) + create custom providers for any website via
gv_create_provider; scan login pages for SSO options withgv_detect_login_options๐๏ธ 3 login levels โ Level 1 (manual), Level 2 (form auto-fill via login_steps), Level 3 (record user's login actions โ replay automatically next time)
โจ๏ธ Human-like interaction โ realistic typing cadence (log-normal distribution), typo+correction, pre-click hover, burst scrolling; 3-layer humanize policy (off / recommended / always)
๐ Anonymous scraping โ
gv_open_ephemeralopens a throwaway session (no account, no login) for public pages๐ API tools โ
gv_api_call(HTTP in browser session),gv_eval_js(run JS in page),gv_get_cookies๐ฉบ Session health check โ
gv_check_sessiontells you if login is still valid (cookie + probe URL)๐ Persistent sessions โ sign in once per account, then reuse forever (cookies + localStorage survive restarts)
๐ Multi-account + multi-provider โ manage unlimited accounts across unlimited websites from one agent
๐๏ธ Vision support โ tools return PNG screenshots so the LLM can see the page
๐ Self-debugging โ structured JSONL logs of every action
๐ Local-first โ sessions, cookies, and fingerprints live on your machine; nothing is ever sent anywhere
๐ Optional encryption at rest โ AES-256-GCM + OS keychain
โฑ๏ธ Auto-close & auto-lock โ close + re-encrypt after each task or after N idle minutes
๐ Private/public profiles โ password gate + 5-attempt wipe
๐ค LLM-agnostic โ Claude, GPT, Gemini, or any MCP-compatible model
How it works
Your AI agent (Claude Desktop / Cursor / Cline)
โ MCP protocol (stdio or HTTP)
โผ
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
โ Ghostvault MCP Server โ
โ โ
โ 42 tools: โ
โ gv_create_account, gv_sign_in, โ
โ gv_create_provider, gv_check_session, โ
โ gv_detect_login_options, gv_record_login,โ
โ gv_open_url, gv_click_element, โ
โ gv_fill_input, gv_api_call, โ
โ gv_open_ephemeral, gv_get_cookies, โ
โ gv_setup_password, gv_unlock, ... โ
โ โ
โ Per-account persistent Camoufox profiles: โ
โ profile_A/ โโ locked fingerprint A + Google โ
โ profile_B/ โโ locked fingerprint B + GitHub โ
โ profile_C/ โโ locked fingerprint C + custom โ
โ โ
โ Provider recipes: โ
โ providers.json (shared login recipes) โ
โ google | github | facebook | custom โ
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
โ traffic exits via your IP or proxy
โผ
Any website (Google, GitHub, your bank, ...)The agent decides what to do; Ghostvault provides the hands. Each profile is a container โ it holds sessions for every website equally, not just one provider. Login is data-driven via provider recipes, so any website's login flow can be described as data, not code.
Why fingerprints are locked (critical)
Camoufox generates a fresh random fingerprint on every launch โ it does not persist one to the profile directory. Without locking, each launch would look like a brand-new device and anti-bot systems would flag the account.
Ghostvault generates one fingerprint per account at creation, serializes it (BrowserForge fingerprint + noise seeds + OS + device profile) to a sidecar JSON, and passes it back on every launch. Result: an account always presents the same identity.
Quick start
Step 1 โ Install (requires Python 3.11+):
pip install --pre ghostvault
python -m camoufox fetch # download the browser binary (~120 MB, one-time)Step 2 โ Connect your AI agent:
Add Ghostvault to your MCP client config. Find your Python path:
which python3 # use this exact path belowThen add to your client config (see Connect your agent for each client's file location):
{
"mcpServers": {
"ghostvault": {
"command": "/absolute/path/to/python3",
"args": ["-m", "ghostvault"]
}
}
}Step 3 โ Try it:
Restart your agent and say: "List available Ghostvault providers."
The agent should respond with the built-in providers (google, github, facebook, generic).
That's it. No server to start, no port to manage โ Ghostvault runs as a subprocess spawned by your AI client.
Prefer a one-command installer? (installs everything + auto-configures Claude Desktop / Cursor)
macOS / Linux (in a terminal):
curl -fsSL https://raw.githubusercontent.com/mienetic/Ghostvault/main/install.sh | bashWindows (in PowerShell):
irm https://raw.githubusercontent.com/mienetic/Ghostvault/main/install.ps1 | iexThe installer automatically:
๐ฅ Clones Ghostvault into
~/.ghostvault-app(or%USERPROFILE%\.ghostvault-appon Windows)๐ Creates an isolated Python virtualenv (doesn't touch your system Python)
๐ฆ Installs Ghostvault + all dependencies
๐ฆ Downloads the Camoufox browser binary (~120 MB, one-time)
โ๏ธ Writes the MCP config for Claude Desktop and/or Cursor if they're installed
Then restart Claude Desktop / Cursor โ Ghostvault's tools appear. That's it. ๐
Requirements: Python 3.11+ (download) and
git. On macOS, runxcode-select --installfirst ifgitisn't installed. On Windows, check "Add Python to PATH" during the Python installer.
Update
# macOS / Linux
~/.ghostvault-app/update.sh
# Windows (PowerShell)
powershell -File "$env:USERPROFILE\.ghostvault-app\update.ps1"Ghostvault also checks automatically on startup and prints a notice if a new version is available โ so you'll never be silently out of date.
Uninstall
# macOS / Linux
bash ~/.ghostvault-app/uninstall.shOn Windows, just delete the install dir and the data dir manually:
Remove-Item -Recurse -Force "$env:USERPROFILE\.ghostvault-app"
Remove-Item -Recurse -Force "$env:USERPROFILE\.ghostvault" # sessions (optional)Then remove the ghostvault entry from your Claude Desktop / Cursor config by hand.
Removes the install dir + the Ghostvault entry from your client configs. (On macOS/Linux the script asks before deleting session data, since ~/.ghostvault contains your Google sessions.)
Connect your agent
๐ก If you ran the one-line installer above, it already wrote the config for Claude Desktop and Cursor. Just restart those apps and you're done โ skip to Usage. The steps below are only needed if you installed manually, or want to connect a different agent.
Ghostvault is an MCP server, so any MCP-compatible client can connect. Ready-to-copy config files for each client live in examples/ โ see examples/README.md for the full cheat-sheet of where each file goes and the JSON shape each client expects.
โ ๏ธ Use an absolute path to your Python. Clients run the server as a subprocess and don't inherit your shell
PATH, so a barepythonwon't be found. After installing, find the right interpreter:
One-line installer:
~/.ghostvault-app/.venv/bin/pythonManual install: run
which pythonin the venv where you installed Ghostvault, or use/usr/bin/python3,/opt/homebrew/bin/python3, etc.
Supported clients
Client | Example file | Config location |
Claude Desktop |
| |
Cursor |
| |
Cline (VS Code) |
| |
VS Code (Agent mode) |
| |
ZCode |
| |
Continue.dev |
| |
Claude Code (CLI) | (CLI โ see below) |
|
Claude Code (CLI)
Claude Code is configured via the claude CLI rather than a JSON file:
claude mcp add --transport stdio -s user \
-e GHOSTVAULT_HEADLESS=false \
ghostvault -- /absolute/path/to/python -m ghostvaultVerify: claude mcp list. Scopes: -s user (all projects), -s project (shared via .mcp.json), -s local (default).
Other clients
Any MCP-compatible client works. The universal recipe:
Point
commandat an absolute Python path that has Ghostvault installedSet
argsto["-m", "ghostvault"]Optionally set
envfor anyGHOSTVAULT_*variables (see Configuration)
The clients disagree on JSON shape โ see the shape cheat-sheet in examples/README.md.
Remote / HTTP transport (advanced)
To serve Ghostvault over HTTP instead of stdio (e.g. for a remote client):
GHOSTVAULT_TRANSPORT=http GHOSTVAULT_PORT=8765 python -m ghostvaultThen point your client at http://127.0.0.1:8765/mcp (use the machine's IP for remote access โ ensure you secure it).
Verify the connection
After connecting any agent, test it with a simple prompt:
"List my Ghostvault accounts."
The agent should call gv_list_accounts and return an empty list on a fresh install. If you get an error instead, check:
The Python path in the config is absolute and correct (
ls /that/path)Ghostvault is importable from that Python:
/that/path/python -c "import ghostvault"The Camoufox browser binary is downloaded:
/that/path/python -m camoufox pathFor stdio clients: check the client's MCP/logs panel โ startup errors appear there
Just talk to your agent naturally. Example prompts:
"Sign in to my Work Google account, then read my latest 5 emails and tell me if any need an urgent reply."
"Switch to my Personal account and open Drive โ list my recent files."
"Open Notion using my Work Google login and create a new page called 'Weekly review'."
"Take a screenshot of the current page so I can see what's happening."
The agent calls the right tools. On the first sign-in of a new account, a browser window opens for you to complete login (Google will likely ask for 2FA โ this is normal).
Typical first-time flow
1. You: "Create a Google account called Work"
Agent: calls gv_create_account โ "Done. Now sign in."
2. You: "Sign in to Work"
Agent: calls gv_sign_in โ a browser window opens
You: complete Google login + 2FA in that window
Agent: "Signed in as you@gmail.com."
3. You: "Read my latest emails"
Agent: calls gv_read_gmail โ returns inbox summary
4. You: "Now switch to Personal and open Drive"
Agent: calls gv_switch_account + gv_open_urlTool reference
Anonymous scraping (2 tools) โ no account needed
Tool | Description |
| Open a throwaway Camoufox session (no profile, no login) โ |
| Close an ephemeral session + free resources (defaults to active) |
Provider management (5 tools) โ custom login recipes
Tool | Description |
| Create a custom login recipe for any website (Level 1) |
| List all providers (built-in + custom) with capability flags |
| Show one provider's full config |
| Update a custom provider (refuses built-ins) |
| Delete a custom provider (refuses built-ins) |
Login scanning + credentials (3 tools)
Tool | Description |
| Scan a page for SSO buttons, form fields, 2FA, captcha โ returns recommendation |
| Store credentials (username/password) for Level 2 auto-fill |
| Show stored credential keys (values masked) |
Session health + API (4 tools)
Tool | Description |
| Check if session is still authenticated (cookie + probe URL) |
| HTTP request using browser session (cookies + TLS fingerprint) |
| Run JavaScript in the page (extract tokens, call site JS) |
| Read browser cookies (masked values) |
Once open, all browser tools work on the ephemeral session unchanged โ gv_open_url, gv_get_page_content, gv_screenshot, gv_get_page_links, gv_click_element, gv_fill_input, gv_scroll, gv_press_key. The session is set as the active target automatically.
Accounts & lifecycle (18 tools)
Tool | Description |
| List accounts + which is active + statuses (private hidden when locked) |
| Create a slot with a locked fingerprint + advanced config ( |
| Tweak advanced fingerprint config post-creation (identity stays locked; reopen to apply) |
| Open a login window for the user (handles 2FA) |
| Open the browser reusing a saved session (no login window) |
| Change the active account |
| Check if a session is running/authenticated |
| Close a browser context (session saved) |
| Close + re-encrypt (session kept) |
| Sign out of Google (session invalidated; re-login required) |
| Delete account + profile + session + DB row permanently |
| Set a password to enable the private/public gate (browser window) |
| Unlock the gate to access private profiles (password or browser window) |
| Lock the gate + close private contexts + switch to public |
| Check whether the gate is active and unlocked |
| Mark a profile as private (hidden when locked) |
| Mark a profile as public (always accessible) |
Browser (9 tools)
Tool | Description |
| Open any URL in the active account (incl. SSO-enabled sites) |
| Read page text (+ optional screenshot via |
| Capture a PNG (vision) โ |
| List visible links |
| Click by visible text or CSS selector โ |
| Fill a form field โ |
| Press a key or chord (Enter, Tab, Escape, Ctrl+A, ...) โ |
| Scroll in human-like bursts โ |
| Read the Gmail inbox (convenience tool) |
Debug (1 tool)
Tool | Description |
| Read recent JSONL action log entries |
Full tool docstrings (what the agent sees) are in the skill/ directory (modular: 9 files covering all 42 tools).
Configuration
All settings are env vars (prefix GHOSTVAULT_), loadable from a .env file.
See .env.example for the full list. Highlights:
Var | Default | Purpose |
|
| Profiles, DB, logs |
|
| Open a visible window (recommended for login + 2FA) |
|
| Default fingerprint OS ( |
|
| Seconds to complete login + 2FA |
|
|
|
| (empty) | Optional global proxy (local-first otherwise) |
|
| Console log level |
|
| Encrypt profile dirs at rest (see Encryption) |
|
| Close browser + re-encrypt after each tool call (minimizes exposure window) |
|
| Auto-close idle contexts after N minutes (0 = disabled) |
|
| Browser window width in pixels (0 = let browser decide) |
|
| Browser window height in pixels (0 = let browser decide) |
|
| Human-like cursor movement (click jitter + bezier path). Strongly recommended for login/SSO work. |
|
| WebRTC gate: |
| (empty) | Default locale for new accounts, e.g. |
| (empty) | Default IANA timezone for new accounts, e.g. |
|
| Humanize policy: |
|
| Ephemeral (scraping) sessions are headless by default |
|
| Block image loading in ephemeral sessions (faster text scraping) |
|
| Idle timeout for ephemeral sessions (0 = disabled) |
|
| Cap on simultaneous ephemeral sessions |
Advanced fingerprint configuration
Camoufox exposes ~15 fingerprint-injection kwargs + 105 config-domain keys (battery, media devices, audio, WebGL params, screen, navigator, ...). Without Ghostvault you'd have to pass them every launch AND remember which go as constructor kwargs vs config dict keys. Ghostvault locks them into each account's fingerprint bundle, so they persist across launches alongside the identity.
