Skip to main content
Glama
mienetic

Ghostvault

by mienetic

๐Ÿ‘ป Ghostvault

Source-available MCP server for managing browser sessions on any website through your AI agent โ€” powered by Camoufox.

CI License: Apache 2.0 + Commons Clause Python 3.11+ MCP Beta

Let Claude Desktop, Cursor, Cline, or any MCP-compatible agent sign in to any website โ€” Google, GitHub, Facebook, your bank, internal apps โ€” switch between accounts, scrape pages, call APIs, and automate any login-gated flow. Each account gets a locked anti-detect fingerprint and a persistent session that survives restarts.

Quick start ยท How it works ยท Tools ยท Docs ยท FAQ ยท Contributing


Why Ghostvault

Managing multiple accounts across websites from automation is painful:

  • ๐Ÿ”’ Anti-bot detection flags headless browsers, datacenter IPs, and behavioral patterns

  • ๐Ÿ” Account hopping requires re-authentication every time

  • ๐ŸŒ Login-gated sites don't expose API access

  • ๐Ÿค– Detecting login options (SSO vs form) and choosing the right path is manual

Ghostvault solves this by giving your AI agent a real, anti-detect browser per account โ€” with sessions that persist between restarts, fingerprints that don't drift, and a provider system that works with any website (not just Google).

Related MCP server: browser-auth-mcp

Features

  • ๐ŸŽญ Locked fingerprints โ€” each account always looks like the same device (Camoufox C-level spoofing + persisted noise seeds + advanced injection: locale, timezone, fonts, WebGL, WebRTC gate, battery, media devices)

  • ๐Ÿงฉ Presets + advanced config โ€” balanced / stealth / minimal presets + 105 Camoufox config keys + 10 device profile templates (macbook, thinkpad, surface, ...)

  • ๐Ÿ”Œ Provider-agnostic login โ€” built-in providers (google, github, facebook) + create custom providers for any website via gv_create_provider; scan login pages for SSO options with gv_detect_login_options

  • ๐Ÿ—๏ธ 3 login levels โ€” Level 1 (manual), Level 2 (form auto-fill via login_steps), Level 3 (record user's login actions โ†’ replay automatically next time)

  • โŒจ๏ธ Human-like interaction โ€” realistic typing cadence (log-normal distribution), typo+correction, pre-click hover, burst scrolling; 3-layer humanize policy (off / recommended / always)

  • ๐ŸŒ Anonymous scraping โ€” gv_open_ephemeral opens a throwaway session (no account, no login) for public pages

  • ๐Ÿ”Œ API tools โ€” gv_api_call (HTTP in browser session), gv_eval_js (run JS in page), gv_get_cookies

  • ๐Ÿฉบ Session health check โ€” gv_check_session tells you if login is still valid (cookie + probe URL)

  • ๐Ÿ” Persistent sessions โ€” sign in once per account, then reuse forever (cookies + localStorage survive restarts)

  • ๐Ÿ”„ Multi-account + multi-provider โ€” manage unlimited accounts across unlimited websites from one agent

  • ๐Ÿ‘๏ธ Vision support โ€” tools return PNG screenshots so the LLM can see the page

  • ๐Ÿ“‹ Self-debugging โ€” structured JSONL logs of every action

  • ๐Ÿ  Local-first โ€” sessions, cookies, and fingerprints live on your machine; nothing is ever sent anywhere

  • ๐Ÿ”’ Optional encryption at rest โ€” AES-256-GCM + OS keychain

  • โฑ๏ธ Auto-close & auto-lock โ€” close + re-encrypt after each task or after N idle minutes

  • ๐Ÿ”‘ Private/public profiles โ€” password gate + 5-attempt wipe

  • ๐Ÿค– LLM-agnostic โ€” Claude, GPT, Gemini, or any MCP-compatible model

How it works

Your AI agent (Claude Desktop / Cursor / Cline)
        โ”‚  MCP protocol (stdio or HTTP)
        โ–ผ
โ”Œโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”
โ”‚ Ghostvault MCP Server                           โ”‚
โ”‚                                                 โ”‚
โ”‚  42 tools:                                      โ”‚
โ”‚   gv_create_account, gv_sign_in,        โ”‚
โ”‚   gv_create_provider, gv_check_session, โ”‚
โ”‚   gv_detect_login_options, gv_record_login,โ”‚
โ”‚   gv_open_url, gv_click_element,        โ”‚
โ”‚   gv_fill_input, gv_api_call,           โ”‚
โ”‚   gv_open_ephemeral, gv_get_cookies,    โ”‚
โ”‚   gv_setup_password, gv_unlock, ...     โ”‚
โ”‚                                                 โ”‚
โ”‚  Per-account persistent Camoufox profiles:      โ”‚
โ”‚   profile_A/  โ”€โ”€ locked fingerprint A + Google   โ”‚
โ”‚   profile_B/  โ”€โ”€ locked fingerprint B + GitHub   โ”‚
โ”‚   profile_C/  โ”€โ”€ locked fingerprint C + custom   โ”‚
โ”‚                                                 โ”‚
โ”‚  Provider recipes:                              โ”‚
โ”‚   providers.json (shared login recipes)         โ”‚
โ”‚   google | github | facebook | custom           โ”‚
โ””โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”˜
        โ”‚  traffic exits via your IP or proxy
        โ–ผ
   Any website (Google, GitHub, your bank, ...)

The agent decides what to do; Ghostvault provides the hands. Each profile is a container โ€” it holds sessions for every website equally, not just one provider. Login is data-driven via provider recipes, so any website's login flow can be described as data, not code.

Why fingerprints are locked (critical)

Camoufox generates a fresh random fingerprint on every launch โ€” it does not persist one to the profile directory. Without locking, each launch would look like a brand-new device and anti-bot systems would flag the account.

Ghostvault generates one fingerprint per account at creation, serializes it (BrowserForge fingerprint + noise seeds + OS + device profile) to a sidecar JSON, and passes it back on every launch. Result: an account always presents the same identity.


Quick start

Step 1 โ€” Install (requires Python 3.11+):

pip install --pre ghostvault
python -m camoufox fetch    # download the browser binary (~120 MB, one-time)

Step 2 โ€” Connect your AI agent:

Add Ghostvault to your MCP client config. Find your Python path:

which python3    # use this exact path below

Then add to your client config (see Connect your agent for each client's file location):

{
  "mcpServers": {
    "ghostvault": {
      "command": "/absolute/path/to/python3",
      "args": ["-m", "ghostvault"]
    }
  }
}

Step 3 โ€” Try it:

Restart your agent and say: "List available Ghostvault providers."

The agent should respond with the built-in providers (google, github, facebook, generic).

That's it. No server to start, no port to manage โ€” Ghostvault runs as a subprocess spawned by your AI client.


Prefer a one-command installer? (installs everything + auto-configures Claude Desktop / Cursor)

macOS / Linux (in a terminal):

curl -fsSL https://raw.githubusercontent.com/mienetic/Ghostvault/main/install.sh | bash

Windows (in PowerShell):

irm https://raw.githubusercontent.com/mienetic/Ghostvault/main/install.ps1 | iex

The installer automatically:

  1. ๐Ÿ“ฅ Clones Ghostvault into ~/.ghostvault-app (or %USERPROFILE%\.ghostvault-app on Windows)

  2. ๐Ÿ Creates an isolated Python virtualenv (doesn't touch your system Python)

  3. ๐Ÿ“ฆ Installs Ghostvault + all dependencies

  4. ๐ŸฆŠ Downloads the Camoufox browser binary (~120 MB, one-time)

  5. โš™๏ธ Writes the MCP config for Claude Desktop and/or Cursor if they're installed

Then restart Claude Desktop / Cursor โ€” Ghostvault's tools appear. That's it. ๐ŸŽ‰

Requirements: Python 3.11+ (download) and git. On macOS, run xcode-select --install first if git isn't installed. On Windows, check "Add Python to PATH" during the Python installer.

Update

# macOS / Linux
~/.ghostvault-app/update.sh

# Windows (PowerShell)
powershell -File "$env:USERPROFILE\.ghostvault-app\update.ps1"

Ghostvault also checks automatically on startup and prints a notice if a new version is available โ€” so you'll never be silently out of date.

Uninstall

# macOS / Linux
bash ~/.ghostvault-app/uninstall.sh

On Windows, just delete the install dir and the data dir manually:

Remove-Item -Recurse -Force "$env:USERPROFILE\.ghostvault-app"
Remove-Item -Recurse -Force "$env:USERPROFILE\.ghostvault"   # sessions (optional)

Then remove the ghostvault entry from your Claude Desktop / Cursor config by hand.

Removes the install dir + the Ghostvault entry from your client configs. (On macOS/Linux the script asks before deleting session data, since ~/.ghostvault contains your Google sessions.)


Connect your agent

๐Ÿ’ก If you ran the one-line installer above, it already wrote the config for Claude Desktop and Cursor. Just restart those apps and you're done โ€” skip to Usage. The steps below are only needed if you installed manually, or want to connect a different agent.

Ghostvault is an MCP server, so any MCP-compatible client can connect. Ready-to-copy config files for each client live in examples/ โ€” see examples/README.md for the full cheat-sheet of where each file goes and the JSON shape each client expects.

โš ๏ธ Use an absolute path to your Python. Clients run the server as a subprocess and don't inherit your shell PATH, so a bare python won't be found. After installing, find the right interpreter:

  • One-line installer: ~/.ghostvault-app/.venv/bin/python

  • Manual install: run which python in the venv where you installed Ghostvault, or use /usr/bin/python3, /opt/homebrew/bin/python3, etc.

Supported clients

Client

Example file

Config location

Claude Desktop

claude_desktop_config.json

~/Library/Application Support/Claude/ (macOS), %APPDATA%\Claude\ (Windows), ~/.config/Claude/ (Linux)

Cursor

cursor_config.json

~/.cursor/mcp.json (global) or .cursor/mcp.json (per-project)

Cline (VS Code)

cline_mcp_settings.json

~/.cline/data/settings/cline_mcp_settings.json (note extra disabled/autoApprove fields)

VS Code (Agent mode)

vscode_mcp.json

.vscode/mcp.json (note shape is {"servers": {...}} with type: "stdio")

ZCode

zcode_config.json

<repo>/.zcode/config.json (workspace) or ~/.zcode/cli/config.json (note nested mcp.servers)

Continue.dev

continue_dev_config.json

~/.continue/config.json under mcpServers

Claude Code (CLI)

(CLI โ€” see below)

claude mcp add ...

Claude Code (CLI)

Claude Code is configured via the claude CLI rather than a JSON file:

claude mcp add --transport stdio -s user \
  -e GHOSTVAULT_HEADLESS=false \
  ghostvault -- /absolute/path/to/python -m ghostvault

Verify: claude mcp list. Scopes: -s user (all projects), -s project (shared via .mcp.json), -s local (default).

Other clients

Any MCP-compatible client works. The universal recipe:

  1. Point command at an absolute Python path that has Ghostvault installed

  2. Set args to ["-m", "ghostvault"]

  3. Optionally set env for any GHOSTVAULT_* variables (see Configuration)

The clients disagree on JSON shape โ€” see the shape cheat-sheet in examples/README.md.

Remote / HTTP transport (advanced)

To serve Ghostvault over HTTP instead of stdio (e.g. for a remote client):

GHOSTVAULT_TRANSPORT=http GHOSTVAULT_PORT=8765 python -m ghostvault

Then point your client at http://127.0.0.1:8765/mcp (use the machine's IP for remote access โ€” ensure you secure it).


Verify the connection

After connecting any agent, test it with a simple prompt:

"List my Ghostvault accounts."

The agent should call gv_list_accounts and return an empty list on a fresh install. If you get an error instead, check:

  • The Python path in the config is absolute and correct (ls /that/path)

  • Ghostvault is importable from that Python: /that/path/python -c "import ghostvault"

  • The Camoufox browser binary is downloaded: /that/path/python -m camoufox path

  • For stdio clients: check the client's MCP/logs panel โ€” startup errors appear there

Just talk to your agent naturally. Example prompts:

  • "Sign in to my Work Google account, then read my latest 5 emails and tell me if any need an urgent reply."

  • "Switch to my Personal account and open Drive โ€” list my recent files."

  • "Open Notion using my Work Google login and create a new page called 'Weekly review'."

  • "Take a screenshot of the current page so I can see what's happening."

The agent calls the right tools. On the first sign-in of a new account, a browser window opens for you to complete login (Google will likely ask for 2FA โ€” this is normal).

Typical first-time flow

1. You:   "Create a Google account called Work"
   Agent: calls gv_create_account โ†’ "Done. Now sign in."

2. You:   "Sign in to Work"
   Agent: calls gv_sign_in โ†’ a browser window opens
   You:   complete Google login + 2FA in that window
   Agent: "Signed in as you@gmail.com."

3. You:   "Read my latest emails"
   Agent: calls gv_read_gmail โ†’ returns inbox summary

4. You:   "Now switch to Personal and open Drive"
   Agent: calls gv_switch_account + gv_open_url

Tool reference

Anonymous scraping (2 tools) โ€” no account needed

Tool

Description

gv_open_ephemeral

Open a throwaway Camoufox session (no profile, no login) โ€” url, headless, proxy, block_images

gv_close_ephemeral

Close an ephemeral session + free resources (defaults to active)

Provider management (5 tools) โ€” custom login recipes

Tool

Description

gv_create_provider

Create a custom login recipe for any website (Level 1)

gv_list_providers

List all providers (built-in + custom) with capability flags

gv_get_provider

Show one provider's full config

gv_update_provider

Update a custom provider (refuses built-ins)

gv_delete_provider

Delete a custom provider (refuses built-ins)

Login scanning + credentials (3 tools)

Tool

Description

gv_detect_login_options

Scan a page for SSO buttons, form fields, 2FA, captcha โ€” returns recommendation

gv_set_credentials

Store credentials (username/password) for Level 2 auto-fill

gv_get_credentials

Show stored credential keys (values masked)

Session health + API (4 tools)

Tool

Description

gv_check_session

Check if session is still authenticated (cookie + probe URL)

gv_api_call

HTTP request using browser session (cookies + TLS fingerprint)

gv_eval_js

Run JavaScript in the page (extract tokens, call site JS)

gv_get_cookies

Read browser cookies (masked values)

Once open, all browser tools work on the ephemeral session unchanged โ€” gv_open_url, gv_get_page_content, gv_screenshot, gv_get_page_links, gv_click_element, gv_fill_input, gv_scroll, gv_press_key. The session is set as the active target automatically.

