diff --git a/Caddyfile b/Caddyfile
index 2a5fd914..d7889f7f 100644
--- a/Caddyfile
+++ b/Caddyfile
@@ -17,6 +17,12 @@
 	@api path /api/* /api
 	reverse_proxy @api localhost:8090
 
+	# OpenMCP relay (tronbrowser.dev/mcp/tron): same API process. Its descriptor
+	# is the static /.well-known/openmcp.json below, which is what makes the
+	# listing "verified" on a catalog (served from this origin, not registered).
+	@mcp path /mcp/* /mcp
+	reverse_proxy @mcp localhost:8090
+
 	# Security headers on every response.
 	header {
 		Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
@@ -35,6 +41,8 @@
 	header /install.sh Content-Type "text/x-shellscript; charset=utf-8"
 	header /sitemap.xml Content-Type "application/xml; charset=utf-8"
 	header /manifest.json Content-Type "application/manifest+json; charset=utf-8"
+	header /.well-known/openmcp.json Content-Type "application/json; charset=utf-8"
+	header /.well-known/openmcp.json Access-Control-Allow-Origin "*"
 
 	# Caching: long for images, SHORT for code/HTML so updates propagate fast
 	# (no content hashing yet — don't let stale JS strand logged-in users).
diff --git a/Dockerfile b/Dockerfile
index 53aa94de..f0ae2fc6 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,25 +1,67 @@
 # Single container for tronbrowser.dev: Caddy serves the static site and
-# reverse-proxies /api to the bundled Hono API (one service, one domain).
-# Built from the monorepo root context.
+# reverse-proxies /api and /mcp to the bundled Hono API (one service, one
+# domain). Built from the monorepo root context.
+#
+# The API now carries the OpenMCP relay at /mcp/tron, so the image also holds
+# its two engines: ungoogled-chromium (the portable Linux build, headless) and
+# Obscura. Both are pinned below; bump the ARGs to move them.
 
-# --- build the API ---
-FROM node:24-slim AS api
-WORKDIR /api
-COPY services/api/package.json ./
-RUN npm install --no-audit --no-fund
-COPY services/api/src ./src
-RUN printf '%s' '{"compilerOptions":{"target":"ES2023","module":"NodeNext","moduleResolution":"NodeNext","outDir":"dist","rootDir":"src","strict":true,"skipLibCheck":true,"esModuleInterop":true},"include":["src"]}' > tsconfig.build.json \
-  && npx tsc -p tsconfig.build.json \
-  && npm prune --omit=dev
+ARG UNGOOGLED_CHROMIUM_VERSION=152.0.7977.82-1
+ARG OBSCURA_VERSION=0.2.2
 
-# --- final: caddy + node ---
-FROM caddy:2-alpine
+# --- build the API (a pnpm workspace member: it imports @tronbrowser/sdk) ---
+FROM node:24-bookworm-slim AS api
+RUN corepack enable && corepack prepare pnpm@9.12.0 --activate
+WORKDIR /repo
+COPY package.json pnpm-workspace.yaml pnpm-lock.yaml tsconfig.base.json ./
+COPY packages/browser-core/package.json packages/browser-core/
+COPY packages/agent-runtime/package.json packages/agent-runtime/
+COPY packages/sdk/package.json packages/sdk/
+COPY services/api/package.json services/api/
+RUN pnpm install --frozen-lockfile --filter @tronbrowser/api...
+COPY packages/browser-core packages/browser-core
+COPY packages/agent-runtime packages/agent-runtime
+COPY packages/sdk packages/sdk
+COPY services/api services/api
+RUN pnpm --filter @tronbrowser/browser-core --filter @tronbrowser/agent-runtime --filter @tronbrowser/sdk --filter @tronbrowser/api build \
+  && pnpm --filter @tronbrowser/api deploy --prod /out
+
+# --- engines: fetched once at build time, not at boot ---
+FROM debian:bookworm-slim AS engines
+ARG UNGOOGLED_CHROMIUM_VERSION
+ARG OBSCURA_VERSION
+RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates curl xz-utils && rm -rf /var/lib/apt/lists/*
+RUN set -eu; arch="$(uname -m)"; case "$arch" in x86_64) uc=x86_64; ob=x86_64 ;; aarch64) uc=arm64; ob=aarch64 ;; *) echo "unsupported arch $arch" >&2; exit 1 ;; esac; \
+  mkdir -p /opt/ungoogled-chromium /opt/obscura; \
+  curl -fsSL "https://github.com/ungoogled-software/ungoogled-chromium-portablelinux/releases/download/${UNGOOGLED_CHROMIUM_VERSION}/ungoogled-chromium-${UNGOOGLED_CHROMIUM_VERSION}-${uc}_linux.tar.xz" \
+    | tar -xJ --strip-components=1 -C /opt/ungoogled-chromium; \
+  test -x /opt/ungoogled-chromium/chrome; \
+  curl -fsSL "https://github.com/h4ckf0r0day/obscura/releases/download/v${OBSCURA_VERSION}/obscura-${ob}-linux-stealth.tar.gz" \
+    | tar -xz -C /opt/obscura; \
+  test -x /opt/obscura/obscura
+
+# --- final: caddy + node + tor + the engines ---
+# Debian rather than Alpine: the portable ungoogled-chromium and Obscura are
+# glibc binaries. Caddy is a static binary, copied from its own image.
+FROM node:24-bookworm-slim
+COPY --from=caddy:2 /usr/bin/caddy /usr/bin/caddy
 # openssh-client: the store provisions BBS publisher accounts and generates
 # ed25519 keypairs via `ssh`/`ssh-keygen` (services/api/src/store/fileshost.ts).
 # tor: runs a Tor v3 hidden service in this same container so tronbrowser.dev is
 # reachable over a stable .onion (start.sh writes torrc and boots it). The onion
 # key persists on a Railway volume mounted at /var/lib/tor/hidden_service.
-RUN apk add --no-cache nodejs openssh-client tor
+# The lib* rows are what headless Chromium links against; fonts so text renders.
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    ca-certificates openssh-client tor \
+    libnss3 libnspr4 libatk1.0-0 libatk-bridge2.0-0 libcups2 libdrm2 libxkbcommon0 \
+    libxcomposite1 libxdamage1 libxfixes3 libxrandr2 libgbm1 libasound2 libpango-1.0-0 \
+    libcairo2 libatspi2.0-0 libxshmfence1 libx11-6 libx11-xcb1 libxcb1 libxext6 libglib2.0-0 \
+    libdbus-1-3 libexpat1 fonts-liberation fonts-noto-color-emoji \
+  && rm -rf /var/lib/apt/lists/*
+COPY --from=engines /opt/ungoogled-chromium /opt/ungoogled-chromium
+COPY --from=engines /opt/obscura /opt/obscura
+ENV TRON_MCP_CHROMIUM_BIN=/opt/ungoogled-chromium/chrome \
+    OBSCURA_BIN=/opt/obscura/obscura
 COPY Caddyfile /etc/caddy/Caddyfile
 COPY apps/web/public/ /srv/
 # Extension store (tronbrowser.dev/store) — static frontend; dynamic bits hit
@@ -29,9 +71,9 @@ COPY apps/extensions/public/ /srv/store/
 # symlinks to them for local dev, but Docker COPY won't follow symlinks pointing
 # outside the copied dir — so copy the real files in (these override the links).
 COPY logo.svg favicon.svg hero.svg banner.png /srv/
-COPY --from=api /api/dist /api/dist
-COPY --from=api /api/node_modules /api/node_modules
-COPY --from=api /api/package.json /api/package.json
+COPY --from=api /out/dist /api/dist
+COPY --from=api /out/node_modules /api/node_modules
+COPY --from=api /out/package.json /api/package.json
 # DB migrations run on boot (start.sh) so schema never drifts from the deploy.
 COPY scripts/db-migrate.mjs /api/db-migrate.mjs
 COPY packages/storage/migrations /api/migrations
diff --git a/README.md b/README.md
index ee8259d4..d5e6c65d 100644
--- a/README.md
+++ b/README.md
@@ -58,6 +58,12 @@ Linux phones (Librem 5 / PinePhone / Ubuntu Touch). See
   to the cloud SQLite (Turso) or your own self-hosted backend.
 - Keeps all Chromium features: extensions, profiles, bookmarks, history, PWAs,
   DevTools.
+- **`tron automate`** — an MCP server for agents: Obscura renders pages first
+  (fast, light), the Chromium session takes over for full-JS pages and bot
+  walls. Stdio for a local host, HTTP with an OpenMCP descriptor for a catalog.
+  The same relay runs hosted at **tronbrowser.dev/mcp/tron** (keyless
+  `fetch_page` + `screenshot_page`, listed on openmcp.logicsrc.com). See
+  [docs/mcp.md](docs/mcp.md).
 
 ## Monorepo
 
diff --git a/apps/web/public/.well-known/openmcp.json b/apps/web/public/.well-known/openmcp.json
new file mode 100644
index 00000000..1224878c
--- /dev/null
+++ b/apps/web/public/.well-known/openmcp.json
@@ -0,0 +1,12 @@
+{
+  "openmcp": "0.1",
+  "mcp": "https://tronbrowser.dev/mcp/tron",
+  "name": "TronBrowser",
+  "description": "Fetch any public web page as markdown, text, links or html, or take a screenshot, through TronBrowser: Obscura renders first (fast, light) and the ungoogled-chromium engine takes over for JS-heavy pages and bot walls. Keyless; a few fetches at a time.",
+  "url": "https://tronbrowser.dev",
+  "auth": { "kind": "none", "open": ["fetch_page", "screenshot_page"] },
+  "tags": ["browser", "fetch", "scrape", "screenshot", "chromium", "ungoogled-chromium", "obscura", "web", "hosted"],
+  "operator": "https://logicsrc.com/.well-known/openprofile.md",
+  "tools": ["fetch_page", "screenshot_page"],
+  "catalogs": ["https://openmcp.logicsrc.com"]
+}
diff --git a/apps/web/public/install.sh b/apps/web/public/install.sh
index 63e8b322..29290ec2 100755
--- a/apps/web/public/install.sh
+++ b/apps/web/public/install.sh
@@ -93,6 +93,12 @@ Usage:
   tron run <script>     Run a JS/TS script using @tronbrowser/sdk (--headless/--trace)
   tron analyze [goal]   Analyze/fill a form or page (--data, --execute, --json)
   tron mcp              Run a local MCP server over stdio (--headless)
+  tron automate         MCP server: Obscura for scraping, Chromium for full-JS
+                        pages (fetch_page picks; --engine pins one)
+  tron automate serve   Same server over HTTP with an OpenMCP descriptor
+  tron automate fetch <url>
+                        Print a page as markdown (--format text|links|html)
+  tron automate status  Which engines are usable (--json)
   tron trace start|stop Record commands into a .trontrace bundle
   tron replay <bundle>  Replay a recorded trace against the session
   tron upgrade          Update to the latest release ('tron update' works too)
@@ -225,6 +231,20 @@ case "${1:-}" in
     command -v node >/dev/null 2>&1 || { echo "tron mcp needs Node.js (>=22) on PATH." >&2; exit 1; }
     [ -f "$ENTRY" ] || { echo "This TronBrowser build lacks the MCP server. Run: tron upgrade" >&2; exit 1; }
     exec env TRON_SESSION_BIN="$(session_bin)" node "$_ld/tron-node.mjs" "$ENTRY" "$@" ;;
+  automate)
+    # Obscura for scraping, the managed Chromium session for full-JS pages, one
+    # MCP server (PRD M3.8). Obscura lives next to the launcher (obscura-bin/),
+    # put there by the installer; TRON_OBSCURA_BIN tells the runtime where.
+    shift
+    _ld="$(dirname "$(readlink -f "$CURRENT" 2>/dev/null || echo "$CURRENT")")"
+    ENTRY="$_ld/sdk/automate-bin.js"
+    command -v node >/dev/null 2>&1 || { echo "tron automate needs Node.js (>=22) on PATH." >&2; exit 1; }
+    [ -f "$ENTRY" ] || { echo "This TronBrowser build lacks the automate runtime. Run: tron upgrade" >&2; exit 1; }
+    _ob="${TRON_OBSCURA_BIN:-$_ld/obscura-bin/obscura}"
+    if [ ! -x "$_ob" ] && [ "${1:-}" != "status" ] && [ "${TRON_OBSCURA_QUIET:-0}" != "1" ]; then
+      echo "tron automate: Obscura is not installed; every fetch will use Chromium. Install it with: curl -fsSL $INSTALL_URL | sh -s -- ensure-obscura" >&2
+    fi
+    exec env TRON_SESSION_BIN="$(session_bin)" TRON_OBSCURA_BIN="$_ob" node "$_ld/tron-node.mjs" "$ENTRY" "$@" ;;
   run)
     # Execute a JS/TS automation script that imports @tronbrowser/sdk (PRD M3.4).
     shift
@@ -626,6 +646,65 @@ download_tor_expert_bundle() { # dest_dir
   rm -rf "$tmp"; return 1
 }
 
+# Obscura (github.com/h4ckf0r0day/obscura, Apache-2.0) is the scraping engine
+# behind `tron automate`: its own renderer plus V8, ~30 MB a page, tens of
+# milliseconds on a light page. It is two ~100 MB binaries, so it is not in the
+# release tarball; the installer fetches the pinned release next to the
+# launcher (obscura-bin/) instead. Best-effort: without it `tron automate` runs
+# everything through Chromium. Skip with TB_NO_OBSCURA_INSTALL=1, pin another
+# release with TRONBROWSER_OBSCURA_VERSION.
