---
title: "MCP tools"
description: "The tools Lilo's built-in MCP server gives AI agents, with each tool's parameters, types and required fields, generated from the app's definitions."
sidebar:
  order: 3
---

The tools an AI agent can call once you turn on **Let agents use Lilo** in Settings > Agents. Each one has a short summary and the parameters an MCP client sends, with their types, allowed values and whether they are required. To connect an agent, see [AI agents](/guides/ai-agents).

What holds for every tool:

- The tools Claude in Chrome has keep its names and shapes, so an agent written for it needs nothing new. Lilo adds more, such as the Web Inspector, network and profile tools.
- An agent works in its own folder, which the tool descriptions call its tab group. `tabId` is the number `tabs_context_mcp` and `tabs_create_mcp` give for a tab of that folder, and an agent reaches only the tabs of its folders. An agent connected from another app works in an Agents Space, in the Agents profile until you allow one of yours; an agent in a Lilo conversation works in the conversation's folder of your own Space, with that Space's profile and your sign-ins. No agent reaches one of your Private Spaces. These tools are all Lilo gives an agent: a conversation agent's own file and command tools are the agent's, not Lilo's, and none of what follows applies to them.
- Some actions wait for your approval, unless you turn off **Ask before sending, paying, deleting or publishing**: a click or Enter on a button, link or form whose label or form address contains one of a fixed list of words such as "send", "pay", "delete" or "publish", and a request other than GET or HEAD with the cookies of one of your profiles. The word check is best effort: clicks on other kinds of element, other labels, other languages, icons and Enter in a message box pass without a question. Whatever that setting, Lilo asks before an agent hands a page one of your files. Opening a local file with `navigate` and reading it asks nothing. [Agent safety](/about/agent-safety) explains what the approvals cover and what they do not.
- A parameter description below is the text the agent itself reads.

## Tabs and pages [#tabs-and-pages]

### `tabs_context_mcp` [#tabs_context_mcp]

Lists the tabs of the agent's folder (its tab group), and can create the folder with an empty tab when it does not exist yet.

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `createIfEmpty` | `boolean` | no | Creates your tab group with an empty tab if none exists. |
| `title` | `string` | no | What you are working on, in 2 to 4 words ("Signup flow", "CSV export bug"): your group's name the user sees, and which group is listed. |

### `tabs_create_mcp` [#tabs_create_mcp]

Opens a new empty tab in the agent's folder, in the background, optionally in a Private Space of the agent's own that shares no cookies or sign-ins with its other tabs.

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `title` | `string` | no | What you are working on, in 2 to 4 words: your group's name the user sees, and which group the tab goes in. |
| `isolated` | `boolean` | no | True for a tab in your own private space: it shares no cookie, storage or sign-in with your other tabs, like a fresh visitor or a second user. Your isolated tabs share one cookie jar, gone when you disconnect. |

### `tabs_close_mcp` [#tabs_close_mcp]

Closes one of the agent's tabs.

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `tabId` | `number` | yes | The tab to close. |

### `navigate` [#navigate]

Loads a URL in a tab, or goes back, forward or reloads, then waits for redirects and for the page to settle before giving its final URL and title.

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `url` | `string` | yes | The URL to load (the scheme defaults to https://), or "back", "forward" or "reload". |
| `tabId` | `number` | yes | The tab to navigate. |

### `read_page` [#read_page]

Returns the page's accessibility tree, each element with a ref the other tools accept, optionally limited to interactive elements or one subtree.

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `tabId` | `number` | yes | The tab to read. |
| `filter` | `string`: `interactive`, `all` | no | "all" (default) or "interactive". |
| `ref_id` | `string` | no | Read only this element's subtree. |
| `depth` | `number` | no | Maximum tree depth (default 15). |
| `max_chars` | `number` | no | Maximum characters of output (default 50000). |

### `find` [#find]

Finds up to 20 shown elements whose role, name or text contains a query, ignoring case.

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `query` | `string` | yes | Text to look for. |
| `tabId` | `number` | yes | The tab to search. |

### `wait_for` [#wait_for]

Waits until a text, element or role shows or disappears, a control becomes enabled, or the tab reaches a URL, for up to 50 seconds.