The full ~105-key schema is documented at Camoufox config schema in the docs site. Use it to set raw keys like battery:level, mediaDevices:webcams, AudioContext:sampleRate via the device_config param.
Device profile templates fill in ~15 hardware-realistic keys at once โ screen size, GPU vendor/renderer, media-device counts, battery, audio rate:
await gv.create_account(
name="Work-MBP",
device_profile="macbook-pro-14-m2", # fills screen, GPU, mics, webcam, ...
device_config={"battery:level": 0.45}, # override one key
)Available profiles: macbook-pro-14-m2, macbook-air-13-m1, imac-24, windows-desktop-rtx, thinkpad-x1-carbon, surface-laptop-5, linux-workstation, dell-xps-13-ubuntu, generic-laptop, headless-server. See Device profile templates for the full comparison table.
A built-in consistency checker flags impossible combos (e.g. macOS with an NVIDIA GPU) โ warnings surface in the gv_create_account response.
Presets bundle smart defaults so you don't have to learn all 15 params:
Preset | Use case | What it sets |
| Most Google / SSO work |
|
| Signups, new IPs, sensitive accounts |
|
| Trusted sites, max speed |
|
Any explicit param you pass overrides the preset value.
Available params (all optional, all locked per-account):
Param | Type | Notes |
|
| e.g. |
|
| IANA timezone, e.g. |
|
|
|
|
|
|
|
| Disable WebGL entirely. Some sites break; use sparingly. |
|
|
|
|
| Installed font family names to inject (on top of OS defaults). |
|
| Paths to extracted Firefox addon dirs (must contain |
|
| Disable Cross-Origin-Opener-Policy โ needed for some captcha/turnstile iframes. |
|
| Block all image loading. Faster but visually inconsistent. |
Smart-default rules (applied at launch time):
block_webrtc:
explicit true/false โ use it
"auto" โ true if proxy present, false otherwise
locale / timezone:
explicit value โ use it, DISABLE geoip matching for that dimension
absent + proxy โ geoip=true (auto-match from proxy IP)
absent + no proxy โ host locale (current behavior)
humanize:
explicit value โ use it
absent โ global GHOSTVAULT_HUMANIZE default (true)Example โ stealth account in Thailand with a US proxy:
await gv.create_account(
name="Work-US",
os="windows",
proxy={"server": "http://us-residential.example:8080"},
preset="stealth",
locale="en-US", # match the proxy country
timezone="America/New_York", # match the proxy country
)Update config after creation (identity stays locked โ only injection params change):
# Account must be closed first.
await gv.update_account_config(account_id, humanize=False, block_webrtc=True)
await gv.open_account(account_id) # relaunch to applyReset a key back to default:
await gv.call("gv_update_account_config", {
"account_id": account_id,
"reset_keys": ["locale", "timezone"],
})Note on IP: Camoufox (and any browser) cannot change the TCP source IP โ that's set by the OS kernel, not the browser. Use a proxy or VPN for IP rotation. What the advanced config does lock is everything else: the browser-visible signals (locale, timezone, fonts, WebGL, WebRTC leak gate) that must match the IP's country or the account looks inconsistent. See this discussion for the full IP/fingerprint model.
Encryption at rest (optional)
By default, each account's persistent profile (which holds real Google session cookies) lives on disk as plaintext Firefox profile files. Anyone with read access to ~/.ghostvault/profiles/ can steal your sessions.
Enable encryption to store profiles as AES-256-GCM archives instead:
export GHOSTVAULT_ENCRYPTION_ENABLED=trueOr set it in your client's env block:
"env": { "GHOSTVAULT_ENCRYPTION_ENABLED": "true" }How it works:
The master key is stored in your OS keychain (macOS Keychain, Windows Credential Manager, Linux Secret Service) โ never on disk. It's auto-generated on first use.
When the browser opens, the profile is decrypted to a temp dir (wiped on close).
When the browser closes, the profile is re-encrypted to
<account_id>.profile.enc.Existing plaintext profiles are auto-migrated on first open after enabling.
Requirements & caveats:
Keychain backend required. On headless Linux without D-Bus / Secret Service (e.g. a bare Docker container), encryption can't store the key securely and stays disabled. Run
gnome-keyringorkwalletfirst.Losing the keychain entry = losing the profiles. The key is not derivable from anything else. There is no recovery path by design โ that's what makes it secure.
The browser still sees plaintext while running. Encryption protects data at rest, not against an attacker who compromises the running session.
Fingerprint files stay plaintext. They describe the spoofed identity (UA, screen, etc.) but don't contain session secrets, so encrypting them isn't worth the complexity.
Private/public profiles (optional)
Ghostvault can separate profiles into public (accessible without unlocking) and private (hidden behind a password). This is an app-level visibility gate on top of encryption-at-rest.
How it works:
Call
gv_setup_passwordโ a browser window opens for you to set a passwordMark sensitive profiles as private:
gv_make_private({account_id})When locked,
gv_list_accountshides private profiles; browser tools refuse to open themCall
gv_unlock({password})to access private profiles (stays unlocked untilgv_logoutor server restart)
Brute-force protection:
3 wrong passwords โ warning with remaining attempts
5 wrong passwords โ all private profiles permanently deleted + password reset
Public profiles are never affected by failed attempts
This is different from encryption-at-rest: encryption protects the disk (someone steals the laptop); the private/public gate protects access (someone sits at your unlocked machine and tries to use private Google accounts via the agent).
Remote (HTTP transport)
For remote access instead of the default stdio transport:
GHOSTVAULT_TRANSPORT=http GHOSTVAULT_PORT=8765 python -m ghostvaultPoint your client at http://127.0.0.1:8765/mcp.
Anonymous scraping (no account needed)
Not every task needs a managed account. gv_open_ephemeral launches a throwaway Camoufox session: no profile, no DB row, no login, random identity per session, tempdir removed on close. Once open, all browser tools work on it unchanged โ it just becomes the active target.
# Open a throwaway browser + navigate to a public page
await gv.open_ephemeral(url="https://news.ycombinator.com")
# All browser tools work โ no changes needed
content = await gv.get_page_content(include_screenshot=True)
links = await gv.get_page_links(limit=20)
await gv.scroll(direction="down", amount=3)
# Done โ close frees the browser + removes the tempdir
await gv.close_ephemeral()Mix anonymous scraping with managed accounts:
# Scrape a public page anonymously...
await gv.open_ephemeral(url="https://example.com/public-data")
data = await gv.get_page_content()
await gv.close_ephemeral()
# ...then switch to a managed account for authenticated work
await gv.open_account("acc_abc123")
await gv.open_url("https://mail.google.com")Ephemeral defaults are tuned for scraping (override per call):
Setting | Default | Why |
|
| Scraping doesn't need a visible window (opposite of managed accounts) |
|
| Faster text scraping; turn off if you need screenshots |
|
| No cursor movement needed for read-only scraping |
|
| Short idle timeout โ abandoned sessions clean themselves up |
|
| Cap on simultaneous ephemeral sessions (each is a full Firefox process) |
Override via env vars (GHOSTVAULT_EPHEMERAL_*) or per call:
# Visible browser + keep images for screenshot-based scraping
await gv.open_ephemeral(url="...", headless=False, block_images=False)When to use ephemeral vs managed accounts:
Scenario | Use |
Scrape a public page (news, docs, pricing) |
|
Login-required site (Gmail, Drive, SSO) | Managed account ( |
Fill a public form (contact, signup-free download) |
|
Read Gmail / access Google services | Managed account |
Captcha-protected scrape target |
|
See examples/scripts/scrape_public_page.py and scrape_with_pagination.py for complete runnable examples.
Human-like interaction (anti-bot typing + clicks)
Camoufox's humanize=True covers mouse-movement bezier curves at the C++ layer (so isTrusted=true and the cursor path looks human). It does NOT cover:
Typing cadence โ Playwright's
fill()pastes the whole string in oneinputevent;keyboard.type(text, delay=N)uses a constant delay between every char, which is itself a bot tell.Inter-keystroke variance โ real humans speed up on common bigrams ("th", "ing") and slow down on rare ones.
Occasional typos + corrections โ a perfect string with zero Backspaces is suspicious for long inputs.
Pre-click hover โ Playwright's
.click()moves + clicks in one gesture; real users hover for 50โ500 ms before clicking.
Ghostvault fills these gaps at the Playwright layer. Every interaction tool gains optional humanization params:
Param | Type | Default | Purpose |
|
|
| Type char-by-char (fill) or hover-then-click (click). |
|
|
| Target words-per-minute (40=slow, 90=avg, 150=fast). |
|
|
| Cadence spread 0โ1 (log-normal sigma). 0=constant, 0.35=realistic, 1=erratic. |
|
|
| Chance per char to typo-then-correct (0โ0.05). Produces realistic Backspace events. |
|
|
| Randomized pause after the action (0.7รโ1.3ร spread). |
Per-call example โ Google login with humanized typing:
await gv.fill_input(
target="Email", value="user@gmail.com",
humanize=True, typing_speed_wpm=85, typing_variance=0.4,
mistake_rate=0.02, delay_after_ms=800,
)
await gv.click_element(target="Next", humanize=True, delay_after_ms=1500)Per-account defaults (set once, applies to all calls unless overridden):
await gv.update_account_config(account_id, humanize_typing=True, default_typing_wpm=85)
# Now every gv_fill_input on this account is humanized unless you pass humanize=FalseThe typing model is a log-normal distribution (the standard HCI model). For wpm=90, variance=0.35, inter-keystroke delays center around ~130 ms with occasional 300โ500 ms outliers โ matching observed human typing. With mistake_rate > 0, a fraction of characters are mistyped to a QWERTY-adjacent key, paused on briefly, then Backspace-corrected.
New tools for richer interaction:
Tool | Use case |
| Submit with Enter, Tab between fields, Escape to dismiss, Ctrl+A to select all |
| Human-like scroll bursts with reading pauses โ critical for reCAPTCHA v3, which weights scroll behavior heavily |
reCAPTCHA v3 warm-up pattern โ a page that loads + immediately submits looks like a bot. Scroll, read, click around, THEN act:
await gv.open_url("https://protected-site.com")
await asyncio.sleep(3) # let the page settle
await gv.scroll(direction="down", amount=2) # burst-scroll
await asyncio.sleep(2) # reading pause
await gv.get_page_content() # "engage" with content
await gv.scroll(direction="up", amount=2) # round-trip scroll
await gv.fill_input("query", "search term", humanize=True) # NOW act
await gv.press_key("Enter")See examples/scripts/human_like_login.py, fill_long_form.py, and captcha_friendly_browsing.py for complete runnable examples.
Humanize policy โ who decides?
By default, the AI agent decides per-call whether to enable humanize (based on the Decision Guide in each tool's docstring). For sensitive accounts you may want to lock this down. Ghostvault supports a 3-layer policy model:
Policy | Behavior | Use case |
| Agent decides every call; per-account | Trusted environments, fast iteration. |
| Humanize defaults ON; agent CAN turn it OFF explicitly by passing | Most real-world use โ safety net without rigidity. |
| Humanize forced ON at the server. The agent cannot disable it, even by passing | Sensitive accounts (ads, payments) where a single mistake = ban. |
Resolution order (highest wins):
1. Per-account humanize_policy (set via gv_update_account_config)
2. Global GHOSTVAULT_HUMANIZE_POLICY (env var)
3. "off" (default โ agent decides)Set it globally (applies to all accounts):
# In .env or your client's env block:
GHOSTVAULT_HUMANIZE_POLICY=recommendedSet it per-account (overrides global):
# Force humanize on for this sensitive account โ agent can't disable it.
await gv.update_account_config(account_id, humanize_policy="always")The tool result includes the effective humanize value so the agent (and you) can verify what actually ran:
{"filled": "Email", "humanize": true, "typing_speed_wpm": 85}Manual install (alternative)
Ghostvault is on PyPI (beta) โ install with pip install --pre ghostvault. Requires Python 3.11+.
git clone https://github.com/mienetic/Ghostvault.git
cd Ghostvault
pip install -e .
# Download the Camoufox browser binary (~120 MB, one-time)
python -m camoufox fetchFor development (includes test + lint tooling):
pip install -e ".[dev]"Then add Ghostvault to your client config manually. Use the Python from your environment as the command โ for example, the venv python if you installed into one.
Claude Desktop โ edit ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or ~/.config/Claude/claude_desktop_config.json (Linux):
{
"mcpServers": {
"ghostvault": {
"command": "/absolute/path/to/your/python",
"args": ["-m", "ghostvault"],
"env": {
"GHOSTVAULT_HEADLESS": "false"
}
}
}
}Cursor โ edit .cursor/mcp.json:
{
"mcpServers": {
"ghostvault": {
"command": "/absolute/path/to/your/python",
"args": ["-m", "ghostvault"]
}
}
}Restart your client after editing.
