@weavetab/mcp

MCPattested
v2.5.1fy2neAGPL-3.0-onlyUpdated 2d agonpmGitHub

The open automation engine for AI agents. Control live browsers and desktop apps locally with instant execution.

Works in
ClaudeCursorCopilotGemini

Inferred from the transports this listing declares (stdio). A client not listed here hasn’t been ruled out — it just isn’t something Forge can confirm.

Attested build
A verified provenance attestation binds this artifact to the listed repository. Nobody has claimed the listing yet — this proves where the code was built, not who stands behind it.
18Downloads/wk
1GitHub stars
2d agoLast update
Package
Authorfy2ne
LicenseAGPL-3.0-only
Version2.5.1
Sourcenpm+mcp-registry
Trust Status
A
85/100Trusted
✓Listed in Forge index+10/10
✓Identity verified · attested build+20/20
—Ed25519 publish signature+0/5
→ Included automatically when the publisher runs `forge publish`
—Domain verification+0/5
→ Publisher: host /.well-known/forge.json on the package homepage with { "publisher": "<github-login>" }
✓npm Trusted Publishing (Sigstore)+5/5
—npm maintainer match+0/5
→ Publisher: add the verified GitHub login to the npm package's maintainers (npm owner add <login>)
✓CVE scan · clean+30/30
✓Static analysis · clean+20/20
Paste into Claude Code, Cursor, or any AI assistant to fix all gaps
StatusIdentity verified
PublisherUnverified
SignatureUnsigned
Domain—
Provenance✓ Sigstore-verified · 01d2b21
Dependencies60 resolved · 2 with advisories
Tool surface40 tools · 2 privileged
Security scan⚠ Warnings (3)v2.5.1 · todayHow well does this scan work?
EvalsNone
IndexedOct 17, 2026

Verification confirms publisher identity (repo ownership), not code safety. The security scan covers known CVEs and suspicious install scripts.

Tools

40 tools · 2 privileged
Statically extracted from the published packagev2.5.1 · 10h ago

Read out of the source npm actually ships, at scan time. The package was never executed. Tools registered dynamically at runtime, or hidden inside bundled or minified code, can be missed — so this is a floor on the tool surface, not a complete census of it.

browser_mapSnapshot interactive DOM with volatile ref IDs that invalidate after DOM mutations. For complex SPAs (e.g. GitHub dashboards), use `scope` or `query` to reduce tokens. For forms/pagination/sequential loops, ALWAYS use `delta: true` to save 97% tokens. For canvas/WebGL/Figma pages where the DOM has…

Snapshot interactive DOM with volatile ref IDs that invalidate after DOM mutations. For complex SPAs (e.g. GitHub dashboards), use `scope` or `query` to reduce tokens. For forms/pagination/sequential loops, ALWAYS use `delta: true` to save 97% tokens. For canvas/WebGL/Figma pages where the DOM has…

No input schema was published for this tool.

browser_navigateNavigate to a URL or launch/focus a configured Electron app.

Navigate to a URL or launch/focus a configured Electron app.

No input schema was published for this tool.

browser_clickClick a DOM element. Use browser_canvas for charts/canvas. If stuck_warning=true, stop and use browser_map. Pass mark: N to click a numbered element from browser_map({ visual: true/"auto" }) without any DOM re-scan.

Click a DOM element. Use browser_canvas for charts/canvas. If stuck_warning=true, stop and use browser_map. Pass mark: N to click a numbered element from browser_map({ visual: true/"auto" }) without any DOM re-scan.

No input schema was published for this tool.

browser_typeType text into an input field or currently focused element. If id/selector/label is omitted, automatically types directly into document.activeElement without needing a redundant click or browser_map. If target is already focused, skips click to prevent unfocus bugs.

Type text into an input field or currently focused element. If id/selector/label is omitted, automatically types directly into document.activeElement without needing a redundant click or browser_map. If target is already focused, skips click to prevent unfocus bugs.