Accounts & lifecycle (18 tools)

Tool

Description

gv_list_accounts

List accounts + which is active + statuses (private hidden when locked)

gv_create_account

Create a slot with a locked fingerprint + advanced config (preset, locale, humanize, ...)

gv_update_account_config

Tweak advanced fingerprint config post-creation (identity stays locked; reopen to apply)

gv_sign_in

Open a login window for the user (handles 2FA)

gv_open_account

Open the browser reusing a saved session (no login window)

gv_switch_account

Change the active account

gv_get_session_status

Check if a session is running/authenticated

gv_close_account

Close a browser context (session saved)

gv_lock_account

Close + re-encrypt (session kept)

gv_sign_out

Sign out of Google (session invalidated; re-login required)

gv_delete_account

Delete account + profile + session + DB row permanently

gv_setup_password

Set a password to enable the private/public gate (browser window)

gv_unlock

Unlock the gate to access private profiles (password or browser window)

gv_logout

Lock the gate + close private contexts + switch to public

gv_get_auth_status

Check whether the gate is active and unlocked

gv_make_private

Mark a profile as private (hidden when locked)

gv_make_public

Mark a profile as public (always accessible)

Browser (9 tools)

Tool

Description

gv_open_url

Open any URL in the active account (incl. SSO-enabled sites)

gv_get_page_content

Read page text (+ optional screenshot via include_screenshot)

gv_screenshot

Capture a PNG (vision) โ€” full_page option

gv_get_page_links

List visible links

gv_click_element

Click by visible text or CSS selector โ€” humanize, delay_after_ms

gv_fill_input

Fill a form field โ€” humanize, typing_speed_wpm, typing_variance, mistake_rate, delay_after_ms

gv_press_key

Press a key or chord (Enter, Tab, Escape, Ctrl+A, ...) โ€” hold_ms, delay_after_ms

gv_scroll

Scroll in human-like bursts โ€” direction, amount, humanize (good for reCAPTCHA v3)

gv_read_gmail

Read the Gmail inbox (convenience tool)

Debug (1 tool)

Tool

Description

gv_get_logs

Read recent JSONL action log entries

Full tool docstrings (what the agent sees) are in the skill/ directory (modular: 9 files covering all 42 tools).


Configuration

All settings are env vars (prefix GHOSTVAULT_), loadable from a .env file. See .env.example for the full list. Highlights:

Var

Default

Purpose

GHOSTVAULT_DATA_DIR

~/.ghostvault

Profiles, DB, logs

GHOSTVAULT_HEADLESS

false

Open a visible window (recommended for login + 2FA)

GHOSTVAULT_DEFAULT_OS

auto

Default fingerprint OS (auto = host OS, or windows/macos/linux)

GHOSTVAULT_LOGIN_TIMEOUT

300

Seconds to complete login + 2FA

GHOSTVAULT_TRANSPORT

stdio

stdio | http | sse

GHOSTVAULT_PROXY_*

(empty)

Optional global proxy (local-first otherwise)

GHOSTVAULT_LOG_LEVEL

INFO

Console log level

GHOSTVAULT_ENCRYPTION_ENABLED

false

Encrypt profile dirs at rest (see Encryption)

GHOSTVAULT_AUTO_CLOSE_AFTER_TASK

false

Close browser + re-encrypt after each tool call (minimizes exposure window)

GHOSTVAULT_AUTO_LOCK_MINUTES

0

Auto-close idle contexts after N minutes (0 = disabled)

GHOSTVAULT_WINDOW_WIDTH

1280

Browser window width in pixels (0 = let browser decide)

GHOSTVAULT_WINDOW_HEIGHT

800

Browser window height in pixels (0 = let browser decide)

GHOSTVAULT_HUMANIZE

true

Human-like cursor movement (click jitter + bezier path). Strongly recommended for login/SSO work.

GHOSTVAULT_BLOCK_WEBRTC_STRATEGY

auto

WebRTC gate: auto (block only with proxy) | true | false

GHOSTVAULT_DEFAULT_LOCALE

(empty)

Default locale for new accounts, e.g. en-US (empty = geoip/host-decided)

GHOSTVAULT_DEFAULT_TIMEZONE

(empty)

Default IANA timezone for new accounts, e.g. America/New_York (empty = geoip/host-decided)

GHOSTVAULT_HUMANIZE_POLICY

off

Humanize policy: off (agent decides) | recommended (default on, agent can disable) | always (forced on)

GHOSTVAULT_EPHEMERAL_HEADLESS

true

Ephemeral (scraping) sessions are headless by default

GHOSTVAULT_EPHEMERAL_BLOCK_IMAGES

true

Block image loading in ephemeral sessions (faster text scraping)

GHOSTVAULT_EPHEMERAL_AUTO_CLOSE_MINUTES

5

Idle timeout for ephemeral sessions (0 = disabled)

GHOSTVAULT_EPHEMERAL_MAX_CONCURRENT

3

Cap on simultaneous ephemeral sessions

Advanced fingerprint configuration

Camoufox exposes ~15 fingerprint-injection kwargs + 105 config-domain keys (battery, media devices, audio, WebGL params, screen, navigator, ...). Without Ghostvault you'd have to pass them every launch AND remember which go as constructor kwargs vs config dict keys. Ghostvault locks them into each account's fingerprint bundle, so they persist across launches alongside the identity.

The full ~105-key schema is documented at Camoufox config schema in the docs site. Use it to set raw keys like battery:level, mediaDevices:webcams, AudioContext:sampleRate via the device_config param.

Device profile templates fill in ~15 hardware-realistic keys at once โ€” screen size, GPU vendor/renderer, media-device counts, battery, audio rate:

await gv.create_account(
    name="Work-MBP",
    device_profile="macbook-pro-14-m2",  # fills screen, GPU, mics, webcam, ...
    device_config={"battery:level": 0.45},  # override one key
)

Available profiles: macbook-pro-14-m2, macbook-air-13-m1, imac-24, windows-desktop-rtx, thinkpad-x1-carbon, surface-laptop-5, linux-workstation, dell-xps-13-ubuntu, generic-laptop, headless-server. See Device profile templates for the full comparison table.

A built-in consistency checker flags impossible combos (e.g. macOS with an NVIDIA GPU) โ€” warnings surface in the gv_create_account response.

Presets bundle smart defaults so you don't have to learn all 15 params:

Preset

Use case

What it sets

balanced (default)

Most Google / SSO work

humanize=true, block_webrtc="auto"

stealth

Signups, new IPs, sensitive accounts

humanize=true, block_webrtc=true, disable_coop=true

minimal

Trusted sites, max speed

humanize=false, block_webrtc=false

Any explicit param you pass overrides the preset value.

Available params (all optional, all locked per-account):

Param

Type

Notes

locale

str | list[str]

e.g. "en-US" or ["en-US","en"]. First drives Intl API; rest populate Accept-Language. Overrides geoip when set.

timezone

str

IANA timezone, e.g. "America/New_York". Overrides geoip when set.

humanize

bool | float

true enables cursor humanization; a float sets max move duration in seconds.

block_webrtc

bool | "auto"

"auto" = block only when a proxy is set (prevents IP leak via STUN).

block_webgl

bool

Disable WebGL entirely. Some sites break; use sparingly.

webgl_config

list[str]

[vendor, renderer] pair to spoof, e.g. ["Apple Inc.", "Apple GPU"].

fonts

list[str]

Installed font family names to inject (on top of OS defaults).

addons

list[str]

Paths to extracted Firefox addon dirs (must contain manifest.json).

disable_coop

bool

Disable Cross-Origin-Opener-Policy โ€” needed for some captcha/turnstile iframes.

block_images

bool

Block all image loading. Faster but visually inconsistent.

Smart-default rules (applied at launch time):

block_webrtc:
  explicit true/false โ†’ use it
  "auto"              โ†’ true if proxy present, false otherwise

locale / timezone:
  explicit value      โ†’ use it, DISABLE geoip matching for that dimension
  absent + proxy      โ†’ geoip=true (auto-match from proxy IP)
  absent + no proxy   โ†’ host locale (current behavior)

humanize:
  explicit value      โ†’ use it
  absent              โ†’ global GHOSTVAULT_HUMANIZE default (true)

Example โ€” stealth account in Thailand with a US proxy:

await gv.create_account(
    name="Work-US",
    os="windows",
    proxy={"server": "http://us-residential.example:8080"},
    preset="stealth",
    locale="en-US",              # match the proxy country
    timezone="America/New_York", # match the proxy country
)

Update config after creation (identity stays locked โ€” only injection params change):

# Account must be closed first.
await gv.update_account_config(account_id, humanize=False, block_webrtc=True)
await gv.open_account(account_id)  # relaunch to apply

Reset a key back to default:

await gv.call("gv_update_account_config", {
    "account_id": account_id,
    "reset_keys": ["locale", "timezone"],
})

Note on IP: Camoufox (and any browser) cannot change the TCP source IP โ€” that's set by the OS kernel, not the browser. Use a proxy or VPN for IP rotation. What the advanced config does lock is everything else: the browser-visible signals (locale, timezone, fonts, WebGL, WebRTC leak gate) that must match the IP's country or the account looks inconsistent. See this discussion for the full IP/fingerprint model.

Encryption at rest (optional)

By default, each account's persistent profile (which holds real Google session cookies) lives on disk as plaintext Firefox profile files. Anyone with read access to ~/.ghostvault/profiles/ can steal your sessions.

Enable encryption to store profiles as AES-256-GCM archives instead:

export GHOSTVAULT_ENCRYPTION_ENABLED=true

Or set it in your client's env block:

"env": { "GHOSTVAULT_ENCRYPTION_ENABLED": "true" }

How it works:

  • The master key is stored in your OS keychain (macOS Keychain, Windows Credential Manager, Linux Secret Service) โ€” never on disk. It's auto-generated on first use.

  • When the browser opens, the profile is decrypted to a temp dir (wiped on close).

  • When the browser closes, the profile is re-encrypted to <account_id>.profile.enc.

  • Existing plaintext profiles are auto-migrated on first open after enabling.

Requirements & caveats:

  • Keychain backend required. On headless Linux without D-Bus / Secret Service (e.g. a bare Docker container), encryption can't store the key securely and stays disabled. Run gnome-keyring or kwallet first.

  • Losing the keychain entry = losing the profiles. The key is not derivable from anything else. There is no recovery path by design โ€” that's what makes it secure.

  • The browser still sees plaintext while running. Encryption protects data at rest, not against an attacker who compromises the running session.

  • Fingerprint files stay plaintext. They describe the spoofed identity (UA, screen, etc.) but don't contain session secrets, so encrypting them isn't worth the complexity.

Private/public profiles (optional)

Ghostvault can separate profiles into public (accessible without unlocking) and private (hidden behind a password). This is an app-level visibility gate on top of encryption-at-rest.

How it works:

  1. Call gv_setup_password โ€” a browser window opens for you to set a password

  2. Mark sensitive profiles as private: gv_make_private({account_id})

  3. When locked, gv_list_accounts hides private profiles; browser tools refuse to open them

  4. Call gv_unlock({password}) to access private profiles (stays unlocked until gv_logout or server restart)

Brute-force protection:

  • 3 wrong passwords โ†’ warning with remaining attempts

  • 5 wrong passwords โ†’ all private profiles permanently deleted + password reset

  • Public profiles are never affected by failed attempts

This is different from encryption-at-rest: encryption protects the disk (someone steals the laptop); the private/public gate protects access (someone sits at your unlocked machine and tries to use private Google accounts via the agent).

Remote (HTTP transport)

For remote access instead of the default stdio transport:

GHOSTVAULT_TRANSPORT=http GHOSTVAULT_PORT=8765 python -m ghostvault

Point your client at http://127.0.0.1:8765/mcp.

Anonymous scraping (no account needed)

Not every task needs a managed account. gv_open_ephemeral launches a throwaway Camoufox session: no profile, no DB row, no login, random identity per session, tempdir removed on close. Once open, all browser tools work on it unchanged โ€” it just becomes the active target.

# Open a throwaway browser + navigate to a public page
await gv.open_ephemeral(url="https://news.ycombinator.com")

# All browser tools work โ€” no changes needed
content = await gv.get_page_content(include_screenshot=True)
links = await gv.get_page_links(limit=20)
await gv.scroll(direction="down", amount=3)

# Done โ€” close frees the browser + removes the tempdir
await gv.close_ephemeral()

Mix anonymous scraping with managed accounts:

# Scrape a public page anonymously...
await gv.open_ephemeral(url="https://example.com/public-data")
data = await gv.get_page_content()
await gv.close_ephemeral()

# ...then switch to a managed account for authenticated work
await gv.open_account("acc_abc123")
await gv.open_url("https://mail.google.com")

Ephemeral defaults are tuned for scraping (override per call):

Setting

Default

Why

headless

true

Scraping doesn't need a visible window (opposite of managed accounts)

block_images

true

Faster text scraping; turn off if you need screenshots

humanize

false

No cursor movement needed for read-only scraping

auto_close_minutes

5

Short idle timeout โ€” abandoned sessions clean themselves up

max_concurrent

3

Cap on simultaneous ephemeral sessions (each is a full Firefox process)

Override via env vars (GHOSTVAULT_EPHEMERAL_*) or per call:

# Visible browser + keep images for screenshot-based scraping
await gv.open_ephemeral(url="...", headless=False, block_images=False)

When to use ephemeral vs managed accounts:

Scenario

Use

Scrape a public page (news, docs, pricing)

gv_open_ephemeral

Login-required site (Gmail, Drive, SSO)

Managed account (gv_create_account + gv_sign_in)

Fill a public form (contact, signup-free download)

gv_open_ephemeral

Read Gmail / access Google services

Managed account

Captcha-protected scrape target

gv_open_ephemeral + humanize=True via the proxy param

See examples/scripts/scrape_public_page.py and scrape_with_pagination.py for complete runnable examples.

Human-like interaction (anti-bot typing + clicks)

Camoufox's humanize=True covers mouse-movement bezier curves at the C++ layer (so isTrusted=true and the cursor path looks human). It does NOT cover:

  • Typing cadence โ€” Playwright's fill() pastes the whole string in one input event; keyboard.type(text, delay=N) uses a constant delay between every char, which is itself a bot tell.