Programmatic use (SDK)
For scripts that want to call Ghostvault without an LLM in the loop (run inside
the cloned repo, after pip install -e . above):
pip install -e ".[sdk]"import asyncio
from ghostvault_sdk import GhostvaultClient
async def main():
async with GhostvaultClient() as gv:
await gv.create_account(name="Work", os="macos")
accounts = await gv.list_accounts()
print(accounts)
asyncio.run(main())See the examples/ directory for comprehensive examples:
Example | What it demonstrates |
Every | |
Create a custom provider recipe for any website + list/delete providers | |
Scan a login page for SSO buttons, form fields, 2FA, captcha + get recommendation | |
Level 3: record a login flow โ replay automatically next time | |
Check session health + API call + JS eval + cookie reading | |
Human-like login (any provider) with realistic typing cadence (85 wpm, 2% typos) | |
Multi-field form with per-field typing speeds + Tab navigation + Shift+Tab to go back | |
reCAPTCHA v3 warm-up pattern: scroll, read, click, THEN act | |
Anonymous one-shot scrape: open_ephemeral โ read + screenshot + links โ close (no account) | |
Multi-page scrape on a persistent ephemeral session: loop {read, scroll, click Next} | |
Private/public gate flow via SDK (setup, lock, unlock, logout) | |
End-to-end: create + sign in + read Gmail + close | |
MCP protocol test: create + sign in + read Gmail | |
Encryption + auto-close + auto-lock + sign_out + delete | |
Copy-paste prompts for Claude Desktop / Cursor / ZCode (all 42 tools) |
FAQ
No. Each profile is a container that holds sessions for any website equally. Use gv_create_account(provider="github") + gv_sign_in to login GitHub directly. Or use gv_create_account(provider="my_custom_site") with a custom provider you created via gv_create_provider. Google is just one of the built-in providers โ it's not a "parent" that other providers depend on.
The agent can detect what login options a page offers by calling gv_detect_login_options(url) โ it scans for SSO buttons, form fields, 2FA, and captcha, then recommends a login path.
Ghostvault uses Camoufox, a Firefox fork with C-level fingerprint spoofing. With locked fingerprints + humanized interaction + your home IP, each account looks like a genuine device. That said:
First-time login often triggers 2FA โ the site sees a new device. This is expected.
Don't share IPs across many accounts โ one account per proxy/IP is the safe ratio.
Use
humanize=trueon login forms โ instant paste typing is the #1 bot tell.No tool is undetectable โ behavioral ML (reCAPTCHA v3) and IP reputation still apply.
Ghostvault gives you the tools to be safe; how you use them is your responsibility. See LICENSE for the full liability disclaimer.
Yes, but with caveats:
You'll need a residential/mobile proxy per account (datacenter IPs get flagged).
Login requires a visible window โ on a headless server, use
headless='virtual'(Xvfb) or VNC.Configure the proxy before the first login (the session is tied to the IP + fingerprint).
For most users, running locally is simpler and safer. Remote HTTP transport (GHOSTVAULT_TRANSPORT=http) is available if needed.
Yes โ any website. Built-in providers: Google, GitHub, Facebook, generic. Custom providers: create via gv_create_provider for any site (your bank, internal apps, SaaS tools). Each profile holds sessions for all websites equally.
Once logged in, call gv_open_url with any URL โ the agent can navigate, click, fill forms, call APIs, and read pages.
Those are agent frameworks (they provide the LLMโbrowser reasoning loop). Ghostvault is a tool provider โ it exposes browser tools via MCP that any agent framework (or plain Claude Desktop) can call. You can even combine them: use Ghostvault for the stealth Google sessions and let your favorite agent framework drive the pages.
Ghostvault uses Camoufox (Firefox/Juggler), while browser-use 0.13+ requires CDP (Chromium-only) โ so they don't directly interoperate, but they solve different problems.
Everything stays local under ~/.ghostvault/:
profiles/โ per-account Camoufox profiles (cookies, localStorage, fingerprint lock)logs/ghostvault.jsonlโ structured debug logbrowserver.sqliteโ account metadata only (no sessions)
Nothing is ever sent to a remote server except the browser traffic itself (which exits via your home IP, or your configured proxy). Ghostvault has no telemetry, no analytics, no phone-home.
You need to sign in first. Tell the agent: "Sign in to [account name]". A browser window opens; complete Google login there. After that, the account is active and the browser tools work. See Typical first-time flow.
Troubleshooting
Symptom | Fix |
Login window doesn't appear | Set |
| Gmail's DOM changes often โ fall back to |
"Session not authenticated" | The session expired โ re-run |
Agent action had no effect | Call |
Install fails on | Network issue โ retry with |
Two windows for same account | Not possible โ Ghostvault enforces one context per account. Switch accounts instead. |
Important notes
First-time login = new device. Google sees a new fingerprint/IP, so expect a 2FA challenge. This is one-time per account.
Local-first by default. Traffic exits via your home IP. If you move Ghostvault to a server, add a residential proxy and re-login.
One context per account. Ghostvault refuses to open two windows for the same profile (would corrupt it). Switch accounts instead.
Gmail scraping is best-effort. Gmail's DOM changes often; if
gv_read_gmailreturns empty, fall back togv_open_url+gv_get_page_contentwith a screenshot.Sessions are sensitive. Anyone with read access to
~/.ghostvault/has full access to your Google accounts. Protect that directory โ or enable encryption at rest.Camoufox โ Firefox. Ghostvault downloads its own patched Camoufox browser (~120 MB) during install. You don't need to install Firefox separately; the two don't conflict.
Known issues
โ ๏ธ macOS Retina/HiDPI rendering (in progress): On Retina displays, the Camoufox browser window renders UI elements too large and content overflows (requires horizontal scrolling). This is a Camoufox upstream issue โ it affects the browser directly, not just Ghostvault. We are investigating workarounds. Non-Retina displays are unaffected.
Roadmap
Legend: ๐ข done ยท ๐ต in progress ยท โช planned ยท ๐ good first issue ยท ๐ help wanted ยท ๐ฐ needs funding
v0.1-beta (current โ PyPI 0.1.x)
โ ๏ธ Beta software. All features below are done and shipped. API may change before v1.0. Known issues: Retina rendering + MCP timeout.
๐ข Core: per-account persistent Camoufox profiles + locked fingerprints
๐ข 42 MCP tools (accounts, lifecycle, browser, providers, API, scraping, debug, security)
๐ข Published to PyPI โ
pip install --pre ghostvault๐ข Provider-agnostic login โ built-in + custom providers, login scan, 3 login levels
๐ข Session health check, API tools, anonymous scraping
๐ข Advanced fingerprint config โ 105 Camoufox config keys + 10 device profiles
๐ข Human-like interaction โ log-normal typing, typo+correction, hover, scroll
๐ข Encryption at rest + private/public gate + profile recovery
๐ข SDK client + GitHub Pages docs + one-click installer
๐ข CI: lint + test + build + docs deploy + PyPI publish
v0.2 โ Stabilize (next โ when known issues are fixed)
๐ต Fix macOS Retina/HiDPI rendering
๐ต Fix MCP timeout for setup_password
โช Community testing feedback โ bug fixes
โช API freeze (no breaking changes after this)
โช
gv_export_session/gv_import_sessionโ backup/restoreโช
gv_wait_for_element+gv_wait_for_navigation๐ Replace ad-hoc CSS selectors with a tested strategy
v0.3 โ Ecosystem (planned)
โช More built-in providers (Microsoft, Apple, Twitter, LinkedIn)
โช Per-site action packs (Gmail, Drive, Calendar, Notion, GitHub)
v1.0 โ Production (planned)
โช Docker image + docker-compose
โช Audit log (who did what, when)
โช Rate limiting + concurrent account limits
โช Plugin system for per-site action packs
โช Independent security review ๐ฐ
v1.x+ โ Scale (ideas)
โช Vision-based action suggestion (LLM looks at screenshot โ proposes next action)
โช Cloud-hosted option (managed Ghostvault as a service) ๐ฐ
โช Mobile device profiles (iPhone Safari, Android Chrome)
โช Proxy rotation per account
Contributing to the roadmap
Pick anything marked ๐ (good first issue) or ๐ (help wanted) โ open a PR.
Have a use case we're missing? Open a discussion.
Contributing
Contributions welcome! See CONTRIBUTING.md for setup, conventions, and how to add a new tool.
pip install -e ".[dev]"
pytest -q
ruff check .Adding a tool
Add the input model to
src/ghostvault/inputs.pyAdd the logic to
src/ghostvault/tools.py(raiseToolErrorfor expected failures)Register it in
src/ghostvault/server.pywith@mcp.tool(name=..., annotations=...)and a thorough docstringAdd a test under
tests/
The fingerprint lock is an invariant โ any change that breaks it causes every account to look like a new device. tests/test_fingerprint.py guards it; keep it green.
Development
git clone https://github.com/mienetic/Ghostvault.git
cd Ghostvault
pip install -e ".[dev]"
python -m camoufox fetch # one-time browser download
pytest -q # 17 unit tests
ruff check . # lintLicense
Apache 2.0 + Commons Clause โ free to use, modify, and distribute for personal, research, educational, and internal use. Selling the software as a product or service (SaaS, paid hosting, paid consulting) requires a commercial license.
What's allowed: internal use, research, education, consulting, modifying, forking.
What's not allowed (without commercial license): selling the software itself, offering it as a paid SaaS, bundling it into a paid product.
Disclaimer: The authors are not responsible for any misuse of this software. You are solely responsible for complying with all applicable laws and terms of service. See LICENSE for the full liability disclaimer.
โ ๏ธ Use responsibly. Ghostvault is a tool for managing your own accounts. Don't use it to access accounts you don't own, violate terms of service, or do anything illegal. You are responsible for how you use it.
Available Tools
42 toolsgv_api_callHTTP API Call (browser session)A
Make an HTTP request using the active account's browser session.
Uses the browser's cookies + TLS fingerprint, so the request looks identical to one made by the page itself. Bypasses cookie-based auth and TLS fingerprinting. Faster than navigating a page when you just need data from an API endpoint.
Args: method: HTTP method โ GET, POST, PUT, PATCH, DELETE. url: The absolute URL to request. headers: Optional dict of HTTP headers (e.g. {"Authorization": "Bearer ..."}). body: Optional request body. Dict/list โ JSON-encoded automatically; string โ sent as-is. use_session: If True (default), the browser's cookies + TLS are used. Set False to send a "clean" request (no cookies). timeout_ms: Request timeout in ms (default 30000).
Returns {status, status_text, headers, body, url}.
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | ||
| body | No | ||
| method | Yes | ||
| headers | No | ||
| timeout_ms | No | ||
| use_session | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description details behavioral traits: uses browser's cookies and TLS fingerprint, bypasses auth and fingerprinting, and notes that body is auto-encoded for dict/list. Annotations only include openWorldHint=true, so the description carries the burden. It does not mention rate limits or potential side effects, but covers key aspects adequately.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and well-structured: a one-paragraph overview followed by an Args list and Returns line. No wasted words, front-loaded with purpose, and easy to scan.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 6 parameters, 2 required, and an output schema present, the description is complete. It explains all parameters, the return format (status, status_text, headers, body, url), and context for using the session. The output schema likely provides further detail, so description need not elaborate.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description compensates fully. It explains each parameter: method lists, url, headers, body (auto-encoding for dict/list, as-is for string), use_session (purpose), and timeout_ms (default). This adds significant meaning beyond the bare schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Make an HTTP request using the active account's browser session.' It distinguishes itself from sibling tools like gv_open_url (navigation) and gv_eval_js (JavaScript execution) by specifying that it uses cookies and TLS fingerprint, and is faster for API data retrieval.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains when to use the tool: when you need API data using the browser's session, bypassing cookie-based auth and TLS fingerprinting. It compares to navigating a page and highlights the speed advantage. It also allows turning off session via use_session. However, it could be more explicit about when not to use or list alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
gv_check_sessionCheck Session HealthARead-only
Check whether the account's browser session is still authenticated.
Uses a 2-layer check: cookie expiry (fast) + probe URL redirect (accurate). Returns the health status (active / likely_active / expired / unknown), a reason, and the recommended action.
The browser context must be open (call gv_open_account first) for an accurate check. If closed, returns 'unknown'.
Args: account_id: The account id to check. Omit to check the active account.
| Name | Required | Description | Default |
|---|---|---|---|
| account_id | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations indicate readOnlyHint=true, and the description does not contradict. It adds behavioral context by describing the two-layer check (cookie expiry + probe URL redirect) and the return fields, which is helpful beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is around 10 sentences with clear sections for return values and args. Each sentence adds value without excessive verbosity. Could be slightly more concise, but structure is good.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the presence of an output schema (not shown but indicated), the description covers return fields and provides necessary context for using the tool. It adequately addresses the complexity of a session health check.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The single optional parameter account_id is explained in the description: 'The account id to check. Omit to check the active account.' This adds meaning beyond the schema default of null and clarifies behavior.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool checks if the browser session is authenticated, with a specific verb and resource. However, it does not differentiate from the sibling tool 'gv_get_session_status', which may have similar functionality, preventing a higher score.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states the browser context must be open (calling gv_open_account first) for an accurate check, and mentions behavior when closed. It also explains when to omit account_id. No explicit when-not-to-use, but clear guidance is provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
gv_click_elementClick ElementA
Click an element on the current page by visible text or CSS selector.
Text matching is case-insensitive and substring-based (preferred). If no text matches, the target is tried as a CSS selector. After clicking, waits for the page to settle and returns a preview of the new page.
