Name: Weavetab
Author: Weavetab

Weavetab MCP

Give AI agents full control over live browsers and apps to navigate, click, extract, and automate.

Grade B Local · stdio No auth needed 50 tools v2.5.0-beta.2 · 27 Aug 2026

No reviews yet by Weavetabnpm Runs on your machine, nothing hosted

89/100

trust score

tools declared

local

runs on your machine

—

downloads a day

What it does

Give AI agents full control over live browsers and apps to navigate, click, extract, and automate.

Quickstart

# 1 — add it to Claude Code
claude mcp add --scope user weavetab-weavetab-mcp '--' npx -y @weavetab/mcp

# 2 — ask your agent for something these tools do
#   browser_map, browser_navigate, browser_click and 47 more

Weavetab costs nothing on mcprush: there is no plan to choose here, no cap to set and nothing mcprush can bill you for.

Publishernot claimed

Weavetab1 server

1 category

All 1 server

Collected from a public index. Nobody has claimed this account, so nothing here was written by its author — claim it if it is yours.

Tool surface

What the model actually sees. Descriptions are diffed on every release — see version history.

Only tools that write or reach the network

Snapshot interactive DOM with volatile ref IDs that invalidate after DOM mutations. For complex SPAs (e.g. GitHub dashboards), use scope or query to reduce tokens. For forms/pagination/sequential loops, ALWAYS use delta: true to save 97% tokens. For canvas/WebGL/Figma pages where the DOM has…

Parameter	Type	Required	Notes
full	boolean	no	Set to true to return a full markdown table (heavier context) instead of the lite list.
scope	string	no	Restrict parsing to a semantic page area to save tokens. Useful on dense dashboards.
query	string	no	Filter returned elements by label or role substring. Useful on dense dashboards.
delta	boolean	no	Diff mode: return ONLY elements that changed since the last browser_map call (added, removed, or modified). Diffs across time — distinct from prune. Cuts prompt tokens by up to 97% on consecutive call
ax_tree	boolean	no	Bypass the extension entirely and read raw Chrome Accessibility Tree. Use this if Shadow DOMs hide elements.
tab_id	string	no	Read a specific background tab instead of the active one.
app	string	no	Electron app name configured in config.json under 'electron'.
show_overlays	boolean	no	Default false. Debug only — draws colored element borders via extension (ugly). The blue edge glow is the standard visual indicator, shown automatically during reading states. Only enable this for deb
force	boolean	no	Force a full DOM map rebuild even if loop detection says nothing changed. Bypasses the map skip guard and resets loop strikes.
prune	boolean	no	Semantic DOM pruning: compress the current snapshot before returning. Drops hidden elements with no interactive descendants and not referenced by any toggle trigger (aria-controls etc.). Replaces SVG
visual		no	Set-of-Marks visual grounding. true = always inject numbered badges + return annotated screenshot. "auto" = only activate when DOM interactive count < 5 (canvas/WebGL/Figma pages). After receiving mar

Navigate to a URL or launch/focus a configured Electron app.

Parameter	Type	Required	Notes
url	string	no	Absolute URL to navigate to (must include https:// or app URL). Optional if 'app' is specified.
app	string	no	Electron app name configured in config.json under 'electron' (e.g. 'example' or 'my-dev-app'). When specified, targets or launches the Electron app.
force	boolean	no	If true, overwrites current tab even if it's protected (anchor tab). Otherwise opens a new tab automatically.
tab_id	string	no	Target a specific tab ID for navigation instead of the active tab.

Click a DOM element. Use browser_canvas for charts/canvas. If stuck_warning=true, stop and use browser_map. Pass mark: N to click a numbered element from browser_map({ visual: true/"auto" }) without any DOM re-scan.