  • Inter-keystroke variance โ€” real humans speed up on common bigrams ("th", "ing") and slow down on rare ones.

  • Occasional typos + corrections โ€” a perfect string with zero Backspaces is suspicious for long inputs.

  • Pre-click hover โ€” Playwright's .click() moves + clicks in one gesture; real users hover for 50โ€“500 ms before clicking.

Ghostvault fills these gaps at the Playwright layer. Every interaction tool gains optional humanization params:

Param

Type

Default

Purpose

humanize

bool

false

Type char-by-char (fill) or hover-then-click (click).

typing_speed_wpm

int

90

Target words-per-minute (40=slow, 90=avg, 150=fast).

typing_variance

float

0.35

Cadence spread 0โ€“1 (log-normal sigma). 0=constant, 0.35=realistic, 1=erratic.

mistake_rate

float

0.0

Chance per char to typo-then-correct (0โ€“0.05). Produces realistic Backspace events.

delay_after_ms

int

0

Randomized pause after the action (0.7ร—โ€“1.3ร— spread).

Per-call example โ€” Google login with humanized typing:

await gv.fill_input(
    target="Email", value="user@gmail.com",
    humanize=True, typing_speed_wpm=85, typing_variance=0.4,
    mistake_rate=0.02, delay_after_ms=800,
)
await gv.click_element(target="Next", humanize=True, delay_after_ms=1500)

Per-account defaults (set once, applies to all calls unless overridden):

await gv.update_account_config(account_id, humanize_typing=True, default_typing_wpm=85)
# Now every gv_fill_input on this account is humanized unless you pass humanize=False

The typing model is a log-normal distribution (the standard HCI model). For wpm=90, variance=0.35, inter-keystroke delays center around ~130 ms with occasional 300โ€“500 ms outliers โ€” matching observed human typing. With mistake_rate > 0, a fraction of characters are mistyped to a QWERTY-adjacent key, paused on briefly, then Backspace-corrected.

New tools for richer interaction:

Tool

Use case

gv_press_key

Submit with Enter, Tab between fields, Escape to dismiss, Ctrl+A to select all

gv_scroll

Human-like scroll bursts with reading pauses โ€” critical for reCAPTCHA v3, which weights scroll behavior heavily

reCAPTCHA v3 warm-up pattern โ€” a page that loads + immediately submits looks like a bot. Scroll, read, click around, THEN act:

await gv.open_url("https://protected-site.com")
await asyncio.sleep(3)                          # let the page settle
await gv.scroll(direction="down", amount=2)     # burst-scroll
await asyncio.sleep(2)                          # reading pause
await gv.get_page_content()                     # "engage" with content
await gv.scroll(direction="up", amount=2)       # round-trip scroll
await gv.fill_input("query", "search term", humanize=True)  # NOW act
await gv.press_key("Enter")

See examples/scripts/human_like_login.py, fill_long_form.py, and captcha_friendly_browsing.py for complete runnable examples.

Humanize policy โ€” who decides?

By default, the AI agent decides per-call whether to enable humanize (based on the Decision Guide in each tool's docstring). For sensitive accounts you may want to lock this down. Ghostvault supports a 3-layer policy model:

Policy

Behavior

Use case

off (default)

Agent decides every call; per-account humanize_typing/humanize_clicks is the fallback when the agent omits the arg.

Trusted environments, fast iteration.

recommended

Humanize defaults ON; agent CAN turn it OFF explicitly by passing humanize=false.

Most real-world use โ€” safety net without rigidity.

always

Humanize forced ON at the server. The agent cannot disable it, even by passing humanize=false.

Sensitive accounts (ads, payments) where a single mistake = ban.

Resolution order (highest wins):

1. Per-account humanize_policy  (set via gv_update_account_config)
2. Global GHOSTVAULT_HUMANIZE_POLICY  (env var)
3. "off"  (default โ€” agent decides)

Set it globally (applies to all accounts):

# In .env or your client's env block:
GHOSTVAULT_HUMANIZE_POLICY=recommended

Set it per-account (overrides global):

# Force humanize on for this sensitive account โ€” agent can't disable it.
await gv.update_account_config(account_id, humanize_policy="always")

The tool result includes the effective humanize value so the agent (and you) can verify what actually ran:

{"filled": "Email", "humanize": true, "typing_speed_wpm": 85}

Manual install (alternative)

Ghostvault is on PyPI (beta) โ€” install with pip install --pre ghostvault. Requires Python 3.11+.

git clone https://github.com/mienetic/Ghostvault.git
cd Ghostvault
pip install -e .

# Download the Camoufox browser binary (~120 MB, one-time)
python -m camoufox fetch

For development (includes test + lint tooling):

pip install -e ".[dev]"

Then add Ghostvault to your client config manually. Use the Python from your environment as the command โ€” for example, the venv python if you installed into one.

Claude Desktop โ€” edit ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or ~/.config/Claude/claude_desktop_config.json (Linux):

{
  "mcpServers": {
    "ghostvault": {
      "command": "/absolute/path/to/your/python",
      "args": ["-m", "ghostvault"],
      "env": {
        "GHOSTVAULT_HEADLESS": "false"
      }
    }
  }
}

Cursor โ€” edit .cursor/mcp.json:

{
  "mcpServers": {
    "ghostvault": {
      "command": "/absolute/path/to/your/python",
      "args": ["-m", "ghostvault"]
    }
  }
}

Restart your client after editing.


Programmatic use (SDK)

For scripts that want to call Ghostvault without an LLM in the loop (run inside the cloned repo, after pip install -e . above):

pip install -e ".[sdk]"
import asyncio
from ghostvault_sdk import GhostvaultClient

async def main():
    async with GhostvaultClient() as gv:
        await gv.create_account(name="Work", os="macos")
        accounts = await gv.list_accounts()
        print(accounts)

asyncio.run(main())

See the examples/ directory for comprehensive examples:

Example

What it demonstrates

scripts/sdk_all_tools.py

Every gv_* tool called via SDK (42 tools)

scripts/custom_provider_demo.py

Create a custom provider recipe for any website + list/delete providers

scripts/detect_login_demo.py

Scan a login page for SSO buttons, form fields, 2FA, captcha + get recommendation

scripts/record_login_demo.py

Level 3: record a login flow โ†’ replay automatically next time

scripts/session_health_demo.py

Check session health + API call + JS eval + cookie reading

scripts/human_like_login.py

Human-like login (any provider) with realistic typing cadence (85 wpm, 2% typos)

scripts/fill_long_form.py

Multi-field form with per-field typing speeds + Tab navigation + Shift+Tab to go back

scripts/captcha_friendly_browsing.py

reCAPTCHA v3 warm-up pattern: scroll, read, click, THEN act

scripts/scrape_public_page.py

Anonymous one-shot scrape: open_ephemeral โ†’ read + screenshot + links โ†’ close (no account)

scripts/scrape_with_pagination.py

Multi-page scrape on a persistent ephemeral session: loop {read, scroll, click Next}

scripts/sdk_private_public.py

Private/public gate flow via SDK (setup, lock, unlock, logout)

scripts/check_gmail.py

End-to-end: create + sign in + read Gmail + close

scripts/mcp_e2e_test.py

MCP protocol test: create + sign in + read Gmail

scripts/mcp_security_test.py

Encryption + auto-close + auto-lock + sign_out + delete

agent_prompts.md

Copy-paste prompts for Claude Desktop / Cursor / ZCode (all 42 tools)


FAQ

No. Each profile is a container that holds sessions for any website equally. Use gv_create_account(provider="github") + gv_sign_in to login GitHub directly. Or use gv_create_account(provider="my_custom_site") with a custom provider you created via gv_create_provider. Google is just one of the built-in providers โ€” it's not a "parent" that other providers depend on.

The agent can detect what login options a page offers by calling gv_detect_login_options(url) โ€” it scans for SSO buttons, form fields, 2FA, and captcha, then recommends a login path.

Ghostvault uses Camoufox, a Firefox fork with C-level fingerprint spoofing. With locked fingerprints + humanized interaction + your home IP, each account looks like a genuine device. That said:

  • First-time login often triggers 2FA โ€” the site sees a new device. This is expected.

  • Don't share IPs across many accounts โ€” one account per proxy/IP is the safe ratio.

  • Use humanize=true on login forms โ€” instant paste typing is the #1 bot tell.

  • No tool is undetectable โ€” behavioral ML (reCAPTCHA v3) and IP reputation still apply.

Ghostvault gives you the tools to be safe; how you use them is your responsibility. See LICENSE for the full liability disclaimer.

Yes, but with caveats:

  • You'll need a residential/mobile proxy per account (datacenter IPs get flagged).

  • Login requires a visible window โ€” on a headless server, use headless='virtual' (Xvfb) or VNC.

  • Configure the proxy before the first login (the session is tied to the IP + fingerprint).

For most users, running locally is simpler and safer. Remote HTTP transport (GHOSTVAULT_TRANSPORT=http) is available if needed.

Yes โ€” any website. Built-in providers: Google, GitHub, Facebook, generic. Custom providers: create via gv_create_provider for any site (your bank, internal apps, SaaS tools). Each profile holds sessions for all websites equally.

Once logged in, call gv_open_url with any URL โ€” the agent can navigate, click, fill forms, call APIs, and read pages.

Those are agent frameworks (they provide the LLMโ†”browser reasoning loop). Ghostvault is a tool provider โ€” it exposes browser tools via MCP that any agent framework (or plain Claude Desktop) can call. You can even combine them: use Ghostvault for the stealth Google sessions and let your favorite agent framework drive the pages.

Ghostvault uses Camoufox (Firefox/Juggler), while browser-use 0.13+ requires CDP (Chromium-only) โ€” so they don't directly interoperate, but they solve different problems.

Everything stays local under ~/.ghostvault/:

  • profiles/ โ€” per-account Camoufox profiles (cookies, localStorage, fingerprint lock)

  • logs/ghostvault.jsonl โ€” structured debug log

  • browserver.sqlite โ€” account metadata only (no sessions)

Nothing is ever sent to a remote server except the browser traffic itself (which exits via your home IP, or your configured proxy). Ghostvault has no telemetry, no analytics, no phone-home.

You need to sign in first. Tell the agent: "Sign in to [account name]". A browser window opens; complete Google login there. After that, the account is active and the browser tools work. See Typical first-time flow.


Troubleshooting

Symptom

Fix

Login window doesn't appear

Set GHOSTVAULT_HEADLESS=false in .env or your client config env block

gv_read_gmail returns empty

Gmail's DOM changes often โ€” fall back to gv_open_url to mail.google.com + gv_get_page_content with include_screenshot=true

"Session not authenticated"

The session expired โ€” re-run gv_sign_in for that account

Agent action had no effect

Call gv_get_logs and/or gv_screenshot to see what the browser shows

Install fails on camoufox fetch

Network issue โ€” retry with python -m camoufox fetch, or skip and run it later

Two windows for same account

Not possible โ€” Ghostvault enforces one context per account. Switch accounts instead.


Important notes

  • First-time login = new device. Google sees a new fingerprint/IP, so expect a 2FA challenge. This is one-time per account.

  • Local-first by default. Traffic exits via your home IP. If you move Ghostvault to a server, add a residential proxy and re-login.

  • One context per account. Ghostvault refuses to open two windows for the same profile (would corrupt it). Switch accounts instead.

  • Gmail scraping is best-effort. Gmail's DOM changes often; if gv_read_gmail returns empty, fall back to gv_open_url + gv_get_page_content with a screenshot.

  • Sessions are sensitive. Anyone with read access to ~/.ghostvault/ has full access to your Google accounts. Protect that directory โ€” or enable encryption at rest.

  • Camoufox โ‰  Firefox. Ghostvault downloads its own patched Camoufox browser (~120 MB) during install. You don't need to install Firefox separately; the two don't conflict.


Known issues

โš ๏ธ macOS Retina/HiDPI rendering (in progress): On Retina displays, the Camoufox browser window renders UI elements too large and content overflows (requires horizontal scrolling). This is a Camoufox upstream issue โ€” it affects the browser directly, not just Ghostvault. We are investigating workarounds. Non-Retina displays are unaffected.

Roadmap

Legend: ๐ŸŸข done ยท ๐Ÿ”ต in progress ยท โšช planned ยท ๐Ÿ good first issue ยท ๐Ÿ’› help wanted ยท ๐Ÿ’ฐ needs funding


v0.1-beta (current โ€” PyPI 0.1.x)

โš ๏ธ Beta software. All features below are done and shipped. API may change before v1.0. Known issues: Retina rendering + MCP timeout.

  • ๐ŸŸข Core: per-account persistent Camoufox profiles + locked fingerprints

  • ๐ŸŸข 42 MCP tools (accounts, lifecycle, browser, providers, API, scraping, debug, security)

  • ๐ŸŸข Published to PyPI โ€” pip install --pre ghostvault

  • ๐ŸŸข Provider-agnostic login โ€” built-in + custom providers, login scan, 3 login levels

  • ๐ŸŸข Session health check, API tools, anonymous scraping

  • ๐ŸŸข Advanced fingerprint config โ€” 105 Camoufox config keys + 10 device profiles

  • ๐ŸŸข Human-like interaction โ€” log-normal typing, typo+correction, hover, scroll

  • ๐ŸŸข Encryption at rest + private/public gate + profile recovery

  • ๐ŸŸข SDK client + GitHub Pages docs + one-click installer

  • ๐ŸŸข CI: lint + test + build + docs deploy + PyPI publish

v0.2 โ€” Stabilize (next โ€” when known issues are fixed)

  • ๐Ÿ”ต Fix macOS Retina/HiDPI rendering

  • ๐Ÿ”ต Fix MCP timeout for setup_password

  • โšช Community testing feedback โ†’ bug fixes

  • โšช API freeze (no breaking changes after this)

  • โšช gv_export_session / gv_import_session โ€” backup/restore

  • โšช gv_wait_for_element + gv_wait_for_navigation

  • ๐Ÿ Replace ad-hoc CSS selectors with a tested strategy

v0.3 โ€” Ecosystem (planned)

  • โšช More built-in providers (Microsoft, Apple, Twitter, LinkedIn)

  • โšช Per-site action packs (Gmail, Drive, Calendar, Notion, GitHub)

v1.0 โ€” Production (planned)

  • โšช Docker image + docker-compose

  • โšช Audit log (who did what, when)

  • โšช Rate limiting + concurrent account limits

  • โšช Plugin system for per-site action packs

  • โšช Independent security review ๐Ÿ’ฐ

v1.x+ โ€” Scale (ideas)

  • โšช Vision-based action suggestion (LLM looks at screenshot โ†’ proposes next action)

  • โšช Cloud-hosted option (managed Ghostvault as a service) ๐Ÿ’ฐ

  • โšช Mobile device profiles (iPhone Safari, Android Chrome)

  • โšช Proxy rotation per account

Contributing to the roadmap

  • Pick anything marked ๐Ÿ (good first issue) or ๐Ÿ’› (help wanted) โ€” open a PR.