Args:
target: Visible text of the element (preferred) OR a CSS selector.
timeout_ms: Max wait time in ms (default 10000).
humanize: When true, hover briefly before clicking + jitter the click
point. Defaults to the account's humanize_clicks setting (off
if unset). Recommended for anti-bot-sensitive sites.
delay_after_ms: Pause for a randomized ~this many ms after the click
(0.7รโ1.3ร spread). 0 = no delay.
DECISION GUIDE โ when to set humanize=true: โข Google / SSO login buttons ("Next", "Sign in") โ ALWAYS โข Captcha-protected pages (reCAPTCHA, Cloudflare) โ ALWAYS โข Form submit buttons on banking / payments โ ALWAYS โข Search buttons, nav links on trusted sites โ optional (can skip) โข One-time quick clicks in a familiar dashboard โ can skip
Note: If the account's humanize_policy is "always", humanize is
forced on regardless of what you pass here.
Returns the clicked target, whether humanize was applied, and a page preview.
| Name | Required | Description | Default |
|---|---|---|---|
| target | Yes | ||
| humanize | No | ||
| timeout_ms | No | ||
| delay_after_ms | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Discloses text matching (case-insensitive, substring), fallback to CSS selector, post-click wait for page settle, and humanize override behavior. Does not contradict annotations (openWorldHint). Minor omission: whether it scrolls element into view.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Well-organized with sections, front-loaded purpose. The decision guide is valuable but adds length; no redundant sentences. Could be slightly tighter.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers main workflow and parameters, and mentions output (target, humanize applied, page preview). Missing error handling details (e.g., element not found, timeout). Adequate for typical usage but not exhaustive.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Despite 0% schema coverage, the description fully explains all four parameters: target (visible text vs CSS), timeout_ms (default), humanize (boolean, default null, with actionable guidance), and delay_after_ms (randomized range).
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool clicks an element on the current page via visible text or CSS selector. It is unambiguous but does not explicitly differentiate from sibling tools like gv_fill_input or gv_scroll.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides a detailed decision guide for when to set humanize=true, covering login buttons, captchas, form submits, and trusted sites. However, lacks general guidance on when to choose this tool over alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
gv_close_accountClose Google Account BrowserA
Close the running browser context for an account (keeps its session saved).
The persistent profile stays on disk, so reopening reuses the same login. Use this to free resources when done with an account.
Args: account_id: The account id to close.
| Name | Required | Description | Default |
|---|---|---|---|
| account_id | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Discloses key behavior: preserves persistent profile on disk so reopening reuses login. No annotations provided, so description carries full burden; it effectively communicates the non-destructive nature and resource impact.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Highly concise: three brief sentences plus a simple arg description. The first sentence immediately states the core purpose, and no redundant information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool with one parameter and an output schema, the description covers the essential behavioral details (closing, session preservation, reuse). No gaps given the tool's simplicity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The only parameter, account_id, is described as 'The account id to close', which adds minimal value beyond the parameter name. Schema coverage is 0%, so the description should provide more detail (e.g., format, how to obtain it).
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states it closes the browser context for an account while preserving session. Differentiates from sibling tools like gv_delete_account (destructive) and gv_logout (session end) by specifying that the session is saved.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says 'Use this to free resources when done with an account', providing clear when-to-use guidance. Lacks explicit when-not-to-use or alternative suggestions, but the context is sufficient.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
gv_close_ephemeralClose Anonymous Browser SessionADestructive
Close an ephemeral session and free its resources.
Removes the tempdir + tears down the browser process. If the closed session was the active target, the active slot falls back to another running context (or None).
Args: session_id: The session id from gv_open_ephemeral. Omit to close the currently-active session.
Returns the closed id + the new active target.
| Name | Required | Description | Default |
|---|---|---|---|
| session_id | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations indicate destructiveHint=true; the description adds context about what gets destroyed (tempdir, browser process) and the fallback behavior for the active slot. This goes beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise with a one-line summary followed by necessary details. Every sentence adds value, with no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (one optional parameter), the description covers usage, behavior, and output (closed id and new active target). An output schema exists but the description complements it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, but the description explains that session_id comes from gv_open_ephemeral and that omitting it closes the active session. This adds essential meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Close an ephemeral session' with specific verb and resource. It distinguishes from sibling tools like gv_check_session and gv_get_session_status by focusing on closure.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains when to use the tool (close ephemeral session) and provides guidance on omitting session_id to close the active one. It mentions fallback behavior but does not explicitly contrast with alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
gv_create_accountCreate Google Account SlotADestructive
Create a new managed account slot with a locked fingerprint + advanced config.
Generates a fresh, pinned fingerprint + empty persistent profile. The account is NOT signed in yet โ call gv_sign_in next to open a login window.
Args: name: Human label for the account (e.g. "Work"). os: Pinned fingerprint OS โ "windows" | "macos" | "linux". Defaults to server config (or the device profile's recommended OS if device_profile is set). proxy: Optional Playwright-style proxy dict for this account only. provider: Identity provider โ "google" (default), "github", etc. preset: Bundle of advanced-config defaults โ "balanced" (default) | "stealth" | "minimal". Explicit params below override the preset. locale: Locale(s) for Intl + Accept-Language, e.g. "en-US" or ["en-US","en"]. When set, overrides geoip-based locale matching. timezone: IANA timezone, e.g. "America/New_York". When set, overrides geoip. humanize: Human-like cursor movement. True (default in balanced) | False | float (max seconds for the move). block_webrtc: Block WebRTC to prevent IP leak. True | False | "auto" (auto = block only when a proxy is set; the preset default). block_webgl: Disable WebGL entirely. Some sites break; use sparingly. webgl_config: [vendor, renderer] pair to spoof, e.g. ["Apple Inc.", "Apple GPU"]. fonts: List of installed font family names to inject (on top of OS defaults). addons: List of paths to extracted Firefox addon dirs (must have manifest.json). disable_coop: Disable Cross-Origin-Opener-Policy โ needed for some captcha/turnstile iframes. (stealth preset sets this.) block_images: Block all image loading. Faster but visually inconsistent. device_profile: A realistic hardware template that fills in ~15 Camoufox config keys at once (screen size, GPU vendor/renderer, media-device counts, battery level, audio sample rate). One of: macbook-pro-14-m2, macbook-air-13-m1, imac-24, windows-desktop-rtx, thinkpad-x1-carbon, surface-laptop-5, linux-workstation, dell-xps-13-ubuntu, generic-laptop, headless-server. Recommended for maximum fingerprint consistency. device_config: Raw dict of Camoufox config-domain keys (battery:, mediaDevices:, navigator.hardwareConcurrency, ...) to override or augment the chosen device_profile. See the Advanced Configuration docs for the full ~100-key schema.
Returns the new account id, resolved config, and any consistency warnings.
| Name | Required | Description | Default |
|---|---|---|---|
| os | No | ||
| name | Yes | ||
| fonts | No | ||
| proxy | No | ||
| addons | No | ||
| locale | No | ||
| preset | No | balanced | |
| humanize | No | ||
| provider | No | ||
| timezone | No | ||
| block_webgl | No | ||
| block_images | No | ||
| block_webrtc | No | ||
| disable_coop | No | ||
| webgl_config | No | ||
| device_config | No | ||
| device_profile | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses that the tool generates a fresh pinned fingerprint and persistent profile but does not sign in, which is consistent with its purpose. Annotations include destructiveHint: true, but creating an account slot is not inherently destructive; the description does not contradict annotations, but it adds useful context about the creation process and return values.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with a header, summary paragraph, and detailed argument list. However, it is verbose with lengthy parameter explanations that could be trimmed slightly without losing clarity. Still, it is efficiently written for the complexity involved.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 17 parameters, no schema descriptions, and an output schema (though not detailed here), the description covers all parameters comprehensively and mentions return values (account id, resolved config, warnings). It is fully complete for an AI agent to understand and invoke the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description compensates fully by explaining every parameter's purpose, defaults, and allowed values (e.g., 'os: Defaults to server config', 'humanize: True (default in balanced) | False | float'). This adds significant value beyond the bare schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Create a new managed account slot with a locked fingerprint + advanced config' and distinguishes it from sibling tools like gv_sign_in by explicitly noting the account is not signed in yet. This makes the primary purpose and its specific role clear.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly guides the user to call gv_sign_in next, indicating a sequential workflow. However, it does not explicitly mention when not to use this tool (e.g., if an account already exists or for other scenarios), missing some exclusionary guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
gv_create_providerCreate Custom ProviderADestructive
Create a custom login provider recipe for any website.
Once created, use it with gv_create_account(provider=name) or
gv_sign_in(account_id, provider=name). The provider recipe is stored
in ~/.ghostvault/providers.json and shared across all accounts.
Args: name: Unique provider name (e.g. "my_bank"). Cannot shadow built-ins. login_url: The URL to navigate to for login (e.g. "https://app.example.com/login"). success_url_fragments: URL fragments indicating login succeeded (e.g. ["app.example.com/dashboard"]). auth_cookie_names: Cookie names that prove authentication (e.g. ["session_id"]). auth_cookie_domain: The domain to read auth cookies from (e.g. "https://app.example.com"). logout_url: Optional direct logout URL. If None, user must logout manually. session_probe_url: Optional URL to check if session is still valid. login_url_fragments: URL fragments indicating redirect to login (session expired). description: Human-readable description of this provider.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | ||
| login_url | Yes | ||
| logout_url | No | ||
| description | No | ||
| auth_cookie_names | Yes | ||
| session_probe_url | No | ||
| auth_cookie_domain | Yes | ||
| login_url_fragments | No | ||
| success_url_fragments | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations indicate 'destructiveHint: true', and description does not contradict. Adds context about persistent storage in ~/.ghostvault/providers.json and sharing across accounts, but lacks details on potential conflicts or error conditions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Description is well-structured with clear front-loaded purpose and organized Args section. Code snippets are helpful; slightly verbose but each sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 9 parameters and 5 required, description covers all parameters and explains their roles. References output schema exists, so return values not needed. Mentions storage and usage across accounts, making it complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, but the description provides detailed parameter explanations, including optional ones with defaults, adding critical meaning beyond the schema structure.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Specific verb 'Create' and resource 'custom login provider recipe'. Distinguishes from siblings like gv_delete_provider and gv_get_provider by stating it's for creation. Includes important constraint 'Cannot shadow built-ins.'
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states how to use the created provider with gv_create_account and gv_sign_in, providing context. Mentions storage location but does not explicitly state when not to use this tool versus alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
gv_delete_accountDelete Google Account (remove all data)ADestructive
Delete an account and all its data from Ghostvault.
Removes the profile directory, encrypted archive (if any), fingerprint file, and the DB row. Cannot delete a running account โ lock/close it first. This does NOT sign the account out of Google; use gv_sign_out first if you want to invalidate the session server-side.
Args: account_id: The account id to delete.
| Name | Required | Description | Default |
|---|---|---|---|
| account_id | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the destructiveHint annotation, description details exactly what is removed (profile directory, encrypted archive, fingerprint file, DB row) and prerequisite (account must not be running). No contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Every sentence adds unique value: deletion scope, what is removed, prerequisite, related sign-out note. No redundancy or fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers all necessary aspects for a destructive tool: effects, prerequisites, and related operations. Output schema exists so return values are not required in description.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema has 0% description coverage for the single parameter. Description adds 'The account id to delete' but lacks format or constraints. Minimal but adequate for a single string parameter.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Title and description clearly state deletion of account and all its data. Distinguishes from sibling tools like gv_close_account, gv_lock_account, gv_create_account by specifying irreversible removal.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states when NOT to use: 'Cannot delete a running account โ lock/close it first.' Also directs to use gv_sign_out if session invalidation is needed, providing clear alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
gv_delete_providerDelete Custom ProviderADestructive
Delete a custom provider. Built-in providers cannot be deleted.
Args: name: The provider name to delete.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotation destructiveHint=true already signals destruction. Description adds that it deletes custom providers and that built-in cannot be deleted, providing useful context beyond the annotation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Extremely concise: two sentences and an Args section. No wasted words; every sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers main action and key constraint (built-in providers not deletable). With an output schema present, return values are likely covered. Adequate for a simple delete tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Only parameter 'name' has no schema description. Description provides meaning: 'The provider name to delete.' This adds value beyond the schema's title alone.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clear verb 'delete' and resource 'custom provider' with distinction from built-in providers. Distinct from sibling tools like gv_create_provider and gv_update_provider.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
States when NOT to use (for built-in providers cannot be deleted). Implicitly suggests use for custom providers only. Does not explicitly name alternatives but context is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
gv_detect_login_optionsDetect Login Options on PageARead-only
Scan the current page (or a URL) for available login options.
Detects SSO buttons (Google, GitHub, Facebook, etc.), username/password form fields, 2FA/OTP fields, and captcha. Returns a recommendation on which login path to take.
Use this BEFORE gv_sign_in when you're not sure what the page offers โ it helps the agent decide whether to auto-fill, click an SSO button, or let the user log in manually.
DECISION GUIDE โ what to do with the result:
recommendation="sso:google" โ click the SSO button for that provider
recommendation="form" โ use gv_sign_in with stored credentials
recommendation="ask_user" โ multiple SSO options found; ASK the user which provider they want to use
recommendation="manual" โ no form/SSO detected; let user do it manually (the browser window is already open)
In ALL cases, the session is saved automatically โ the user only needs to log in once per account.