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `text` | `string` | no | Text that must show, case-insensitively. |
| `selector` | `string` | no | A CSS selector, instead of text. |
| `role` | `string` | no | An element's role as read\_page gives it (button, link, textbox, heading...), instead of text. |
| `name` | `string` | no | With role: part of the element's name as read\_page gives it, case-insensitively. |
| `url` | `string` | no | Part of the tab's URL, or with \* for any run of characters a pattern for the whole URL (\*/orders/\*), case-sensitively. Takes no state. |
| `state` | `string`: `visible`, `hidden`, `enabled` | no | visible (default): until it shows; hidden: until it is gone; enabled: until the selector's or role's element shows, not disabled. |
| `timeout` | `number` | no | Seconds, 10 by default, up to 50. |
| `tabId` | `number` | yes | The tab. |

### `get_page_text` [#get_page_text]

Extracts the visible text of the page, its article or main content first.

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `tabId` | `number` | yes | The tab to read. |
| `max_chars` | `number` | no | Maximum characters of output (default 50000). |

### `form_input` [#form_input]

Sets the value of an input, text area, select, checkbox or editable element by its ref, and reports what the element holds afterwards.

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `ref` | `string` | yes | The element's ref from read\_page or find. |
| `value` | `string` or `boolean` or `number` | yes | The value; a boolean for a checkbox. |
| `tabId` | `number` | yes | The tab. |

### `javascript_tool` [#javascript_tool]

Runs JavaScript in the page and returns the value of its last expression; top-level await works.

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `action` | `string`: `javascript_exec` | yes | Always "javascript\_exec". |
| `text` | `string` | yes | The JavaScript code to run. |
| `timeout` | `number` | no | Seconds before the call is stopped, 55 by default, up to 600: for a long fetch or wait. Past 60 s your MCP client may stop waiting first, unless it takes progress notifications. |
| `tabId` | `number` | yes | The tab. |

### `fetch` [#fetch]

Sends an HTTP request from a tab as its page would, with its origin and cookies; a request other than GET or HEAD in one of your profiles waits for your approval.

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `url` | `string` | yes | The URL to request. |
| `method` | `string` | no | GET by default. |
| `headers` | `object` | no | Request headers by name. The browser sets Cookie itself. |
| `body` | `string` or `object` or `array` | no | The request body: a string, or JSON for an object. |
| `credentials` | `string`: `same-origin`, `include`, `omit` | no | Which requests carry cookies, as fetch's option: same-origin by default, include for a cross-origin API that allows them. |
| `responseType` | `string`: `text`, `json`, `base64` | no | How the body comes back: text (default), parsed json, or base64 for binary. |
| `maxBytes` | `number` | no | Most bytes of the body read, 1048576 (1 MB) by default, up to 10485760. |
| `tabId` | `number` | yes | The tab whose page sends the request. |

## Interaction [#interaction]

### `computer` [#computer]

Clicks, types, presses keys, scrolls, drags and hovers in a tab, takes screenshots, and screenshots one region at full detail; a click or Enter on a control whose label contains a word such as send, pay, order, delete or publish waits for your approval.

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `action` | `string`: `left_click`, `right_click`, `double_click`, `triple_click`, `type`, `insert_text`, `key`, `screenshot`, `wait`, `scroll`, `left_click_drag`, `zoom`, `scroll_to`, `hover` | yes |  |
| `coordinate` | `array` of `number` | no | (x, y) for clicks, scroll, hover, and the end of a drag. |
| `ref` | `string` | no | An element ref from read\_page or find, instead of coordinate; for screenshot, the element to capture. |
| `selector` | `string` | no | screenshot: a CSS selector of the element to capture, instead of ref. |
| `margin` | `number` | no | screenshot of an element: CSS pixels kept around it, 0 by default. |
| `fullPage` | `boolean` | no | screenshot: the whole page, lazy content loaded, without resizing the viewport. |
| `fullResolution` | `boolean` | no | screenshot: at the page's device pixel ratio instead of one pixel per point. |
| `savePath` | `string` | no | screenshot: an absolute .png path to write it to, folders created; the reply gives the path, not the image. |
| `text` | `string` | no | The text to type or insert, or for key the keys: space separated, modifiers joined by + (cmd+a, Return). |
| `modifiers` | `string` | no | Modifier keys held during a click, joined by + (cmd, shift, alt, ctrl). |
| `scroll_direction` | `string`: `up`, `down`, `left`, `right` | no |  |
| `scroll_amount` | `number` | no | Wheel ticks, 3 by default. |
| `start_coordinate` | `array` of `number` | no | (x, y) where a drag starts. |
| `region` | `array` of `number` | no | (x0, y0, x1, y1) to zoom on. |
| `duration` | `number` | no | Seconds to wait, at most 10. |
| `repeat` | `number` | no | How many times to press the keys of a key action. |
| `tabId` | `number` | yes | The tab. |