  • Have a use case we're missing? Open a discussion.


Contributing

Contributions welcome! See CONTRIBUTING.md for setup, conventions, and how to add a new tool.

pip install -e ".[dev]"
pytest -q
ruff check .

Adding a tool

  1. Add the input model to src/ghostvault/inputs.py

  2. Add the logic to src/ghostvault/tools.py (raise ToolError for expected failures)

  3. Register it in src/ghostvault/server.py with @mcp.tool(name=..., annotations=...) and a thorough docstring

  4. Add a test under tests/

The fingerprint lock is an invariant โ€” any change that breaks it causes every account to look like a new device. tests/test_fingerprint.py guards it; keep it green.


Development

git clone https://github.com/mienetic/Ghostvault.git
cd Ghostvault
pip install -e ".[dev]"
python -m camoufox fetch   # one-time browser download
pytest -q                  # 17 unit tests
ruff check .               # lint

License

Apache 2.0 + Commons Clause โ€” free to use, modify, and distribute for personal, research, educational, and internal use. Selling the software as a product or service (SaaS, paid hosting, paid consulting) requires a commercial license.

What's allowed: internal use, research, education, consulting, modifying, forking.

What's not allowed (without commercial license): selling the software itself, offering it as a paid SaaS, bundling it into a paid product.

Disclaimer: The authors are not responsible for any misuse of this software. You are solely responsible for complying with all applicable laws and terms of service. See LICENSE for the full liability disclaimer.


โš ๏ธ Use responsibly. Ghostvault is a tool for managing your own accounts. Don't use it to access accounts you don't own, violate terms of service, or do anything illegal. You are responsible for how you use it.

Available Tools

42 tools
gv_api_callHTTP API Call (browser session)A

Make an HTTP request using the active account's browser session.

Uses the browser's cookies + TLS fingerprint, so the request looks identical to one made by the page itself. Bypasses cookie-based auth and TLS fingerprinting. Faster than navigating a page when you just need data from an API endpoint.

Args: method: HTTP method โ€” GET, POST, PUT, PATCH, DELETE. url: The absolute URL to request. headers: Optional dict of HTTP headers (e.g. {"Authorization": "Bearer ..."}). body: Optional request body. Dict/list โ†’ JSON-encoded automatically; string โ†’ sent as-is. use_session: If True (default), the browser's cookies + TLS are used. Set False to send a "clean" request (no cookies). timeout_ms: Request timeout in ms (default 30000).

Returns {status, status_text, headers, body, url}.

ParametersJSON Schema
NameRequiredDescriptionDefault
urlYes
bodyNo
methodYes
headersNo
timeout_msNo
use_sessionNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description details behavioral traits: uses browser's cookies and TLS fingerprint, bypasses auth and fingerprinting, and notes that body is auto-encoded for dict/list. Annotations only include openWorldHint=true, so the description carries the burden. It does not mention rate limits or potential side effects, but covers key aspects adequately.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and well-structured: a one-paragraph overview followed by an Args list and Returns line. No wasted words, front-loaded with purpose, and easy to scan.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 6 parameters, 2 required, and an output schema present, the description is complete. It explains all parameters, the return format (status, status_text, headers, body, url), and context for using the session. The output schema likely provides further detail, so description need not elaborate.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description compensates fully. It explains each parameter: method lists, url, headers, body (auto-encoding for dict/list, as-is for string), use_session (purpose), and timeout_ms (default). This adds significant meaning beyond the bare schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Make an HTTP request using the active account's browser session.' It distinguishes itself from sibling tools like gv_open_url (navigation) and gv_eval_js (JavaScript execution) by specifying that it uses cookies and TLS fingerprint, and is faster for API data retrieval.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explains when to use the tool: when you need API data using the browser's session, bypassing cookie-based auth and TLS fingerprinting. It compares to navigating a page and highlights the speed advantage. It also allows turning off session via use_session. However, it could be more explicit about when not to use or list alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

gv_check_sessionCheck Session HealthA
Read-only

Check whether the account's browser session is still authenticated.

Uses a 2-layer check: cookie expiry (fast) + probe URL redirect (accurate). Returns the health status (active / likely_active / expired / unknown), a reason, and the recommended action.

The browser context must be open (call gv_open_account first) for an accurate check. If closed, returns 'unknown'.

Args: account_id: The account id to check. Omit to check the active account.

ParametersJSON Schema
NameRequiredDescriptionDefault
account_idNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations indicate readOnlyHint=true, and the description does not contradict. It adds behavioral context by describing the two-layer check (cookie expiry + probe URL redirect) and the return fields, which is helpful beyond annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is around 10 sentences with clear sections for return values and args. Each sentence adds value without excessive verbosity. Could be slightly more concise, but structure is good.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the presence of an output schema (not shown but indicated), the description covers return fields and provides necessary context for using the tool. It adequately addresses the complexity of a session health check.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The single optional parameter account_id is explained in the description: 'The account id to check. Omit to check the active account.' This adds meaning beyond the schema default of null and clarifies behavior.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool checks if the browser session is authenticated, with a specific verb and resource. However, it does not differentiate from the sibling tool 'gv_get_session_status', which may have similar functionality, preventing a higher score.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states the browser context must be open (calling gv_open_account first) for an accurate check, and mentions behavior when closed. It also explains when to omit account_id. No explicit when-not-to-use, but clear guidance is provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

gv_click_elementClick ElementA

Click an element on the current page by visible text or CSS selector.

Text matching is case-insensitive and substring-based (preferred). If no text matches, the target is tried as a CSS selector. After clicking, waits for the page to settle and returns a preview of the new page.

Args: target: Visible text of the element (preferred) OR a CSS selector. timeout_ms: Max wait time in ms (default 10000). humanize: When true, hover briefly before clicking + jitter the click point. Defaults to the account's humanize_clicks setting (off if unset). Recommended for anti-bot-sensitive sites. delay_after_ms: Pause for a randomized ~this many ms after the click (0.7ร—โ€“1.3ร— spread). 0 = no delay.

DECISION GUIDE โ€” when to set humanize=true: โ€ข Google / SSO login buttons ("Next", "Sign in") โ†’ ALWAYS โ€ข Captcha-protected pages (reCAPTCHA, Cloudflare) โ†’ ALWAYS โ€ข Form submit buttons on banking / payments โ†’ ALWAYS โ€ข Search buttons, nav links on trusted sites โ†’ optional (can skip) โ€ข One-time quick clicks in a familiar dashboard โ†’ can skip

Note: If the account's humanize_policy is "always", humanize is forced on regardless of what you pass here.

Returns the clicked target, whether humanize was applied, and a page preview.

ParametersJSON Schema
NameRequiredDescriptionDefault
targetYes
humanizeNo
timeout_msNo
delay_after_msNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Discloses text matching (case-insensitive, substring), fallback to CSS selector, post-click wait for page settle, and humanize override behavior. Does not contradict annotations (openWorldHint). Minor omission: whether it scrolls element into view.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Well-organized with sections, front-loaded purpose. The decision guide is valuable but adds length; no redundant sentences. Could be slightly tighter.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers main workflow and parameters, and mentions output (target, humanize applied, page preview). Missing error handling details (e.g., element not found, timeout). Adequate for typical usage but not exhaustive.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Despite 0% schema coverage, the description fully explains all four parameters: target (visible text vs CSS), timeout_ms (default), humanize (boolean, default null, with actionable guidance), and delay_after_ms (randomized range).

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool clicks an element on the current page via visible text or CSS selector. It is unambiguous but does not explicitly differentiate from sibling tools like gv_fill_input or gv_scroll.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides a detailed decision guide for when to set humanize=true, covering login buttons, captchas, form submits, and trusted sites. However, lacks general guidance on when to choose this tool over alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

gv_close_accountClose Google Account BrowserA

Close the running browser context for an account (keeps its session saved).

The persistent profile stays on disk, so reopening reuses the same login. Use this to free resources when done with an account.

Args: account_id: The account id to close.

ParametersJSON Schema
NameRequiredDescriptionDefault
account_idYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Discloses key behavior: preserves persistent profile on disk so reopening reuses login. No annotations provided, so description carries full burden; it effectively communicates the non-destructive nature and resource impact.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Highly concise: three brief sentences plus a simple arg description. The first sentence immediately states the core purpose, and no redundant information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple tool with one parameter and an output schema, the description covers the essential behavioral details (closing, session preservation, reuse). No gaps given the tool's simplicity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The only parameter, account_id, is described as 'The account id to close', which adds minimal value beyond the parameter name. Schema coverage is 0%, so the description should provide more detail (e.g., format, how to obtain it).

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states it closes the browser context for an account while preserving session. Differentiates from sibling tools like gv_delete_account (destructive) and gv_logout (session end) by specifying that the session is saved.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says 'Use this to free resources when done with an account', providing clear when-to-use guidance. Lacks explicit when-not-to-use or alternative suggestions, but the context is sufficient.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

gv_close_ephemeralClose Anonymous Browser SessionA
Destructive

Close an ephemeral session and free its resources.

Removes the tempdir + tears down the browser process. If the closed session was the active target, the active slot falls back to another running context (or None).

Args: session_id: The session id from gv_open_ephemeral. Omit to close the currently-active session.

Returns the closed id + the new active target.

ParametersJSON Schema
NameRequiredDescriptionDefault
session_idNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations indicate destructiveHint=true; the description adds context about what gets destroyed (tempdir, browser process) and the fallback behavior for the active slot. This goes beyond annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise with a one-line summary followed by necessary details. Every sentence adds value, with no redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (one optional parameter), the description covers usage, behavior, and output (closed id and new active target). An output schema exists but the description complements it.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, but the description explains that session_id comes from gv_open_ephemeral and that omitting it closes the active session. This adds essential meaning beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Close an ephemeral session' with specific verb and resource. It distinguishes from sibling tools like gv_check_session and gv_get_session_status by focusing on closure.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explains when to use the tool (close ephemeral session) and provides guidance on omitting session_id to close the active one. It mentions fallback behavior but does not explicitly contrast with alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

gv_create_accountCreate Google Account SlotA
Destructive

Create a new managed account slot with a locked fingerprint + advanced config.

Generates a fresh, pinned fingerprint + empty persistent profile. The account is NOT signed in yet โ€” call gv_sign_in next to open a login window.

Args: name: Human label for the account (e.g. "Work"). os: Pinned fingerprint OS โ€” "windows" | "macos" | "linux". Defaults to server config (or the device profile's recommended OS if device_profile is set). proxy: Optional Playwright-style proxy dict for this account only. provider: Identity provider โ€” "google" (default), "github", etc. preset: Bundle of advanced-config defaults โ€” "balanced" (default) | "stealth" | "minimal". Explicit params below override the preset. locale: Locale(s) for Intl + Accept-Language, e.g. "en-US" or ["en-US","en"]. When set, overrides geoip-based locale matching. timezone: IANA timezone, e.g. "America/New_York". When set, overrides geoip. humanize: Human-like cursor movement. True (default in balanced) | False | float (max seconds for the move). block_webrtc: Block WebRTC to prevent IP leak. True | False | "auto" (auto = block only when a proxy is set; the preset default). block_webgl: Disable WebGL entirely. Some sites break; use sparingly. webgl_config: [vendor, renderer] pair to spoof, e.g. ["Apple Inc.", "Apple GPU"]. fonts: List of installed font family names to inject (on top of OS defaults). addons: List of paths to extracted Firefox addon dirs (must have manifest.json). disable_coop: Disable Cross-Origin-Opener-Policy โ€” needed for some captcha/turnstile iframes. (stealth preset sets this.) block_images: Block all image loading. Faster but visually inconsistent. device_profile: A realistic hardware template that fills in ~15 Camoufox config keys at once (screen size, GPU vendor/renderer, media-device counts, battery level, audio sample rate). One of: macbook-pro-14-m2, macbook-air-13-m1, imac-24, windows-desktop-rtx, thinkpad-x1-carbon, surface-laptop-5, linux-workstation, dell-xps-13-ubuntu, generic-laptop, headless-server. Recommended for maximum fingerprint consistency. device_config: Raw dict of Camoufox config-domain keys (battery:, mediaDevices:, navigator.hardwareConcurrency, ...) to override or augment the chosen device_profile. See the Advanced Configuration docs for the full ~100-key schema.

Returns the new account id, resolved config, and any consistency warnings.

ParametersJSON Schema
NameRequiredDescriptionDefault
osNo
nameYes
fontsNo
proxyNo
addonsNo
localeNo
presetNobalanced
humanizeNo
providerNogoogle
timezoneNo
block_webglNo
block_imagesNo
block_webrtcNo
disable_coopNo
webgl_configNo
device_configNo
device_profileNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses that the tool generates a fresh pinned fingerprint and persistent profile but does not sign in, which is consistent with its purpose. Annotations include destructiveHint: true, but creating an account slot is not inherently destructive; the description does not contradict annotations, but it adds useful context about the creation process and return values.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with a header, summary paragraph, and detailed argument list. However, it is verbose with lengthy parameter explanations that could be trimmed slightly without losing clarity. Still, it is efficiently written for the complexity involved.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with 17 parameters, no schema descriptions, and an output schema (though not detailed here), the description covers all parameters comprehensively and mentions return values (account id, resolved config, warnings). It is fully complete for an AI agent to understand and invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description compensates fully by explaining every parameter's purpose, defaults, and allowed values (e.g., 'os: Defaults to server config', 'humanize: True (default in balanced) | False | float'). This adds significant value beyond the bare schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Create a new managed account slot with a locked fingerprint + advanced config' and distinguishes it from sibling tools like gv_sign_in by explicitly noting the account is not signed in yet. This makes the primary purpose and its specific role clear.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly guides the user to call gv_sign_in next, indicating a sequential workflow. However, it does not explicitly mention when not to use this tool (e.g., if an account already exists or for other scenarios), missing some exclusionary guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

gv_create_providerCreate Custom ProviderA
Destructive

Create a custom login provider recipe for any website.