No input schema was published for this tool.

browser_type_secretInject a secret from an environment variable.

Inject a secret from an environment variable.

No input schema was published for this tool.

browser_keyPress a keyboard key.

Press a keyboard key.

No input schema was published for this tool.

browser_scrollScroll the page.

Scroll the page.

No input schema was published for this tool.

browser_dialogAccept or dismiss JS dialogs (alert, confirm, prompt). Browser sessions only.

Accept or dismiss JS dialogs (alert, confirm, prompt). Browser sessions only.

No input schema was published for this tool.

browser_burstNo description published

This tool published no description. Forge does not invent one.

browser_tabsManage browser and Electron app tabs/windows (open, switch, close, list). Specify 'app' when targeting desktop apps (e.g. app: 'discord') to avoid opening web browser.

Manage browser and Electron app tabs/windows (open, switch, close, list). Specify 'app' when targeting desktop apps (e.g. app: 'discord') to avoid opening web browser.

No input schema was published for this tool.

browser_waitPause until a condition is met.

Pause until a condition is met.

No input schema was published for this tool.

browser_captchaAutonomous CAPTCHA detection and solving.

Autonomous CAPTCHA detection and solving.

No input schema was published for this tool.

browser_thoughtsAgent-to-user communication. Renders in the middle down of the page. Use 'question' mode to ask a free-text question. Use 'feedback' mode to provide status updates, analysis, or decisions. Supports element anchoring (e.g. 'w:15') and presentation styles ('observation', 'decision', 'warning', 'quest…

Agent-to-user communication. Renders in the middle down of the page. Use 'question' mode to ask a free-text question. Use 'feedback' mode to provide status updates, analysis, or decisions. Supports element anchoring (e.g. 'w:15') and presentation styles ('observation', 'decision', 'warning', 'quest…

No input schema was published for this tool.

browser_pointerAdvanced pointer control (hover, click, double_click, drag_and_drop, hover_chain). Use hover_chain for Photoshop/Photopea, Figma, and multi-level flyout submenus.

Advanced pointer control (hover, click, double_click, drag_and_drop, hover_chain). Use hover_chain for Photoshop/Photopea, Figma, and multi-level flyout submenus.

No input schema was published for this tool.

browser_selectSelect an option from a native dropdown or custom UI dropdown.

Select an option from a native dropdown or custom UI dropdown.

No input schema was published for this tool.

browser_fillSmart multi-field form-filling and input inspector. Call with scan:true (or empty) to get a lightweight list of all editable inputs on the page without dumping the full DOM. Fill multiple fields in a single turn.

Smart multi-field form-filling and input inspector. Call with scan:true (or empty) to get a lightweight list of all editable inputs on the page without dumping the full DOM. Fill multiple fields in a single turn.

No input schema was published for this tool.

browser_highlightHighlight elements on page. Supports single or multiple candidates (refs) with styles ('consideration' for candidate evaluation, 'target' for lock-on, 'danger' for destructive actions, 'success', or 'shimmer'), floating badges, and configurable duration.

Highlight elements on page. Supports single or multiple candidates (refs) with styles ('consideration' for candidate evaluation, 'target' for lock-on, 'danger' for destructive actions, 'success', or 'shimmer'), floating badges, and configurable duration.

No input schema was published for this tool.

browser_uploadprivilegedUpload files to a file input.

Upload files to a file input.

No input schema was published for this tool.

browser_findInstant text & keyword search across page text, labels, and placeholders. Returns matched element coordinates, selectors, and ref IDs.

Instant text & keyword search across page text, labels, and placeholders. Returns matched element coordinates, selectors, and ref IDs.

No input schema was published for this tool.

browser_storageManage localStorage and sessionStorage.

Manage localStorage and sessionStorage.