+OBSCURA_VERSION="${TRONBROWSER_OBSCURA_VERSION:-0.2.2}"
+
+obscura_asset() { # -> asset name for this OS/arch, or nothing
+  os="$(uname -s)"; arch="$(uname -m)"
+  case "$os" in
+    Linux)  ob_os=linux ;;
+    Darwin) ob_os=macos ;;
+    *) return 1 ;;
+  esac
+  case "$arch" in
+    x86_64|amd64)  ob_arch=x86_64 ;;
+    aarch64|arm64) ob_arch=aarch64 ;;
+    *) return 1 ;;
+  esac
+  # The stealth build is a superset: --stealth turns the TLS fingerprint and
+  # tracker blocklist on, and without the flag it behaves like the plain build.
+  echo "obscura-${ob_arch}-${ob_os}-stealth.tar.gz"
+}
+
+download_obscura() { # dest_dir
+  dst="$1"
+  asset="$(obscura_asset)" || return 1
+  url="https://github.com/h4ckf0r0day/obscura/releases/download/v${OBSCURA_VERSION}/${asset}"
+  tmp="$(mktemp -d)"
+  info "Downloading Obscura ${OBSCURA_VERSION} ($asset)…"
+  if fetch "$url" "$tmp/obscura.tgz" 2>/dev/null && tar -xzf "$tmp/obscura.tgz" -C "$tmp" 2>/dev/null && [ -f "$tmp/obscura" ]; then
+    mkdir -p "$dst"
+    cp "$tmp/obscura" "$dst/obscura"
+    [ -f "$tmp/obscura-worker" ] && cp "$tmp/obscura-worker" "$dst/obscura-worker"
+    chmod +x "$dst/obscura" "$dst/obscura-worker" 2>/dev/null || true
+    echo "$OBSCURA_VERSION" > "$dst/VERSION"
+    rm -rf "$tmp"
+    [ -x "$dst/obscura" ] && return 0
+  fi
+  rm -rf "$tmp"; return 1
+}
+
+ensure_obscura() {
+  [ "${TB_NO_OBSCURA_INSTALL:-0}" = "1" ] && return 0
+  obdest="$APP_DIR/obscura-bin"
+  _ldir="$(find "$APP_DIR" -maxdepth 3 -type f -name tronbrowser 2>/dev/null | head -n1)"
+  [ -n "$_ldir" ] && obdest="$(dirname "$_ldir")/obscura-bin"
+  if [ -x "$obdest/obscura" ] && [ "$(cat "$obdest/VERSION" 2>/dev/null)" = "$OBSCURA_VERSION" ]; then return 0; fi
+  info "Setting up Obscura (the scraping engine for 'tron automate')…"
+  if download_obscura "$obdest"; then
+    info "Installed Obscura $OBSCURA_VERSION to $obdest"
+    return 0
+  fi
+  warn "Couldn't install Obscura; 'tron automate' will use Chromium for every page. Retry with: curl -fsSL $INSTALL_URL | sh -s -- ensure-obscura"
+  return 1
+}
+
 # Make a `tor` daemon available for the in-browser 🧅 Tor toggle. We install OUR
 # OWN standalone tor (the Tor Expert Bundle) and run it on our OWN port (9071),
 # never touching any system tor. We prefer the bundle because the system `tor`
@@ -770,6 +849,7 @@ DESKTOP
   # abort an install that has already put the browser on disk.
   ensure_tor      || true  # so the in-browser 🧅 Tor toggle works out of the box
   ensure_certutil || true  # so Moshpit names load over HTTPS on first launch
+  ensure_obscura  || true  # so 'tron automate' has its scraping engine
   brand_macos_icon "$(dirname "$bin")/tronbrowser.png"
 
   info "Installed TronBrowser $tag to $APP_DIR"
@@ -877,6 +957,7 @@ do_upgrade() {
     ensure_browser            # still make sure Ungoogled Chromium is installed
     ensure_tor      || true   # and that Tor is available for the toggle
     ensure_certutil || true   # and that Moshpit trust can be written
+    ensure_obscura  || true   # and that the scraping engine is current
     brand_macos_icon "$(find "$APP_DIR" -maxdepth 3 -name tronbrowser.png 2>/dev/null | head -n1)"  # re-apply icon (Chromium updates reset it)
     info "Re-install anyway with: TB_FORCE=1 tron upgrade"
     return
@@ -920,6 +1001,8 @@ Env:
   TRONBROWSER_REPO            GitHub repo (default: $REPO)
   TRONBROWSER_CACHE_LIMIT_MB  clear profile caches on upgrade once they exceed
                               this (default: 1024; 0 disables)
+  TRONBROWSER_OBSCURA_VERSION Obscura release to install for 'tron automate'
+                              (default: 0.2.2; TB_NO_OBSCURA_INSTALL=1 skips it)
 EOF
 }
 
@@ -936,6 +1019,7 @@ case "$cmd" in
     esac ;;
   remove|uninstall) do_remove ;;
   ensure-tor) ensure_tor ;;
+  ensure-obscura) ensure_obscura ;;
   ensure-certutil) ensure_certutil ;;
   version|--version|-v) do_version ;;
   help|--help|-h) usage ;;
diff --git a/apps/web/test/install-automate.test.ts b/apps/web/test/install-automate.test.ts
new file mode 100644
index 00000000..47f8bf9c
--- /dev/null
+++ b/apps/web/test/install-automate.test.ts
@@ -0,0 +1,120 @@
+// `tron automate` routes to sdk/automate-bin.js with the Obscura binary the
+// installer put next to the launcher. It lives inside install.sh's `<<'TRON'`
+// heredoc, so `sh -n install.sh` never parses it — these tests extract the
+// generated CLI and run it against a fake install tree.
+
+import { spawnSync } from 'node:child_process';
+import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, rmSync, symlinkSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const INSTALL_SH = join(HERE, '..', 'public', 'install.sh');
+
+const roots: string[] = [];
+let cli = '';
+let installSrc = '';
+
+beforeAll(() => {
+  installSrc = readFileSync(INSTALL_SH, 'utf8');
+  const start = installSrc.indexOf("<<'TRON'\n");
+  const end = installSrc.indexOf('\nTRON\n', start);
+  expect(start, 'CLI heredoc not found in install.sh').toBeGreaterThan(-1);
+  expect(end, 'CLI heredoc has no terminator').toBeGreaterThan(start);
+  const body = installSrc.slice(start + "<<'TRON'\n".length, end);
+
+  const dir = mkdtempSync(join(tmpdir(), 'tron-cli-'));
+  roots.push(dir);
+  cli = join(dir, 'tron');
+  writeFileSync(cli, body, { mode: 0o755 });
+  expect(spawnSync('sh', ['-n', cli], { encoding: 'utf8' }).status, 'generated CLI is not valid sh').toBe(0);
+  expect(spawnSync('sh', ['-n', INSTALL_SH], { encoding: 'utf8' }).status, 'install.sh is not valid sh').toBe(0);
+});
+
+afterAll(() => {
+  for (const r of roots) rmSync(r, { recursive: true, force: true });
+});
+
+/** A fake install: launcher dir with a `tronbrowser` shim, `current` symlink, and a fake node that prints its argv + env. */
+function install(opts: { automateBin?: boolean; obscura?: boolean } = {}) {
+  const home = mkdtempSync(join(tmpdir(), 'tron-home-'));
+  roots.push(home);
+  const app = join(home, '.local', 'lib', 'tronbrowser');
+  const launcher = join(app, 'v1', 'tronbrowser');
+  mkdirSync(launcher, { recursive: true });
+  writeFileSync(join(launcher, 'tronbrowser'), '#!/bin/sh\nexit 0\n', { mode: 0o755 });
+  writeFileSync(join(launcher, 'tron-session'), '#!/bin/sh\nexit 0\n', { mode: 0o755 });
+  writeFileSync(join(launcher, 'tron-node.mjs'), '');
+  if (opts.automateBin !== false) {
+    mkdirSync(join(launcher, 'sdk'), { recursive: true });
+    writeFileSync(join(launcher, 'sdk', 'automate-bin.js'), '');
+  }
+  if (opts.obscura) {
+    mkdirSync(join(launcher, 'obscura-bin'), { recursive: true });
+    writeFileSync(join(launcher, 'obscura-bin', 'obscura'), '#!/bin/sh\nexit 0\n', { mode: 0o755 });
+  }
+  symlinkSync(join(launcher, 'tronbrowser'), join(app, 'current'));
+
+  const bin = join(home, 'bin');
+  mkdirSync(bin);
+  writeFileSync(join(bin, 'node'), '#!/bin/sh\necho "node argv: $*"\necho "TRON_OBSCURA_BIN=$TRON_OBSCURA_BIN"\necho "TRON_SESSION_BIN=$TRON_SESSION_BIN"\n', { mode: 0o755 });
+  return { home, launcher, bin };
+}
+
+function tron(home: string, path: string, args: string[]) {
+  const r = spawnSync('sh', [cli, ...args], {
+    encoding: 'utf8',
+    env: { PATH: `${path}:${process.env.PATH ?? '/usr/bin:/bin'}`, HOME: home, TRONBROWSER_AUTO_UPGRADE: '0' },
+  });
+  return { status: r.status, out: r.stdout, err: r.stderr };
+}
+
+describe('tron automate', () => {
+  it('is in the help text', () => {
+    const r = spawnSync('sh', [cli, 'help'], { encoding: 'utf8', env: { PATH: process.env.PATH ?? '/usr/bin:/bin', HOME: '/nonexistent' } });
+    expect(r.stdout).toContain('tron automate');
+    expect(r.stdout).toContain('tron automate serve');
+    expect(r.stdout).toContain('tron automate fetch <url>');
+  });
+
+  it('runs sdk/automate-bin.js through tron-node.mjs with the installed Obscura', () => {
+    const { home, launcher, bin } = install({ obscura: true });
+    const r = tron(home, bin, ['automate', 'fetch', 'https://example.com/', '--format', 'text']);
+    expect(r.status).toBe(0);
+    expect(r.out).toContain(`node argv: ${join(launcher, 'tron-node.mjs')} ${join(launcher, 'sdk', 'automate-bin.js')} fetch https://example.com/ --format text`);
+    expect(r.out).toContain(`TRON_OBSCURA_BIN=${join(launcher, 'obscura-bin', 'obscura')}`);
+    expect(r.out).toContain(`TRON_SESSION_BIN=${join(launcher, 'tron-session')}`);
+    expect(r.err).not.toContain('Obscura is not installed');
+  });
+
+  it('warns once when Obscura is missing and still runs (Chromium does every page)', () => {
+    const { home, bin } = install({ obscura: false });
+    const r = tron(home, bin, ['automate']);
+    expect(r.status).toBe(0);
+    expect(r.err).toContain('Obscura is not installed');
+    expect(r.err).toContain('ensure-obscura');
+    expect(r.out).toContain('automate-bin.js');
+    // status is the command that reports the gap itself; no nagging there.
+    expect(tron(home, bin, ['automate', 'status']).err).not.toContain('Obscura is not installed');
+  });
+
+  it('explains what to do when the build predates the automate runtime', () => {
+    const { home, bin } = install({ automateBin: false });
+    const r = tron(home, bin, ['automate']);
+    expect(r.status).toBe(1);
+    expect(r.err).toContain('tron upgrade');
+  });
+});
+
+describe('installer Obscura setup', () => {
+  it('has an ensure-obscura command, pins a version, and hooks install and upgrade', () => {
+    expect(installSrc).toMatch(/^\s+ensure-obscura\) ensure_obscura ;;/m);
+    expect(installSrc).toMatch(/OBSCURA_VERSION="\$\{TRONBROWSER_OBSCURA_VERSION:-\d+\.\d+\.\d+\}"/);
+    expect(installSrc).toContain('https://github.com/h4ckf0r0day/obscura/releases/download/v${OBSCURA_VERSION}/${asset}');
+    // Both paths that put files on disk keep the engine current; both tolerate a miss.
+    expect(installSrc.match(/ensure_obscura\s+\|\| true/g)?.length).toBe(2);
+    expect(installSrc).toContain('TB_NO_OBSCURA_INSTALL');
+  });
+});
diff --git a/docs/mcp.md b/docs/mcp.md
index 3dd75b55..eabb762d 100644
--- a/docs/mcp.md
+++ b/docs/mcp.md
@@ -1,17 +1,28 @@
-# MCP server (M3.6)
+# MCP server (M3.6) and `tron automate` (M3.8)
 
-`tron mcp` runs a local [Model Context Protocol](https://modelcontextprotocol.io)
-server over **stdio**, exposing TronBrowser's browser + analyze tools to any MCP
-host (Claude Desktop, IDE agents, etc.).
+TronBrowser speaks the [Model Context Protocol](https://modelcontextprotocol.io)
+two ways:
+
+- `tron mcp` runs the browser + analyze tools over **stdio** for a local MCP
+  host (Claude Desktop, IDE agents).