Args: url: Optional URL to navigate to before scanning. If omitted, scans the current page.
| Name | Required | Description | Default |
|---|---|---|---|
| url | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations declare readOnlyHint=true, and the description adds that the tool only scans and returns a recommendation, with no side effects. It also notes that the session is saved automatically, providing useful behavioral context beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with clear sections and front-loaded key info. It is somewhat lengthy but every sentence adds value; no redundancy. Could be slightly trimmed without losing clarity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter tool with an output schema (implied), the description covers all necessary aspects: purpose, usage decision guide, parameter semantics, and behavioral notes. It is fully self-contained and actionable.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Despite 0% schema description coverage, the description fully explains the single parameter 'url': it is optional, navigates to that URL first, or scans the current page if omitted. This adds clear meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it scans the page for login options and returns a recommendation. It uses specific verbs ('Scan', 'Detects', 'Returns') and distinguishes from sibling gv_sign_in by stating usage before that tool.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says 'Use this BEFORE gv_sign_in when you're not sure what the page offers' and provides a complete decision guide mapping recommendations to actions, including alternatives like asking the user.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
gv_eval_jsEvaluate JavaScript in PageA
Run JavaScript in the active page and return the result.
Use cases:
Extract CSRF tokens: document.querySelector('meta[name=csrf-token]').content
Call site JS: window.app.generateSignature(payload)
Read state: localStorage.getItem('auth_token')
Read hidden fields: document.querySelector('#token').value
The script can be an expression or a function. If arg is provided,
it's passed as the first parameter to a function script.
Args: script: JS expression or arrow function. arg: Optional argument to pass to a function script.
Returns whatever the JS evaluates to.
| Name | Required | Description | Default |
|---|---|---|---|
| arg | No | ||
| script | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description mentions executing JavaScript in the page, implying side effects, but does not elaborate on potential risks (e.g., page modifications, error handling, async behavior). With 'openWorldHint: true' in annotations, the description adds modest context but could be more forthcoming about behavioral traits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and well-structured: a one-line summary followed by bulleted use cases and clear parameter explanations. Every sentence adds value without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity of executing arbitrary JavaScript, the description covers the main functionality, argument usage, and return value. It does not discuss error handling or security implications, but the presence of an output schema (not shown) reduces the need for return value details. Slightly more completeness would be ideal.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Despite 0% schema description coverage, the description adds critical meaning: 'script' is defined as a 'JS expression or arrow function' and 'arg' as an 'Optional argument to pass to a function script.' This fully compensates for the lack of schema descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Run JavaScript in the active page and return the result' with specific, concrete use cases (e.g., extracting CSRF tokens, reading localStorage). This uniquely identifies the tool and distinguishes it from sibling tools like gv_get_page_content or gv_fill_input.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit use cases and examples, guiding when to use the tool (e.g., extracting values, calling site functions). However, it does not explicitly state when not to use it or offer alternatives, which would improve clarity for the agent.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
gv_fill_inputFill Input FieldA
Fill a form input on the current page.
Tries to find the input by its label text first (case-insensitive, substring match), falling back to a CSS selector.
By default this uses Playwright's instant paste (fast, but detectable).
Set humanize=true to type one character at a time with a realistic
log-normal cadence + optional typos โ strongly recommended for Google
login forms and any anti-bot-protected input.
Args:
target: Visible label text of the field (preferred) OR a CSS selector.
value: The text to type into the field.
timeout_ms: Max wait time in ms (default 10000).
humanize: Type char-by-char with realistic cadence. Defaults to the
account's humanize_typing setting (off if unset).
typing_speed_wpm: Target words-per-minute (40=slow, 90=avg, 150=fast).
Defaults to the account's default_typing_wpm or 90.
typing_variance: Cadence spread 0โ1 (0=constant, 0.35=realistic,
1=erratic). Default 0.35.
mistake_rate: Chance per char to typo-then-correct (0โ0.05). Produces
realistic Backspace events. Default 0 (off).
delay_after_ms: Pause for a randomized ~this many ms after typing.
DECISION GUIDE โ when to set humanize=true: โข Google / SSO login forms (email, password) โ ALWAYS (instant paste is the #1 bot detection tell) โข Captcha-protected form fields โ ALWAYS โข Banking / payment forms โ ALWAYS โข 2FA / OTP code fields โ optional (short codes, paste is fine) โข Search boxes on trusted sites (Gmail, Drive) โ optional โข Quick one-off inputs in a familiar dashboard โ can skip
Recommended values by scenario: โข Login email: humanize=true, wpm=85, variance=0.4, mistakes=0.02 โข Login password: humanize=true, wpm=65, variance=0.5, mistakes=0.0 โข Long form: humanize=true, wpm=90, variance=0.35, mistakes=0.01 โข Search box: humanize=false (or omit)
Note: If the account's humanize_policy is "always", humanize is
forced on regardless of what you pass here.
Returns the target, char count, and whether humanize was applied.
| Name | Required | Description | Default |
|---|---|---|---|
| value | Yes | ||
| target | Yes | ||
| humanize | No | ||
| timeout_ms | No | ||
| mistake_rate | No | ||
| delay_after_ms | No | ||
| typing_variance | No | ||
| typing_speed_wpm | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description extensively discloses behavioral traits: instant paste vs humanize typing, account policy overrides, return values, and detectability. Annotations only provide openWorldHint, so the description carries the full burden and meets it excellently.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with sections for arguments, decision guide, and notes. It is somewhat lengthy but every section adds value. The front-loaded purpose and organized layout aid scanning.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity (8 parameters, output schema exists), the description is complete. It covers all parameter semantics, usage context, behavioral details, and return values. No gaps are evident.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description fully explains all 8 parameters, including defaults, recommended values by scenario, and the effect of account-level settings. This adds significant meaning beyond the bare schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Fill a form input on the current page' with a specific verb and resource. It distinguishes itself from siblings like gv_click_element and gv_open_url by focusing on input field filling.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
While the description does not explicitly compare to alternatives, it provides clear context on how the tool finds inputs (label text then CSS selector) and includes a Decision Guide for when to set humanize=true. The implied use case is sufficiently clear for agents.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
gv_get_auth_statusGet Auth StatusARead-only
Check whether the private/public password gate is active and unlocked.
Returns gate_enabled (bool), unlocked (bool), and a human-readable message. If no password has been set, the gate is off and all profiles are public.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, indicating a safe read operation. The description adds detailed behavioral context: it returns three specific fields (gate_enabled, unlocked, message) and describes the special case when no password is set ('gate is off and all profiles are public'). This goes beyond annotations and fully informs the agent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise: two sentences, both front-loaded. The first sentence states the purpose, the second specifies return values and edge case. Every sentence adds value without waste.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (0 parameters, no complex logic), the description fully covers what the agent needs: purpose, return type, and behavior in the default and edge cases. Annotations and output schema exist, so no further detail is necessary.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are no parameters, so the input schema is trivially covered (100%). The description does not need to add parameter details. Baseline for 0 parameters is 4, and the description meets that without any redundant or missing info.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: checking the status of a password gate ('active and unlocked'). It uses a specific verb ('Check') and resource, and the title 'Get Auth Status' reinforces this. Among 39 sibling tools, none overlap directly, so no confusion.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use the tool (to check auth gate status), but does not provide explicit guidance on when not to use it or mention alternatives among siblings (e.g., gv_unlock, gv_setup_password). Context is clear but lacks exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
gv_get_cookiesRead Browser CookiesARead-only
Read cookies from the active browser context.
Cookie values longer than 20 chars are masked for security. Use this for debugging sessions or understanding what the site has set.
Args: domain: If set, only cookies matching this domain are returned. If omitted, all cookies are returned.
| Name | Required | Description | Default |
|---|---|---|---|
| domain | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotation readOnlyHint=true indicates a safe read operation. The description adds behavioral context: 'Cookie values longer than 20 chars are masked for security', which is beyond what annotations provide. Also specifies scope ('from the active browser context'). No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is short and front-loaded with the purpose. It uses a structured 'Args' section for parameter details. Every sentence adds value, with no unnecessary words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers purpose, usage scenario, a key behavioral trait (masking), and parameter semantics. An output schema exists (not shown), so return values need not be detailed. For a simple read tool with two states (with or without domain), this is sufficiently complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has one optional parameter 'domain' with 0% description coverage. The description clearly explains its effect: 'If set, only cookies matching this domain are returned. If omitted, all cookies are returned.' This adds meaningful guidance beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Read cookies from the active browser context', which is a specific verb ('Read') and resource ('cookies from the active browser context'). It distinguishes from sibling tools like gv_get_page_content (content) and gv_check_session (session/auth status).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description suggests using the tool 'for debugging sessions or understanding what the site has set', providing clear context. While it does not explicitly exclude alternatives, the sibling list shows no other cookie-reading tool, making the guidance adequate.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
gv_get_credentialsShow Stored Credential KeysARead-only
Show which credential keys are stored for an account (values are masked).
Args: account_id: The account id.
| Name | Required | Description | Default |
|---|---|---|---|
| account_id | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate readOnlyHint=true, so the description adds value by specifying that values are masked. This goes beyond the annotation and provides behavioral insight. However, no other side effects or limitations are disclosed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise with only two sentences and a parameter line. It front-loads the purpose and avoids unnecessary words. Every sentence provides value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (one required parameter, read-only, with output schema), the description covers the essential behavioral aspect (masking). It does not explain the return format but that is expected from the output schema. Slightly incomplete due to lack of parameter detail but sufficient for minimal context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description restates the parameter name 'account_id' with 'The account id.', adding no additional meaning beyond the schema. Since schema coverage is 0%, the description fails to compensate with details like format or examples.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Show which credential keys are stored for an account (values are masked)', providing a specific verb (show) and resource (credential keys) with an important detail about masking. This distinguishes it from sibling tools like gv_set_credentials or gv_delete_account.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage when needing to see stored credential keys, but lacks explicit guidance on when not to use it or alternatives. No prerequisites or exclusions are mentioned, which is acceptable for a simple read tool but not actively helpful.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
gv_get_logsGet Debug LogsARead-only
Return the most recent debug log entries (for troubleshooting).
Each entry records a tool call / browser action with timestamp, account, action, status, duration, and error info. Use this when something isn't working and you need to see what happened.
Args: n: Number of recent entries to return (default 50, max 500).
| Name | Required | Description | Default |
|---|---|---|---|
| n | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds value beyond the readOnlyHint annotation by detailing the content of log entries (timestamp, account, action, status, duration, error info). It is consistent with the annotation and does not contradict.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise, front-loaded with the purpose, and includes only necessary details. Every sentence contributes to understanding.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read tool with one parameter and an output schema, the description is complete. It clearly explains what the tool returns and when to use it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description documents the single parameter 'n' with default and max (500), which the schema does not fully cover (only default). This compensates for the 0% schema description coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Return the most recent debug log entries (for troubleshooting)', specifying the verb and resource. The sibling tools are all distinct actions, so this tool is uniquely identified.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly says 'Use this when something isn't working and you need to see what happened', providing clear guidance on when to use. It does not mention alternatives or when not to use, but the context is sufficient.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
gv_get_page_contentGet Page Content (text + optional screenshot)ARead-only
Read the current page's text content, optionally with a screenshot.
Set include_screenshot=true to ALSO receive an image of the page so you can SEE the layout โ use this when text alone isn't enough (captcha, image buttons, complex visual structure).
Args: include_screenshot: If true, append a PNG image of the viewport. max_chars: Max characters of page text (default 20000).
| Name | Required | Description | Default |
|---|---|---|---|
| max_chars | No | ||
| include_screenshot | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already mark readOnlyHint=true, so description doesn't need to emphasize safety. It adds context about screenshot benefits but does not cover potential limitations like page load timing or character limits beyond the default.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Extremely concise: three short sentences plus parameter docs. Front-loaded with core purpose, then usage note, then parameter details. No fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers all critical aspects: what it reads, optional image, usage guidance, and parameter meanings. Lacks output format description, but given no output schema and simple read operation, it is reasonably complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema has 0% coverage, but description compensates by explaining include_screenshot's purpose and specifying max_chars as max characters. This adds meaningful guidance beyond the schema's type and default.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Read' and the resource 'current page's text content', with an optional screenshot. It distinguishes itself from sibling tools like gv_screenshot and gv_get_page_links by specifying the exact scope.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit guidance on when to set include_screenshot=true (captcha, image buttons, complex visual structure). However, it does not directly contrast with alternatives like gv_screenshot for standalone image capture, missing a clear 'when not to use'.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
gv_get_page_linksGet Page LinksARead-only
List the visible links on the current page.
Returns [{text, href}, ...]. Use this to choose where to navigate next.
Args: limit: Max number of links to return (default 50, max 100).
