Agent Tools

August 12, 2026 · View on GitHub

WebBrain separates model tier from conversation mode.

  • Tier (compact, mid, full) is a per-provider setting. It controls how many normal browser-agent tools a model sees.
  • Mode (ask, act, dev) is chosen per conversation. It controls what kind of task the user is allowing.
ModeWhat it allows
AskRead-only. No clicking, typing, navigating, or downloading.
ActThe selected tier's normal browser tools.
DevRequires a Mid or Full provider. Adds a source/style/debug appendix, including deeper DOM/frame inspection for Mid-tier Dev runs. Compact Dev is blocked before an LLM request is sent.
TierIntended model classNormal tool surface
compactvery small local modelsShortest prompt and a small normal Act tool set. No scheduling, iframe, download-resource, or advanced DOM/UI fallbacks.
midcapable local modelsCommon task tools: downloads, scheduling, iframe tools, form verification. No Full-only advanced fallbacks.
fullfrontier/cloud or large local modelsEverything, including hover, drag-drop, frames, and shadow DOM.

Tier defaults and resolution rules are documented in providers and models.

Accessibility read budgets

get_accessibility_tree normally uses a 6,000-character structured page inside an 8,000-character serialized result. Mid/Full providers with a detected context window of at least 65,536 tokens advertise the expanded 12,000 / 16,000 pair. When that larger page is requested, its accessibility result alone may use the 16,000-character serializer window. Compact providers and providers below the 64k boundary remain at 6,000 / 8,000.

The larger window is reserved for complete-thread and whole-document reads. Ordinary visible/interactive UI reads retain their smaller defaults, other tool results remain capped at 8,000 characters, and every truncated tree must be continued with its exact returned continuationArgs until the required coverage is complete. See adaptive read windows.

For Gmail, the first accessibility result identifies the trusted active conversation with conversationRootRefId. Complete coverage pages only that anchored subtree with filter:"all" and maxDepth:15; document-root page 2+ contains unrelated inbox rows and does not count. Expansion is independent: Collapse all must be visible as evidence. Ask cannot expand collapsed messages and returns a clear limitation; Act/Dev can use Expand all and then re-read the trusted conversation subtree from page 1.

Tool matrix

Legend: Yes = available · - = not available · C = Chrome only · Dev = Dev-mode add-on (Mid/Full providers; not Compact).

ToolAskCompactMidFullDev
get_accessibility_treeYesYesYesYes-
read_pageYesYesYesYes-
read_pdfYesNoYesYes-
list_webmcp_toolsCNoCC-
execute_webmcp_toolNoNoCC-
read_page_sourceNoNoNoNoYes
get_window_infoYesYesYesYes-
get_interactive_elementsYesNoYesYes-
scrollYesYesYesYes-
extract_dataYesYesYesYes-
inspect_element_stylesNoNoNoNoYes
wait_for_stableYesNoYesYes-
get_selectionYesYesYesYes-
doneYesYesYesYes-
clarifyNoYesYesYes-
fetch_urlYesYesYesYes-
research_urlYesNoYesYes-
list_downloadsYesNoYesYes-
click_axNoYesYesYes-
type_axNoYesYesYes-
set_fieldNoYesYesYes-
resize_windowNoNoNoYes-
clickNoYesYesYes-
type_textNoYesYesYes-
press_keysNoYesYesYes-
navigateNoYesYesYes-
wait_for_elementNoYesYesYes-
new_tabNoYesYesYes-
promote_iframeNoNoYesYes-
scratchpad_writeNoYesYesYes-
progress_updateNoYesYesYes-
progress_readNoYesYesYes-
download_social_mediaNoNoYesYes-
solve_captchaNoNoYesYes-
go_backNoNoYesYes-
go_forwardNoNoYesYes-
schedule_resumeNoNoYesYes-
schedule_taskNoNoYesYes-
iframe_readNoNoYesYes-
iframe_clickNoNoYesYes-
iframe_typeNoNoYesYes-
read_downloaded_fileNoNoYesYes-
download_filesNoNoYesYes-
download_resource_from_pageNoNoYesYes-
upload_fileNoNoYesYes-
verify_formNoNoYesYes-
hoverNoNoNoYes-
drag_dropNoNoNoYes-
get_shadow_domNoNoNoYesYes
shadow_dom_queryNoNoNoCC
get_framesNoNoNoYesYes
inject_cssNoNoNoNoC
remove_injected_cssNoNoNoNoC
patch_elementNoNoNoNoC
revert_patchNoNoNoNoC
execute_jsNoNoNoNoYes
read_consoleNoNoNoNoC
inspect_network_requestsNoNoNoNoC
inspect_event_listenersNoNoNoNoC
highlight_elementNoNoNoNoC