+- `tron automate` adds an engine router: **Obscura first for scraping, the
+  managed Chromium session as the fallback for full-JS pages**, over stdio or
+  over HTTP with an [OpenMCP](https://logicsrc.com/openmcp) descriptor.
 
 ```sh
-tron mcp                # headed managed session
-tron mcp --headless     # headless
+tron mcp                          # headed managed session, stdio
+tron mcp --headless               # headless
 tron mcp --profile work
+
+tron automate                     # stdio MCP: fetch_page + engine_status + browser_*
+tron automate serve               # same server over HTTP on 127.0.0.1:7333
+tron automate fetch <url>         # one-shot: print the page as markdown
+tron automate status              # which engines are usable
 ```
 
-It speaks newline-delimited JSON-RPC 2.0 on stdin/stdout — **local only**, never
-a network listener. The managed session launches lazily on the first tool call
+Both speak newline-delimited JSON-RPC 2.0 on stdin/stdout by default; only
+`tron automate serve` opens a listener, and it binds loopback unless told
+otherwise. The managed session launches lazily on the first tool that needs it
 and is torn down on `browser_close` (or when the host disconnects).
 
 ## Example host config
@@ -19,14 +30,22 @@ and is torn down on `browser_close` (or when the host disconnects).
 ```json
 {
   "mcpServers": {
-    "tronbrowser": { "command": "tron", "args": ["mcp", "--headless"] }
+    "tronbrowser": { "command": "tron", "args": ["automate"] }
   }
 }
 ```
 
 ## Tools
 
-Primitive browser tools:
+The router (both `tron mcp` and `tron automate`):
+
+```
+fetch_page      url, format=markdown|text|links|html, engine=auto|obscura|chromium,
+                max_chars, timeout_s
+engine_status   which engines are usable and whether they are running
+```
+
+Primitive browser tools (the managed Chromium session):
 
 ```
 browser_open      browser_snapshot   browser_click     browser_fill
@@ -45,6 +64,9 @@ browser_run_task  # bounded unknown-interface task
 
 - **Mutating tools return a fresh snapshot** (open/click/fill/type/press/select/
   scroll), so the host always sees current, ref-tagged page state.
+- `fetch_page` returns two text blocks: the page, then one JSON line
+  `{"engine","url","format","ms","chars","fellBack"?}` saying which engine
+  answered and why the fallback ran, when it did.
 - `browser_screenshot` returns image content (PNG); `browser_extract`,
   `browser_analyze`, `browser_step`, `browser_run_task`, and `browser_tabs`
   return JSON text.
@@ -52,16 +74,108 @@ browser_run_task  # bounded unknown-interface task
   engine (M3.5), so form-fill works without an AI provider; open-ended goals
   report `AI_PROVIDER_NOT_CONFIGURED`.
 
+## How the router picks an engine
+
+[Obscura](https://github.com/h4ckf0r0day/obscura) is a headless browser with
+its own renderer and a real V8. Measured on the same pages, it renders a light
+page in tens of milliseconds for about 30 MB, and Chromium cannot start in under
+700 ms. On JS-heavy pages the order flips: a warm Chromium is 3 to 10 times
+faster than Obscura, and only Chromium passes a real login or an interactive
+bot wall. So `engine=auto`:
+
+1. Asks Obscura (`browser_navigate` + `browser_markdown`, over stdio) with a
+   budget of `timeout_s` (default 20 s).
+2. Falls back to the managed Chromium session when Obscura is not installed,
+   errors, runs out of budget, or hands back a page that is plainly a wall
+   ("Just a moment", "enable JavaScript", "Access denied", a captcha) or empty.
+3. `engine=obscura` never falls back and returns whatever Obscura saw;
+   `engine=chromium` never asks Obscura.
+
+`--stealth` runs Obscura with a Chrome TLS fingerprint and its tracker
+blocklist. The Chromium fallback is headless by default for `tron automate`
+(`--headed` shows it) and headed by default for `tron mcp` (`--headless`).
+
+Obscura is two ~100 MB binaries, so the release tarball does not carry it: the
+installer downloads the pinned release (0.2.2) next to the launcher, in
+`obscura-bin/`, on install and on `tron upgrade`. Without it every fetch goes
+through Chromium and `tron automate` says so once. `TB_NO_OBSCURA_INSTALL=1`
+skips the download, `TRONBROWSER_OBSCURA_VERSION` pins another release, and
+`curl -fsSL https://tronbrowser.dev/install.sh | sh -s -- ensure-obscura`
+installs it on its own. `TRON_OBSCURA_BIN` or `OBSCURA_BIN` point the runtime at
+any other binary.
+
+## HTTP and OpenMCP
+
+`tron automate serve` exposes the same server over Streamable HTTP, plain JSON
+in and out, with the descriptor an OpenMCP catalog reads:
+
+```
+POST http://127.0.0.1:7333/mcp                       JSON-RPC (one message or a batch)
+GET  http://127.0.0.1:7333/.well-known/openmcp.json  the OpenMCP descriptor
+GET  http://127.0.0.1:7333/healthz
+```
+
+Register it on a catalog with `openmcp add http://127.0.0.1:7333`. A catalog
+has to be able to reach the address, so a listing on a public catalog needs a
+reachable host: `--host 0.0.0.0 --port 7333 --token <secret>` requires
+`Authorization: Bearer <secret>` on `/mcp` and the descriptor says
+`auth.kind: bearer`. The server refuses to bind a non-loopback host without a
+token. `TRON_MCP_TOKEN` works in place of `--token`.
+
+## Hosted relay: tronbrowser.dev/mcp/tron
+
+The same router runs inside the tronbrowser.dev container as a public
+[OpenMCP](https://logicsrc.com/openmcp) relay, so any agent can use the
+ungoogled-chromium engine without installing anything:
+
+```
+POST https://tronbrowser.dev/mcp/tron                  JSON-RPC (Streamable HTTP, plain JSON)
+GET  https://tronbrowser.dev/mcp/tron                  health + which engines are up
+GET  https://tronbrowser.dev/.well-known/openmcp.json  the descriptor a catalog reads
+```
+
+It is keyless and stateless on purpose: only `fetch_page` and `screenshot_page`
+(no click/fill/session tools), one fresh tab per call, closed afterwards, and
+nothing kept between calls. Guards, all in `services/api/src/mcp`:
+
+- Public targets only: `localhost`, `*.local`, `*.internal`, literal private
+  addresses and any name that resolves to one are refused before an engine is
+  asked; the Chromium engine also carries host-resolver rules for the same
+  ranges and Obscura blocks private targets itself.
+- 3 pages rendering at once (a fourth call gets `Busy`), 30 calls a minute per
+  caller address (`Rate limited`), a 1 MiB request body, 400k characters and a
+  45 s Obscura budget per fetch.
+
+The container (`Dockerfile`) bakes in the portable ungoogled-chromium build
+and Obscura, pinned by build args; Caddy proxies `/mcp/*` to the API next to
+`/api/*`. `TRON_MCP_DISABLED=1` turns the relay off, `TRON_MCP_CHROMIUM_BIN` and
+`OBSCURA_BIN` point at other binaries, `TRON_MCP_IDLE_MS` sets how long Chromium
+stays up with nothing to do (default 5 min). Chromium starts on the first call
+that needs it and costs a few hundred MB while up.
+
+Listing it on the catalog is one registration (`openmcp add
+https://tronbrowser.dev`, or `POST https://openmcp.logicsrc.com/v1/relays
+{"url":"https://tronbrowser.dev"}`); the catalog reads the descriptor from this
+origin, runs the handshake, and re-probes on its own schedule. Smoke-test a
+build with `node services/api/scripts/mcp-smoke.mjs`.
+
 ## How it works
 
-- The shell `tron` dispatcher runs `sdk/mcp-bin.js` via `tron-node.mjs` (which
-  resolves the `@tronbrowser/*` imports) with `TRON_SESSION_BIN` set so the
-  server can launch/close its managed session.
+- The shell `tron` dispatcher runs `sdk/mcp-bin.js` or `sdk/automate-bin.js`
+  via `tron-node.mjs` (which resolves the `@tronbrowser/*` imports) with
+  `TRON_SESSION_BIN` set so the server can launch/close its managed session and
+  `TRON_OBSCURA_BIN` pointing at the installed Obscura.
 - The MCP protocol layer is a small, dependency-free JSON-RPC 2.0 server
   (`packages/sdk/src/mcp`) — no `@modelcontextprotocol/sdk` dependency, keeping
-  the shipped runtime self-contained. Tools wrap the SDK `Browser`/`Page`.
+  the shipped runtime self-contained. Tools wrap the SDK `Browser`/`Page`;
+  `mcp/obscura.ts` is the MCP client that drives Obscura as a child process;
+  `mcp/automate.ts` is the router; `mcp/http.ts` is the HTTP transport and the
+  descriptor.
+- Obscura is driven over stdio on purpose: its own HTTP transport answers the
+  first request on a connection quickly and then stalls every later request on
+  that connection by about 4 seconds.
 
 ## Scope
 
-- Requires Node ≥22. Runs over stdio; remote transports are out of scope.
+- Requires Node ≥22.
 - Cookies/local storage are not exposed as tools.
diff --git a/packages/sdk/src/automate-bin.ts b/packages/sdk/src/automate-bin.ts
new file mode 100644
index 00000000..49ef0055
--- /dev/null
+++ b/packages/sdk/src/automate-bin.ts
@@ -0,0 +1,193 @@
+/**
+ * `tron automate` (PRD M3.8). Obscura for scraping, the managed Chromium
+ * session for full-JS pages, one MCP server either way. Built into the
+ * launcher payload (sdk/automate-bin.js) and run via tron-node.mjs.
+ *
+ *   tron automate                    MCP server over stdio (browser_* + fetch_page)
+ *   tron automate serve              same server over HTTP with an OpenMCP descriptor
+ *   tron automate fetch <url>        one-shot fetch, prints the page
+ *   tron automate status             which engines are usable
+ *
+ * Common flags: --engine auto|obscura|chromium, --stealth, --headed,
+ * --profile <name>, --obscura-bin <path>, --chromium-bin <path> (drive a
+ * Chromium binary directly instead of the TronBrowser managed session).
+ * serve: --host, --port, --token.
+ * fetch: --format markdown|text|links|html, --max-chars N, --timeout S, --json.
+ */
+import { automateTools, engineStatus, fetchPage, parseFetchArgs, type AutomateDeps } from './mcp/automate.js';
+import { DirectChromium, resolveChromiumBin } from './mcp/chromium.js';
+import { DEFAULT_HTTP_PORT, serveHttp, WELL_KNOWN_PATH } from './mcp/http.js';
+import { ObscuraClient, resolveObscuraBin } from './mcp/obscura.js';
+import { createMcpServer, serveStdio } from './mcp/server.js';
+import { McpBrowserSession } from './mcp/session.js';
+
+interface Flags {
+  positional: string[];
+  values: Map<string, string>;
+  switches: Set<string>;
+}
+
+const VALUE_FLAGS = new Set(['engine', 'profile', 'obscura-bin', 'chromium-bin', 'host', 'port', 'token', 'format', 'max-chars', 'timeout']);
+
+function parseFlags(argv: string[]): Flags {
+  const out: Flags = { positional: [], values: new Map(), switches: new Set() };
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i] ?? '';
+    if (!arg.startsWith('--')) {
+      out.positional.push(arg);
+      continue;
+    }
+    const eq = arg.indexOf('=');
+    const name = eq > 0 ? arg.slice(2, eq) : arg.slice(2);
+    if (VALUE_FLAGS.has(name)) {
+      const value = eq > 0 ? arg.slice(eq + 1) : argv[++i];
+      if (value === undefined) fail(`--${name} needs a value`);
+      out.values.set(name, value);
+    } else {
+      out.switches.add(name);
+    }
+  }
+  return out;
+}
+
+function fail(message: string, code = 2): never {
+  process.stderr.write(`tron automate: ${message}\n`);
+  process.exit(code);
+}
+
+function usage(): void {
+  process.stdout.write(`tron automate — Obscura for scraping, Chromium for full-JS pages, one MCP server
+
+Usage:
+  tron automate                      MCP server over stdio (for Claude Desktop, IDE agents)
+  tron automate serve                HTTP MCP server + OpenMCP descriptor (loopback, port ${DEFAULT_HTTP_PORT})
+  tron automate fetch <url>          Print a page as markdown (--format text|links|html)
+  tron automate status               Which engines are usable (--json)
+
+Flags:
+  --engine auto|obscura|chromium     Default auto: Obscura first, Chromium when it fails or hits a wall
+  --stealth                          Obscura with a Chrome TLS fingerprint + tracker blocking
+  --headed                           Show the Chromium fallback (headless by default)
+  --profile <name>                   Chromium profile for the fallback session
+  --obscura-bin <path>               Obscura binary (default: the installed one, or PATH)
+  --chromium-bin <path>              Drive this Chromium directly (default: the TronBrowser managed session)
+  serve: --host <h> --port <p> --token <t>   Bind address, port, and a required bearer token
+  fetch: --format <f> --max-chars <n> --timeout <s> --json
+`);
+}
+
+function deps(flags: Flags): AutomateDeps & { chromium?: DirectChromium; close(): Promise<void> } {
+  const stealth = flags.switches.has('stealth');
+  const bin = flags.values.get('obscura-bin') ?? resolveObscuraBin();
+  const obscura = new ObscuraClient({ ...(bin ? { bin } : {}), stealth });
+  const profile = flags.values.get('profile');
+  const headless = !flags.switches.has('headed');
+  // The managed TronBrowser session when the launcher is around; a Chromium
+  // binary driven directly when asked for, or when there is no launcher at all.