Parameter	Type	Required	Notes
id	string	no	Ref ID from browser_map (e.g. 'w:42'). Primary targeting method. DO NOT SPAM. If stuck_warning is returned, stop retrying and call browser_map first.
ref	string	no	Alias for id (e.g. 'w:42').
selector	string	no	CSS selector of the element to click.
target	string	no	CSS selector or query string. Alias for selector.
label	string	no	Visible text or aria-label to click.
intent	string	no	Semantic description of the action (e.g. 'submit login form'). WeaveTab checks learned memory first — if a high-confidence selector is found it clicks immediately without DOM resolution. Falls through
mark	integer	no	Mark number from browser_map({ visual: true/"auto" }). Clicks the center of the numbered badge seen in the annotated screenshot. Zero DOM walk — instant coordinate dispatch. Use when the page is canva
backendNodeId	number	no	Raw CDP backendNodeId for direct hardware targeting.
x	number	no	Raw X coordinate. Use for precise positional clicks when element ID is not available.
y	number	no	Raw Y coordinate. Use for precise positional clicks when element ID is not available.
include_map	boolean	no	Set true to include a full updated page_map in the response. Default false — omit when you already have ref IDs or don't need a DOM refresh.
tab_id	string	no	Execute in a specific tab instead of active.
app	string	no	Electron app name configured in config.json under 'electron'.

Type text into an input field or currently focused element. If id/selector/label is omitted, automatically types directly into document.activeElement without needing a redundant click or browser_map. If target is already focused, skips click to prevent unfocus bugs.

Parameter	Type	Required	Notes
id	string	no	Ref ID from browser_map (e.g. 'w:42'). If omitted, types directly into the currently focused element or single page input.
ref	string	no	Alias for id (e.g. 'w:42').
selector	string	no	CSS selector of the input field.
target	string	no	CSS selector or query string. Alias for selector.
label	string	no	Field label or placeholder text. Used for fuzzy matching.
intent	string	no	Semantic description of the field (e.g. 'search box', 'username field'). Checked against learned memory first.
x	number	no	Raw X coordinate to focus before typing.
y	number	no	Raw Y coordinate to focus before typing.
text	string	yes	Text to type into the field.
clearFirst	boolean	no	Wipe existing field content before typing.
paste	boolean	no	Instant paste mode via clipboard. Auto-enabled for text longer than 8 chars.
include_map	boolean	no	Set true to include a full updated page_map in the response. Default false.
tab_id	string	no	Execute in a specific tab instead of active.
app	string	no	Electron app name configured in config.json under 'electron'.

Inject a secret from an environment variable.

Parameter	Type	Required	Notes
id	string	no	Ref ID from browser_map.
ref	string	no	Alias for id (e.g. 'w:42').
target	string	no	Alternative target input element identifier or CSS selector.
envKey	string	yes	The environment variable key containing the secret.
app	string	no	Electron app name configured in config.json under 'electron'.

Press a keyboard key.

Parameter	Type	Required	Notes
key	string	yes	Key name: Enter, Escape, Tab, ArrowDown, F5, etc. DO NOT SPAM. If action fails or loops, STOP calling this tool and use browser_map to re-evaluate the page state.
modifiers	array	no	Array of modifier keys to hold during the press.
tab_id	string	no	Execute in a specific tab instead of active.
app	string	no	Electron app name configured in config.json under 'electron'.

Scroll the page.

Parameter	Type	Required	Notes
id	string	no	Ref ID to scroll into view or scroll inside of. DO NOT SPAM. If action fails or loops, STOP calling this tool and use browser_map to re-evaluate the page state.
ref	string	no	Alias for id (e.g. 'w:42').
selector	string	no	CSS Selector of the element to scroll into view.
target	string	no	Alternative element identifier or query to scroll into view.
label	string	no	Element label to scroll into view.
direction	string	yes	Scroll direction.
distance	number	no	Pixels to scroll (default 400).
tab_id	string	no	Execute in a specific tab instead of active. DO NOT SPAM. If action fails or loops, STOP calling this tool and use browser_map to re-evaluate the page state.
app	string	no	Electron app name configured in config.json under 'electron'.

Accept or dismiss JS dialogs (alert, confirm, prompt). Browser sessions only.

Parameter	Type	Required	Notes
action	string	yes	Action to perform on the dialog.
promptText	string	no	Text to enter if it is a prompt dialog.