### `resize_window` [#resize_window]

Sets the size of a tab's viewport to test a layout at another width, without resizing Lilo's window.

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `width` | `number` | yes | Width in pixels. |
| `height` | `number` | yes | Height in pixels. |
| `tabId` | `number` | yes | The tab. |

### `read_console_messages` [#read_console_messages]

Returns the console output of the tab's current page, optionally only errors or messages containing a text.

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `tabId` | `number` | yes | The tab. |
| `onlyErrors` | `boolean` | no | Only errors. |
| `pattern` | `string` | no | Only messages containing this text. |
| `limit` | `number` | no | Most recent messages to return, 50 by default, at most 200. |

### `read_network_requests` [#read_network_requests]

Lists the tab's network requests with their method, status, URL, type, size and duration; once a devtools tool has run on the tab, one request can be read in full, body included.

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `tabId` | `number` | yes | The tab. |
| `urlPattern` | `string` | no | Only requests whose URL contains this text, as is: not a regex, unlike network\_mock's. |
| `exclude` | `array` of `string` | no | Leave out requests whose URL contains any of these texts, like \["/node\_modules/", "/@vite/", "/src/"\] for a dev server's modules. |
| `requestId` | `string` | no | One request in full, its id as a string: "0.16620". |
| `limit` | `number` | no | Most recent requests to return, 50 by default. |

### `file_upload` [#file_upload]

Chooses files for a file input without showing a file panel, once you allow each file.

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `paths` | `array` of `string` | yes | Absolute paths of the files. |
| `ref` | `string` | yes | The file input's ref. |
| `tabId` | `number` | yes | The tab. |

### `upload_image` [#upload_image]

Drops an image on an element or sets it on a file input, from a screenshot the agent took or from a file you allow.

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `imageId` | `string` | no | The id of a screenshot taken with computer. |
| `path` | `string` | no | An absolute path to an image file, which the user allows first. |
| `ref` | `string` | no | The target element's ref. |
| `coordinate` | `array` of `number` | no | (x, y) of the target instead of ref. |
| `filename` | `string` | no | The file name the page sees. |
| `tabId` | `number` | yes | The tab. |

### `gif_creator` [#gif_creator]

Records the actions in a tab and exports them as an animated GIF to the Downloads folder.

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `action` | `string`: `start_recording`, `stop_recording`, `export`, `clear` | yes |  |
| `filename` | `string` | no | File name for export. |
| `tabId` | `number` | yes | The tab. |

### `browser_batch` [#browser_batch]

Runs several tool calls in order in one round trip, stopping at the first error.

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `actions` | `array` of `object` | yes | Each item is \{name, input\}: a tool name and its arguments. |
| `actions[].name` | `string` | yes |  |
| `actions[].input` | `object` | yes |  |

### `run` [#run]

Runs a JavaScript program that calls the other tools itself, for loops and branches over many steps in one round trip, with at most 200 tool calls.

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `code` | `string` | yes | The body of an async function: await and return work. For example: for (const u of urls) \{ await tool('navigate', \{tabId: 1, url: u\}); out.push(await tool('get\_page\_text', \{tabId: 1\})) \} return out |
| `timeout` | `number` | no | Seconds before the run is stopped, 55 by default, up to 600. Past 60 s your MCP client may stop waiting first, unless it takes progress notifications. |

### `list_profiles` [#list_profiles]

Lists Lilo's profiles, marking the one the agent's tabs use (the Agents profile by default) and the one you work in.