No input schema was published for this tool.

browser_network_interceptIntercept/stub network responses (e.g. mock APIs) OR retrieve captured network telemetry: per-request TLS/SSL certificate details (when the connection exposes them), millisecond timing phases, and failure reasons.

Intercept/stub network responses (e.g. mock APIs) OR retrieve captured network telemetry: per-request TLS/SSL certificate details (when the connection exposes them), millisecond timing phases, and failure reasons.

No input schema was published for this tool.

browser_console1-5ms latency. Read or clear buffered console API messages, JS exceptions, and network errors.

1-5ms latency. Read or clear buffered console API messages, JS exceptions, and network errors.

No input schema was published for this tool.

browser_pdfPrint the current page to a PDF file.

Print the current page to a PDF file.

No input schema was published for this tool.

browser_evalprivilegedRun arbitrary JS via CDP. Good for extracting app state. Cannot traverse shadow DOM/cross-origin iframes.

Run arbitrary JS via CDP. Good for extracting app state. Cannot traverse shadow DOM/cross-origin iframes.

No input schema was published for this tool.

browser_cookiesManage browser cookies.

Manage browser cookies.

No input schema was published for this tool.

browser_canvasFor ALL canvas content (charts, games, graphs). Use 'get_image' to read pixels, 'draw' to simulate gestures. Do NOT use browser_click here.

For ALL canvas content (charts, games, graphs). Use 'get_image' to read pixels, 'draw' to simulate gestures. Do NOT use browser_click here.

No input schema was published for this tool.

browser_scrapeSub-5ms latency, zero waste extraction. Best for batch list extraction, table parsing, targeted data mining. Prefer this over browser_map for pure data extraction. Note: XPath selectors lack shadow-DOM support; use CSS selectors for shadow DOMs.

Sub-5ms latency, zero waste extraction. Best for batch list extraction, table parsing, targeted data mining. Prefer this over browser_map for pure data extraction. Note: XPath selectors lack shadow-DOM support; use CSS selectors for shadow DOMs.

No input schema was published for this tool.

browser_snapshotCapture or restore an MHTML snapshot. Best for offline archival, replay testing, and compliance audits.

Capture or restore an MHTML snapshot. Best for offline archival, replay testing, and compliance audits.

No input schema was published for this tool.

browser_screenshot95-135ms capture. Best for visual layout validation, canvas/image inspection. For multimodal models only. Text-only models should use browser_map or browser_canvas instead.

95-135ms capture. Best for visual layout validation, canvas/image inspection. For multimodal models only. Text-only models should use browser_map or browser_canvas instead.

No input schema was published for this tool.

browser_viewportSet viewport dimensions and device emulation (device presets, geolocation, locale, timezone, color scheme, touch, orientation).

Set viewport dimensions and device emulation (device presets, geolocation, locale, timezone, color scheme, touch, orientation).

No input schema was published for this tool.

browser_clipboardRead or write to the system clipboard.

Read or write to the system clipboard.

No input schema was published for this tool.

browser_inspect15-35ms latency, zero waste. Deep DOM inspection. Useful for debugging failed clicks, verifying z-index & visibility, or computed styles.

15-35ms latency, zero waste. Deep DOM inspection. Useful for debugging failed clicks, verifying z-index & visibility, or computed styles.

No input schema was published for this tool.

browser_extract_designExtract design tokens (colors, typography, spacing, shadows, CSS variables), semantic HTML layouts, and clean CSS into structured files and an LLM design blueprint. Ideal for cloning websites, UI components, and design systems with 100% pixel fidelity.

Extract design tokens (colors, typography, spacing, shadows, CSS variables), semantic HTML layouts, and clean CSS into structured files and an LLM design blueprint. Ideal for cloning websites, UI components, and design systems with 100% pixel fidelity.

No input schema was published for this tool.

browser_automationInject self-running background script for monitoring/polling. Cleared on tab close. Don't use persistent scripts for expensive ops.