HIGH-SPEED MULTI-ACTION PIPELINE: Executes 2 or more sequential browser actions in a single round-trip without waiting for LLM turns between steps. PREFER THIS over individual single-action calls (e.g. typing + pressing Enter, filling multiple form fields, clicking tabs/buttons then waiting,…

Parameter	Type	Required	Notes
steps	array	no	Ordered array of tool calls or macros to execute serially. Either 'steps' or 'actions' may be passed.
actions	array	no	Alias for 'steps'.
compile_from_history	boolean	no	Compile recent successful session trail actions into a macro. If steps are omitted, executes the compiled macro directly.
history_limit	number	no	Number of recent session trail entries to consider when compile_from_history is true (default: 20).
dry_run	boolean	no	If true with compile_from_history, returns the compiled steps without executing them.
stop_on_error	boolean	no	Halt execution immediately if a step fails to prevent cascading failures (default: true).
batch	boolean	no	If true, defers action map generation until all steps are complete to maximize throughput.
app	string	no	Electron app name configured in config.json under 'electron'.

Manage browser and Electron app tabs/windows (open, switch, close, list). Specify 'app' when targeting desktop apps (e.g. app: 'discord') to avoid opening web browser.

Parameter	Type	Required	Notes
action	string	yes	Action to perform. 'consolidate' deduplicates tabs. 'heal' recovers crashed tabs.
url	string	no	URL to open (required for 'open' action).
app	string	no	Optional Electron app name configured in config.json under 'electron'.
tabId	string	no	Target Tab ID (required for 'switch' or 'close').
tabIds	array	no	Multiple Tab IDs for batch 'close' action.
force	boolean	no	Force close protected (anchor) tabs. Use with extreme caution.
windowId	number	no	Window ID to focus (required for 'focus_window').
reuse	boolean	no	Default true. When opening a URL already loaded in another tab, focus that tab instead of opening a duplicate.

Pause until a condition is met.

Parameter	Type	Required	Notes
for	string	yes	'stable' = DOM stops mutating, 'network' = 0 pending requests. 'auto' tries to guess.
value	string	no	CSS selector, text string, or URL pattern. Not needed for 'stable'/'network'.
timeout	number	no	Max wait in ms (default 8000).
tab_id	string	no	Execute in a specific tab instead of active.
app	string	no	Electron app name configured in config.json under 'electron'.

Autonomous CAPTCHA detection and solving.

Parameter	Type	Required	Notes
action	string	yes	Action to perform.
timeout	number	no	Timeout in ms (default 120000).

Agent-to-user communication. Renders in the middle down of the page. Use 'question' mode to ask a free-text question. Use 'feedback' mode to provide status updates, analysis, or decisions. Supports element anchoring (e.g. 'w:15') and presentation styles ('observation', 'decision', 'warning',…

Parameter	Type	Required	Notes
action	string	yes	Action to perform.
message	string	yes	The question to ask, or the feedback/analysis to log.
anchor	string	no	Optional element Ref ID (e.g. 'w:15') or CSS selector to visually anchor this thought to on the page.
style	string	no	Thought presentation style. Defaults to 'observation' for feedback and 'question' for question.
input	string	no	Input field type for question mode (default: sentence).
timeout	number	no	Timeout in seconds for question mode before auto-cancel (default: 120).
app	string	no	Optional Electron app name. (Note: thought HUD overlay is browser-only).

Advanced pointer control (hover, click, double_click, drag_and_drop, hover_chain). Use hover_chain for Photoshop/Photopea, Figma, and multi-level flyout submenus.

Parameter	Type	Required	Notes
action	string	no	Action to perform (default: click, or hover_chain if hover_chain array is provided).
ref	string	no	Ref ID of the target element (e.g. w:42).
id	string	no	Alternative element ID / Ref ID from browser_map.
selector	string	no	CSS Selector of the target element.
target	string	no	Alternative target element identifier or query.
label	string	no	Target element label or text.
x	number	no	Raw X coordinate (fallback).
y	number	no	Raw Y coordinate (fallback).
end_ref	string	no	Destination Ref ID (only for drag_and_drop).
end_id	string	no	Destination element ID (only for drag_and_drop).
end_selector	string	no	Destination CSS Selector (only for drag_and_drop).
end_target	string	no	Alternative destination target identifier or query.
end_x	number	no	Destination X coordinate (only for drag_and_drop).
end_y	number	no	Destination Y coordinate (only for drag_and_drop).
waitForChild	string	no	CSS Selector of a child element to wait for (only for hover).
holdMs	number	no	Milliseconds to hold the pointer down (only for hover).
hover_chain	array	no	Array of element ref IDs, selectors, or labels to hover sequentially and click the last one (e.g. ['File', 'Export As', 'PNG']). Perfect for Photoshop/Photopea, Figma, Canva, and multi-level flyout su
chain	array	no	Advanced chain step array of { action, ref, label, selector, x, y, holdMs }.
clickFinal	boolean	no	Default true. Whether to click the final element in the hover chain.
app	string	no	Electron app name configured in config.json under 'electron'.