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, and the description is consistent with this. It adds value by specifying the return format and the limit parameter's behavior, though it does not elaborate on other behavioral traits like whether it scrolls or handles dynamic content.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very concise: three short sentences that cover purpose, output format, and parameter details. Every sentence is necessary and well-placed.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's low complexity and the presence of an output schema, the description is complete. It explains what the tool does, its return format, and the only parameter. No obvious gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 0% description coverage (no descriptions for parameters), so the description must compensate. It clearly explains the 'limit' parameter: 'Max number of links to return (default 50, max 100).' This adds essential semantic meaning beyond the schema's type and default.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description explicitly states 'List the visible links on the current page,' using a specific verb and resource. It further clarifies the purpose by saying 'Use this to choose where to navigate next,' which distinguishes it from sibling tools like gv_click_element and gv_open_url.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides a clear context for when to use the tool ('choose where to navigate next') but does not explicitly state when not to use it or mention alternatives. This is still helpful for an AI agent.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
gv_get_providerGet Provider DetailsARead-only
Show one provider's full configuration (login URL, cookies, etc.).
Args: name: The provider name (built-in or custom).
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already mark readOnlyHint true; description adds that it returns full configuration with examples (login URL, cookies), providing context beyond the annotation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Very concise, front-loaded with the action, and includes a structured Args section with no wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given there is an output schema (unseen), the description adequately describes the return value (full configuration) and examples, but could mention it returns only one provider's details.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema lacks descriptions (0% coverage), but the description's 'Args:' section explains the single 'name' parameter effectively, adding meaning over the schema alone.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool shows one provider's full configuration, including login URL and cookies, distinguishing it from listing tools like gv_list_providers.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It is clear that this tool is for retrieving details of a specific provider by name, but it does not explicitly say when not to use it (e.g., for listing all providers).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
gv_get_session_statusGet Google Session StatusBRead-only
Check whether an account's browser session is running and authenticated.
If account_id is omitted, checks the active account.
Returns: id, name, email, running, active, status, last_login_at.
| Name | Required | Description | Default |
|---|---|---|---|
| account_id | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
ReadOnlyHint annotation already indicates safe read. Description adds return field list (id, name, email, etc.), which is useful but not behavioral beyond what annotations imply.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences covering purpose, parameter behavior, and return fields. No extraneous information, front-loaded with main action.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Includes return field list, which covers output expectations. With output schema available, it is mostly complete. Could mention error cases or what happens if session doesn't exist, but not critical.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so description must compensate. It explains that omitting account_id checks the active account, adding meaning. However, it doesn't describe the format or constraints of account_id, leaving it partially ambiguous.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States 'Check whether an account's browser session is running and authenticated', which is a clear verb+resource. However, sibling tool 'gv_check_session' exists and is not differentiated, so purpose is clear but not distinguished.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool vs alternatives like 'gv_check_session'. The hint about account_id omission is helpful but does not provide usage context or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
gv_list_accountsList Google AccountsARead-onlyIdempotent
List all managed accounts and which one is currently active.
Returns each account's id, label, email, status (created/logging_in/active/ failed), whether a browser context is running, and the active account id. Use this first to discover account ids before calling other tools.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and idempotentHint=true, so the safety profile is clear. The description adds valuable behavioral details beyond annotations: it lists the exact fields returned (id, label, email, status, browser context running, active account id), which helps the agent understand the output without needing to inspect the output schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise: three sentences covering purpose, output details, and usage hint. Every sentence adds value, and there is no fluff or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (no parameters, safe read operation), the description is complete. It explains what the tool does, what it returns, and provides a key usage hint. The presence of an output schema does not reduce the need for the description, and the description complements it well.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has no parameters, so the description does not need to provide parameter semantics. With 0 parameters and 100% schema coverage, the baseline is 4, and the description adds no redundant information.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses specific verbs (List, discover) and resources (managed accounts, active account). It clearly states the tool's output (id, label, email, status, etc.) and distinguishes itself from sibling tools like gv_create_account or gv_delete_account.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly says 'Use this first to discover account ids before calling other tools,' which provides clear when-to-use guidance. It does not explicitly mention when not to use, but given the simplicity of the tool and lack of direct alternatives among siblings, this is sufficient.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
gv_list_providersList All ProvidersARead-onlyIdempotent
List all providers (built-in + custom) with capability flags.
Returns each provider's name, max_login_level, needs_credentials, has_logout_url, has_session_probe, is_builtin, and description.
Built-in providers: google, github, facebook, generic.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already mark the tool as readOnly and idempotent. The description adds value by detailing the returned fields (name, max_login_level, etc.) and listing built-in providers, providing behavioral context beyond the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise with two sentences plus a short list. It front-loads the main action and returns fields. No unnecessary words, though the list format could be slightly more structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no parameters, strong annotations (readOnly, idempotent), and presence of an output schema, the description is fully complete. It explains what is returned and gives examples, leaving no gaps for effective use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has no parameters (0 params, 100% schema coverage). Per guidelines, baseline score for 0 parameters is 4. The description appropriately focuses on output rather than parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states it lists all providers (built-in and custom) with capability flags, and distinguishes from sibling tools like gv_get_provider (single provider) and gv_create_provider. The specific verb 'list' and resource 'providers' are explicit.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description does not explicitly state when to use this tool versus alternatives like gv_get_provider. Usage context is implied by the name 'list all', but no explicit when-to-use or when-not-to-use guidance is provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
gv_lock_accountLock Google Account (close + re-encrypt)A
Lock an account โ close the browser and re-encrypt its profile.
The saved session is KEPT, so reopening (gv_open_account) works without re-login. This is the manual version of auto-lock. Use it when you're done with an account for now but want to come back to it later without re-authenticating.
Args: account_id: The account id to lock.
| Name | Required | Description | Default |
|---|---|---|---|
| account_id | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses that the saved session is kept and that reopening works without re-login, and notes it is the manual version of auto-lock. However, it does not mention any side effects (e.g., impact on tabs, ongoing processes) or rate limits, leaving gaps in comprehensive behavioral disclosure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and front-loaded with the core action. The 'Args:' section is somewhat redundant given the single parameter, but overall it is well-structured and efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has only one required parameter and no enums, the description adequately covers purpose and usage. However, since an output schema is present, the description could mention what the tool returns to ensure full completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description simply repeats 'The account id to lock' for the single parameter account_id, which adds minimal value beyond the schema's title 'Account Id'. With 0% schema description coverage, the description should provide more context about acceptable values or format but does not.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Lock an account โ close the browser and re-encrypt its profile.' It uses a specific verb and resource, and distinguishes from siblings like gv_close_account and gv_unlock by explaining that the session is preserved for later reopening without re-login.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly says 'Use it when you're done with an account for now but want to come back to it later without re-authenticating.' This provides clear context for when to use the tool. However, it does not mention when not to use it or explicitly compare with alternatives like gv_logout or gv_close_account.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
gv_logoutLock Private Profiles (Logout)A
Lock the private/public gate.
Closes any open private browser contexts and switches the active account to the first available public profile (or none). Private profiles become hidden again until you call google_unlock.
This does NOT sign you out of Google โ it only locks Ghostvault's gate.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description fully discloses behavior: closing private contexts, switching to a public profile, and explicitly stating it does not sign out of Google. It also explains the effect on private profiles becoming hidden until unlocked. This is comprehensive for a zero-parameter tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, no wasted words. The most important action ('Lock the private/public gate') is front-loaded. Each sentence adds distinct value: function, process, and caveat.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given zero parameters and the existence of an output schema (not shown but present), the description is complete. It explains the effect, what happens to private profiles, and how to unlock. No gaps remain for an agent to interpret.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has no parameters, so the baseline is 4. The description does not need to add parameter information, and it correctly focuses on behavior and context. The schema coverage is 100% (trivially), so no additional detail is needed.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses specific verbs ('Lock', 'closes', 'switches') and resources ('private/public gate', 'private browser contexts', 'active account'). It clearly distinguishes this tool from siblings like gv_sign_out (signing out of Google) and gv_unlock (reversing the lock), stating explicitly what it does and does not do.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use this tool (to lock private profiles) and mentions that gv_unlock can reverse it. However, it does not explicitly state when not to use it or list alternative tools for similar operations, though the context of sibling tools provides some implicit guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
gv_make_privateMake Profile PrivateA
Mark a profile as private (hidden when the gate is locked).
Requires the password gate to be active (call google_setup_password first).
Args: account_id: The account id to make private.
| Name | Required | Description | Default |
|---|---|---|---|
| account_id | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses the core effect (profile becomes private/hidden) and the prerequisite (password gate active). However, it does not describe idempotency, side effects, error states, or what happens if the gate is not active. Additional details on return values (output schema exists but not detailed) or authentication needs would improve transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is exceptionally concise: two sentences and an args line. It front-loads the purpose with the condition, then provides the prerequisite. There is no irrelevant information, making it easy for an AI agent to quickly grasp the tool's function.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has an output schema (not shown), so return values need not be described. However, the description does not mention that the action is reversible via gv_make_public, nor does it specify behavior if the profile is already private. Given the complexity (simple mutation with one parameter), the description is adequate but lacks a nod to related siblings and edge cases.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description only adds a brief explanation: 'account_id: The account id to make private.' This is minimal and does not provide format, source, or examples. The description should compensate for the lack of schema description, but it only adds a marginal clarification.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Mark a profile as private (hidden when the gate is locked).' It uses a specific verb ('mark') and identifies the resource ('profile'). The explanation of the condition ('when the gate is locked') distinguishes it from sibling tools like gv_make_public, which does the opposite.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly provides a prerequisite: 'Requires the password gate to be active (call google_setup_password first).' This tells the agent when to use this tool (after setting up password gate) and implies a sequence. It does not, however, mention exclusions or alternative tools for different scenarios.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
gv_make_publicMake Profile PublicB
Mark a profile as public (accessible without unlocking).
Args: account_id: The account id to make public.
| Name | Required | Description | Default |
|---|---|---|---|
| account_id | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must disclose behavioral traits. It only says 'make public' but doesn't mention side effects, error conditions, or prerequisites (e.g., profile must exist). Minimal disclosure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Description is extremely concise: one-line purpose followed by parameter explanation. No wasted words; front-loaded with key information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Tool is simple with one parameter and an output schema. Description explains what it does and the parameter, but lacks mention of preconditions (e.g., profile existence) or effects. Adequate but not fully complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, and description adds 'The account id to make public.' This provides some meaning beyond the schema's 'Account Id' but remains basic. For a single parameter, this is adequate but not enriched with format or source hints.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the action: 'Mark a profile as public (accessible without unlocking).' It uses a specific verb and resource, and it distinguishes from sibling tools like gv_make_private.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives, no prerequisites or exclusions mentioned. Description only states what it does, not context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
gv_open_accountOpen Google Account Browser (reuse session)A
Open the browser context for an already-signed-in account.
Unlike gv_sign_in (which waits for you to complete login), this opens the account's persistent profile and reuses the existing saved session โ no login window, no waiting. Use this after a sign-in has succeeded once and you've since closed the browser.
Also marks the account as active so subsequent browser tools target it.
Args: account_id: The account id to open.
| Name | Required | Description | Default |
|---|---|---|---|
| account_id | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the openWorldHint annotation, the description reveals key behaviors: reuses existing saved session, no login window or waiting, and marks the account as active. No contradictions with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise at about 5 lines, front-loaded with the primary action, followed by differentiation, usage condition, side effect, and parameter. Every sentence adds value without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool with one parameter, no nested objects, and an existing output schema, the description covers purpose, usage, and behavior adequately. Minor omission: no mention of return value, but not critical given schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds minimal meaning for the single parameter account_id ('The account id to open'), which is only slightly more than the schema's title. Given 0% schema coverage, the description compensates to some extent but lacks detail on format or source.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Open the browser context for an already-signed-in account', specifying the verb (open) and resource (browser context). It distinguishes itself from sibling tool gv_sign_in by noting that this tool reuses an existing session without a login window.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly tells when to use: 'Use this after a sign-in has succeeded once and you've since closed the browser.' It contrasts with gv_sign_in and explains that it marks the account as active for subsequent tools, providing clear context for tool selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
gv_open_ephemeralOpen Anonymous Browser SessionA
Open a throwaway browser session for anonymous scraping โ NO account needed.
Launches a fresh Camoufox browser with a random identity, no persistent profile, and no DB row. Nothing survives the session โ perfect for public pages that don't require login.
The session becomes the active target, so ALL existing browser tools work on it unchanged: gv_open_url, gv_get_page_content, gv_screenshot, gv_get_page_links, gv_click_element, gv_fill_input, gv_scroll, gv_press_key.
Defaults are tuned for scraping: headless=True, block_images=True, short 5-minute idle auto-close. Override per call if needed.
Args: url: Optional URL to navigate to immediately. Omit to start on a blank page. headless: Override the default (True). Set False to watch the browser. proxy: Optional Playwright-style proxy dict (same format as gv_create_account). block_images: Override the default (True). Set False if you need screenshots.
Returns the session id + next steps.
When done, call gv_close_ephemeral. The session also auto-closes after GHOSTVAULT_EPHEMERAL_AUTO_CLOSE_MINUTES idle (default 5).
| Name | Required | Description | Default |
|---|---|---|---|
| url | No | ||
| proxy | No | ||
| headless | No | ||
| block_images | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Discloses no persistent profile, no DB row, session being active target, default headless/block_images, 5-min auto-close. Contradicts no annotations (openWorldHint is consistent).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Well-structured with clear opening, parameter bullets, default guidance, and lifecycle notes. Every sentence adds value without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers all aspects: purpose, use case, parameters, defaults, return value, lifecycle, and integration with sibling tools. Nothing missing for an AI agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Despite 0% schema coverage, description explains each parameter's purpose and defaults, adding significant meaning beyond schema types.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states 'Open a throwaway browser session for anonymous scraping' with specific verb and resource. Distinguishes from siblings like gv_open_account by emphasizing no login needed.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says 'NO account needed', 'perfect for public pages', and provides lifecycle guidance (call gv_close_ephemeral). Defaults and overrides are clearly stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
gv_open_urlOpen URL in Google AccountA
Open a URL in the active account's browser.