No parameters.

### `switch_profile` [#switch_profile]

Moves the agent's tabs to another profile so it can act with that profile's sign-ins, once you allow that profile.

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `profile` | `string` | yes | The profile's name or id, from list\_profiles. |

### `reset_profile` [#reset_profile]

Wipes the Agents profile's cookies, storage, cache and history and reloads the agent's tabs; it never touches your own profiles.

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `wait` | `number` | no | Seconds to wait for other agents to close their tabs, up to 600 (default 0). |

## Developer tools [#developer-tools]

### `devtools_command` [#devtools_command]

Sends a command of WebKit's Web Inspector protocol to a tab and returns its result, or lists every command this WebKit supports.

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `method` | `string` | no | Domain.command, for example Runtime.evaluate or DOM.getDocument. |
| `params` | `object` | no | The command's parameters. |
| `tabId` | `number` | yes | The tab. |

### `devtools_events` [#devtools_events]

Reads the Web Inspector protocol events of a tab, from the domains the agent sent commands to.

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `prefix` | `string` | no | Only events whose name starts with this, like Network. or Console.messageAdded. |
| `limit` | `number` | no | Most recent events to return, 50 by default. |
| `clear` | `boolean` | no | Empty the buffer after reading. |
| `tabId` | `number` | yes | The tab. |

### `network_mock` [#network_mock]

Intercepts a tab's requests whose URL matches a regular expression to mock, fail, rewrite or delay them.

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `action` | `string`: `add`, `remove`, `list`, `clear` | yes |  |
| `id` | `number` | no | The rule to remove. |
| `urlPattern` | `string` | no | A JavaScript regex tested against the full URL. |
| `methods` | `array` of `string` | no | Only requests of these HTTP methods, like \["POST"\]. |
| `bodyPattern` | `string` | no | Only requests whose body, as text, matches this JavaScript regex. |
| `bodyJson` | `object` | no | Only requests whose JSON body has all these top-level fields. A string is a regex over the field's value: \{operationName: "\^GetUser$"\} for one GraphQL operation, \{query: "\^\\s\*mutation\\b"\} for every mutation. Other values must be equal. A batch (a JSON array) matches when one of its items does. |
| `stage` | `string`: `request`, `response` | no | request (default): before it is sent. response: replace the real response. |
| `response` | `object` | no | The mock: status (200), statusText, headers, mimeType (text/plain, or the file's), and one of body (text), bodyBase64, or path: an absolute local path, read on each request. $1 and up in path take urlPattern's groups, to serve a folder: /assets/(\[\^?\]\*) with /abs/dist/assets/$1. A missing file answers 404. The user allows the file, or the folder, first. |
| `error` | `string`: `General`, `AccessControl`, `Cancellation`, `Timeout` | no | Fail the request instead. |
| `modify` | `object` | no | Send the request changed instead: url, method, headers, postData. |
| `delayMs` | `number` | no | Wait this long before applying the outcome. |
| `tabId` | `number` | yes | The tab. |

### `network_response` [#network_response]

Returns a tab's requests in full, with headers, bodies, timings and sizes, or saves them as a HAR file.

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `url` | `string` | no | The URL, or part of it; for one request, the most recent with exactly this URL wins, else the most recent containing it. |
| `requestId` | `string` | no | One request by its id, from read\_network\_requests or all, as a string: "0.16620". |
| `responseBody` | `boolean` | no | false leaves the response body out, for a request body alone. |
| `method` | `string` | no | Only requests of this method, like POST. |
| `all` | `boolean` | no | Every matching request (the last 200), not just the most recent. |
| `har` | `boolean` | no | Save every matching request, bodies whole, as a HAR file and return its path. |
| `max_chars` | `number` | no | Maximum characters of each body (default 5000 for one request, 2000 with all). A longer JSON body also comes with bodyShape: its keys and types, and each array's length. |
| `tabId` | `number` | yes | The tab. |

### `cookies` [#cookies]

Reads and changes the cookies of a tab's profile, HttpOnly ones included; reading and deleting reach only the cookies of the sites the agent's tabs show.