Select an option from a native dropdown.

Parameter	Type	Required	Notes
nodeId	number	no	CDP backendNodeId.
selector	string	no	CSS Selector.
value	string	yes	The exact text value to select.
app	string	no	Electron app name configured in config.json under 'electron'.

Smart multi-field form-filling and input inspector. Call with scan:true (or empty) to get a lightweight list of all editable inputs on the page without dumping the full DOM. Fill multiple fields in a single turn.

Parameter	Type	Required	Notes
fields	array	no	Array of field ref+value pairs to fill sequentially.
scan	boolean	no	Set true to discover and return all fillable inputs on the page (with ref IDs, types, and values) in ~30 tokens without full browser_map.
inputs	boolean	no	Alias for scan.
scan_only	boolean	no	Validate field types without mutating DOM.
blast_mode	boolean	no	Fill all fields simultaneously in a single CDP eval round-trip.
submit	string	no	Optional ref ID (w:NN) of a submit button to click after filling all fields.
app	string	no	Electron app name configured in config.json under 'electron'.

Highlight elements on page. Supports single or multiple candidates (refs) with styles ('consideration' for candidate evaluation, 'target' for lock-on, 'danger' for destructive actions, 'success', or 'shimmer'), floating badges, and configurable duration.

Parameter	Type	Required	Notes
selector	string	no	CSS Selector of the element to highlight.
id	string	no	Alternative element Ref ID from browser_map (e.g. 'w:42').
ref	string	no	Alternative element Ref ID (e.g. 'w:42').
refs	array	no	Array of element Ref IDs to highlight concurrently (e.g. ['w:12', 'w:15', 'w:23']).
target	string	no	Alternative element identifier, CSS Selector, or query.
style	string	no	Visual highlight style. Defaults to 'shimmer' (or 'consideration' when refs provided).
label	string	no	Floating label badge text to display above the element(s).
duration	number	no	Duration in ms to keep highlight visible (default: 2000ms for consideration/target, 600ms for shimmer).
nodeId	number	no	CDP backendNodeId to highlight directly.
color	string	no	Custom CSS color to use for the overlay (e.g. 'rgba(255,0,0,0.5)').
app	string	no	Electron app name configured in config.json under 'electron'.

Upload files to a file input.

Parameter	Type	Required	Notes
nodeId	number	yes	CDP backendNodeId of the target <input type='file'> element.
filePaths	array	yes	List of absolute system file paths to upload.
app	string	no	Electron app name configured in config.json under 'electron'.

Instant text & keyword search across page text, labels, and placeholders. Returns matched element coordinates, selectors, and ref IDs.

Parameter	Type	Required	Notes
query	string	yes	Text or keyword query to search for on the page.
all	boolean	no	Set true to return all matching elements on the page (default false returns first match).
limit	number	no	Max number of matches to return when all: true (default 10).
app	string	no	Electron app name configured in config.json under 'electron'.

Manage localStorage and sessionStorage.

Parameter	Type	Required	Notes
scope	string	yes	Storage scope to manipulate.
action	string	yes	Action to perform on the storage.
key	string	no	Key name (required for 'get' and 'set' actions).
value	string	no	String value (required for 'set' action).
app	string	no	Electron app name configured in config.json under 'electron'.

Intercept/stub network responses (e.g. mock APIs, block tracking) OR retrieve detailed raw protocol network telemetry (TLS/SSL certificate info, microsecond timing breakdown, and OS-level failure reasons).