Once created, use it with gv_create_account(provider=name) or gv_sign_in(account_id, provider=name). The provider recipe is stored in ~/.ghostvault/providers.json and shared across all accounts.

Args: name: Unique provider name (e.g. "my_bank"). Cannot shadow built-ins. login_url: The URL to navigate to for login (e.g. "https://app.example.com/login"). success_url_fragments: URL fragments indicating login succeeded (e.g. ["app.example.com/dashboard"]). auth_cookie_names: Cookie names that prove authentication (e.g. ["session_id"]). auth_cookie_domain: The domain to read auth cookies from (e.g. "https://app.example.com"). logout_url: Optional direct logout URL. If None, user must logout manually. session_probe_url: Optional URL to check if session is still valid. login_url_fragments: URL fragments indicating redirect to login (session expired). description: Human-readable description of this provider.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYes
login_urlYes
logout_urlNo
descriptionNo
auth_cookie_namesYes
session_probe_urlNo
auth_cookie_domainYes
login_url_fragmentsNo
success_url_fragmentsYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations indicate 'destructiveHint: true', and description does not contradict. Adds context about persistent storage in ~/.ghostvault/providers.json and sharing across accounts, but lacks details on potential conflicts or error conditions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Description is well-structured with clear front-loaded purpose and organized Args section. Code snippets are helpful; slightly verbose but each sentence adds value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 9 parameters and 5 required, description covers all parameters and explains their roles. References output schema exists, so return values not needed. Mentions storage and usage across accounts, making it complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, but the description provides detailed parameter explanations, including optional ones with defaults, adding critical meaning beyond the schema structure.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Specific verb 'Create' and resource 'custom login provider recipe'. Distinguishes from siblings like gv_delete_provider and gv_get_provider by stating it's for creation. Includes important constraint 'Cannot shadow built-ins.'

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states how to use the created provider with gv_create_account and gv_sign_in, providing context. Mentions storage location but does not explicitly state when not to use this tool versus alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

gv_delete_accountDelete Google Account (remove all data)A
Destructive

Delete an account and all its data from Ghostvault.

Removes the profile directory, encrypted archive (if any), fingerprint file, and the DB row. Cannot delete a running account โ€” lock/close it first. This does NOT sign the account out of Google; use gv_sign_out first if you want to invalidate the session server-side.

Args: account_id: The account id to delete.

ParametersJSON Schema
NameRequiredDescriptionDefault
account_idYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the destructiveHint annotation, description details exactly what is removed (profile directory, encrypted archive, fingerprint file, DB row) and prerequisite (account must not be running). No contradiction.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Every sentence adds unique value: deletion scope, what is removed, prerequisite, related sign-out note. No redundancy or fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers all necessary aspects for a destructive tool: effects, prerequisites, and related operations. Output schema exists so return values are not required in description.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema has 0% description coverage for the single parameter. Description adds 'The account id to delete' but lacks format or constraints. Minimal but adequate for a single string parameter.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Title and description clearly state deletion of account and all its data. Distinguishes from sibling tools like gv_close_account, gv_lock_account, gv_create_account by specifying irreversible removal.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states when NOT to use: 'Cannot delete a running account โ€” lock/close it first.' Also directs to use gv_sign_out if session invalidation is needed, providing clear alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

gv_delete_providerDelete Custom ProviderA
Destructive

Delete a custom provider. Built-in providers cannot be deleted.

Args: name: The provider name to delete.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotation destructiveHint=true already signals destruction. Description adds that it deletes custom providers and that built-in cannot be deleted, providing useful context beyond the annotation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Extremely concise: two sentences and an Args section. No wasted words; every sentence adds value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers main action and key constraint (built-in providers not deletable). With an output schema present, return values are likely covered. Adequate for a simple delete tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Only parameter 'name' has no schema description. Description provides meaning: 'The provider name to delete.' This adds value beyond the schema's title alone.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clear verb 'delete' and resource 'custom provider' with distinction from built-in providers. Distinct from sibling tools like gv_create_provider and gv_update_provider.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

States when NOT to use (for built-in providers cannot be deleted). Implicitly suggests use for custom providers only. Does not explicitly name alternatives but context is clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

gv_detect_login_optionsDetect Login Options on PageA
Read-only

Scan the current page (or a URL) for available login options.

Detects SSO buttons (Google, GitHub, Facebook, etc.), username/password form fields, 2FA/OTP fields, and captcha. Returns a recommendation on which login path to take.

Use this BEFORE gv_sign_in when you're not sure what the page offers โ€” it helps the agent decide whether to auto-fill, click an SSO button, or let the user log in manually.

DECISION GUIDE โ€” what to do with the result:

  • recommendation="sso:google" โ†’ click the SSO button for that provider

  • recommendation="form" โ†’ use gv_sign_in with stored credentials

  • recommendation="ask_user" โ†’ multiple SSO options found; ASK the user which provider they want to use

  • recommendation="manual" โ†’ no form/SSO detected; let user do it manually (the browser window is already open)

In ALL cases, the session is saved automatically โ€” the user only needs to log in once per account.

Args: url: Optional URL to navigate to before scanning. If omitted, scans the current page.

ParametersJSON Schema
NameRequiredDescriptionDefault
urlNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations declare readOnlyHint=true, and the description adds that the tool only scans and returns a recommendation, with no side effects. It also notes that the session is saved automatically, providing useful behavioral context beyond annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with clear sections and front-loaded key info. It is somewhat lengthy but every sentence adds value; no redundancy. Could be slightly trimmed without losing clarity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a one-parameter tool with an output schema (implied), the description covers all necessary aspects: purpose, usage decision guide, parameter semantics, and behavioral notes. It is fully self-contained and actionable.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Despite 0% schema description coverage, the description fully explains the single parameter 'url': it is optional, navigates to that URL first, or scans the current page if omitted. This adds clear meaning beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it scans the page for login options and returns a recommendation. It uses specific verbs ('Scan', 'Detects', 'Returns') and distinguishes from sibling gv_sign_in by stating usage before that tool.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says 'Use this BEFORE gv_sign_in when you're not sure what the page offers' and provides a complete decision guide mapping recommendations to actions, including alternatives like asking the user.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

gv_eval_jsEvaluate JavaScript in PageA

Run JavaScript in the active page and return the result.

Use cases:

  • Extract CSRF tokens: document.querySelector('meta[name=csrf-token]').content

  • Call site JS: window.app.generateSignature(payload)

  • Read state: localStorage.getItem('auth_token')

  • Read hidden fields: document.querySelector('#token').value

The script can be an expression or a function. If arg is provided, it's passed as the first parameter to a function script.

Args: script: JS expression or arrow function. arg: Optional argument to pass to a function script.

Returns whatever the JS evaluates to.

ParametersJSON Schema
NameRequiredDescriptionDefault
argNo
scriptYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description mentions executing JavaScript in the page, implying side effects, but does not elaborate on potential risks (e.g., page modifications, error handling, async behavior). With 'openWorldHint: true' in annotations, the description adds modest context but could be more forthcoming about behavioral traits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and well-structured: a one-line summary followed by bulleted use cases and clear parameter explanations. Every sentence adds value without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity of executing arbitrary JavaScript, the description covers the main functionality, argument usage, and return value. It does not discuss error handling or security implications, but the presence of an output schema (not shown) reduces the need for return value details. Slightly more completeness would be ideal.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Despite 0% schema description coverage, the description adds critical meaning: 'script' is defined as a 'JS expression or arrow function' and 'arg' as an 'Optional argument to pass to a function script.' This fully compensates for the lack of schema descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Run JavaScript in the active page and return the result' with specific, concrete use cases (e.g., extracting CSRF tokens, reading localStorage). This uniquely identifies the tool and distinguishes it from sibling tools like gv_get_page_content or gv_fill_input.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit use cases and examples, guiding when to use the tool (e.g., extracting values, calling site functions). However, it does not explicitly state when not to use it or offer alternatives, which would improve clarity for the agent.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

gv_fill_inputFill Input FieldA

Fill a form input on the current page.

Tries to find the input by its label text first (case-insensitive, substring match), falling back to a CSS selector.

By default this uses Playwright's instant paste (fast, but detectable). Set humanize=true to type one character at a time with a realistic log-normal cadence + optional typos โ€” strongly recommended for Google login forms and any anti-bot-protected input.

Args: target: Visible label text of the field (preferred) OR a CSS selector. value: The text to type into the field. timeout_ms: Max wait time in ms (default 10000). humanize: Type char-by-char with realistic cadence. Defaults to the account's humanize_typing setting (off if unset). typing_speed_wpm: Target words-per-minute (40=slow, 90=avg, 150=fast). Defaults to the account's default_typing_wpm or 90. typing_variance: Cadence spread 0โ€“1 (0=constant, 0.35=realistic, 1=erratic). Default 0.35. mistake_rate: Chance per char to typo-then-correct (0โ€“0.05). Produces realistic Backspace events. Default 0 (off). delay_after_ms: Pause for a randomized ~this many ms after typing.

DECISION GUIDE โ€” when to set humanize=true: โ€ข Google / SSO login forms (email, password) โ†’ ALWAYS (instant paste is the #1 bot detection tell) โ€ข Captcha-protected form fields โ†’ ALWAYS โ€ข Banking / payment forms โ†’ ALWAYS โ€ข 2FA / OTP code fields โ†’ optional (short codes, paste is fine) โ€ข Search boxes on trusted sites (Gmail, Drive) โ†’ optional โ€ข Quick one-off inputs in a familiar dashboard โ†’ can skip

Recommended values by scenario: โ€ข Login email: humanize=true, wpm=85, variance=0.4, mistakes=0.02 โ€ข Login password: humanize=true, wpm=65, variance=0.5, mistakes=0.0 โ€ข Long form: humanize=true, wpm=90, variance=0.35, mistakes=0.01 โ€ข Search box: humanize=false (or omit)

Note: If the account's humanize_policy is "always", humanize is forced on regardless of what you pass here.

Returns the target, char count, and whether humanize was applied.

ParametersJSON Schema
NameRequiredDescriptionDefault
valueYes
targetYes
humanizeNo
timeout_msNo
mistake_rateNo
delay_after_msNo
typing_varianceNo
typing_speed_wpmNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description extensively discloses behavioral traits: instant paste vs humanize typing, account policy overrides, return values, and detectability. Annotations only provide openWorldHint, so the description carries the full burden and meets it excellently.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with sections for arguments, decision guide, and notes. It is somewhat lengthy but every section adds value. The front-loaded purpose and organized layout aid scanning.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity (8 parameters, output schema exists), the description is complete. It covers all parameter semantics, usage context, behavioral details, and return values. No gaps are evident.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description fully explains all 8 parameters, including defaults, recommended values by scenario, and the effect of account-level settings. This adds significant meaning beyond the bare schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Fill a form input on the current page' with a specific verb and resource. It distinguishes itself from siblings like gv_click_element and gv_open_url by focusing on input field filling.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

While the description does not explicitly compare to alternatives, it provides clear context on how the tool finds inputs (label text then CSS selector) and includes a Decision Guide for when to set humanize=true. The implied use case is sufficiently clear for agents.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

gv_get_auth_statusGet Auth StatusA
Read-only

Check whether the private/public password gate is active and unlocked.

Returns gate_enabled (bool), unlocked (bool), and a human-readable message. If no password has been set, the gate is off and all profiles are public.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, indicating a safe read operation. The description adds detailed behavioral context: it returns three specific fields (gate_enabled, unlocked, message) and describes the special case when no password is set ('gate is off and all profiles are public'). This goes beyond annotations and fully informs the agent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise: two sentences, both front-loaded. The first sentence states the purpose, the second specifies return values and edge case. Every sentence adds value without waste.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (0 parameters, no complex logic), the description fully covers what the agent needs: purpose, return type, and behavior in the default and edge cases. Annotations and output schema exist, so no further detail is necessary.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There are no parameters, so the input schema is trivially covered (100%). The description does not need to add parameter details. Baseline for 0 parameters is 4, and the description meets that without any redundant or missing info.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: checking the status of a password gate ('active and unlocked'). It uses a specific verb ('Check') and resource, and the title 'Get Auth Status' reinforces this. Among 39 sibling tools, none overlap directly, so no confusion.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use the tool (to check auth gate status), but does not provide explicit guidance on when not to use it or mention alternatives among siblings (e.g., gv_unlock, gv_setup_password). Context is clear but lacks exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

gv_get_cookiesRead Browser CookiesA
Read-only

Read cookies from the active browser context.

Cookie values longer than 20 chars are masked for security. Use this for debugging sessions or understanding what the site has set.

Args: domain: If set, only cookies matching this domain are returned. If omitted, all cookies are returned.

ParametersJSON Schema
NameRequiredDescriptionDefault
domainNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotation readOnlyHint=true indicates a safe read operation. The description adds behavioral context: 'Cookie values longer than 20 chars are masked for security', which is beyond what annotations provide. Also specifies scope ('from the active browser context'). No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is short and front-loaded with the purpose. It uses a structured 'Args' section for parameter details. Every sentence adds value, with no unnecessary words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers purpose, usage scenario, a key behavioral trait (masking), and parameter semantics. An output schema exists (not shown), so return values need not be detailed. For a simple read tool with two states (with or without domain), this is sufficiently complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has one optional parameter 'domain' with 0% description coverage. The description clearly explains its effect: 'If set, only cookies matching this domain are returned. If omitted, all cookies are returned.' This adds meaningful guidance beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Read cookies from the active browser context', which is a specific verb ('Read') and resource ('cookies from the active browser context'). It distinguishes from sibling tools like gv_get_page_content (content) and gv_check_session (session/auth status).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description suggests using the tool 'for debugging sessions or understanding what the site has set', providing clear context. While it does not explicitly exclude alternatives, the sibling list shows no other cookie-reading tool, making the guidance adequate.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

gv_get_credentialsShow Stored Credential KeysA
Read-only

Show which credential keys are stored for an account (values are masked).

Args: account_id: The account id.