+  const chromiumBin = flags.values.get('chromium-bin') ?? process.env.TRON_CHROMIUM_BIN ?? (process.env.TRON_SESSION_BIN ? undefined : resolveChromiumBin());
+  const chromium = chromiumBin ? new DirectChromium({ bin: chromiumBin, headless, noSandbox: process.getuid?.() === 0, log: (l) => process.stderr.write(`tron automate: ${l}\n`) }) : undefined;
+  const session = chromium ? chromium.session() : McpBrowserSession.fromSdk({ headless, ...(profile ? { profile } : {}) });
+  return {
+    obscura,
+    session,
+    ...(chromium ? { chromium } : {}),
+    async close() {
+      await Promise.allSettled([obscura.close(), session.close()]);
+      await chromium?.close();
+    },
+  };
+}
+
+function server(d: AutomateDeps) {
+  return createMcpServer(d.session, { name: 'tronbrowser', version: '3.9' }, automateTools(d));
+}
+
+async function main(): Promise<void> {
+  const flags = parseFlags(process.argv.slice(2));
+  const command = flags.positional[0] ?? 'mcp';
+  if (flags.switches.has('help') || command === 'help') return usage();
+  const engineFlag = flags.values.get('engine');
+  if (engineFlag && !['auto', 'obscura', 'chromium'].includes(engineFlag)) fail('--engine must be auto|obscura|chromium');
+
+  switch (command) {
+    case 'mcp': {
+      const d = deps(flags);
+      process.stderr.write('tron automate: MCP server on stdio (Obscura + Chromium)\n');
+      await serveStdio(server(d), { input: process.stdin, write: (line) => process.stdout.write(line) });
+      await d.close();
+      return;
+    }
+    case 'serve': {
+      const d = deps(flags);
+      const port = Number(flags.values.get('port') ?? DEFAULT_HTTP_PORT);
+      if (!Number.isInteger(port) || port < 0 || port > 65535) fail('--port must be 0-65535');
+      const host = flags.values.get('host') ?? '127.0.0.1';
+      const token = flags.values.get('token') ?? process.env.TRON_MCP_TOKEN;
+      if (host !== '127.0.0.1' && host !== 'localhost' && host !== '::1' && !token) {
+        fail(`--host ${host} is reachable from other machines; pass --token (or TRON_MCP_TOKEN) to require a bearer token`);
+      }
+      const handle = await serveHttp(server(d), { host, port, ...(token ? { token } : {}), log: (l) => process.stderr.write(l + '\n') });
+      process.stderr.write(
+        `tron automate: MCP over HTTP at ${handle.url}/mcp\n` +
+          `  descriptor  ${handle.url}${WELL_KNOWN_PATH}\n` +
+          `  register    openmcp add ${handle.url}   (a catalog must be able to reach this address)\n` +
+          (token ? '  auth        Authorization: Bearer <token>\n' : '  auth        none (loopback only)\n'),
+      );
+      const stop = async () => {
+        await handle.close();
+        await d.close();
+        process.exit(0);
+      };
+      process.once('SIGINT', () => void stop());
+      process.once('SIGTERM', () => void stop());
+      return;
+    }
+    case 'fetch': {
+      const url = flags.positional[1];
+      if (!url) fail('usage: tron automate fetch <url> [--format markdown|text|links|html] [--engine auto|obscura|chromium]');
+      const d = deps(flags);
+      try {
+        const timeout = flags.values.get('timeout');
+        const maxChars = flags.values.get('max-chars');
+        const args = parseFetchArgs({
+          url,
+          format: flags.values.get('format') ?? 'markdown',
+          engine: engineFlag ?? 'auto',
+          ...(maxChars ? { max_chars: Number(maxChars) } : {}),
+          ...(timeout ? { timeout_s: Number(timeout) } : {}),
+        });
+        const { text, outcome } = await fetchPage(d, args);
+        if (flags.switches.has('json')) process.stdout.write(JSON.stringify({ ...outcome, text }) + '\n');
+        else {
+          process.stdout.write(text.endsWith('\n') ? text : text + '\n');
+          process.stderr.write(`[${outcome.engine} ${outcome.ms}ms ${outcome.chars} chars${outcome.fellBack ? `; ${outcome.fellBack}` : ''}]\n`);
+        }
+      } finally {
+        await d.close();
+      }
+      return;
+    }
+    case 'status': {
+      const d = deps(flags);
+      const status = await engineStatus(d);
+      if (flags.switches.has('json')) process.stdout.write(JSON.stringify(status) + '\n');
+      else {
+        const o = status.obscura;
+        process.stdout.write(
+          `obscura   ${o.available ? `ok  ${o.version ?? '?'}  ${o.bin ?? ''}` : 'missing (run: tron upgrade, or set TRON_OBSCURA_BIN)'}\n` +
+            `chromium  ${d.chromium ? `ok  direct  ${d.chromium.bin ?? ''}` : process.env.TRON_SESSION_BIN ? 'ok  managed session via tron-session' : 'missing (no tron-session and no Chromium on PATH; set TRON_CHROMIUM_BIN)'}\n`,
+        );
+      }
+      await d.close();
+      return;
+    }
+    default:
+      usage();
+      fail(`unknown command: ${command}`);
+  }
+}
+
+main().catch((err: unknown) => {
+  process.stderr.write(`tron automate: ${err instanceof Error ? err.message : String(err)}\n`);
+  process.exit(1);
+});
diff --git a/packages/sdk/src/index.ts b/packages/sdk/src/index.ts
index db9e70b0..f0055ce8 100644
--- a/packages/sdk/src/index.ts
+++ b/packages/sdk/src/index.ts
@@ -18,6 +18,10 @@ export { Browser, type LaunchOptions } from './browser.js';
 export { Page } from './page.js';
 export type { SdkDeps, LaunchArgs } from './deps.js';
 
+// MCP server, the Obscura/Chromium engines and the fetch_page router (M3.6/M3.8),
+// so a host process (the tronbrowser.dev relay) can serve the same tools.
+export * from './mcp/index.js';
+
 // Re-export the shared automation types so scripts can annotate results.
 export type {
   AgentSnapshot,
diff --git a/packages/sdk/src/mcp-bin.ts b/packages/sdk/src/mcp-bin.ts
index 691b85dc..e03ba908 100644
--- a/packages/sdk/src/mcp-bin.ts
+++ b/packages/sdk/src/mcp-bin.ts
@@ -2,8 +2,9 @@
  * `tron mcp` — local MCP server over stdio (PRD M3.6). Built into the launcher
  * payload (sdk/mcp-bin.js) and run via tron-node.mjs so @tronbrowser/* resolve.
  */
-import { createMcpServer } from './mcp/server.js';
-import { serveStdio } from './mcp/server.js';
+import { automateTools } from './mcp/automate.js';
+import { ObscuraClient } from './mcp/obscura.js';
+import { createMcpServer, serveStdio } from './mcp/server.js';
 import { McpBrowserSession } from './mcp/session.js';
 
 const argv = process.argv.slice(2);
@@ -12,7 +13,9 @@ const profileIdx = argv.indexOf('--profile');
 const profile = profileIdx >= 0 ? argv[profileIdx + 1] : undefined;
 
 const session = McpBrowserSession.fromSdk({ headless, ...(profile ? { profile } : {}) });
-const server = createMcpServer(session);
+// fetch_page rides along (PRD M3.8): Obscura when installed, Chromium otherwise.
+const obscura = new ObscuraClient({ stealth: argv.includes('--stealth') });
+const server = createMcpServer(session, undefined, automateTools({ obscura, session }));
 
 process.stderr.write('tron mcp: TronBrowser MCP server on stdio\n');
 
diff --git a/packages/sdk/src/mcp/automate.test.ts b/packages/sdk/src/mcp/automate.test.ts
new file mode 100644
index 00000000..c9f4a754
--- /dev/null
+++ b/packages/sdk/src/mcp/automate.test.ts
@@ -0,0 +1,260 @@
+import { describe, expect, it } from 'vitest';
+import type { AgentSnapshot } from '@tronbrowser/browser-core';
+import { automateTools, fetchPage, markdownExpression, parseFetchArgs, wallReason, engineStatus } from './automate.js';
+import { ObscuraClient, type ObscuraProcess } from './obscura.js';
+import { McpBrowserSession, type McpPage } from './session.js';
+import { createMcpServer } from './server.js';
+
+const SNAP: AgentSnapshot = { url: 'https://x/', title: 'X', timestamp: 't', elements: [] };
+const LONG = 'Rust is a multi-paradigm, general-purpose programming language that emphasizes performance, type safety, and concurrency. '.repeat(3);
+
+/** A fake page: records calls, answers eval/extract from a table. */
+function fakePage(answers: { markdown?: string; text?: string; links?: unknown; html?: string } = {}) {
+  const calls: string[] = [];
+  const page: McpPage = {
+    id: 'p1',
+    goto: async (u) => { calls.push('goto:' + u); },
+    snapshot: async () => SNAP,
+    click: async () => {},
+    fill: async () => {},
+    extract: async (m) => { calls.push('extract:' + m); return m === 'links' ? (answers.links ?? []) : { text: answers.text ?? 'chromium text ' + LONG }; },
+    screenshot: async () => Buffer.from('PNG'),
+    eval: (async (code: string) => {
+      calls.push('eval');
+      return code.includes('outerHTML') ? (answers.html ?? '<html>chromium</html>') : (answers.markdown ?? '# chromium\n\n' + LONG);
+    }) as McpPage['eval'],
+    url: async () => 'https://x/',
+    title: async () => 'X',
+    analyze: async () => ({ ok: true, mode: 'dry-run', status: 'planned', page: { url: 'x', title: 'X' } }),
+    step: async () => ({ ok: true, mode: 'execute', status: 'acted', page: { url: 'x', title: 'X' } }),
+    runTask: async () => ({ ok: true, mode: 'execute', status: 'complete', page: { url: 'x', title: 'X' } }),
+  };
+  const session = new McpBrowserSession(async () => ({ page, close: async () => {} }));
+  return { page, session, calls };
+}
+
+/**
+ * A fake Obscura process: a script maps tool name to a reply (text, an
+ * isError, a thrown transport failure, or a delay). Speaks the same
+ * newline-delimited JSON-RPC the real binary does.
+ */
+type Reply = { text: string } | { error: string } | { hang: true } | { exit: true };
+function fakeObscura(script: Record<string, Reply>, opts: { bin?: string; timeoutMs?: number } = {}) {
+  const calls: string[] = [];
+  let exitCb: (() => void) | undefined;
+  let killed = 0;
+  const spawn = (): ObscuraProcess => {
+    const queue: string[] = [];
+    let wake: (() => void) | undefined;
+    let closed = false;
+    const push = (msg: unknown) => { queue.push(JSON.stringify(msg) + '\n'); wake?.(); };
+    return {
+      stdin: {
+        write(chunk: string) {
+          const msg = JSON.parse(chunk) as { id?: number; method: string; params?: { name?: string; arguments?: Record<string, unknown> } };
+          if (msg.method === 'initialize') return push({ jsonrpc: '2.0', id: msg.id, result: { protocolVersion: '2024-11-05', serverInfo: { name: 'obscura' } } });
+          if (msg.id === undefined) return;
+          const name = msg.params?.name ?? '';
+          calls.push(name + (msg.params?.arguments?.url ? ':' + msg.params.arguments.url : ''));
+          const reply = script[name] ?? { text: 'ok' };
+          if ('hang' in reply) return;
+          if ('exit' in reply) { closed = true; wake?.(); exitCb?.(); return; }
+          if ('error' in reply) return push({ jsonrpc: '2.0', id: msg.id, result: { content: [{ type: 'text', text: reply.error }], isError: true } });
+          push({ jsonrpc: '2.0', id: msg.id, result: { content: [{ type: 'text', text: reply.text }] } });
+        },
+      },
+      stdout: (async function* () {
+        while (!closed) {
+          if (queue.length) { yield queue.shift() as string; continue; }
+          await new Promise<void>((r) => { wake = r; });
+          wake = undefined;
+        }
+      })(),
+      kill: () => { killed++; closed = true; wake?.(); },
+      onExit: (cb) => { exitCb = cb; },
+    };
+  };
+  const client = new ObscuraClient({ bin: opts.bin ?? '/fake/obscura', spawn, timeoutMs: opts.timeoutMs ?? 1000 });
+  return { client, calls, killed: () => killed };
+}
+
+const args = (over: Record<string, unknown> = {}) => parseFetchArgs({ url: 'https://example.com/', ...over });
+
+describe('parseFetchArgs', () => {
+  it('defaults to markdown, auto, and the standing caps', () => {
+    const a = args();
+    expect(a).toMatchObject({ url: 'https://example.com/', format: 'markdown', engine: 'auto' });
+    expect(a.maxChars).toBeGreaterThan(1000);
+    expect(a.budgetMs).toBe(20_000);
+  });
+  it('rejects non-http URLs and unknown formats/engines', () => {
+    expect(() => parseFetchArgs({ url: 'file:///etc/passwd' })).toThrow(/http/);
+    expect(() => parseFetchArgs({ url: 'nope' })).toThrow(/Not a URL/);
+    expect(() => args({ format: 'pdf' })).toThrow(/format/);
+    expect(() => args({ engine: 'firefox' })).toThrow(/engine/);
+    expect(() => parseFetchArgs({})).toThrow(/needs a url/);
+  });
+});
+
+describe('wallReason', () => {
+  it('flags bot walls and empty pages, passes real content', () => {
+    expect(wallReason('Just a moment...\nChecking your browser', 'markdown')).toMatch(/bot wall/);
+    expect(wallReason('Please enable JavaScript to continue', 'text')).toMatch(/bot wall/);
+    expect(wallReason('   \n', 'markdown')).toMatch(/empty/);
+    expect(wallReason(LONG, 'markdown')).toBeNull();
+    // A links dump is short by nature; only walls disqualify it.