Parameter	Type	Required	Notes
action	string	yes	Action to perform: 'enable'/'disable' network response interception, 'get_telemetry' to read captured requests with TLS/SSL certs & timing breakdown, or 'clear_telemetry' to reset buffer.
pattern	string	no	URL glob pattern to intercept or filter telemetry (e.g. 'api/login').
mockStatus	number	no	HTTP status code to return when enabling mock (default 200).
mockBody	string	no	JSON or plaintext body payload to return in the mocked response.
app	string	no	Electron app name configured in config.json under 'electron'.

1-5ms latency. Read or clear buffered console API messages, JS exceptions, and network errors.

Parameter	Type	Required	Notes
action	string	yes	Action to perform on the console buffer.
app	string	no	Electron app name configured in config.json under 'electron'.

Print the current page to a PDF file.

Parameter	Type	Required	Notes
filename	string	no	Output filename (e.g. 'report.pdf'). Defaults to capture_<timestamp>.pdf.
landscape	boolean	no	Print in landscape orientation (default false).
scale	number	no	Scale factor (default 1.0).
pageRanges	string	no	Page ranges to print (e.g. '1-5'). Leave empty for all pages.
app	string	no	Electron app name configured in config.json under 'electron'.

Run arbitrary JS via CDP. Good for extracting app state. Cannot traverse shadow DOM/cross-origin iframes.

Parameter	Type	Required	Notes
expression	string	yes	JavaScript code to evaluate in the context of the page.
timeout	number	no	Timeout in ms (default 5000).
app	string	no	Electron app name configured in config.json under 'electron'.

Manage browser cookies.

Parameter	Type	Required	Notes
action	string	yes	Action to perform on cookies.
name	string	no	Cookie name.
value	string	no	Cookie value (required for 'set').
domain	string	no	Domain for the cookie.
path	string	no	Path for the cookie.
url	string	no	URL scope for 'get' action (defaults to current page).
app	string	no	Electron app name configured in config.json under 'electron'.

For ALL canvas content (charts, games, graphs). Use 'get_image' to read pixels, 'draw' to simulate gestures. Do NOT use browser_click here.

Parameter	Type	Required	Notes
action	string	yes	'get_image' — exports the canvas as a base64 image so you can analyze its visual content (prices, chart patterns, etc). 'draw' — simulates drag/pointer events across canvas points (for drawing, select
selector	string	no	CSS Selector for the target <canvas> element. Use 'canvas' to select the first canvas on the page, or a more specific selector like 'canvas#chart'.
id	string	no	Ref ID from browser_map (e.g. 'w:42') for the canvas element.
label	string	no	Visible text or aria-label of the canvas element.
ref	string	no	Alternative ref identifier for the canvas element.
backendNodeId	number	no	Raw CDP backendNodeId for direct targeting.
points	array	no	Array of {x,y} points relative to canvas viewport for 'draw' action. Simulates a drag path across the canvas.
app	string	no	Electron app name configured in config.json under 'electron'.

Sub-5ms latency, zero waste extraction. Best for batch list extraction, table parsing, targeted data mining. Prefer this over browser_map for pure data extraction. Note: XPath selectors lack shadow-DOM support; use CSS selectors for shadow DOMs.

Parameter	Type	Required	Notes
query	string	yes	CSS Selector or XPath query to extract.
type	string	no	Query type (default 'css').
attributes	array	no	Attributes to extract (e.g. ['textContent', 'href'], default ['textContent']).
multiple	boolean	no	Whether to extract multiple elements (default true).
app	string	no	Electron app name configured in config.json under 'electron'.

Capture or restore an MHTML snapshot. Best for offline archival, replay testing, and compliance audits.

Parameter	Type	Required	Notes
action	string	yes	Action to perform.
filePath	string	yes	Absolute file path to save/load the .mhtml snapshot.
app	string	no	Electron app name configured in config.json under 'electron'.

95-135ms capture. Best for visual layout validation, canvas/image inspection. For multimodal models only. Text-only models should use browser_map or browser_canvas instead.

Parameter	Type	Required	Notes
format	string	no	Capture format. 'jpeg' is smaller and faster for large pages. Default 'png'.
quality	number	no	JPEG quality 0-100 (default 90). Only used when format is jpeg.
fullPage	boolean	no	If true, captures the full scrollable page. Default false (viewport only).
clip	object	no	Clip region. Use to capture only part of the page (e.g. just a chart area) to reduce token cost.
app	string	no	Electron app name configured in config.json under 'electron'.