ParametersJSON Schema
NameRequiredDescriptionDefault
account_idYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate readOnlyHint=true, so the description adds value by specifying that values are masked. This goes beyond the annotation and provides behavioral insight. However, no other side effects or limitations are disclosed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise with only two sentences and a parameter line. It front-loads the purpose and avoids unnecessary words. Every sentence provides value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (one required parameter, read-only, with output schema), the description covers the essential behavioral aspect (masking). It does not explain the return format but that is expected from the output schema. Slightly incomplete due to lack of parameter detail but sufficient for minimal context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description restates the parameter name 'account_id' with 'The account id.', adding no additional meaning beyond the schema. Since schema coverage is 0%, the description fails to compensate with details like format or examples.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Show which credential keys are stored for an account (values are masked)', providing a specific verb (show) and resource (credential keys) with an important detail about masking. This distinguishes it from sibling tools like gv_set_credentials or gv_delete_account.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage when needing to see stored credential keys, but lacks explicit guidance on when not to use it or alternatives. No prerequisites or exclusions are mentioned, which is acceptable for a simple read tool but not actively helpful.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

gv_get_logsGet Debug LogsA
Read-only

Return the most recent debug log entries (for troubleshooting).

Each entry records a tool call / browser action with timestamp, account, action, status, duration, and error info. Use this when something isn't working and you need to see what happened.

Args: n: Number of recent entries to return (default 50, max 500).

ParametersJSON Schema
NameRequiredDescriptionDefault
nNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds value beyond the readOnlyHint annotation by detailing the content of log entries (timestamp, account, action, status, duration, error info). It is consistent with the annotation and does not contradict.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise, front-loaded with the purpose, and includes only necessary details. Every sentence contributes to understanding.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple read tool with one parameter and an output schema, the description is complete. It clearly explains what the tool returns and when to use it.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description documents the single parameter 'n' with default and max (500), which the schema does not fully cover (only default). This compensates for the 0% schema description coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Return the most recent debug log entries (for troubleshooting)', specifying the verb and resource. The sibling tools are all distinct actions, so this tool is uniquely identified.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly says 'Use this when something isn't working and you need to see what happened', providing clear guidance on when to use. It does not mention alternatives or when not to use, but the context is sufficient.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

gv_get_page_contentGet Page Content (text + optional screenshot)A
Read-only

Read the current page's text content, optionally with a screenshot.

Set include_screenshot=true to ALSO receive an image of the page so you can SEE the layout โ€” use this when text alone isn't enough (captcha, image buttons, complex visual structure).

Args: include_screenshot: If true, append a PNG image of the viewport. max_chars: Max characters of page text (default 20000).

ParametersJSON Schema
NameRequiredDescriptionDefault
max_charsNo
include_screenshotNo

TDQS

A4.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark readOnlyHint=true, so description doesn't need to emphasize safety. It adds context about screenshot benefits but does not cover potential limitations like page load timing or character limits beyond the default.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Extremely concise: three short sentences plus parameter docs. Front-loaded with core purpose, then usage note, then parameter details. No fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers all critical aspects: what it reads, optional image, usage guidance, and parameter meanings. Lacks output format description, but given no output schema and simple read operation, it is reasonably complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema has 0% coverage, but description compensates by explaining include_screenshot's purpose and specifying max_chars as max characters. This adds meaningful guidance beyond the schema's type and default.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Read' and the resource 'current page's text content', with an optional screenshot. It distinguishes itself from sibling tools like gv_screenshot and gv_get_page_links by specifying the exact scope.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit guidance on when to set include_screenshot=true (captcha, image buttons, complex visual structure). However, it does not directly contrast with alternatives like gv_screenshot for standalone image capture, missing a clear 'when not to use'.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

gv_get_providerGet Provider DetailsA
Read-only

Show one provider's full configuration (login URL, cookies, etc.).

Args: name: The provider name (built-in or custom).

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark readOnlyHint true; description adds that it returns full configuration with examples (login URL, cookies), providing context beyond the annotation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Very concise, front-loaded with the action, and includes a structured Args section with no wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given there is an output schema (unseen), the description adequately describes the return value (full configuration) and examples, but could mention it returns only one provider's details.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema lacks descriptions (0% coverage), but the description's 'Args:' section explains the single 'name' parameter effectively, adding meaning over the schema alone.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool shows one provider's full configuration, including login URL and cookies, distinguishing it from listing tools like gv_list_providers.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It is clear that this tool is for retrieving details of a specific provider by name, but it does not explicitly say when not to use it (e.g., for listing all providers).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

gv_get_session_statusGet Google Session StatusB
Read-only

Check whether an account's browser session is running and authenticated.

If account_id is omitted, checks the active account.

Returns: id, name, email, running, active, status, last_login_at.

ParametersJSON Schema
NameRequiredDescriptionDefault
account_idNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

ReadOnlyHint annotation already indicates safe read. Description adds return field list (id, name, email, etc.), which is useful but not behavioral beyond what annotations imply.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences covering purpose, parameter behavior, and return fields. No extraneous information, front-loaded with main action.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Includes return field list, which covers output expectations. With output schema available, it is mostly complete. Could mention error cases or what happens if session doesn't exist, but not critical.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so description must compensate. It explains that omitting account_id checks the active account, adding meaning. However, it doesn't describe the format or constraints of account_id, leaving it partially ambiguous.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States 'Check whether an account's browser session is running and authenticated', which is a clear verb+resource. However, sibling tool 'gv_check_session' exists and is not differentiated, so purpose is clear but not distinguished.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool vs alternatives like 'gv_check_session'. The hint about account_id omission is helpful but does not provide usage context or exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

gv_list_accountsList Google AccountsA
Read-onlyIdempotent

List all managed accounts and which one is currently active.

Returns each account's id, label, email, status (created/logging_in/active/ failed), whether a browser context is running, and the active account id. Use this first to discover account ids before calling other tools.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and idempotentHint=true, so the safety profile is clear. The description adds valuable behavioral details beyond annotations: it lists the exact fields returned (id, label, email, status, browser context running, active account id), which helps the agent understand the output without needing to inspect the output schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise: three sentences covering purpose, output details, and usage hint. Every sentence adds value, and there is no fluff or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (no parameters, safe read operation), the description is complete. It explains what the tool does, what it returns, and provides a key usage hint. The presence of an output schema does not reduce the need for the description, and the description complements it well.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has no parameters, so the description does not need to provide parameter semantics. With 0 parameters and 100% schema coverage, the baseline is 4, and the description adds no redundant information.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses specific verbs (List, discover) and resources (managed accounts, active account). It clearly states the tool's output (id, label, email, status, etc.) and distinguishes itself from sibling tools like gv_create_account or gv_delete_account.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly says 'Use this first to discover account ids before calling other tools,' which provides clear when-to-use guidance. It does not explicitly mention when not to use, but given the simplicity of the tool and lack of direct alternatives among siblings, this is sufficient.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

gv_list_providersList All ProvidersA
Read-onlyIdempotent

List all providers (built-in + custom) with capability flags.

Returns each provider's name, max_login_level, needs_credentials, has_logout_url, has_session_probe, is_builtin, and description.

Built-in providers: google, github, facebook, generic.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark the tool as readOnly and idempotent. The description adds value by detailing the returned fields (name, max_login_level, etc.) and listing built-in providers, providing behavioral context beyond the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise with two sentences plus a short list. It front-loads the main action and returns fields. No unnecessary words, though the list format could be slightly more structured.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no parameters, strong annotations (readOnly, idempotent), and presence of an output schema, the description is fully complete. It explains what is returned and gives examples, leaving no gaps for effective use.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has no parameters (0 params, 100% schema coverage). Per guidelines, baseline score for 0 parameters is 4. The description appropriately focuses on output rather than parameters.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states it lists all providers (built-in and custom) with capability flags, and distinguishes from sibling tools like gv_get_provider (single provider) and gv_create_provider. The specific verb 'list' and resource 'providers' are explicit.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description does not explicitly state when to use this tool versus alternatives like gv_get_provider. Usage context is implied by the name 'list all', but no explicit when-to-use or when-not-to-use guidance is provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

gv_lock_accountLock Google Account (close + re-encrypt)A

Lock an account โ€” close the browser and re-encrypt its profile.

The saved session is KEPT, so reopening (gv_open_account) works without re-login. This is the manual version of auto-lock. Use it when you're done with an account for now but want to come back to it later without re-authenticating.

Args: account_id: The account id to lock.

ParametersJSON Schema
NameRequiredDescriptionDefault
account_idYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It discloses that the saved session is kept and that reopening works without re-login, and notes it is the manual version of auto-lock. However, it does not mention any side effects (e.g., impact on tabs, ongoing processes) or rate limits, leaving gaps in comprehensive behavioral disclosure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and front-loaded with the core action. The 'Args:' section is somewhat redundant given the single parameter, but overall it is well-structured and efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has only one required parameter and no enums, the description adequately covers purpose and usage. However, since an output schema is present, the description could mention what the tool returns to ensure full completeness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description simply repeats 'The account id to lock' for the single parameter account_id, which adds minimal value beyond the schema's title 'Account Id'. With 0% schema description coverage, the description should provide more context about acceptable values or format but does not.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Lock an account โ€” close the browser and re-encrypt its profile.' It uses a specific verb and resource, and distinguishes from siblings like gv_close_account and gv_unlock by explaining that the session is preserved for later reopening without re-login.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly says 'Use it when you're done with an account for now but want to come back to it later without re-authenticating.' This provides clear context for when to use the tool. However, it does not mention when not to use it or explicitly compare with alternatives like gv_logout or gv_close_account.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

gv_logoutLock Private Profiles (Logout)A

Lock the private/public gate.

Closes any open private browser contexts and switches the active account to the first available public profile (or none). Private profiles become hidden again until you call google_unlock.

This does NOT sign you out of Google โ€” it only locks Ghostvault's gate.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description fully discloses behavior: closing private contexts, switching to a public profile, and explicitly stating it does not sign out of Google. It also explains the effect on private profiles becoming hidden until unlocked. This is comprehensive for a zero-parameter tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences, no wasted words. The most important action ('Lock the private/public gate') is front-loaded. Each sentence adds distinct value: function, process, and caveat.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given zero parameters and the existence of an output schema (not shown but present), the description is complete. It explains the effect, what happens to private profiles, and how to unlock. No gaps remain for an agent to interpret.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has no parameters, so the baseline is 4. The description does not need to add parameter information, and it correctly focuses on behavior and context. The schema coverage is 100% (trivially), so no additional detail is needed.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses specific verbs ('Lock', 'closes', 'switches') and resources ('private/public gate', 'private browser contexts', 'active account'). It clearly distinguishes this tool from siblings like gv_sign_out (signing out of Google) and gv_unlock (reversing the lock), stating explicitly what it does and does not do.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use this tool (to lock private profiles) and mentions that gv_unlock can reverse it. However, it does not explicitly state when not to use it or list alternative tools for similar operations, though the context of sibling tools provides some implicit guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

gv_make_privateMake Profile PrivateA

Mark a profile as private (hidden when the gate is locked).

Requires the password gate to be active (call google_setup_password first).

Args: account_id: The account id to make private.

ParametersJSON Schema
NameRequiredDescriptionDefault
account_idYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It discloses the core effect (profile becomes private/hidden) and the prerequisite (password gate active). However, it does not describe idempotency, side effects, error states, or what happens if the gate is not active. Additional details on return values (output schema exists but not detailed) or authentication needs would improve transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is exceptionally concise: two sentences and an args line. It front-loads the purpose with the condition, then provides the prerequisite. There is no irrelevant information, making it easy for an AI agent to quickly grasp the tool's function.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has an output schema (not shown), so return values need not be described. However, the description does not mention that the action is reversible via gv_make_public, nor does it specify behavior if the profile is already private. Given the complexity (simple mutation with one parameter), the description is adequate but lacks a nod to related siblings and edge cases.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, and the description only adds a brief explanation: 'account_id: The account id to make private.' This is minimal and does not provide format, source, or examples. The description should compensate for the lack of schema description, but it only adds a marginal clarification.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Mark a profile as private (hidden when the gate is locked).' It uses a specific verb ('mark') and identifies the resource ('profile'). The explanation of the condition ('when the gate is locked') distinguishes it from sibling tools like gv_make_public, which does the opposite.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly provides a prerequisite: 'Requires the password gate to be active (call google_setup_password first).' This tells the agent when to use this tool (after setting up password gate) and implies a sequence. It does not, however, mention exclusions or alternative tools for different scenarios.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

gv_make_publicMake Profile PublicB

Mark a profile as public (accessible without unlocking).

Args: account_id: The account id to make public.

ParametersJSON Schema
NameRequiredDescriptionDefault
account_idYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

B3.3/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must disclose behavioral traits. It only says 'make public' but doesn't mention side effects, error conditions, or prerequisites (e.g., profile must exist). Minimal disclosure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Description is extremely concise: one-line purpose followed by parameter explanation. No wasted words; front-loaded with key information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Tool is simple with one parameter and an output schema. Description explains what it does and the parameter, but lacks mention of preconditions (e.g., profile existence) or effects. Adequate but not fully complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, and description adds 'The account id to make public.' This provides some meaning beyond the schema's 'Account Id' but remains basic. For a single parameter, this is adequate but not enriched with format or source hints.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states the action: 'Mark a profile as public (accessible without unlocking).' It uses a specific verb and resource, and it distinguishes from sibling tools like gv_make_private.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives, no prerequisites or exclusions mentioned. Description only states what it does, not context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

gv_open_accountOpen Google Account Browser (reuse session)A

Open the browser context for an already-signed-in account.

Unlike gv_sign_in (which waits for you to complete login), this opens the account's persistent profile and reuses the existing saved session โ€” no login window, no waiting. Use this after a sign-in has succeeded once and you've since closed the browser.

Also marks the account as active so subsequent browser tools target it.

Args: account_id: The account id to open.

ParametersJSON Schema
NameRequiredDescriptionDefault
account_idYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the openWorldHint annotation, the description reveals key behaviors: reuses existing saved session, no login window or waiting, and marks the account as active. No contradictions with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise at about 5 lines, front-loaded with the primary action, followed by differentiation, usage condition, side effect, and parameter. Every sentence adds value without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple tool with one parameter, no nested objects, and an existing output schema, the description covers purpose, usage, and behavior adequately. Minor omission: no mention of return value, but not critical given schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description adds minimal meaning for the single parameter account_id ('The account id to open'), which is only slightly more than the schema's title. Given 0% schema coverage, the description compensates to some extent but lacks detail on format or source.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Open the browser context for an already-signed-in account', specifying the verb (open) and resource (browser context). It distinguishes itself from sibling tool gv_sign_in by noting that this tool reuses an existing session without a login window.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly tells when to use: 'Use this after a sign-in has succeeded once and you've since closed the browser.' It contrasts with gv_sign_in and explains that it marks the account as active for subsequent tools, providing clear context for tool selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

gv_open_ephemeralOpen Anonymous Browser SessionA

Open a throwaway browser session for anonymous scraping โ€” NO account needed.