+    expect(wallReason('{"text":"a","href":"https://x/"}', 'links')).toBeNull();
+  });
+});
+
+describe('fetchPage routing', () => {
+  it('uses Obscura when it answers with real content', async () => {
+    const { client, calls } = fakeObscura({ browser_markdown: { text: '# Example\n\n' + LONG } });
+    const { session, calls: pageCalls } = fakePage();
+    const r = await fetchPage({ obscura: client, session }, args());
+    expect(r.outcome.engine).toBe('obscura');
+    expect(r.outcome.fellBack).toBeUndefined();
+    expect(r.text).toContain('# Example');
+    expect(calls).toEqual(['browser_navigate:https://example.com/', 'browser_markdown']);
+    expect(pageCalls).toEqual([]); // Chromium never launched
+    await client.close();
+  });
+
+  it('falls back to Chromium on a bot wall', async () => {
+    const { client } = fakeObscura({ browser_markdown: { text: 'Just a moment... Checking your browser before accessing' } });
+    const { session, calls } = fakePage();
+    const r = await fetchPage({ obscura: client, session }, args());
+    expect(r.outcome.engine).toBe('chromium');
+    expect(r.outcome.fellBack).toMatch(/bot wall/);
+    expect(calls[0]).toBe('goto:https://example.com/');
+    expect(r.text).toContain('# chromium');
+    await client.close();
+  });
+
+  it('falls back to Chromium when Obscura reports a tool error', async () => {
+    const { client } = fakeObscura({ browser_navigate: { error: 'navigation failed: 403' } });
+    const { session } = fakePage();
+    const r = await fetchPage({ obscura: client, session }, args());
+    expect(r.outcome.engine).toBe('chromium');
+    expect(r.outcome.fellBack).toContain('403');
+    await client.close();
+  });
+
+  it('falls back to Chromium when Obscura times out, and restarts the engine', async () => {
+    const { client, killed } = fakeObscura({ browser_navigate: { hang: true } }, { timeoutMs: 50 });
+    const { session } = fakePage();
+    const r = await fetchPage({ obscura: client, session }, args({ timeout_s: 0.05 }));
+    expect(r.outcome.engine).toBe('chromium');
+    expect(r.outcome.fellBack).toMatch(/timed out/);
+    expect(killed()).toBe(1);
+    expect(client.running()).toBe(false);
+  });
+
+  it('falls back to Chromium when Obscura is not installed', async () => {
+    const client = new ObscuraClient({ bin: undefined, spawn: () => { throw new Error('never'); } });
+    expect(client.available()).toBe(false);
+    const { session } = fakePage();
+    const r = await fetchPage({ obscura: client, session }, args());
+    expect(r.outcome.engine).toBe('chromium');
+    expect(r.outcome.fellBack).toMatch(/not installed/);
+  });
+
+  it('engine=obscura never falls back, engine=chromium never asks Obscura', async () => {
+    const { client, calls } = fakeObscura({ browser_navigate: { error: 'boom' } });
+    const { session, calls: pageCalls } = fakePage();
+    await expect(fetchPage({ obscura: client, session }, args({ engine: 'obscura' }))).rejects.toThrow(/boom/);
+    expect(pageCalls).toEqual([]);
+    const r = await fetchPage({ obscura: client, session }, args({ engine: 'chromium' }));
+    expect(r.outcome.engine).toBe('chromium');
+    expect(calls.filter((c) => c.startsWith('browser_navigate'))).toHaveLength(1);
+    await client.close();
+  });
+
+  it('engine=obscura returns a wall verbatim instead of second-guessing', async () => {
+    const { client } = fakeObscura({ browser_markdown: { text: 'Access denied' } });
+    const { session } = fakePage();
+    const r = await fetchPage({ obscura: client, session }, args({ engine: 'obscura' }));
+    expect(r.outcome.engine).toBe('obscura');
+    expect(r.text).toBe('Access denied');
+    await client.close();
+  });
+
+  it('maps every format onto the right Obscura tool and Chromium path', async () => {
+    const { client, calls } = fakeObscura({
+      browser_snapshot: { text: LONG },
+      browser_links: { text: '{"text":"a","href":"https://x/"}' },
+      browser_evaluate: { text: '<html>' + LONG + '</html>' },
+    });
+    const { session, calls: pageCalls } = fakePage({ links: [{ text: 'b', href: 'https://y/' }] });
+    for (const format of ['text', 'links', 'html'] as const) {
+      const r = await fetchPage({ obscura: client, session }, args({ format }));
+      expect(r.outcome.engine).toBe('obscura');
+    }
+    expect(calls.filter((c) => !c.startsWith('browser_navigate'))).toEqual(['browser_snapshot', 'browser_links', 'browser_evaluate']);
+    for (const format of ['text', 'links', 'html'] as const) {
+      const r = await fetchPage({ obscura: client, session }, args({ format, engine: 'chromium' }));
+      expect(r.outcome.engine).toBe('chromium');
+      if (format === 'links') expect(r.text).toBe('{"text":"b","href":"https://y/"}');
+      if (format === 'html') expect(r.text).toBe('<html>chromium</html>');
+      if (format === 'text') expect(r.text).toContain('chromium text');
+    }
+    expect(pageCalls).toContain('extract:main');
+    expect(pageCalls).toContain('extract:links');
+    await client.close();
+  });
+
+  it('truncates to max_chars and reports the cut', async () => {
+    const { client } = fakeObscura({ browser_markdown: { text: 'x'.repeat(5000) } });
+    const { session } = fakePage();
+    const r = await fetchPage({ obscura: client, session }, args({ max_chars: 1000 }));
+    expect(r.text.startsWith('x'.repeat(1000))).toBe(true);
+    expect(r.text).toContain('[truncated]');
+    expect(r.outcome.chars).toBe(r.text.length);
+    await client.close();
+  });
+});
+
+describe('automate tools over MCP', () => {
+  it('registers fetch_page and engine_status next to the browser tools', async () => {
+    const { client } = fakeObscura({ browser_markdown: { text: LONG } });
+    const { session } = fakePage();
+    const server = createMcpServer(session, undefined, automateTools({ obscura: client, session }));
+    const list = await server.handle({ jsonrpc: '2.0', id: 1, method: 'tools/list' });
+    const names = (list!.result as { tools: Array<{ name: string }> }).tools.map((t) => t.name);
+    expect(names).toEqual(expect.arrayContaining(['fetch_page', 'engine_status', 'browser_open', 'browser_snapshot']));
+
+    const r = await server.handle({ jsonrpc: '2.0', id: 2, method: 'tools/call', params: { name: 'fetch_page', arguments: { url: 'https://example.com/' } } });
+    const content = (r!.result as { content: Array<{ text: string }> }).content;
+    expect(content[0]!.text).toBe(LONG);
+    expect(JSON.parse(content[1]!.text)).toMatchObject({ engine: 'obscura', format: 'markdown', url: 'https://example.com/' });
+
+    const bad = await server.handle({ jsonrpc: '2.0', id: 3, method: 'tools/call', params: { name: 'fetch_page', arguments: { url: 'ftp://x' } } });
+    expect((bad!.result as { isError: boolean }).isError).toBe(true);
+    await client.close();
+  });
+
+  it('engine_status reports both engines', async () => {
+    const { client } = fakeObscura({});
+    const { session } = fakePage();
+    const before = await engineStatus({ obscura: client, session });
+    expect(before.obscura.available).toBe(true);
+    expect(before.obscura.running).toBe(false);
+    expect(before.chromium.session).toBe('idle');
+    await session.getPage();
+    await client.call('browser_navigate', { url: 'https://x/' });
+    const after = await engineStatus({ obscura: client, session });
+    expect(after.obscura.running).toBe(true);
+    expect(after.chromium.session).toBe('open');
+    await client.close();
+  });
+});
+
+describe('markdownExpression', () => {
+  it('is a self-contained expression that yields a string', () => {
+    const src = markdownExpression();
+    expect(src.startsWith('(() => {')).toBe(true);
+    expect(src.trimEnd().endsWith('})()')).toBe(true);
+    // It must parse as JavaScript; a syntax slip here breaks every Chromium markdown fetch.
+    expect(() => new Function('return ' + src)).not.toThrow();
+  });
+});
diff --git a/packages/sdk/src/mcp/automate.ts b/packages/sdk/src/mcp/automate.ts
new file mode 100644
index 00000000..98926af9
--- /dev/null
+++ b/packages/sdk/src/mcp/automate.ts
@@ -0,0 +1,296 @@
+/**
+ * `tron automate` tools (PRD M3.8): one `fetch_page` that picks the engine.
+ *
+ * Obscura first, because it renders a light page in tens of milliseconds for
+ * ~30 MB; the managed Chromium session second, because it is 3-10x faster than
+ * Obscura on JS-heavy pages and is the only one that passes a real login or an
+ * interactive bot wall. The router falls back when Obscura is missing, errors,
+ * times out, or hands back a page that is plainly a wall or empty. `engine`
+ * pins either one when the caller knows better.
+ */
+import type { McpContent, McpTool } from './protocol.js';
+import type { McpBrowserSession, McpPage } from './session.js';
+import { resultText, type ObscuraClient } from './obscura.js';
+
+export const FETCH_FORMATS = ['markdown', 'text', 'links', 'html'] as const;
+export type FetchFormat = (typeof FETCH_FORMATS)[number];
+export const ENGINES = ['auto', 'obscura', 'chromium'] as const;
+export type Engine = (typeof ENGINES)[number];
+
+export const DEFAULT_MAX_CHARS = 200_000;
+/** How long Obscura gets before Chromium takes over. */
+export const DEFAULT_OBSCURA_BUDGET_S = 20;
+/** A rendered page with less text than this is treated as empty or blocked. */
+export const THIN_PAGE_CHARS = 80;
+
+/** Phrases a bot wall or a JS-required shell shows instead of the page. */
+const WALL_PATTERNS = [
+  /just a moment/i,
+  /enable javascript/i,
+  /javascript is (required|disabled)/i,
+  /access denied/i,
+  /attention required/i,
+  /are you a (human|robot)/i,
+  /verify you are human/i,
+  /checking your browser/i,
+  /captcha/i,
+  /request blocked/i,
+  /unusual traffic/i,
+];
+
+export interface FetchArgs {
+  url: string;
+  format: FetchFormat;
+  engine: Engine;
+  maxChars: number;
+  budgetMs: number;
+}
+
+export interface FetchOutcome {
+  engine: 'obscura' | 'chromium';
+  url: string;
+  format: FetchFormat;
+  ms: number;
+  chars: number;
+  /** Why the fallback ran, when it did. */
+  fellBack?: string;
+}
+
+export interface AutomateDeps {
+  obscura: ObscuraClient | undefined;
+  session: McpBrowserSession;
+  now?: () => number;
+}
+
+/** Why an Obscura answer is not good enough, or null when it is. */
+export function wallReason(text: string, format: FetchFormat): string | null {
+  const head = text.slice(0, 1500);
+  for (const pattern of WALL_PATTERNS) {
+    if (pattern.test(head)) return `looks like a bot wall (${pattern.source})`;
+  }
+  if (format !== 'links' && text.replace(/\s+/g, ' ').trim().length < THIN_PAGE_CHARS) return 'page came back empty';
+  return null;
+}
+
+export function parseFetchArgs(a: Record<string, unknown>): FetchArgs {
+  const url = typeof a.url === 'string' ? a.url.trim() : '';
+  if (!url) throw new Error('fetch_page needs a url');
+  let parsed: URL;
+  try {
+    parsed = new URL(url);
+  } catch {
+    throw new Error(`Not a URL: ${url}`);
+  }
+  if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') throw new Error(`Only http(s) URLs: ${url}`);
+  const format = (FETCH_FORMATS as readonly string[]).includes(String(a.format ?? 'markdown'))
+    ? (String(a.format ?? 'markdown') as FetchFormat)
+    : (() => {
+        throw new Error(`format must be one of ${FETCH_FORMATS.join('|')}`);
+      })();
+  const engine = (ENGINES as readonly string[]).includes(String(a.engine ?? 'auto'))
+    ? (String(a.engine ?? 'auto') as Engine)
+    : (() => {
+        throw new Error(`engine must be one of ${ENGINES.join('|')}`);
+      })();
+  const maxChars = typeof a.max_chars === 'number' && a.max_chars > 0 ? Math.floor(a.max_chars) : DEFAULT_MAX_CHARS;
+  const timeoutS = typeof a.timeout_s === 'number' && a.timeout_s > 0 ? Math.min(a.timeout_s, 120) : DEFAULT_OBSCURA_BUDGET_S;
+  return { url: parsed.toString(), format, engine, maxChars, budgetMs: Math.round(timeoutS * 1000) };
+}
+
+/**
+ * In-page Markdown from the main content. Chromium has no markdown dump, so
+ * the fallback walks the DOM itself: headings, paragraphs, lists, links,
+ * emphasis, code, quotes and simple tables, skipping chrome (nav, footer,
+ * scripts) the way Obscura's browser_markdown does.