Set viewport dimensions and device emulation.

Parameter	Type	Required	Notes
action	string	yes	Action to perform.
width	number	no	Viewport width in pixels.
height	number	no	Viewport height in pixels.
deviceScaleFactor	number	no	Device Pixel Ratio (default 1).
mobile	boolean	no	Whether to emulate a mobile device (default false).
app	string	no	Electron app name configured in config.json under 'electron'.

Read or write to the system clipboard.

Parameter	Type	Required	Notes
action	string	yes	Action to perform.
text	string	no	Text to write to clipboard (for write action).
dataUrl	string	no	Base64 data URL of an image to write to clipboard (e.g. 'data:image/png;base64,...').
mimeType	string	no	MIME type override for image write (auto-detected from dataUrl by default, e.g. 'image/png').
app	string	no	Electron app name configured in config.json under 'electron'.

15-35ms latency, zero waste. Deep DOM inspection. Useful for debugging failed clicks, verifying z-index & visibility, or computed styles.

Parameter	Type	Required	Notes
nodeId	number	no	CDP backendNodeId.
selector	string	no	CSS Selector.
ref	string	no	Ref ID (e.g. 'w:42').
app	string	no	Electron app name configured in config.json under 'electron'.

Extract design tokens (colors, typography, spacing, shadows, CSS variables), semantic HTML layouts, and clean CSS into structured files and an LLM design blueprint. Ideal for cloning websites, UI components, and design systems with 100% pixel fidelity.

Parameter	Type	Required	Notes
selector	string	no	CSS selector of the container element to extract (default 'main', falls back to 'body').
format	string	no	Format preset for extracted styles: 'tailwind' (default, generates tailwind.theme.json), 'vanilla_css' (generates scoped styles), or 'tokens_only' (design tokens only).
outputDir	string	no	Optional custom directory to write extracted files into. If omitted, uses configured designDir (~/.weavetab/designs/<domain>-<timestamp>/).
name	string	no	Optional custom name for the saved design folder (e.g. 'resend-hero', 'pricing-section').
includeAssets	boolean	no	Whether to capture inline SVGs and asset references (default true).
hideOverlay	boolean	no	Whether to hide Weavetab overlay during capture (default true).
app	string	no	Electron app name configured in config.json under 'electron'.

Inject self-running background script for monitoring/polling. Cleared on tab close. Don't use persistent scripts for expensive ops.

Parameter	Type	Required	Notes
action	string	yes	Action to perform.
id	string	no	Unique script identifier (required for start/stop).
script	string	no	JavaScript code to inject and run (required for start).
persistent	boolean	no	If true, the script re-runs in a loop (default false).
onResult	string	no	How to handle script results (default 'store').
app	string	no	Electron app name configured in config.json under 'electron'.

Record video screencast for compliance/audit. Compiles captured frames into video/animation (.webp, .gif, .webm, .mp4).

Parameter	Type	Required	Notes
action	string	yes	Action to perform.
sessionId	string	no	Unique recording session ID (required for start/stop).
fps	number	no	Frames per second (1-10, default 3).
maxFrames	number	no	Maximum frames to capture (default 500).
format	string	no	Output video format when stopping recording. Default 'webp' (pure Node native compilation).
keepFrames	boolean	no	If true, keeps raw JPEG frames after video compilation (default false).
app	string	no	Electron app name configured in config.json under 'electron'.

CRITICAL INITIALIZATION TOOL. Detect available browsers and configured desktop apps (Discord, Slack, etc.). Call this FIRST before interacting with the environment to know if apps are online/offline and what tabs they have open.

No parameter schema on file.

Retrieve page performance metrics.

Parameter	Type	Required	Notes
app	string	no	Electron app name configured in config.json under 'electron'.