Launches a fresh Camoufox browser with a random identity, no persistent profile, and no DB row. Nothing survives the session โ€” perfect for public pages that don't require login.

The session becomes the active target, so ALL existing browser tools work on it unchanged: gv_open_url, gv_get_page_content, gv_screenshot, gv_get_page_links, gv_click_element, gv_fill_input, gv_scroll, gv_press_key.

Defaults are tuned for scraping: headless=True, block_images=True, short 5-minute idle auto-close. Override per call if needed.

Args: url: Optional URL to navigate to immediately. Omit to start on a blank page. headless: Override the default (True). Set False to watch the browser. proxy: Optional Playwright-style proxy dict (same format as gv_create_account). block_images: Override the default (True). Set False if you need screenshots.

Returns the session id + next steps.

When done, call gv_close_ephemeral. The session also auto-closes after GHOSTVAULT_EPHEMERAL_AUTO_CLOSE_MINUTES idle (default 5).

ParametersJSON Schema
NameRequiredDescriptionDefault
urlNo
proxyNo
headlessNo
block_imagesNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Discloses no persistent profile, no DB row, session being active target, default headless/block_images, 5-min auto-close. Contradicts no annotations (openWorldHint is consistent).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Well-structured with clear opening, parameter bullets, default guidance, and lifecycle notes. Every sentence adds value without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers all aspects: purpose, use case, parameters, defaults, return value, lifecycle, and integration with sibling tools. Nothing missing for an AI agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Despite 0% schema coverage, description explains each parameter's purpose and defaults, adding significant meaning beyond schema types.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states 'Open a throwaway browser session for anonymous scraping' with specific verb and resource. Distinguishes from siblings like gv_open_account by emphasizing no login needed.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says 'NO account needed', 'perfect for public pages', and provides lifecycle guidance (call gv_close_ephemeral). Defaults and overrides are clearly stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

gv_open_urlOpen URL in Google AccountA

Open a URL in the active account's browser.

Works for ANY website โ€” including third-party sites that use Google Sign-In (they'll auto-SSO using the account's session). The page becomes the "current" page that google_get_page_content / google_click_element operate on.

Args: url: Absolute URL to navigate to. wait_until: "load" | "domcontentloaded" | "networkidle" (default domcontentloaded).

ParametersJSON Schema
NameRequiredDescriptionDefault
urlYes
wait_untilNodomcontentloaded

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the openWorldHint annotation, the description discloses auto-SSO behavior and that the page becomes the current page for subsequent tools. Does not mention tab management or error handling, but adds useful context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise paragraphs plus an Args section; every sentence adds value. Front-loaded with purpose, no redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers key details: navigation purpose, state change (current page), parameter meanings. Missing potential error conditions or interaction with account state, but output schema likely fills gaps. Adequate for a simple tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Despite 0% schema description coverage, the description explicitly lists both parameters ('url' and 'wait_until') with their purpose, accepted values, and default. Fully compensates for the schema's lack of descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool opens a URL in the active account's browser with specific verb and resource. It distinguishes from siblings like gv_click_element and gv_get_page_content by noting that the page becomes the current page for those tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides clear context on when to use: before gv_get_page_content/gv_click_element, and mentions universal compatibility including auto-SSO. Lacks explicit when-not-to-use or alternative tool references.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

gv_press_keyPress KeyA

Press a single key or key chord on the active page.

Use this for things gv_fill_input can't do โ€” submitting a form with Enter, tabbing between fields, dismissing a modal with Escape, selecting all with Ctrl+A, etc.

Args: key: Playwright key name โ€” "Enter", "Tab", "Escape", "ArrowDown", "Backspace", "a", "1", etc. modifiers: Optional modifier keys to hold โ€” ["Control"], ["Shift"], ["Control", "Shift"]. Combined as modifier+...+key. hold_ms: Hold the key down for this many ms before releasing (for long-press scenarios). 0 = tap. delay_after_ms: Pause for a randomized ~this many ms after.

Returns the pressed chord.

ParametersJSON Schema
NameRequiredDescriptionDefault
keyYes
hold_msNo
modifiersNo
delay_after_msNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Description details behavior: pressing keys, holding, modifiers, delay. It mentions return value. No contradiction with annotations (openWorldHint). Could note potential side effects (e.g., page changes) but sufficient for a key-press tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Description is well-structured with sections and examples. Slightly verbose but every sentence adds value. Front-loaded with purpose and key usage guidance.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

All parameters covered, usage explained, return value mentioned. No gaps given the tool's complexity. Output schema exists but description still states return type.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, but description fully explains each parameter: key with examples, modifiers as array of modifier keys, hold_ms for long-press, delay_after_ms. Adds meaning beyond schema defaults and types.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it presses a single key or key chord. It distinguishes itself from sibling 'gv_fill_input' by noting what it can do that fill_input cannot, providing specific examples.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly says 'Use this for things gv_fill_input can't do' and gives concrete examples like submitting a form with Enter, tabbing, dismissing a modal with Escape, etc., providing clear when-to-use guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

gv_read_gmailRead Gmail InboxA
Read-only

Read the Gmail inbox of the active account.

Returns recent messages as [{id, subject, sender, snippet, url, date}, ...]. Gmail's DOM changes often โ€” if this returns empty, use gv_open_url to mail.google.com and google_get_page_content (with screenshot) instead.

Args: limit: Max number of messages (default 20, max 50).

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already set readOnlyHint=true, confirming read-only behavior. Description adds 'Gmail's DOM changes often โ€” if this returns empty...' which warns of potential instability and suggests workaround. No contradictions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Four sentences, each serving a distinct purpose: action, return format, fallback strategy, and parameter details. No redundancy, well-structured, and front-loaded with core purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Comprehensive for a simple read tool: describes return format with fields, parameter constraints, and fallback behavior. Output schema hinted by the fields listed. No gaps given the low complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Only parameter 'limit' described with default (20) and max (50). While schema provides default, description adds max constraint and clarifies it's the number of messages. Schema coverage is 0%, so description compensates significantly.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states 'Read the Gmail inbox of the active account' with specific verb and resource. It distinguishes from siblings like gv_open_url and google_get_page_content by focusing on reading inbox versus browsing or page interaction.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly advises when to use alternatives: 'if this returns empty, use gv_open_url to mail.google.com and google_get_page_content (with screenshot) instead.' This provides clear fallback and context for when the tool may not be effective.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

gv_record_loginRecord Login Flow (Level 3)A
Destructive

Record a login flow for future automatic replay (Level 3).

Opens a browser, injects an action recorder, and waits for the user to complete login manually (including 2FA, captcha, etc.). After login succeeds, the recorded steps are saved to the provider's config.

Future gv_sign_in calls with the same provider will replay these steps automatically โ€” pausing only for credential fields (password, OTP) and captcha that can't be replayed.

Security: password/OTP values are NEVER recorded. Only the field selectors + credential_key are saved. Store actual credentials via gv_set_credentials.

When to use:

  • Complex login flows (multi-page, custom captcha, unusual 2FA)

  • Sites where the login form is hard to describe with login_steps

  • When you want to "teach" Ghostvault how to log in once, then automate

Args: account_id: The account id to use. provider: Override the provider. Defaults to the account's provider.

ParametersJSON Schema
NameRequiredDescriptionDefault
providerNo
account_idYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond annotations (openWorldHint, destructiveHint), the description details that it opens a browser, injects an action recorder, waits for manual login completion, records steps to config, and notes security (password/OTP never recorded). This adds significant behavioral context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with a clear first paragraph stating purpose, a security note, a bulleted 'When to use' section, and an Args list. It is front-loaded and every sentence adds value without repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the core functionality, security, and usage scenarios but lacks explanation of the 'Level 3' concept and does not address error handling or cancellation behavior. However, given the tool's complexity and existence of an output schema, it is fairly complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, but the description provides brief yet clear explanations for both parameters: account_id is 'the account id to use' and provider is 'Override the provider. Defaults to the account's provider.' This compensates for the lack of schema descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Record' and resource 'login flow for future automatic replay'. It distinguishes itself from siblings like gv_sign_in (which replays) and gv_set_credentials (which stores actual credentials) by emphasizing the recording and teaching aspect.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The 'When to use' section provides explicit scenarios: complex login flows, sites where login form is hard to describe, and when you want to teach once then automate. It implicitly contrasts with simpler methods like login_steps and mentions future gv_sign_in calls will replay the steps.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

gv_screenshotTake ScreenshotA
Read-only

Capture a screenshot of the current page as a PNG image (vision support).

Use this to visually understand the page when the text snapshot is ambiguous โ€” e.g. to locate a button by its appearance or read a captcha.

Args: full_page: If true, capture the full scrollable page (larger image).

ParametersJSON Schema
NameRequiredDescriptionDefault
full_pageNo

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations indicate readOnlyHint=true, and description adds context (vision support, examples). No contradictions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences plus parameter note; no wasted words, front-loaded with purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers purpose, usage, and parameter meaning. Lacks description of output, but title implies PNG.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has no description but the tool description explains the full_page parameter's effect clearly.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states 'Capture a screenshot of the current page as a PNG image' and provides specific use cases like visually locating buttons or reading captchas.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says to use when text snapshot is ambiguous, distinguishing from gv_get_page_content (text snapshot).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

gv_scrollScroll PageA

Scroll the active page in human-like increments.

reCAPTCHA v3 and similar behavioral detectors weight scroll behavior heavily. This tool scrolls in small bursts with varied distance + reading pauses, mimicking a real user skimming the page.

Args: direction: "down" (default) or "up". amount: Roughly the number of scroll gestures (each ~300px). Default 3. humanize: Vary the scroll distance + add reading pauses between gestures (default true โ€” scrolling is cheap, leave it on). delay_after_ms: Pause for a randomized ~this many ms after.

Returns the direction, amount, and whether humanize was applied.

ParametersJSON Schema
NameRequiredDescriptionDefault
amountNo
humanizeNo
directionNodown
delay_after_msNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Provides detailed behavioral traits: small bursts, varied distance, reading pauses, mimicking real users. Highlights reCAPTCHA v3 relevance. Adds significant value beyond the minimal openWorldHint annotation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Concise with a clear intro, explanatory paragraph, and structured Args list. Every sentence adds value without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers all aspects: purpose, behavioral nuances, parameter explanations, and return values (direction, amount, humanize). No gaps given the presence of an output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Despite 0% schema coverage, the description fully explains each parameter (direction, amount, humanize, delay_after_ms) with concrete details like 'each ~300px' and 'randomized delay', adding meaning beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states 'Scroll the active page' with a specific verb and resource. Adds 'human-like increments' to distinguish from basic scrolling, aligning with anti-detection context.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Describes when to use (human-like scrolling to evade behavioral detection) but does not explicitly exclude alternatives like scrolling via JS or other tools. Context is clear but lacks explicit 'when-not-to-use'.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

gv_set_credentialsStore Account CredentialsA
Destructive

Store credentials (username/password) for Level 2 form auto-fill.

Credentials are saved in the account's fingerprint bundle (encrypted at rest when encryption is enabled). Use this before calling gv_sign_in on a provider that has login_steps configured.

Args: account_id: The account id. credentials: Dict of credential key-value pairs. The keys must match the credential_key in the provider's login_steps. Example: {"username": "john", "password": "secret"}

ParametersJSON Schema
NameRequiredDescriptionDefault
account_idYes
credentialsYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond annotations (destructiveHint=true), the description adds that credentials are saved in an encrypted fingerprint bundle, providing security context. No contradictions with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two paragraphs and an Args section with no fluff. Purpose is front-loaded. Every sentence adds value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the presence of an output schema, the description explains behavior and preconditions adequately. Could mention return value or errors, but output schema covers that.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description fully compensates by explaining that credentials keys must match credential_key in login_steps, and provides an example. This adds significant meaning beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it stores credentials for Level 2 form auto-fill, with a specific verb ('store') and resource ('credentials'). It distinguishes from siblings by positioning itself as a prerequisite for gv_sign_in on providers with login_steps.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states when to use: before gv_sign_in on a provider with login_steps configured. Does not list when-not-to or alternatives, but provides clear context for usage.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

gv_setup_passwordSetup Password (Private/Public Gate)A
Destructive

Open a browser window to set a password for the private/public gate.

This is a ONE-TIME setup. After setting a password, you can mark profiles as private (google_make_private) โ€” they'll be hidden until you unlock (google_unlock). Public profiles remain accessible without unlocking.

A browser window opens with a password form โ€” type and confirm there. The password is stored as a salted hash (PBKDF2-SHA256, 200k iterations).

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond annotations (openWorldHint, destructiveHint), the description adds that it opens a browser window, is one-time setup, and uses PBKDF2-SHA256 hashing. It doesn't mention reversibility or prerequisites, but the added detail is valuable.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise, with three short paragraphs that each add value. It front-loads the main action and uses bullet points for clarity. No wasted sentences, though minor redundancy in explaining the hash.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with zero parameters and a simple action, the description covers purpose, behavior, and relationship to other tools. It lacks mention of what happens if password already set or if it can be reset, but these are gaps given the existence of an output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

No parameters exist, so schema coverage is 100%. The description does not need to add parameter information, and the baseline of 4 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool opens a browser window to set a password for the private/public gate, using specific verb 'open' and resource 'password'. It distinguishes from siblings by noting it's a one-time setup and relates to privacy features like google_make_private and google_unlock.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides context on when to use this tool: it's a one-time setup before marking profiles private. It mentions the result (password storage) and links to related tools, but doesn't explicitly state when not to use it or name alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

gv_sign_inSign In to ProviderA

Open a sign-in window for the user to complete login (including 2FA).

A real browser window opens on the server's machine โ€” the USER completes sign-in themselves; Ghostvault never touches the password. On success the session is saved to the account's persistent profile automatically.

First-time login from a new fingerprint usually triggers a 2FA challenge โ€” this is expected. The tool blocks until login completes or times out.