+ */
+export function markdownExpression(): string {
+  return `(() => {
+  const SKIP = new Set(['SCRIPT','STYLE','NOSCRIPT','TEMPLATE','SVG','IFRAME','NAV','FOOTER','ASIDE','FORM','BUTTON','INPUT','SELECT','TEXTAREA','CANVAS','VIDEO','AUDIO']);
+  const BLOCK = new Set(['P','DIV','SECTION','ARTICLE','MAIN','HEADER','UL','OL','LI','TABLE','TR','BLOCKQUOTE','PRE','H1','H2','H3','H4','H5','H6','BR','HR','DL','DT','DD','FIGURE','FIGCAPTION','DETAILS','SUMMARY']);
+  const esc = (s) => s.replace(/\\s+/g, ' ');
+  const walk = (node, ctx) => {
+    if (node.nodeType === 3) return esc(node.nodeValue || '');
+    if (node.nodeType !== 1) return '';
+    const el = node, tag = el.tagName;
+    if (SKIP.has(tag)) return '';
+    if (el.hidden || el.getAttribute('aria-hidden') === 'true') return '';
+    const kids = (c) => [...el.childNodes].map((n) => walk(n, c)).join('');
+    switch (tag) {
+      case 'H1': case 'H2': case 'H3': case 'H4': case 'H5': case 'H6':
+        return '\\n\\n' + '#'.repeat(+tag[1]) + ' ' + kids(ctx).trim() + '\\n\\n';
+      case 'P': return '\\n\\n' + kids(ctx).trim() + '\\n\\n';
+      case 'BR': return '\\n';
+      case 'HR': return '\\n\\n---\\n\\n';
+      case 'STRONG': case 'B': { const t = kids(ctx).trim(); return t ? '**' + t + '**' : ''; }
+      case 'EM': case 'I': { const t = kids(ctx).trim(); return t ? '*' + t + '*' : ''; }
+      case 'CODE': return ctx.pre ? el.textContent : '\`' + (el.textContent || '').trim() + '\`';
+      case 'PRE': return '\\n\\n\`\`\`\\n' + (el.textContent || '').replace(/\\n$/, '') + '\\n\`\`\`\\n\\n';
+      case 'A': { const t = kids(ctx).trim(); const h = el.href; return t ? (h && /^https?:/.test(h) ? '[' + t + '](' + h + ')' : t) : ''; }
+      case 'IMG': { const alt = (el.getAttribute('alt') || '').trim(); return alt ? '![' + alt + '](' + el.src + ')' : ''; }
+      case 'UL': case 'OL': {
+        let i = 0;
+        const items = [...el.children].filter((c) => c.tagName === 'LI').map((li) => {
+          const body = walk(li, { ...ctx, list: true }).trim().replace(/\\n{2,}/g, '\\n').replace(/\\n/g, '\\n  ');
+          return (tag === 'OL' ? (++i) + '. ' : '- ') + body;
+        });
+        return '\\n\\n' + items.join('\\n') + '\\n\\n';
+      }
+      case 'LI': return kids(ctx);
+      case 'BLOCKQUOTE': return '\\n\\n' + kids(ctx).trim().split('\\n').map((l) => '> ' + l).join('\\n') + '\\n\\n';
+      case 'TABLE': {
+        const rows = [...el.querySelectorAll('tr')].map((tr) => [...tr.children].map((c) => esc(c.textContent || '').trim()));
+        if (!rows.length) return '';
+        const w = Math.max(...rows.map((r) => r.length));
+        const line = (r) => '| ' + Array.from({ length: w }, (_, i) => r[i] || '').join(' | ') + ' |';
+        return '\\n\\n' + [line(rows[0]), '| ' + Array(w).fill('---').join(' | ') + ' |', ...rows.slice(1).map(line)].join('\\n') + '\\n\\n';
+      }
+      default: return BLOCK.has(tag) ? '\\n' + kids(ctx) + '\\n' : kids(ctx);
+    }
+  };
+  const root = document.querySelector('main, article, [role="main"]') || document.body;
+  const title = (document.title || '').trim();
+  const body = walk(root, { pre: false }).replace(/[ \\t]+\\n/g, '\\n').replace(/\\n{3,}/g, '\\n\\n').trim();
+  return (title ? '# ' + title + '\\n\\n' : '') + body;
+})()`;
+}
+
+async function viaObscura(obscura: ObscuraClient, args: FetchArgs): Promise<string> {
+  const nav = await obscura.call('browser_navigate', { url: args.url, waitUntil: 'load' }, args.budgetMs);
+  if (nav.isError) throw new Error(resultText(nav) || 'navigate failed');
+  let result;
+  switch (args.format) {
+    case 'markdown':
+      result = await obscura.call('browser_markdown', { max_chars: args.maxChars }, args.budgetMs);
+      break;
+    case 'text':
+      result = await obscura.call('browser_snapshot', { max_chars: args.maxChars }, args.budgetMs);
+      break;
+    case 'links':
+      result = await obscura.call('browser_links', { limit: 1000 }, args.budgetMs);
+      break;
+    case 'html':
+      result = await obscura.call('browser_evaluate', { expression: 'document.documentElement.outerHTML' }, args.budgetMs);
+      break;
+  }
+  if (result.isError) throw new Error(resultText(result) || `${args.format} failed`);
+  return resultText(result);
+}
+
+async function viaChromium(page: McpPage, args: FetchArgs): Promise<string> {
+  await page.goto(args.url);
+  switch (args.format) {
+    case 'markdown':
+      return String((await page.eval<string>(markdownExpression())) ?? '');
+    case 'text': {
+      const out = (await page.extract('main')) as { text?: string } | string;
+      return typeof out === 'string' ? out : (out?.text ?? '');
+    }
+    case 'links': {
+      const links = (await page.extract('links')) as Array<{ text: string; href: string }>;
+      return (Array.isArray(links) ? links : []).map((l) => JSON.stringify(l)).join('\n');
+    }
+    case 'html':
+      return String((await page.eval<string>('document.documentElement.outerHTML')) ?? '');
+  }
+}
+
+/** Run one fetch through the router. Exposed for `tron automate fetch`. */
+export async function fetchPage(deps: AutomateDeps, args: FetchArgs): Promise<{ text: string; outcome: FetchOutcome }> {
+  const now = deps.now ?? (() => performance.now());
+  const start = now();
+  const finish = (engine: 'obscura' | 'chromium', text: string, fellBack?: string) => {
+    const cut = text.length > args.maxChars ? text.slice(0, args.maxChars) + '\n…[truncated]' : text;
+    return {
+      text: cut,
+      outcome: {
+        engine,
+        url: args.url,
+        format: args.format,
+        ms: Math.round(now() - start),
+        chars: cut.length,
+        ...(fellBack ? { fellBack } : {}),
+      },
+    };
+  };
+
+  let fellBack: string | undefined;
+  if (args.engine !== 'chromium') {
+    const obscura = deps.obscura;
+    if (!obscura?.available()) {
+      fellBack = 'obscura is not installed';
+    } else {
+      try {
+        const text = await viaObscura(obscura, args);
+        const reason = args.engine === 'auto' ? wallReason(text, args.format) : null;
+        if (!reason) return finish('obscura', text);
+        fellBack = `obscura: ${reason}`;
+      } catch (err) {
+        fellBack = `obscura: ${err instanceof Error ? err.message : String(err)}`;
+      }
+    }
+    if (args.engine === 'obscura') throw new Error(fellBack);
+  }
+
+  const page = await deps.session.getPage();
+  const text = await viaChromium(page, args);
+  return finish('chromium', text, fellBack);
+}
+
+const obj = (properties: Record<string, unknown>, required: string[] = []) => ({
+  type: 'object' as const,
+  properties,
+  ...(required.length ? { required } : {}),
+});
+
+export function automateTools(deps: AutomateDeps): McpTool[] {
+  return [
+    {
+      name: 'fetch_page',
+      description:
+        'Fetch a public web page as markdown, text, links or html. Renders with Obscura (fast, light) and falls back to the managed Chromium session for JS-heavy pages, bot walls and logins. Set engine to pin one.',
+      inputSchema: obj(
+        {
+          url: { type: 'string', description: 'http(s) URL to fetch' },
+          format: { type: 'string', enum: [...FETCH_FORMATS], description: 'Output format (default markdown)' },
+          engine: { type: 'string', enum: [...ENGINES], description: 'auto (default): Obscura then Chromium; or pin obscura|chromium' },
+          max_chars: { type: 'number', description: `Cut the output to this many characters (default ${DEFAULT_MAX_CHARS})` },
+          timeout_s: { type: 'number', description: `Seconds Obscura gets before Chromium takes over (default ${DEFAULT_OBSCURA_BUDGET_S})` },
+        },
+        ['url'],
+      ),
+      handler: async (a): Promise<McpContent[]> => {
+        const { text, outcome } = await fetchPage(deps, parseFetchArgs(a));
+        return [
+          { type: 'text', text },
+          { type: 'text', text: JSON.stringify(outcome) },
+        ];
+      },
+    },
+    {
+      name: 'engine_status',
+      description: 'Report which engines tron automate can use: Obscura (binary, version) and the managed Chromium session.',
+      inputSchema: obj({}),
+      handler: async (): Promise<McpContent[]> => [{ type: 'text', text: JSON.stringify(await engineStatus(deps), null, 2) }],
+    },
+  ];
+}
+
+export interface EngineStatus {
+  obscura: { available: boolean; bin?: string; version?: string; running: boolean };
+  chromium: { session: 'open' | 'idle' };
+}
+
+export async function engineStatus(deps: AutomateDeps): Promise<EngineStatus> {
+  const obscura = deps.obscura;
+  const available = obscura?.available() ?? false;
+  const version = available ? await obscura?.version() : undefined;
+  return {
+    obscura: {
+      available,
+      ...(obscura?.bin ? { bin: obscura.bin } : {}),
+      ...(version ? { version } : {}),
+      running: obscura?.running() ?? false,
+    },
+    chromium: { session: deps.session.isOpen() ? 'open' : 'idle' },
+  };
+}
diff --git a/packages/sdk/src/mcp/chromium.test.ts b/packages/sdk/src/mcp/chromium.test.ts
new file mode 100644
index 00000000..eb0478ac
--- /dev/null
+++ b/packages/sdk/src/mcp/chromium.test.ts
@@ -0,0 +1,77 @@
+import { existsSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { afterAll, describe, expect, it } from 'vitest';
+import { DirectChromium, privateHostRules, resolveChromiumBin } from './chromium.js';
+
+const dirs: string[] = [];
+afterAll(() => {
+  for (const d of dirs) rmSync(d, { recursive: true, force: true });
+});
+
+describe('resolveChromiumBin', () => {
+  it('takes TRON_CHROMIUM_BIN when it exists, then an ungoogled build on PATH before others', () => {
+    const d = mkdtempSync(join(tmpdir(), 'tron-chromium-'));
+    dirs.push(d);
+    const explicit = join(d, 'mychrome');
+    writeFileSync(explicit, '');
+    expect(resolveChromiumBin({ TRON_CHROMIUM_BIN: explicit, PATH: '' })).toBe(explicit);
+    writeFileSync(join(d, 'chromium'), '');
+    writeFileSync(join(d, 'ungoogled-chromium'), '');
+    expect(resolveChromiumBin({ PATH: d })).toBe(join(d, 'ungoogled-chromium'));
+    expect(resolveChromiumBin({ TRON_CHROMIUM_BIN: join(d, 'missing'), PATH: d })).toBe(join(d, 'ungoogled-chromium'));
+  });
+});
+
+describe('DirectChromium.args', () => {
+  it('runs headless with a throwaway profile and a kernel-picked port, and adds the guards asked for', () => {
+    const plain = new DirectChromium({ bin: '/x/chrome' }).args('/tmp/p');
+    expect(plain).toContain('--headless=new');
+    expect(plain).toContain('--remote-debugging-port=0');
+    expect(plain).toContain('--user-data-dir=/tmp/p');
+    expect(plain).not.toContain('--no-sandbox');
+    expect(plain.some((a) => a.startsWith('--host-resolver-rules='))).toBe(false);
+    const guarded = new DirectChromium({ bin: '/x/chrome', headless: false, noSandbox: true, blockPrivate: true, extraArgs: ['--lang=en'] }).args('/tmp/p');
+    expect(guarded).not.toContain('--headless=new');
+    expect(guarded).toContain('--no-sandbox');
+    expect(guarded).toContain('--lang=en');
+    expect(guarded.find((a) => a.startsWith('--host-resolver-rules='))).toContain('MAP 169.254.* ~NOTFOUND');
+  });
+  it('privateHostRules covers loopback, link-local, and every RFC1918 block', () => {
+    const rules = privateHostRules();
+    for (const needle of ['MAP localhost ~NOTFOUND', 'MAP 127.* ~NOTFOUND', 'MAP 10.* ~NOTFOUND', 'MAP 192.168.* ~NOTFOUND', 'MAP 172.16.* ~NOTFOUND', 'MAP 172.31.* ~NOTFOUND', 'MAP *.internal ~NOTFOUND']) {
+      expect(rules).toContain(needle);
+    }
+  });
+  it('reports unavailable without a binary and refuses to open a page', async () => {
+    const c = new DirectChromium({ bin: undefined });
+    expect(c.available()).toBe(false);
+    await expect(c.page()).rejects.toThrow(/No Chromium/);
+  });
+});
+
+// The live half is opt-in: TRON_CHROMIUM_LIVE_TEST=1 on a box with a browser
+// (a dev machine, the relay image). GitHub runners carry a Chrome that cannot
+// start under the default sandbox, so "binary present" is not the switch.