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `action` | `string`: `get`, `set`, `delete`, `clear` | yes |  |
| `url` | `string` | no | get: the cookies a request to this URL would send. |
| `domain` | `string` | no | get, delete, clear: this domain and its subdomains. |
| `name` | `string` | no | delete: the cookie's name. |
| `cookie` | `object` | no | set: name, value, domain, path (/), expires (unix seconds, a session cookie without), httpOnly, secure, sameSite (Lax, Strict or None). |
| `tabId` | `number` | yes | The tab. |

### `emulate` [#emulate]

Makes a tab look like another environment: user agent, pixel ratio, color scheme, reduced motion, contrast, media type, JavaScript, images, cache, extra headers, a script run before each page, text replacement and freezing.

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `userAgent` | `string` or `null` | no | The User-Agent header and navigator.userAgent, from the next load. |
| `deviceScaleFactor` | `number` or `null` | no | devicePixelRatio, like 2 or 3. |
| `colorScheme` | `string` or `null`: `light`, `dark`, `null` | no | prefers-color-scheme: the light or dark theme of a site that follows the system. |
| `reducedMotion` | `string` or `null`: `reduce`, `no-preference`, `null` | no | prefers-reduced-motion. |
| `contrast` | `string` or `null`: `more`, `no-preference`, `null` | no | prefers-contrast: more for a high contrast theme, with either colorScheme. |
| `media` | `string` or `null`: `print`, `screen`, `null` | no | The CSS media type. |
| `javascript` | `boolean` or `null` | no | false runs pages without JavaScript. |
| `images` | `boolean` or `null` | no | false loads no images. |
| `cache` | `boolean` or `null` | no | false bypasses the HTTP cache. |
| `extraHeaders` | `object` or `null` | no | Headers added to every request, by name. |
| `initScript` | `string` or `null` | no | JavaScript run in the main frame of every page before its own scripts, from the next load (navigate reload; a single-page app's route change is no load): performance observers, timing marks, API stubs. |
| `textReplace` | `array` of `array` of `string` or `null` | no | \[\[pattern, replacement\], ...\] kept applied as the page renders, for anonymized captures: text, field values, placeholder, title, alt and aria-label, shadow DOM, every frame and the tab title, now and at each load. A pattern is literal text matched as whole words in any case, or /a regex/flags ($1 in the replacement). Text split across elements, canvas and images are not reached. null puts the page's text back. |
| `textReplaceGuard` | `boolean` or `array` of `string` or `null` | no | true, or more patterns that must not show, like the first name alone: computer screenshot and zoom fail while a textReplace or guard pattern matches the rendered text, a name split by markup included, or a field. |
| `frozen` | `boolean` or `null` | no | true freezes the tab as Lilo freezes a user's tab left in the background (page suspended, told it is hidden, media paused). Your next call on the tab wakes it, as the user coming back to it. |
| `reset` | `boolean` | no | Undo every emulation of the tab. |
| `tabId` | `number` | yes | The tab. |

### `performance` [#performance]

Measures a tab: load and paint metrics and memory, a timeline profile with a summary, heap snapshots and garbage collection.

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `action` | `string`: `metrics`, `start`, `stop`, `summary`, `heap_snapshot`, `gc` | yes |  |
| `fromMs` | `number` | no | stop, summary: only what happened from this many ms after the start. |
| `toMs` | `number` | no | stop, summary: only what happened until this many ms after the start. |
| `focus` | `string` | no | stop, summary: the call paths leading to functions whose name contains this, like appendChild. |
| `screenshots` | `boolean` | no | start: also record a screenshot each frame, which costs the page time (off by default). |
| `className` | `string` | no | heap\_snapshot: list what retains objects of this class, and a path to one from a root. |
| `tabId` | `number` | yes | The tab. |

## Browser selection [#browser-selection]

| Tool | Parameters | Summary |
| --- | --- | --- |
| `list_connected_browsers` | none | Lists the browsers this server can drive, which is only the running Lilo. |
| `select_browser` | `deviceId` | Selects the browser to drive; Lilo is the only one. |
| `switch_browser` | none | Connects to a browser; Lilo is already connected. |

The browser selection tools exist so that clients written for several browsers find the one they expect. They are not offered to the agents you talk to in a Lilo conversation.