promote_iframe is a normal Mid/Full Act tool, not a Dev-only add-on. Dev sessions using a Mid or Full provider inherit it from the selected Act tier. See iframe targeting for the standalone-frame workflow and safety checks.

Shadow DOM note: The accessibility tree only traverses light DOM. On Web Component-heavy pages (Stripe, Salesforce, Shopify), use get_interactive_elements first; in Full Act or Dev mode, use get_shadow_dom / shadow_dom_query for targeted reads.

Tools that are not in the table

Skill tools. Loaded skills can append tool schemas for the current run. The bundled FreeSkillz.xyz skill, for example, can expose read_youtube_transcript plus resolve_public_media / download_public_media. These are not hard-coded: before the skill is loaded (or if it is removed), the tools are absent. Ask mode still filters out mutating and download tools even when their owning skill is loaded. See skills.

WebMCP (experimental, opt-in). The list_webmcp_tools / execute_webmcp_tool rows apply only when Experimental WebMCP is enabled under Settings → General → Advanced. The setting is off by default; while off, the tools and their prompt guidance are omitted from model requests. WebMCP annotations such as readOnly are page-authored hints, not a security boundary. Every invocation requires Act or Dev, fresh per-call confirmation, and the normal capability × registration-frame-origin permission. WebMCP currently requires a supporting Chrome build/page configuration; Firefox does not expose these tools.

Dev-mode page editing and diagnostics

Dev tools are only exposed in Dev mode, and Dev mode is blocked for Compact-tier providers. Chrome's reversible editing tools return patch IDs: inject_css pairs with remove_injected_css, and patch_element pairs with revert_patch.

  • inject_css / remove_injected_css apply and undo temporary CSS by patchId. Each patch is unique and bound to the exact page document, and its metadata is kept in session storage so a service-worker restart does not lose the undo handle. Navigating invalidates the old handle instead of letting it affect a replacement page.
  • patch_element / revert_patch make structured inline-style, class, and attribute changes with exact before/after values. Browser-equivalent style and HTML attribute names are canonicalized before the undo record is created, contradictory set/remove operations are rejected, and executable URL attributes reject javascript: values (including form action). highlight_element provides a temporary pointer-transparent target overlay; because it inserts live DOM, it uses the temporary Dev-patch permission.
  • execute_js runs an async JavaScript function body in the page main world. Chrome uses CDP Runtime.evaluate with a 15-second execution limit; Firefox uses its MV2 content-script evaluator. The tool is host-permission gated and receives a fresh submit confirmation.
  • read_console, inspect_network_requests, inspect_event_listeners provide bounded diagnostics on Chrome. Capture starts before either streaming or non-streaming Dev runs and stops when the tab leaves Dev mode or its conversation is cleared; leaving Dev drains every tab with active capture even if the panel switched tabs, removes handlers and buffers, and disables the matching CDP domains. Listener inspection briefly adds and restores an internal target attribute, follows open-shadow hosts when collecting ancestors, and therefore uses the same host permission as temporary Dev patches. Network headers and bodies are omitted by default, sensitive header names (including common API/subscription-key variants) are redacted before buffering, and page-derived diagnostic output is treated as untrusted content.

See also