+const LIVE = process.env.TRON_CHROMIUM_LIVE_TEST === '1' ? resolveChromiumBin() : undefined;
+describe.skipIf(!LIVE || !existsSync(LIVE))('DirectChromium live', () => {
+  it('hands out isolated tabs, evaluates in them, closes them, and shuts down', async () => {
+    const c = new DirectChromium({ bin: LIVE, noSandbox: process.getuid?.() === 0, idleMs: 0 });
+    const a = await c.page();
+    const b = await c.page();
+    expect(c.running()).toBe(true);
+    expect(c.openPages()).toBe(2);
+    await a.page.goto('data:text/html,<title>A</title><main><h1>Alpha</h1></main>');
+    await b.page.goto('data:text/html,<title>B</title><main><h1>Beta</h1></main>');
+    expect(await a.page.title()).toBe('A');
+    expect(await b.page.title()).toBe('B');
+    expect(await a.page.eval<string>('document.querySelector("h1").textContent')).toBe('Alpha');
+    await a.close();
+    await a.close(); // idempotent
+    expect(c.openPages()).toBe(1);
+    await b.close();
+    expect(c.openPages()).toBe(0);
+    await c.close();
+    expect(c.running()).toBe(false);
+  }, 30_000);
+});
diff --git a/packages/sdk/src/mcp/chromium.ts b/packages/sdk/src/mcp/chromium.ts
new file mode 100644
index 00000000..278d5c3d
--- /dev/null
+++ b/packages/sdk/src/mcp/chromium.ts
@@ -0,0 +1,260 @@
+/**
+ * A Chromium the SDK spawns itself (PRD M3.8). The desktop path goes through
+ * `tron-session` and the launcher shim; a server, a container, or a box with
+ * only the engine installed has neither. This starts the binary headless with
+ * a throwaway profile, finds the DevTools port it picked, and hands out
+ * isolated page targets: one per call for a public relay, one kept open for a
+ * local session. The browser shuts itself down after sitting idle.
+ */
+import { spawn, execFile } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { mkdtemp, readFile, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { delimiter, join } from 'node:path';
+import { CdpClient, type CdpConnection } from '@tronbrowser/browser-core';
+import { Page } from '../page.js';
+import { McpBrowserSession, type McpPage } from './session.js';
+
+export interface ChromiumOptions {
+  /** The binary. Default: resolveChromiumBin(); an explicit undefined means none. */
+  bin?: string | undefined;
+  headless?: boolean;
+  /** Shut the browser down after this long with no page open. Default 5 min; 0 keeps it. */
+  idleMs?: number;
+  /** Refuse to resolve loopback, link-local and RFC1918 names (a public relay wants this). */
+  blockPrivate?: boolean;
+  /** Chromium refuses to run its sandbox as root; a container usually has to say so. */
+  noSandbox?: boolean;
+  extraArgs?: string[];
+  log?: (line: string) => void;
+  connect?: (wsUrl: string) => Promise<CdpConnection>;
+}
+
+export const DEFAULT_IDLE_MS = 5 * 60_000;
+const LAUNCH_TIMEOUT_MS = 20_000;
+
+const CANDIDATES = [
+  'ungoogled-chromium',
+  'ungoogled-chromium-stable',
+  'chromium',
+  'chromium-browser',
+  'google-chrome',
+  'google-chrome-stable',
+];
+const FIXED = ['/opt/ungoogled-chromium/chrome', '/opt/google/chrome/chrome', '/usr/lib/chromium/chromium'];
+
+/** `TRON_CHROMIUM_BIN`, then PATH, then the usual fixed spots. Ungoogled builds first. */
+export function resolveChromiumBin(env: NodeJS.ProcessEnv = process.env): string | undefined {
+  const explicit = env.TRON_CHROMIUM_BIN;
+  if (explicit && existsSync(explicit)) return explicit;
+  const dirs = (env.PATH ?? '').split(delimiter).filter(Boolean);
+  for (const name of CANDIDATES) {
+    for (const dir of dirs) {
+      const candidate = join(dir, name);
+      if (existsSync(candidate)) return candidate;
+    }
+  }
+  return FIXED.find((p) => existsSync(p));
+}
+
+/** Names Chromium must not resolve when the caller is untrusted. */
+export function privateHostRules(): string {
+  const rules = ['MAP localhost ~NOTFOUND', 'MAP *.localhost ~NOTFOUND', 'MAP *.local ~NOTFOUND', 'MAP *.internal ~NOTFOUND', 'MAP 127.* ~NOTFOUND', 'MAP 0.* ~NOTFOUND', 'MAP 10.* ~NOTFOUND', 'MAP 169.254.* ~NOTFOUND', 'MAP 192.168.* ~NOTFOUND', 'MAP metadata.google.internal ~NOTFOUND'];
+  for (let i = 16; i <= 31; i++) rules.push(`MAP 172.${i}.* ~NOTFOUND`);
+  return rules.join(', ');
+}
+
+interface Running {
+  proc: ReturnType<typeof spawn>;
+  dataDir: string;
+  port: number;
+  browser: CdpConnection;
+}
+
+export class DirectChromium {
+  readonly bin: string | undefined;
+  readonly #opts: ChromiumOptions;
+  #running: Running | undefined;
+  #starting: Promise<Running> | undefined;
+  #open = 0;
+  #idle: NodeJS.Timeout | undefined;
+
+  constructor(options: ChromiumOptions = {}) {
+    this.#opts = options;
+    this.bin = 'bin' in options ? options.bin : resolveChromiumBin();
+  }
+
+  available(): boolean {
+    return this.bin !== undefined;
+  }
+
+  running(): boolean {
+    return this.#running !== undefined;
+  }
+
+  /** Pages currently handed out. */
+  openPages(): number {
+    return this.#open;
+  }
+
+  version(): Promise<string | undefined> {
+    const bin = this.bin;
+    if (!bin) return Promise.resolve(undefined);
+    return new Promise((resolve) => {
+      execFile(bin, ['--version'], { timeout: 10_000 }, (err, stdout) => resolve(err ? undefined : stdout.trim()));
+    });
+  }
+
+  args(dataDir: string): string[] {
+    const o = this.#opts;
+    return [
+      ...(o.headless === false ? [] : ['--headless=new']),
+      '--disable-gpu',
+      '--no-first-run',
+      '--no-default-browser-check',
+      '--disable-extensions',
+      '--disable-background-networking',
+      '--disable-sync',
+      '--disable-component-update',
+      '--disable-dev-shm-usage',
+      '--hide-scrollbars',
+      '--mute-audio',
+      '--window-size=1280,900',
+      '--remote-debugging-port=0',
+      `--user-data-dir=${dataDir}`,
+      ...(o.noSandbox ? ['--no-sandbox'] : []),
+      ...(o.blockPrivate ? [`--host-resolver-rules=${privateHostRules()}`] : []),
+      ...(o.extraArgs ?? []),
+      'about:blank',
+    ];
+  }
+
+  /** An isolated page target; `close` shuts the tab. */
+  async page(): Promise<{ page: McpPage; close: () => Promise<void> }> {
+    const run = await this.#ensure();
+    const { targetId } = await run.browser.send<{ targetId: string }>('Target.createTarget', { url: 'about:blank' });
+    const connect = this.#opts.connect ?? ((url: string) => CdpClient.connect(url));
+    let conn: CdpConnection;
+    try {
+      conn = await connect(`ws://127.0.0.1:${run.port}/devtools/page/${targetId}`);
+    } catch (err) {
+      await run.browser.send('Target.closeTarget', { targetId }).catch(() => {});
+      throw err;
+    }
+    const page = (await Page.attach(conn, targetId)) as unknown as McpPage;
+    this.#open++;
+    this.#armIdle();
+    let closed = false;
+    return {
+      page,
+      close: async () => {
+        if (closed) return;
+        closed = true;
+        this.#open--;
+        conn.close();
+        if (this.#running === run) await run.browser.send('Target.closeTarget', { targetId }).catch(() => {});
+        this.#armIdle();
+      },
+    };
+  }
+
+  /** A session over this engine: one page, opened on first use, closed with the session. */
+  session(): McpBrowserSession {
+    return new McpBrowserSession(() => this.page());
+  }
+
+  /** Stop the browser and delete its profile. Pages handed out become dead. */
+  async close(): Promise<void> {
+    if (this.#idle) clearTimeout(this.#idle);
+    this.#idle = undefined;
+    const run = this.#running ?? (await this.#starting?.catch(() => undefined));
+    this.#running = undefined;
+    this.#starting = undefined;
+    this.#open = 0;
+    if (!run) return;
+    run.browser.close();
+    await new Promise<void>((resolve) => {
+      const timer = setTimeout(() => {
+        run.proc.kill('SIGKILL');
+        resolve();
+      }, 3000);
+      run.proc.once('exit', () => {
+        clearTimeout(timer);
+        resolve();
+      });
+      run.proc.kill();
+    });
+    await rm(run.dataDir, { recursive: true, force: true }).catch(() => {});
+  }
+
+  #armIdle(): void {
+    if (this.#idle) clearTimeout(this.#idle);
+    this.#idle = undefined;
+    const idleMs = this.#opts.idleMs ?? DEFAULT_IDLE_MS;
+    if (!idleMs || this.#open > 0 || !this.#running) return;
+    this.#idle = setTimeout(() => {
+      if (this.#open === 0) void this.close();
+    }, idleMs);
+    this.#idle.unref?.();
+  }
+
+  #ensure(): Promise<Running> {
+    if (this.#running) return Promise.resolve(this.#running);
+    this.#starting ??= this.#launch().then(
+      (run) => {
+        this.#running = run;
+        this.#starting = undefined;
+        return run;
+      },
+      (err) => {
+        this.#starting = undefined;
+        throw err;
+      },
+    );
+    return this.#starting;
+  }
+
+  async #launch(): Promise<Running> {
+    const bin = this.bin;
+    if (!bin) throw new Error('No Chromium found (set TRON_CHROMIUM_BIN or install ungoogled-chromium).');
+    const dataDir = await mkdtemp(join(tmpdir(), 'tron-chromium-'));
+    const proc = spawn(bin, this.args(dataDir), { stdio: ['ignore', 'ignore', 'pipe'] });
+    let stderr = '';
+    proc.stderr?.on('data', (chunk: Buffer) => {
+      if (stderr.length < 8000) stderr += chunk.toString('utf8');
+    });
+    proc.once('exit', () => {
+      if (this.#running?.proc === proc) {
+        this.#running = undefined;
+        this.#open = 0;
+        this.#opts.log?.('chromium exited');
+      }
+    });
+    try {
+      const port = await this.#waitForPort(dataDir, proc);
+      const version = await fetch(`http://127.0.0.1:${port}/json/version`).then((r) => r.json() as Promise<{ webSocketDebuggerUrl: string }>);
+      const connect = this.#opts.connect ?? ((url: string) => CdpClient.connect(url));
+      const browser = await connect(version.webSocketDebuggerUrl);
+      this.#opts.log?.(`chromium up: pid ${proc.pid} port ${port}`);
+      return { proc, dataDir, port, browser };
+    } catch (err) {
+      proc.kill('SIGKILL');
+      await rm(dataDir, { recursive: true, force: true }).catch(() => {});
+      throw new Error(`${err instanceof Error ? err.message : String(err)}${stderr ? `\n${stderr.trim().split('\n').slice(-5).join('\n')}` : ''}`);
+    }
+  }
+
+  /** Chromium writes `<profile>/DevToolsActivePort` once it listens: the port on line 1. */
+  async #waitForPort(dataDir: string, proc: ReturnType<typeof spawn>): Promise<number> {
+    const file = join(dataDir, 'DevToolsActivePort');
+    const deadline = Date.now() + LAUNCH_TIMEOUT_MS;
+    while (Date.now() < deadline) {
+      if (proc.exitCode !== null) throw new Error(`chromium exited with ${proc.exitCode} before listening`);
+      const text = await readFile(file, 'utf8').catch(() => '');
+      const port = Number(text.split('\n')[0]);
+      if (Number.isInteger(port) && port > 0) return port;
+      await new Promise((r) => setTimeout(r, 50));
+    }
+    throw new Error('chromium did not open its DevTools port in time');
+  }
+}
diff --git a/packages/sdk/src/mcp/http.test.ts b/packages/sdk/src/mcp/http.test.ts
new file mode 100644
index 00000000..456a0ef3
--- /dev/null
+++ b/packages/sdk/src/mcp/http.test.ts
@@ -0,0 +1,110 @@