Inject self-running background script for monitoring/polling. Cleared on tab close. Don't use persistent scripts for expensive ops.

No input schema was published for this tool.

browser_recordingRecord video screencast for compliance/audit. Compiles captured frames into video/animation (.webp, .gif, .webm, .mp4).

Record video screencast for compliance/audit. Compiles captured frames into video/animation (.webp, .gif, .webm, .mp4).

No input schema was published for this tool.

browser_detectCRITICAL INITIALIZATION TOOL. Detect available browsers and configured desktop apps (Discord, Slack, etc.). Call this FIRST before interacting with the environment to know if apps are online/offline and what tabs they have open.

CRITICAL INITIALIZATION TOOL. Detect available browsers and configured desktop apps (Discord, Slack, etc.). Call this FIRST before interacting with the environment to know if apps are online/offline and what tabs they have open.

No input schema was published for this tool.

browser_performanceRetrieve page performance metrics: Core Web Vitals (FCP, LCP, CLS, INP, TTFB), JS heap memory, navigation timing, slowest resources, and raw CDP counters.

Retrieve page performance metrics: Core Web Vitals (FCP, LCP, CLS, INP, TTFB), JS heap memory, navigation timing, slowest resources, and raw CDP counters.

No input schema was published for this tool.

browser_pattern_learnRead, register, update, and record execution outcomes for named workflow patterns and site quirks in ~/.weavetab-system/memory/sites/. Use action='get' at session start to inspect a site profile and decide between fast-path replay (reliability ≥ 0.8) or exploratory navigation. Use action='learn' af…

Read, register, update, and record execution outcomes for named workflow patterns and site quirks in ~/.weavetab-system/memory/sites/. Use action='get' at session start to inspect a site profile and decide between fast-path replay (reliability ≥ 0.8) or exploratory navigation. Use action='learn' af…

No input schema was published for this tool.

browser_officeNo description published

This tool published no description. Forge does not invent one.

browser_emulateEmulate browser conditions over CDP: network throttling (Slow 3G, Fast 3G, 4G, Offline), CPU throttling rate, Geolocation coordinates, Timezone, and User Agent string overrides.

Emulate browser conditions over CDP: network throttling (Slow 3G, Fast 3G, 4G, Offline), CPU throttling rate, Geolocation coordinates, Timezone, and User Agent string overrides.

No input schema was published for this tool.

38 of 40 tools published a description.

Tool names and descriptions are written by the publisher and shown verbatim as inert text. They are the strings an MCP client passes to a model, so Forge scans them for prompt-injection patterns — any finding appears with the security scan above. “Privileged” is a keyword match on the tool name, not an audit of what the tool does: a benign-sounding name can still do anything.

About

The open automation engine for AI agents. Control live browsers and desktop apps locally with instant execution.

Keywords
mcp servermcpmodel context protocolbrowser automationelectron automationdesktop automationai agentclaude mcpcursor mcpcdpchrome devtools protocollocal mcpWeavetabWeavetab MCP@weavetab/mcppuppeteer alternativeplaywright alternativeautonomous agent
Alternatives
Comparing tool surfaces…

Dependency tree

What one Forge scan resolved from npm metadata on 2026-10-19 — observed resolution, not a publisher declaration.

60 packages resolved · 16 direct · 2 carrying advisories Resolution stops at depth 4 and 60 packages.

The crawl stopped at the 60-package limit. The rest of the tree was never resolved.

36 more resolved packages are not drawn here (display cap: 24). Every dependency carrying an advisory is drawn regardless of the cap. Full inventory (CycloneDX SBOM)

Declared but not resolved

70 declared dependencies never landed in the tree. They are missing from Forge's resolution, not from the package.

+58 more not listed. The counts by reason above cover all of them.

Not followed: peerDependencies. This tree covers runtime dependencies only, so anything those pull in was never resolved.

Topics

Related in browser automation & scraping