Read, register, update, and record execution outcomes for named workflow patterns and site quirks in ~/.weavetab-system/memory/sites/. Use action='get' at session start to inspect a site profile and decide between fast-path replay (reliability ≥ 0.8) or exploratory navigation. Use action='learn'…

Parameter	Type	Required	Notes
origin	string	no	Full origin associated with the pattern, e.g. 'https://github.com'. Required for write actions. If omitted with action='get', reads the active tab origin.
action	string	no	'get': inspect site profile and known workflow patterns. 'learn': create/update a named pattern. 'record_execution': update reliability after replay. 'record_quirk': store a site quirk.
pattern	string	no	With action='get': returns reliability score for this specific named pattern only.
name	string	no	Pattern name in snake_case (required for 'learn' and 'record_execution').
steps	array	no	Ordered workflow steps (required for 'learn').
success_indicator	string	no	CSS selector or URL fragment confirming workflow success.
entry	string	no	URL path or pattern where this workflow starts.
success	boolean	no	Whether the execution succeeded (required for 'record_execution').
duration_ms	number	no	Execution duration in ms (optional for 'record_execution').
quirk_key	string	no	Quirk key: 'cookie_banner', 'rate_limit', or 'modal_popups' (required for 'record_quirk').
quirk_data	object	no	Quirk payload object (required for 'record_quirk').

Interact with GitHub repositories without burning browser turns. Analyze repo trees, read raw source files, search/inspect issues, and examine PR diffs and review comments.

Parameter	Type	Required	Notes
action	string	yes	GitHub operation: 'analyze' (repo structure & README), 'read' (raw file contents), 'issues' (list/search/inspect issues), 'pr' (PR details, diff files & comments).
repo	string	no	Optional 'owner/repo' slug or GitHub URL. If omitted, uses active tab's repository.
paths	array	no	For action: 'read'. File paths relative to repo root.
line_range	array	no	For action: 'read'. Optional [start, end] line range (1-indexed).
number	number	no	For action: 'issues' or 'pr'. Issue or PR number to fetch details and comments.
search	string	no	For action: 'issues'. Search query to find issues.
labels	array	no	For action: 'issues'. Filter issues by labels.
state	string	no	For action: 'issues'. Filter issues by state.
limit	number	no	For action: 'issues'. Max number of issues to list (default 5).

Read and extract structured content from office documents (Excel, Word, PDF, CSV). Note: PDF/Word extraction requires local binary dependencies (e.g., poppler) and output is truncated by max_chars/max_rows limits. Two modes: - url — fetch a document URL using the browser's live session cookies…

Parameter	Type	Required	Notes
action	string	yes	'read' — parse a document and return its content. 'list' — show all files in the downloads directory.
url	string	no	URL of the document to fetch and parse in-browser (using active session cookies). Supports .pdf, .xlsx, .xls, .docx, .csv. Use for authenticated downloads, SharePoint links, Google Drive exports.
file	string	no	Bare filename (e.g. 'report.xlsx') of a file already in the local downloads directory. No path separators allowed.
max_rows	number	no	Max rows to return for Excel/CSV (default 500). Increase if you need more data.
max_chars	number	no	Max characters to return for PDF/Word text (default 50000).

Emulate browser conditions over CDP: network throttling (Slow 3G, Fast 3G, 4G, Offline), CPU throttling rate, Geolocation coordinates, Timezone, and User Agent string overrides.

Parameter	Type	Required	Notes
network		no	Network throttling profile or custom parameters
cpuThrottlingRate	number	no	CPU slowdown multiplier (e.g. 2 = 2x slowdown, 4 = 4x slowdown, 1 = disable)
geolocation	object	no	Override geolocation coordinates
timezoneId	string	no	Override browser timezone (e.g. 'America/New_York')
userAgent	string	no	Override User Agent string
app	string	no	Electron app name configured in config.json under 'electron'.

Snapshot and restore browser state (cookies, localStorage, sessionStorage, and scroll/URL) into named checkpoints to time-travel and rollback failed automation branches.

Parameter	Type	Required	Notes
action	string	yes	Action to perform: 'save' a new checkpoint, 'restore' an existing checkpoint, 'list' all checkpoints, or 'delete' a checkpoint.
name	string	no	Checkpoint name identifier (required for 'save', 'restore', 'delete').
includeDom	boolean	no	Whether to include a lightweight DOM snapshot during 'save' (default false).
app	string	no	Electron app name configured in config.json under 'electron'.

No parameter schema on file.