Works for ANY website โ including third-party sites that use Google Sign-In (they'll auto-SSO using the account's session). The page becomes the "current" page that google_get_page_content / google_click_element operate on.
Args: url: Absolute URL to navigate to. wait_until: "load" | "domcontentloaded" | "networkidle" (default domcontentloaded).
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | ||
| wait_until | No | domcontentloaded |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the openWorldHint annotation, the description discloses auto-SSO behavior and that the page becomes the current page for subsequent tools. Does not mention tab management or error handling, but adds useful context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise paragraphs plus an Args section; every sentence adds value. Front-loaded with purpose, no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers key details: navigation purpose, state change (current page), parameter meanings. Missing potential error conditions or interaction with account state, but output schema likely fills gaps. Adequate for a simple tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Despite 0% schema description coverage, the description explicitly lists both parameters ('url' and 'wait_until') with their purpose, accepted values, and default. Fully compensates for the schema's lack of descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool opens a URL in the active account's browser with specific verb and resource. It distinguishes from siblings like gv_click_element and gv_get_page_content by noting that the page becomes the current page for those tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides clear context on when to use: before gv_get_page_content/gv_click_element, and mentions universal compatibility including auto-SSO. Lacks explicit when-not-to-use or alternative tool references.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
gv_press_keyPress KeyA
Press a single key or key chord on the active page.
Use this for things gv_fill_input can't do โ submitting a form with
Enter, tabbing between fields, dismissing a modal with Escape, selecting
all with Ctrl+A, etc.
Args:
key: Playwright key name โ "Enter", "Tab", "Escape", "ArrowDown",
"Backspace", "a", "1", etc.
modifiers: Optional modifier keys to hold โ ["Control"], ["Shift"],
["Control", "Shift"]. Combined as modifier+...+key.
hold_ms: Hold the key down for this many ms before releasing (for
long-press scenarios). 0 = tap.
delay_after_ms: Pause for a randomized ~this many ms after.
Returns the pressed chord.
| Name | Required | Description | Default |
|---|---|---|---|
| key | Yes | ||
| hold_ms | No | ||
| modifiers | No | ||
| delay_after_ms | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Description details behavior: pressing keys, holding, modifiers, delay. It mentions return value. No contradiction with annotations (openWorldHint). Could note potential side effects (e.g., page changes) but sufficient for a key-press tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Description is well-structured with sections and examples. Slightly verbose but every sentence adds value. Front-loaded with purpose and key usage guidance.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
All parameters covered, usage explained, return value mentioned. No gaps given the tool's complexity. Output schema exists but description still states return type.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, but description fully explains each parameter: key with examples, modifiers as array of modifier keys, hold_ms for long-press, delay_after_ms. Adds meaning beyond schema defaults and types.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it presses a single key or key chord. It distinguishes itself from sibling 'gv_fill_input' by noting what it can do that fill_input cannot, providing specific examples.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly says 'Use this for things gv_fill_input can't do' and gives concrete examples like submitting a form with Enter, tabbing, dismissing a modal with Escape, etc., providing clear when-to-use guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
gv_read_gmailRead Gmail InboxARead-only
Read the Gmail inbox of the active account.
Returns recent messages as [{id, subject, sender, snippet, url, date}, ...]. Gmail's DOM changes often โ if this returns empty, use gv_open_url to mail.google.com and google_get_page_content (with screenshot) instead.
Args: limit: Max number of messages (default 20, max 50).
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already set readOnlyHint=true, confirming read-only behavior. Description adds 'Gmail's DOM changes often โ if this returns empty...' which warns of potential instability and suggests workaround. No contradictions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four sentences, each serving a distinct purpose: action, return format, fallback strategy, and parameter details. No redundancy, well-structured, and front-loaded with core purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Comprehensive for a simple read tool: describes return format with fields, parameter constraints, and fallback behavior. Output schema hinted by the fields listed. No gaps given the low complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Only parameter 'limit' described with default (20) and max (50). While schema provides default, description adds max constraint and clarifies it's the number of messages. Schema coverage is 0%, so description compensates significantly.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states 'Read the Gmail inbox of the active account' with specific verb and resource. It distinguishes from siblings like gv_open_url and google_get_page_content by focusing on reading inbox versus browsing or page interaction.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly advises when to use alternatives: 'if this returns empty, use gv_open_url to mail.google.com and google_get_page_content (with screenshot) instead.' This provides clear fallback and context for when the tool may not be effective.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
gv_record_loginRecord Login Flow (Level 3)ADestructive
Record a login flow for future automatic replay (Level 3).
Opens a browser, injects an action recorder, and waits for the user to complete login manually (including 2FA, captcha, etc.). After login succeeds, the recorded steps are saved to the provider's config.
Future gv_sign_in calls with the same provider will replay these steps automatically โ pausing only for credential fields (password, OTP) and captcha that can't be replayed.
Security: password/OTP values are NEVER recorded. Only the field selectors + credential_key are saved. Store actual credentials via gv_set_credentials.
When to use:
Complex login flows (multi-page, custom captcha, unusual 2FA)
Sites where the login form is hard to describe with login_steps
When you want to "teach" Ghostvault how to log in once, then automate
Args: account_id: The account id to use. provider: Override the provider. Defaults to the account's provider.
| Name | Required | Description | Default |
|---|---|---|---|
| provider | No | ||
| account_id | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond annotations (openWorldHint, destructiveHint), the description details that it opens a browser, injects an action recorder, waits for manual login completion, records steps to config, and notes security (password/OTP never recorded). This adds significant behavioral context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with a clear first paragraph stating purpose, a security note, a bulleted 'When to use' section, and an Args list. It is front-loaded and every sentence adds value without repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers the core functionality, security, and usage scenarios but lacks explanation of the 'Level 3' concept and does not address error handling or cancellation behavior. However, given the tool's complexity and existence of an output schema, it is fairly complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, but the description provides brief yet clear explanations for both parameters: account_id is 'the account id to use' and provider is 'Override the provider. Defaults to the account's provider.' This compensates for the lack of schema descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Record' and resource 'login flow for future automatic replay'. It distinguishes itself from siblings like gv_sign_in (which replays) and gv_set_credentials (which stores actual credentials) by emphasizing the recording and teaching aspect.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The 'When to use' section provides explicit scenarios: complex login flows, sites where login form is hard to describe, and when you want to teach once then automate. It implicitly contrasts with simpler methods like login_steps and mentions future gv_sign_in calls will replay the steps.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
gv_screenshotTake ScreenshotARead-only
Capture a screenshot of the current page as a PNG image (vision support).
Use this to visually understand the page when the text snapshot is ambiguous โ e.g. to locate a button by its appearance or read a captcha.
Args: full_page: If true, capture the full scrollable page (larger image).
| Name | Required | Description | Default |
|---|---|---|---|
| full_page | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations indicate readOnlyHint=true, and description adds context (vision support, examples). No contradictions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences plus parameter note; no wasted words, front-loaded with purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers purpose, usage, and parameter meaning. Lacks description of output, but title implies PNG.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has no description but the tool description explains the full_page parameter's effect clearly.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states 'Capture a screenshot of the current page as a PNG image' and provides specific use cases like visually locating buttons or reading captchas.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says to use when text snapshot is ambiguous, distinguishing from gv_get_page_content (text snapshot).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
gv_scrollScroll PageA
Scroll the active page in human-like increments.
reCAPTCHA v3 and similar behavioral detectors weight scroll behavior heavily. This tool scrolls in small bursts with varied distance + reading pauses, mimicking a real user skimming the page.
Args: direction: "down" (default) or "up". amount: Roughly the number of scroll gestures (each ~300px). Default 3. humanize: Vary the scroll distance + add reading pauses between gestures (default true โ scrolling is cheap, leave it on). delay_after_ms: Pause for a randomized ~this many ms after.
Returns the direction, amount, and whether humanize was applied.
| Name | Required | Description | Default |
|---|---|---|---|
| amount | No | ||
| humanize | No | ||
| direction | No | down | |
| delay_after_ms | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Provides detailed behavioral traits: small bursts, varied distance, reading pauses, mimicking real users. Highlights reCAPTCHA v3 relevance. Adds significant value beyond the minimal openWorldHint annotation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Concise with a clear intro, explanatory paragraph, and structured Args list. Every sentence adds value without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers all aspects: purpose, behavioral nuances, parameter explanations, and return values (direction, amount, humanize). No gaps given the presence of an output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Despite 0% schema coverage, the description fully explains each parameter (direction, amount, humanize, delay_after_ms) with concrete details like 'each ~300px' and 'randomized delay', adding meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states 'Scroll the active page' with a specific verb and resource. Adds 'human-like increments' to distinguish from basic scrolling, aligning with anti-detection context.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Describes when to use (human-like scrolling to evade behavioral detection) but does not explicitly exclude alternatives like scrolling via JS or other tools. Context is clear but lacks explicit 'when-not-to-use'.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
gv_set_credentialsStore Account CredentialsADestructive
Store credentials (username/password) for Level 2 form auto-fill.
Credentials are saved in the account's fingerprint bundle (encrypted at rest when encryption is enabled). Use this before calling gv_sign_in on a provider that has login_steps configured.
Args:
account_id: The account id.
credentials: Dict of credential key-value pairs. The keys must match
the credential_key in the provider's login_steps.
Example: {"username": "john", "password": "secret"}
| Name | Required | Description | Default |
|---|---|---|---|
| account_id | Yes | ||
| credentials | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond annotations (destructiveHint=true), the description adds that credentials are saved in an encrypted fingerprint bundle, providing security context. No contradictions with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two paragraphs and an Args section with no fluff. Purpose is front-loaded. Every sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the presence of an output schema, the description explains behavior and preconditions adequately. Could mention return value or errors, but output schema covers that.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description fully compensates by explaining that credentials keys must match credential_key in login_steps, and provides an example. This adds significant meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it stores credentials for Level 2 form auto-fill, with a specific verb ('store') and resource ('credentials'). It distinguishes from siblings by positioning itself as a prerequisite for gv_sign_in on providers with login_steps.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states when to use: before gv_sign_in on a provider with login_steps configured. Does not list when-not-to or alternatives, but provides clear context for usage.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
gv_setup_passwordSetup Password (Private/Public Gate)ADestructive
Open a browser window to set a password for the private/public gate.
This is a ONE-TIME setup. After setting a password, you can mark profiles as private (google_make_private) โ they'll be hidden until you unlock (google_unlock). Public profiles remain accessible without unlocking.
A browser window opens with a password form โ type and confirm there. The password is stored as a salted hash (PBKDF2-SHA256, 200k iterations).
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond annotations (openWorldHint, destructiveHint), the description adds that it opens a browser window, is one-time setup, and uses PBKDF2-SHA256 hashing. It doesn't mention reversibility or prerequisites, but the added detail is valuable.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise, with three short paragraphs that each add value. It front-loads the main action and uses bullet points for clarity. No wasted sentences, though minor redundancy in explaining the hash.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with zero parameters and a simple action, the description covers purpose, behavior, and relationship to other tools. It lacks mention of what happens if password already set or if it can be reset, but these are gaps given the existence of an output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
No parameters exist, so schema coverage is 100%. The description does not need to add parameter information, and the baseline of 4 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool opens a browser window to set a password for the private/public gate, using specific verb 'open' and resource 'password'. It distinguishes from siblings by noting it's a one-time setup and relates to privacy features like google_make_private and google_unlock.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides context on when to use this tool: it's a one-time setup before marking profiles private. It mentions the result (password storage) and links to related tools, but doesn't explicitly state when not to use it or name alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
gv_sign_inSign In to ProviderA
Open a sign-in window for the user to complete login (including 2FA).
A real browser window opens on the server's machine โ the USER completes sign-in themselves; Ghostvault never touches the password. On success the session is saved to the account's persistent profile automatically.
First-time login from a new fingerprint usually triggers a 2FA challenge โ this is expected. The tool blocks until login completes or times out.
Login level is auto-selected:
If the provider has login_steps AND credentials are available (either passed here or stored via gv_set_credentials) โ Level 2 auto-fill.
Otherwise โ Level 1 manual (user does everything in the visible window).
DECISION GUIDE:
For Google / SSO providers โ Level 1 manual (most reliable for 2FA/captcha).
For providers with login_steps โ store credentials first via gv_set_credentials, then sign_in.
Not sure what the page offers? Call gv_detect_login_options first.