Login level is auto-selected:

  • If the provider has login_steps AND credentials are available (either passed here or stored via gv_set_credentials) โ†’ Level 2 auto-fill.

  • Otherwise โ†’ Level 1 manual (user does everything in the visible window).

DECISION GUIDE:

  • For Google / SSO providers โ†’ Level 1 manual (most reliable for 2FA/captcha).

  • For providers with login_steps โ†’ store credentials first via gv_set_credentials, then sign_in.

  • Not sure what the page offers? Call gv_detect_login_options first.

Args: account_id: The account id from gv_list_accounts. provider: Override the provider for this login (e.g. "github", "facebook", or a custom provider name). Defaults to the account's provider field. credentials: Optional dict of credential values for Level 2 auto-fill (e.g. {"username": "john", "password": "secret"}). If omitted, stored credentials are loaded automatically.

ParametersJSON Schema
NameRequiredDescriptionDefault
providerNo
account_idYes
credentialsNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds extensive behavioral context beyond the annotations (only openWorldHint): it opens a real browser window, user completes sign-in without Ghostvault touching password, session saved automatically, blocks until completion or timeout, and auto-selects login level. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is detailed and well-structured with paragraphs and a decision guide. Every sentence adds value, but it is somewhat lengthy. However, given the tool's complexity (two login levels, credential handling), the length is justified.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers key aspects: blocking behavior, auto-login level selection, credential handling, and reference to sibling tools. It lacks mention of the return value/response, but since an output schema exists (summary signals), this is partially mitigated. Overall, it is fairly complete for the tool's complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Despite 0% schema description coverage, the description's Args section explains each parameter: account_id as required, provider with default behavior (defaults to account's provider), and credentials as optional with clear role in Level 2 auto-fill. This adds significant meaning beyond the schema's type-only definitions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool opens a sign-in window for user login including 2FA. It specifies the resource (sign-in window) and verb (open), and distinguishes from siblings like gv_detect_login_options and gv_set_credentials by explaining when to use each.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit decision guidance: for Google/SSO use Level 1, for providers with login_steps store credentials first via gv_set_credentials, and if unsure call gv_detect_login_options. It also differentiates between Level 1 and Level 2 login based on credential availability, giving clear when-to-use and when-not-to-use advice.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

gv_sign_outSign Out of ProviderA
Destructive

Sign the account out of the provider (invalidates the session server-side).

Opens the browser, navigates to the provider's sign-out URL, waits for the session to clear, then closes the browser. After this, the account must sign in again before any browser tools work.

If the provider has no logout_url configured, the browser closes and the user is told to navigate to the site's logout page manually.

Args: account_id: The account id to sign out. provider: Override the provider for this sign-out. Defaults to the account's provider field.

ParametersJSON Schema
NameRequiredDescriptionDefault
providerNo
account_idYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare destructiveHint=true, so the description adds value by detailing the side effects: opens browser, navigates, waits, closes, and forces re-authentication. This goes beyond the annotation by specifying the sequence and the case of missing logout URL, but could mention if cookies are cleared.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and well-structured: it starts with the core action, then lists steps and special cases, and ends with parameter docs. Every sentence adds necessary detail without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (browser automation) and the presence of an output schema, the description covers the main behaviors: session invalidation, browser operations, and fallback for missing logout URL. It could be slightly more complete by describing what happens to existing browser state, but overall it provides sufficient context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 0% description coverage, so the description fully compensates by explaining each parameter: account_id is the account to sign out, and provider is an override that defaults to the account's provider. This adds essential meaning beyond the schema's type information.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: signing an account out of a provider by invalidating the session server-side. The detailed steps (opening browser, navigating to sign-out URL, waiting, closing) and handling of missing logout_url further clarify its function. While siblings like gv_logout exist, the description is specific enough to distinguish its action.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explains what happens after sign-out ('account must sign in again before any browser tools work') and handles a special case (no logout_url), providing implicit context. However, it does not explicitly tell when to use this tool over alternatives like gv_logout, nor does it provide exclusions or prerequisites.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

gv_switch_accountSwitch Active Google AccountA

Switch the active account that browser tools operate on.

The account must already be open (it becomes open after gv_sign_in). All subsequent gv_open_url / gv_read_gmail calls target the active account until you switch again.

Args: account_id: The account id to make active.

ParametersJSON Schema
NameRequiredDescriptionDefault
account_idYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description discloses the state change, precondition, and scope of effect. It does not mention error handling or what happens with invalid account_id, but the core behavior is transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three sentences plus a brief args line, no wasted words, and the key information is front-loaded. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple switching tool with one parameter, the description covers purpose, precondition, and effect. It does not mention return values (output schema exists) or error cases, but is largely complete for the intended use.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%. The description adds basic meaning for account_id ('The account id to make active'), but lacks format or source details. This partially compensates for the schema gap but could be more helpful.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description explicitly states the verb 'switch' and resource 'active account', and clarifies that subsequent browser operations target this account, distinguishing it from siblings like gv_sign_in and gv_open_url.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It clearly states the precondition (account must already be open via gv_sign_in) and the effect on subsequent calls, providing context for when to use this tool. It does not explicitly list alternatives but the precondition is informative.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

gv_unlockUnlock Private ProfilesA

Unlock the private/public gate to access private profiles.

Two modes:

  • Pass the password directly: google_unlock({password: "..."})

  • Omit the password to open a browser window: google_unlock()

Once unlocked, private profiles are visible and accessible until you call google_logout or restart the MCP server.

Args: password: Your gate password. Omit to unlock via a browser window.

ParametersJSON Schema
NameRequiredDescriptionDefault
passwordNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description carries full burden. It explains the unlock mechanism, browser window fallback, and duration. Does not mention error handling or security implications, but adequate for a simple unlock.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Concise with well-structured sentences and clear bullet points. Every sentence adds value, no fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Tool has one optional parameter and output schema exists. Description covers unlock behavior, modes, and persistence. Could mention handling of already-unlocked state, but largely complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, but description fully documents the single parameter 'password', explaining it can be omitted for browser unlock. Adds meaning beyond schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool unlocks the 'private/public gate' to access private profiles, with specific verb and resource. It distinguishes from sibling tools like gv_make_private or gv_lock_account.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Describes two usage modes (with or without password) and the persistence of the unlocked state until logout or restart. Lacks explicit when-not-to-use or alternatives, but context is clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

gv_update_account_configUpdate Account Advanced ConfigA
Destructive

Update the advanced fingerprint config of an existing account.

Only the keys you pass are changed; everything else stays locked. The account's fingerprint + seeds are NOT re-rolled โ€” identity stays the same, only the injection/behavioral params change.

The browser must be CLOSED when this is called; relaunch with gv_open_account to apply the new settings.

Args: account_id: The account id to update. locale, timezone, humanize, block_webrtc, block_webgl, webgl_config, fonts, addons, disable_coop, block_images: Same meanings as in gv_create_account. Pass only the ones you want to change. device_profile: Switch to a different hardware template (replaces the device_config section). Same names as in gv_create_account. device_config: Raw Camoufox config keys to merge into device_config (battery:, mediaDevices:, navigator.hardwareConcurrency, ...). Overrides values from device_profile. reset_keys: List of advanced keys to remove entirely (fall back to default). E.g. ["locale", "timezone"] to clear explicit pins. reset_device_keys: List of raw Camoufox config keys to remove from device_config. E.g. ["battery:level", "mediaDevices:webcams"].

Returns the updated keys, the new advanced + device config dicts.

ParametersJSON Schema
NameRequiredDescriptionDefault
fontsNo
addonsNo
localeNo
humanizeNo
timezoneNo
account_idYes
reset_keysNo
block_webglNo
block_imagesNo
block_webrtcNo
disable_coopNo
webgl_configNo
device_configNo
device_profileNo
reset_device_keysNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotation 'destructiveHint: true' is supported by the description which details that only passed keys change, identity stays same, and browser must be closed. It adds value beyond the annotation by explaining the non-destructive nature of the update and the requirement to relaunch the browser. There is no contradiction.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured: a brief introduction, behavioral notes, a prerequisite, and a clear args list. Every sentence adds value, but the args section could be made slightly more concise by grouping similar parameters. It is appropriately sized for the complexity of 15 parameters.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the high parameter count and no schema descriptions, the description covers the operation, prerequisites, outcomes (returns new config), and key constraints (fingerprint not re-rolled, browser must be closed). It references an existing output schema and provides enough context for an agent to use the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema coverage, the description fully compensates by defining each parameter, referencing gv_create_account for common meanings, and providing examples for complex ones like device_profile, device_config, reset_keys, and reset_device_keys. It clarifies that only passed parameters change and explains how multiple parameters interact.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Update' and the resource 'advanced fingerprint config of an existing account'. It distinguishes this tool from siblings like gv_create_account and gv_delete_account by specifying that only injection/behavioral params change, not the identity. The behavior 'Only the keys you pass are changed' adds precision.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states when to use this tool (to update advanced config) and provides a critical prerequisite: 'The browser must be CLOSED when this is called; relaunch with gv_open_account to apply the new settings.' It also implies when not to use it (identity stays same, so no for re-rolling fingerprints). However, it does not explicitly name alternative tools for different operations, though the sibling list implies alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

gv_update_providerUpdate Custom ProviderA
Destructive

Update a custom provider's configuration. Built-in providers cannot be updated.

Pass only the fields you want to change. The provider must be closed (no active login flow) when updating.

Args: name: The provider name to update. login_url, success_url_fragments, auth_cookie_names, auth_cookie_domain, logout_url, session_probe_url, login_url_fragments, description: Same meanings as in gv_create_provider. Pass only the ones to change.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYes
login_urlNo
logout_urlNo
descriptionNo
auth_cookie_namesNo
session_probe_urlNo
auth_cookie_domainNo
login_url_fragmentsNo
success_url_fragmentsNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds value beyond the destructiveHint annotation by clarifying that built-in providers are ineligible and that the provider must be in a closed state. It also implies a partial update behavior. It does not detail error conditions or side effects, which would raise it to a 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is very concise: two sentences plus an args section. It front-loads the core purpose and constraint, then efficiently lists parameters by reference. No unnecessary words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (9 parameters, 1 required, no schema descriptions, has output schema), the description covers the update semantics, prerequisite condition, and parameter mapping via cross-reference. It does not explain the return value, but the output schema provides that. It is complete enough for an agent to use correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description compensates by explaining that most parameters have the same meaning as in gv_create_provider and that only changed ones should be passed. It explicitly lists the parameter names and clarifies the required 'name' parameter. However, it relies on cross-reference rather than defining each parameter individually, which is a minor limitation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Update' and the resource 'custom provider's configuration'. It distinguishes itself from siblings by explicitly noting that built-in providers cannot be updated, effectively differentiating from create and get operations.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit prerequisites ('provider must be closed') and the usage pattern ('pass only the fields you want to change'). It lacks explicit guidance on when not to use this tool (e.g., for creation, use gv_create_provider), but the tool name and context imply the alternative.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. 42 tool updatesv0.1.1-beta
    • First observedgv_api_call
    • First observedgv_check_session
    • First observedgv_click_element
    • First observedgv_close_account
    • First observedgv_close_ephemeral
    • First observedgv_create_account
    • First observedgv_create_provider
    • First observedgv_delete_account
    • First observedgv_delete_provider
    • First observedgv_detect_login_options
    • First observedgv_eval_js
    • First observedgv_fill_input
    • First observedgv_get_auth_status
    • First observedgv_get_cookies
    • First observedgv_get_credentials
    • First observedgv_get_logs
    • First observedgv_get_page_content
    • First observedgv_get_page_links
    • First observedgv_get_provider
    • First observedgv_get_session_status
    • First observedgv_list_accounts
    • First observedgv_list_providers
    • First observedgv_lock_account
    • First observedgv_logout
    • First observedgv_make_private
    • First observedgv_make_public
    • First observedgv_open_account
    • First observedgv_open_ephemeral
    • First observedgv_open_url
    • First observedgv_press_key
    • First observedgv_read_gmail
    • First observedgv_record_login
    • First observedgv_screenshot
    • First observedgv_scroll
    • First observedgv_set_credentials
    • First observedgv_setup_password
    • First observedgv_sign_in
    • First observedgv_sign_out
    • First observedgv_switch_account
    • First observedgv_unlock
    • First observedgv_update_account_config
    • First observedgv_update_provider

TDQS

A4/5.0
Disambiguation4/5

Most tools have clearly distinct purposes, but some pairs (e.g., gv_lock_account/gv_close_account, gv_logout/gv_sign_out) could cause confusion due to overlapping functionality.

Naming Consistency5/5

All tools follow a consistent 'gv_' prefix and snake_case naming convention with a predictable verb_noun pattern (e.g., gv_list_accounts, gv_open_account), making navigation intuitive.

Tool Count3/5

With 42 tools, the server covers a broad domain but feels slightly overloaded; some tools (e.g., gv_make_private/gv_make_public) could be merged without loss of clarity.

Completeness4/5

The tool set comprehensively covers account lifecycle, browser automation, provider management, and security features; minor gaps exist (e.g., limited Gmail operations) but do not impede core workflows.

Maintenance

ActivityMaintained
ResponsivenessSyncing

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers

  • -
    license
    Not graded
    quality
    Not graded
    maintenance
    Enables AI assistants to securely manage Google Workspace services (Gmail, Calendar, Drive, Sheets, Contacts) with persistent multi-account OAuth. Uses OS keychain for credential storage with health monitoring and granular business rules for enterprise security.
    -
  • F
    license
    Not graded
    quality
    Not graded
    maintenance
    Enables AI agents to authenticate with websites using a real Chromium browser with anti-detection measures and human-in-the-loop support for captchas and 2FA. Features stealth browsing, human-like interactions, and persistent session storage to automate and resume login workflows.
    -
  • A
    license
    A
    quality
    B
    maintenance
    Gives your AI agent a persistent browser identity with anti-detection, credential vault, and multi-persona support for automated web browsing, login, and signup.
    31
    8
    MIT
  • A
    license
    B
    quality
    B
    maintenance
    Enables AI assistants to manage multiple Gmail accounts simultaneously with built-in OAuth authentication, supporting email reading, sending, drafts, labels, and account management.
    60
    48
    2
    MIT

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/mienetic/Ghostvault'

If you have feedback or need assistance with the MCP directory API, please join our Discord server