Free

$0 forever

Every tool, no call limit
No card, and mcprush charges nothing for it
Source published under AGPL-3.0
Runs on your machine — nothing of it reaches our gateway
Nothing to cap, because mcprush bills nothing

Nothing here is billable: mcprush charges nothing to install Weavetab or to call it, at any volume.

BTrust score 89 / 100

Release 2.5.0-beta.2 · scanned 17 Oct 2026

Two independent axes, because powerful and malicious are different questions. The grade is threat only. The capability level is blast radius, and it is never a penalty on the grade — it is priced as one subtract-only term in the score, where you can see it.

Threat score100

Client score89

Findings10 threat · 7 capability

Capabilitycritical

Coveragesource

Verificationrepo

Surface digest62e677b9fdebafde4c9d6a72b903780ddf08eb029aadf4cf181ddad6d9903165

Score vectorthreat 100 → client 89

Term	Level	What it prices	Points
capability-exposure	critical	capability blast radius (critical) — client exposure if the model is manipulated	−10
verification-discount	repo	publisher verification (public source) — no provenance, but the source is public and inspectable	−1
coverage-honesty	source	inspection depth (source) — how much of the target the scan could see	−0

score = clamp(round(threatScore − E_cap − E_ver − E_cov), 0, 100). No model, no opinion, no network call at scoring time: the same methodology version against the same bytes always produces this number, and every line above is a field of the report rather than a summary of it.

What the scan could actually read

A grade is only as meaningful as its coverage, so the scanner publishes its own depth before it publishes its result.

Tool surfaceread

Implementation sourceread

Package metadataread

Live transportnot available

Tools were statically extracted from the published source (47 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".

Capability — what it could do if the model were manipulated

Tags derived from each tool’s schema and the implementation, not from what the tool calls itself. critical is the level these add up to.

Tool	Capability tags	Why the tag was assigned
browser_map	no tags
browser_navigate	no tags
browser_click	no tags
browser_type	no tags
browser_type_secret	no tags
browser_key	no tags
browser_scroll	no tags
browser_dialog	no tags
browser_burst	no tags
browser_tabs	no tags
browser_wait	no tags
browser_captcha	no tags
browser_thoughts	no tags
browser_pointer	no tags
browser_select	no tags
browser_fill	no tags
browser_highlight	no tags
browser_upload	external-sink	external-sink: keyword "upload_file"
browser_find	no tags
browser_storage	no tags
browser_network_intercept	no tags
browser_console	no tags
browser_pdf	no tags
browser_eval	code-exec	code-exec: keyword "eval" in tool name
browser_cookies	no tags
browser_canvas	no tags
browser_scrape	untrusted-input	untrusted-input: keyword "scrape"
browser_snapshot	no tags
browser_screenshot	no tags
browser_viewport	no tags
browser_clipboard	no tags
browser_inspect	no tags
browser_extract_design	no tags
browser_automation	code-exec	code-exec: parameter "script"
browser_recording	no tags
browser_reset_loop_counter	no tags
browser_detect	no tags
browser_performance	no tags
browser_macro_compile	no tags
github_analyze	no tags
github_read	sensitive-source	sensitive-source: keyword "read_file"
github_issues	no tags
github_get_pr	no tags
browser_office	untrusted-input	untrusted-input: keyword "fetch", parameter "url" with "fetch" in the description
browser_emulate	no tags
list_plugins	no tags
load_plugin	no tags

Toxic-flow graph

The lethal trifecta, checked as a graph rather than as a checklist: untrusted input, a sensitive source and an external sink have to meet before there is a path worth worrying about.

browser_office → github_read → browser_automation

A cross-tool exfiltration chain exists: browser_office → github_read → browser_automation.

Supply chain and provenance

Integrityfirst-seen

Surface digest62e677b9fdebafde

Scanned2026-10-17

This is the first scan of this surface here, so there is nothing yet to compare it against.

Every result on this tab comes from one deterministic pass over the published package — offline, rule by rule, and auditable line by line above. Same methodology version, same bytes, same score.

Where are you running it?

Tool surface

Release history

Weavetab MCP

What it does

Quickstart

Where are you running it?

Tool surface

What counts against your monthly calls

What the scan could actually read

Capability — what it could do if the model were manipulated

Toxic-flow graph

Supply chain and provenance

Release history

See also