Args: account_id: The account id from gv_list_accounts. provider: Override the provider for this login (e.g. "github", "facebook", or a custom provider name). Defaults to the account's provider field. credentials: Optional dict of credential values for Level 2 auto-fill (e.g. {"username": "john", "password": "secret"}). If omitted, stored credentials are loaded automatically.
| Name | Required | Description | Default |
|---|---|---|---|
| provider | No | ||
| account_id | Yes | ||
| credentials | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds extensive behavioral context beyond the annotations (only openWorldHint): it opens a real browser window, user completes sign-in without Ghostvault touching password, session saved automatically, blocks until completion or timeout, and auto-selects login level. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is detailed and well-structured with paragraphs and a decision guide. Every sentence adds value, but it is somewhat lengthy. However, given the tool's complexity (two login levels, credential handling), the length is justified.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers key aspects: blocking behavior, auto-login level selection, credential handling, and reference to sibling tools. It lacks mention of the return value/response, but since an output schema exists (summary signals), this is partially mitigated. Overall, it is fairly complete for the tool's complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Despite 0% schema description coverage, the description's Args section explains each parameter: account_id as required, provider with default behavior (defaults to account's provider), and credentials as optional with clear role in Level 2 auto-fill. This adds significant meaning beyond the schema's type-only definitions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool opens a sign-in window for user login including 2FA. It specifies the resource (sign-in window) and verb (open), and distinguishes from siblings like gv_detect_login_options and gv_set_credentials by explaining when to use each.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit decision guidance: for Google/SSO use Level 1, for providers with login_steps store credentials first via gv_set_credentials, and if unsure call gv_detect_login_options. It also differentiates between Level 1 and Level 2 login based on credential availability, giving clear when-to-use and when-not-to-use advice.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
gv_sign_outSign Out of ProviderADestructive
Sign the account out of the provider (invalidates the session server-side).
Opens the browser, navigates to the provider's sign-out URL, waits for the session to clear, then closes the browser. After this, the account must sign in again before any browser tools work.
If the provider has no logout_url configured, the browser closes and the user is told to navigate to the site's logout page manually.
Args: account_id: The account id to sign out. provider: Override the provider for this sign-out. Defaults to the account's provider field.
| Name | Required | Description | Default |
|---|---|---|---|
| provider | No | ||
| account_id | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true, so the description adds value by detailing the side effects: opens browser, navigates, waits, closes, and forces re-authentication. This goes beyond the annotation by specifying the sequence and the case of missing logout URL, but could mention if cookies are cleared.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and well-structured: it starts with the core action, then lists steps and special cases, and ends with parameter docs. Every sentence adds necessary detail without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (browser automation) and the presence of an output schema, the description covers the main behaviors: session invalidation, browser operations, and fallback for missing logout URL. It could be slightly more complete by describing what happens to existing browser state, but overall it provides sufficient context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 0% description coverage, so the description fully compensates by explaining each parameter: account_id is the account to sign out, and provider is an override that defaults to the account's provider. This adds essential meaning beyond the schema's type information.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: signing an account out of a provider by invalidating the session server-side. The detailed steps (opening browser, navigating to sign-out URL, waiting, closing) and handling of missing logout_url further clarify its function. While siblings like gv_logout exist, the description is specific enough to distinguish its action.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains what happens after sign-out ('account must sign in again before any browser tools work') and handles a special case (no logout_url), providing implicit context. However, it does not explicitly tell when to use this tool over alternatives like gv_logout, nor does it provide exclusions or prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
gv_switch_accountSwitch Active Google AccountA
Switch the active account that browser tools operate on.
The account must already be open (it becomes open after gv_sign_in). All subsequent gv_open_url / gv_read_gmail calls target the active account until you switch again.
Args: account_id: The account id to make active.
| Name | Required | Description | Default |
|---|---|---|---|
| account_id | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description discloses the state change, precondition, and scope of effect. It does not mention error handling or what happens with invalid account_id, but the core behavior is transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three sentences plus a brief args line, no wasted words, and the key information is front-loaded. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple switching tool with one parameter, the description covers purpose, precondition, and effect. It does not mention return values (output schema exists) or error cases, but is largely complete for the intended use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%. The description adds basic meaning for account_id ('The account id to make active'), but lacks format or source details. This partially compensates for the schema gap but could be more helpful.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description explicitly states the verb 'switch' and resource 'active account', and clarifies that subsequent browser operations target this account, distinguishing it from siblings like gv_sign_in and gv_open_url.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It clearly states the precondition (account must already be open via gv_sign_in) and the effect on subsequent calls, providing context for when to use this tool. It does not explicitly list alternatives but the precondition is informative.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
gv_unlockUnlock Private ProfilesA
Unlock the private/public gate to access private profiles.
Two modes:
Pass the password directly: google_unlock({password: "..."})
Omit the password to open a browser window: google_unlock()
Once unlocked, private profiles are visible and accessible until you call google_logout or restart the MCP server.
Args: password: Your gate password. Omit to unlock via a browser window.
| Name | Required | Description | Default |
|---|---|---|---|
| password | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description carries full burden. It explains the unlock mechanism, browser window fallback, and duration. Does not mention error handling or security implications, but adequate for a simple unlock.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Concise with well-structured sentences and clear bullet points. Every sentence adds value, no fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Tool has one optional parameter and output schema exists. Description covers unlock behavior, modes, and persistence. Could mention handling of already-unlocked state, but largely complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, but description fully documents the single parameter 'password', explaining it can be omitted for browser unlock. Adds meaning beyond schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool unlocks the 'private/public gate' to access private profiles, with specific verb and resource. It distinguishes from sibling tools like gv_make_private or gv_lock_account.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Describes two usage modes (with or without password) and the persistence of the unlocked state until logout or restart. Lacks explicit when-not-to-use or alternatives, but context is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
gv_update_account_configUpdate Account Advanced ConfigADestructive
Update the advanced fingerprint config of an existing account.
Only the keys you pass are changed; everything else stays locked. The account's fingerprint + seeds are NOT re-rolled โ identity stays the same, only the injection/behavioral params change.
The browser must be CLOSED when this is called; relaunch with gv_open_account to apply the new settings.
Args: account_id: The account id to update. locale, timezone, humanize, block_webrtc, block_webgl, webgl_config, fonts, addons, disable_coop, block_images: Same meanings as in gv_create_account. Pass only the ones you want to change. device_profile: Switch to a different hardware template (replaces the device_config section). Same names as in gv_create_account. device_config: Raw Camoufox config keys to merge into device_config (battery:, mediaDevices:, navigator.hardwareConcurrency, ...). Overrides values from device_profile. reset_keys: List of advanced keys to remove entirely (fall back to default). E.g. ["locale", "timezone"] to clear explicit pins. reset_device_keys: List of raw Camoufox config keys to remove from device_config. E.g. ["battery:level", "mediaDevices:webcams"].
Returns the updated keys, the new advanced + device config dicts.
| Name | Required | Description | Default |
|---|---|---|---|
| fonts | No | ||
| addons | No | ||
| locale | No | ||
| humanize | No | ||
| timezone | No | ||
| account_id | Yes | ||
| reset_keys | No | ||
| block_webgl | No | ||
| block_images | No | ||
| block_webrtc | No | ||
| disable_coop | No | ||
| webgl_config | No | ||
| device_config | No | ||
| device_profile | No | ||
| reset_device_keys | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotation 'destructiveHint: true' is supported by the description which details that only passed keys change, identity stays same, and browser must be closed. It adds value beyond the annotation by explaining the non-destructive nature of the update and the requirement to relaunch the browser. There is no contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured: a brief introduction, behavioral notes, a prerequisite, and a clear args list. Every sentence adds value, but the args section could be made slightly more concise by grouping similar parameters. It is appropriately sized for the complexity of 15 parameters.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the high parameter count and no schema descriptions, the description covers the operation, prerequisites, outcomes (returns new config), and key constraints (fingerprint not re-rolled, browser must be closed). It references an existing output schema and provides enough context for an agent to use the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema coverage, the description fully compensates by defining each parameter, referencing gv_create_account for common meanings, and providing examples for complex ones like device_profile, device_config, reset_keys, and reset_device_keys. It clarifies that only passed parameters change and explains how multiple parameters interact.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Update' and the resource 'advanced fingerprint config of an existing account'. It distinguishes this tool from siblings like gv_create_account and gv_delete_account by specifying that only injection/behavioral params change, not the identity. The behavior 'Only the keys you pass are changed' adds precision.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states when to use this tool (to update advanced config) and provides a critical prerequisite: 'The browser must be CLOSED when this is called; relaunch with gv_open_account to apply the new settings.' It also implies when not to use it (identity stays same, so no for re-rolling fingerprints). However, it does not explicitly name alternative tools for different operations, though the sibling list implies alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
gv_update_providerUpdate Custom ProviderADestructive
Update a custom provider's configuration. Built-in providers cannot be updated.
Pass only the fields you want to change. The provider must be closed (no active login flow) when updating.
Args: name: The provider name to update. login_url, success_url_fragments, auth_cookie_names, auth_cookie_domain, logout_url, session_probe_url, login_url_fragments, description: Same meanings as in gv_create_provider. Pass only the ones to change.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | ||
| login_url | No | ||
| logout_url | No | ||
| description | No | ||
| auth_cookie_names | No | ||
| session_probe_url | No | ||
| auth_cookie_domain | No | ||
| login_url_fragments | No | ||
| success_url_fragments | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds value beyond the destructiveHint annotation by clarifying that built-in providers are ineligible and that the provider must be in a closed state. It also implies a partial update behavior. It does not detail error conditions or side effects, which would raise it to a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very concise: two sentences plus an args section. It front-loads the core purpose and constraint, then efficiently lists parameters by reference. No unnecessary words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (9 parameters, 1 required, no schema descriptions, has output schema), the description covers the update semantics, prerequisite condition, and parameter mapping via cross-reference. It does not explain the return value, but the output schema provides that. It is complete enough for an agent to use correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description compensates by explaining that most parameters have the same meaning as in gv_create_provider and that only changed ones should be passed. It explicitly lists the parameter names and clarifies the required 'name' parameter. However, it relies on cross-reference rather than defining each parameter individually, which is a minor limitation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Update' and the resource 'custom provider's configuration'. It distinguishes itself from siblings by explicitly noting that built-in providers cannot be updated, effectively differentiating from create and get operations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit prerequisites ('provider must be closed') and the usage pattern ('pass only the fields you want to change'). It lacks explicit guidance on when not to use this tool (e.g., for creation, use gv_create_provider), but the tool name and context imply the alternative.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
42 tool updates
v0.1.1-beta- First observed
gv_api_call - First observed
gv_check_session - First observed
gv_click_element - First observed
gv_close_account - First observed
gv_close_ephemeral - First observed
gv_create_account - First observed
gv_create_provider - First observed
gv_delete_account - First observed
gv_delete_provider - First observed
gv_detect_login_options - First observed
gv_eval_js - First observed
gv_fill_input - First observed
gv_get_auth_status - First observed
gv_get_cookies - First observed
gv_get_credentials - First observed
gv_get_logs - First observed
gv_get_page_content - First observed
gv_get_page_links - First observed
gv_get_provider - First observed
gv_get_session_status - First observed
gv_list_accounts - First observed
gv_list_providers - First observed
gv_lock_account - First observed
gv_logout - First observed
gv_make_private - First observed
gv_make_public - First observed
gv_open_account - First observed
gv_open_ephemeral - First observed
gv_open_url - First observed
gv_press_key - First observed
gv_read_gmail - First observed
gv_record_login - First observed
gv_screenshot - First observed
gv_scroll - First observed
gv_set_credentials - First observed
gv_setup_password - First observed
gv_sign_in - First observed
gv_sign_out - First observed
gv_switch_account - First observed
gv_unlock - First observed
gv_update_account_config - First observed
gv_update_provider
TDQS
Most tools have clearly distinct purposes, but some pairs (e.g., gv_lock_account/gv_close_account, gv_logout/gv_sign_out) could cause confusion due to overlapping functionality.
All tools follow a consistent 'gv_' prefix and snake_case naming convention with a predictable verb_noun pattern (e.g., gv_list_accounts, gv_open_account), making navigation intuitive.
With 42 tools, the server covers a broad domain but feels slightly overloaded; some tools (e.g., gv_make_private/gv_make_public) could be merged without loss of clarity.
The tool set comprehensively covers account lifecycle, browser automation, provider management, and security features; minor gaps exist (e.g., limited Gmail operations) but do not impede core workflows.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
Stealth web automation for AI agents. Login, signup, navigate, screenshot.
Stealth web automation for AI agents. Login, signup, navigate, screenshot.
Signup sessions, browser continuity, email, SMS, and OTP/TOTP infrastructure for AI agents.
Multiple Google accounts (Gmail, Calendar, Drive, Contacts, Tasks) in one Claude connector.
1
Related MCP Servers
- -licenseNot gradedqualityNot gradedmaintenanceEnables AI assistants to securely manage Google Workspace services (Gmail, Calendar, Drive, Sheets, Contacts) with persistent multi-account OAuth. Uses OS keychain for credential storage with health monitoring and granular business rules for enterprise security.-
- FlicenseNot gradedqualityNot gradedmaintenanceEnables AI agents to authenticate with websites using a real Chromium browser with anti-detection measures and human-in-the-loop support for captchas and 2FA. Features stealth browsing, human-like interactions, and persistent session storage to automate and resume login workflows.-
- AlicenseAqualityBmaintenanceGives your AI agent a persistent browser identity with anti-detection, credential vault, and multi-persona support for automated web browsing, login, and signup.318MIT
- AlicenseBqualityBmaintenanceEnables AI assistants to manage multiple Gmail accounts simultaneously with built-in OAuth authentication, supporting email reading, sending, drafts, labels, and account management.60482MIT
Appeared in Searches
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/mienetic/Ghostvault'
If you have feedback or need assistance with the MCP directory API, please join our Discord server