+import { afterAll, describe, expect, it } from 'vitest';
+import { McpServer } from './protocol.js';
+import { openMcpDescriptor, serveHttp, WELL_KNOWN_PATH, type HttpHandle } from './http.js';
+
+function server(): McpServer {
+  const s = new McpServer({ name: 'tronbrowser', version: '3.9' });
+  s.register({
+    name: 'echo',
+    description: 'echo',
+    inputSchema: { type: 'object', properties: { text: { type: 'string' } } },
+    handler: async (a) => [{ type: 'text', text: String(a.text ?? '') }],
+  });
+  return s;
+}
+
+const handles: HttpHandle[] = [];
+afterAll(async () => {
+  await Promise.all(handles.map((h) => h.close()));
+});
+
+async function listen(token?: string): Promise<HttpHandle> {
+  const h = await serveHttp(server(), { port: 0, ...(token ? { token } : {}) });
+  handles.push(h);
+  return h;
+}
+
+const post = (url: string, body: unknown, headers: Record<string, string> = {}) =>
+  fetch(`${url}/mcp`, { method: 'POST', headers: { 'content-type': 'application/json', ...headers }, body: typeof body === 'string' ? body : JSON.stringify(body) });
+
+describe('openMcpDescriptor', () => {
+  it('describes the relay the way an OpenMCP catalog reads it', () => {
+    const d = openMcpDescriptor({ base: 'http://127.0.0.1:7333/', tools: ['fetch_page', 'browser_open'] });
+    expect(d.openmcp).toBe('0.1');
+    expect(d.mcp).toBe('http://127.0.0.1:7333/mcp');
+    expect(d.name).toBe('TronBrowser');
+    expect(d.url).toBe('https://tronbrowser.dev');
+    expect(d.auth).toEqual({ kind: 'none', open: ['fetch_page', 'browser_open'] });
+    expect(d.tools).toEqual(['fetch_page', 'browser_open']);
+    expect(d.operator).toMatch(/openprofile\.md$/);
+    expect(d.tags).toContain('browser');
+  });
+  it('switches to bearer auth when a token guards the endpoint', () => {
+    const d = openMcpDescriptor({ base: 'http://h:1', tools: ['echo'], bearer: true, operator: 'https://x/.well-known/openprofile.md' });
+    expect(d.auth).toEqual({ kind: 'bearer' });
+    expect(d.operator).toBe('https://x/.well-known/openprofile.md');
+  });
+});
+
+describe('serveHttp', () => {
+  it('binds loopback, serves the descriptor and a health check', async () => {
+    const h = await listen();
+    expect(h.host).toBe('127.0.0.1');
+    expect(h.url).toBe(`http://127.0.0.1:${h.port}`);
+    const d = await (await fetch(`${h.url}${WELL_KNOWN_PATH}`)).json();
+    expect(d.mcp).toBe(`${h.url}/mcp`);
+    expect(d.tools).toEqual(['echo']);
+    const health = await (await fetch(`${h.url}/healthz`)).json();
+    expect(health.ok).toBe(true);
+    expect((await fetch(`${h.url}/nope`)).status).toBe(404);
+    expect((await fetch(`${h.url}/mcp`)).status).toBe(405);
+  });
+
+  it('runs the MCP handshake and a tool call over plain JSON', async () => {
+    const h = await listen();
+    const init = await post(h.url, { jsonrpc: '2.0', id: 1, method: 'initialize', params: { protocolVersion: '2025-06-18' } });
+    expect(init.status).toBe(200);
+    expect(init.headers.get('content-type')).toContain('application/json');
+    const initBody = await init.json();
+    expect(initBody.result.serverInfo.name).toBe('tronbrowser');
+
+    const note = await post(h.url, { jsonrpc: '2.0', method: 'notifications/initialized' });
+    expect(note.status).toBe(202);
+    expect(await note.text()).toBe('');
+
+    const list = await (await post(h.url, { jsonrpc: '2.0', id: 2, method: 'tools/list' })).json();
+    expect(list.result.tools.map((t: { name: string }) => t.name)).toEqual(['echo']);
+
+    const call = await (await post(h.url, { jsonrpc: '2.0', id: 3, method: 'tools/call', params: { name: 'echo', arguments: { text: 'hi' } } })).json();
+    expect(call.result.content[0].text).toBe('hi');
+  });
+
+  it('answers batches, parse errors and bad requests as JSON-RPC', async () => {
+    const h = await listen();
+    const batch = await (await post(h.url, [{ jsonrpc: '2.0', id: 1, method: 'ping' }, { jsonrpc: '2.0', method: 'notifications/x' }, 7])).json();
+    expect(Array.isArray(batch)).toBe(true);
+    expect(batch).toHaveLength(2);
+    expect(batch[0].result).toEqual({});
+    expect(batch[1].error.code).toBe(-32600);
+    const bad = await post(h.url, '{not json');
+    expect(bad.status).toBe(400);
+    expect((await bad.json()).error.code).toBe(-32700);
+  });
+
+  it('requires the bearer token when one is set, and says so in the descriptor', async () => {
+    const h = await listen('s3cret');
+    const d = await (await fetch(`${h.url}${WELL_KNOWN_PATH}`)).json();
+    expect(d.auth.kind).toBe('bearer');
+    expect((await post(h.url, { jsonrpc: '2.0', id: 1, method: 'ping' })).status).toBe(401);
+    expect((await post(h.url, { jsonrpc: '2.0', id: 1, method: 'ping' }, { authorization: 'Bearer wrong' })).status).toBe(401);
+    const ok = await post(h.url, { jsonrpc: '2.0', id: 1, method: 'ping' }, { authorization: 'Bearer s3cret' });
+    expect(ok.status).toBe(200);
+  });
+
+  it('answers CORS preflight so a browser-hosted MCP client can reach it', async () => {
+    const h = await listen();
+    const r = await fetch(`${h.url}/mcp`, { method: 'OPTIONS' });
+    expect(r.status).toBe(204);
+    expect(r.headers.get('access-control-allow-methods')).toContain('POST');
+  });
+});
diff --git a/packages/sdk/src/mcp/http.ts b/packages/sdk/src/mcp/http.ts
new file mode 100644
index 00000000..1bedf160
--- /dev/null
+++ b/packages/sdk/src/mcp/http.ts
@@ -0,0 +1,194 @@
+/**
+ * Streamable-HTTP transport for the MCP server, plus the OpenMCP descriptor
+ * (PRD M3.8). `tron automate serve` binds it on loopback so an MCP host, or an
+ * OpenMCP catalog, can reach the same tools `tron mcp` serves over stdio.
+ *
+ * Plain JSON in, plain JSON out: every POST /mcp carries one JSON-RPC message
+ * (or a batch) and gets its response in the body, notifications get 202. That
+ * is the subset OpenMCP's probe and every host we know of speak. No session
+ * ids, no SSE, no dependency.
+ */
+import { createServer, type IncomingMessage, type Server, type ServerResponse } from 'node:http';
+import type { JsonRpcMessage, McpServer } from './protocol.js';
+
+export const OPENMCP_VERSION = '0.1';
+export const WELL_KNOWN_PATH = '/.well-known/openmcp.json';
+export const DEFAULT_HTTP_PORT = 7333;
+const MAX_BODY_BYTES = 16 * 1024 * 1024;
+
+/** What the server says about itself at /.well-known/openmcp.json. */
+export interface OpenMcpDescriptor {
+  openmcp: string;
+  mcp: string;
+  name: string;
+  description: string;
+  url: string;
+  auth: { kind: 'none' | 'bearer'; open?: string[] };
+  tags: string[];
+  operator?: string;
+  tools: string[];
+}
+
+export interface DescriptorOptions {
+  /** The origin the server is reachable at, e.g. http://127.0.0.1:7333 */
+  base: string;
+  tools: string[];
+  /** Set when POST /mcp needs `Authorization: Bearer`. */
+  bearer?: boolean;
+  operator?: string;
+}
+
+export const DEFAULT_OPERATOR = 'https://logicsrc.com/.well-known/openprofile.md';
+
+export function openMcpDescriptor(options: DescriptorOptions): OpenMcpDescriptor {
+  const base = options.base.replace(/\/+$/, '');
+  return {
+    openmcp: OPENMCP_VERSION,
+    mcp: `${base}/mcp`,
+    name: 'TronBrowser',
+    description:
+      'Browse and scrape from a local TronBrowser: fetch_page renders pages with Obscura and falls back to a managed Chromium session for JS-heavy pages, bot walls and logins; browser_* tools drive that session by ref (snapshot, click, fill, extract, screenshot).',
+    url: 'https://tronbrowser.dev',
+    auth: options.bearer ? { kind: 'bearer' } : { kind: 'none', open: options.tools },
+    tags: ['browser', 'fetch', 'scrape', 'automation', 'chromium', 'obscura', 'local'],
+    operator: options.operator ?? DEFAULT_OPERATOR,
+    tools: options.tools,
+  };
+}
+
+export interface HttpOptions {
+  host?: string;
+  port?: number;
+  /** When set, POST /mcp requires `Authorization: Bearer <token>`. */
+  token?: string;
+  operator?: string;
+  log?: (line: string) => void;
+}
+
+export interface HttpHandle {
+  url: string;
+  host: string;
+  port: number;
+  server: Server;
+  close(): Promise<void>;
+}
+
+function readBody(req: IncomingMessage): Promise<string> {
+  return new Promise((resolve, reject) => {
+    const chunks: Buffer[] = [];
+    let size = 0;
+    req.on('data', (chunk: Buffer) => {
+      size += chunk.length;
+      if (size > MAX_BODY_BYTES) {
+        reject(new Error('body too large'));
+        req.destroy();
+        return;
+      }
+      chunks.push(chunk);
+    });
+    req.on('end', () => resolve(Buffer.concat(chunks).toString('utf8')));
+    req.on('error', reject);
+  });
+}
+
+function send(res: ServerResponse, status: number, body: unknown, extra: Record<string, string> = {}): void {
+  const text = body === undefined ? '' : JSON.stringify(body);
+  res.writeHead(status, {
+    'content-type': 'application/json; charset=utf-8',
+    'cache-control': 'no-store',
+    'access-control-allow-origin': '*',
+    'access-control-allow-methods': 'GET, POST, OPTIONS',
+    'access-control-allow-headers': 'content-type, accept, authorization, mcp-protocol-version, mcp-session-id',
+    ...extra,
+  });
+  res.end(text);
+}
+
+const rpcError = (id: number | string | null, code: number, message: string): JsonRpcMessage =>
+  ({ jsonrpc: '2.0', id: id ?? undefined, error: { code, message } }) as JsonRpcMessage;
+
+/** Build the request handler; exported so tests can drive it without a socket. */
+export function httpHandler(server: McpServer, options: HttpOptions, base: () => string) {
+  const descriptor = () =>
+    openMcpDescriptor({
+      base: base(),
+      tools: server.tools().map((t) => t.name),
+      bearer: Boolean(options.token),
+      ...(options.operator ? { operator: options.operator } : {}),
+    });
+
+  return async (req: IncomingMessage, res: ServerResponse): Promise<void> => {
+    const path = (req.url ?? '/').split('?')[0] ?? '/';
+    if (req.method === 'OPTIONS') return send(res, 204, undefined);
+    if (req.method === 'GET' && path === WELL_KNOWN_PATH) return send(res, 200, descriptor());
+    if (req.method === 'GET' && (path === '/healthz' || path === '/')) {
+      return send(res, 200, { ok: true, name: 'tronbrowser', mcp: `${base()}/mcp`, descriptor: `${base()}${WELL_KNOWN_PATH}` });
+    }
+    if (path !== '/mcp') return send(res, 404, { error: 'not found' });
+    if (req.method !== 'POST') return send(res, 405, { error: 'POST /mcp' }, { allow: 'POST, OPTIONS' });
+    if (options.token) {
+      const auth = req.headers.authorization ?? '';
+      if (auth !== `Bearer ${options.token}`) return send(res, 401, rpcError(null, -32001, 'bearer token required'));
+    }
+
+    let body: string;
+    try {
+      body = await readBody(req);
+    } catch (err) {
+      return send(res, 413, rpcError(null, -32600, err instanceof Error ? err.message : 'bad body'));
+    }
+    let parsed: unknown;
+    try {
+      parsed = JSON.parse(body);
+    } catch {
+      return send(res, 400, rpcError(null, -32700, 'parse error'));
+    }
+
+    const messages = Array.isArray(parsed) ? parsed : [parsed];
+    const responses: JsonRpcMessage[] = [];
+    for (const msg of messages) {
+      if (typeof msg !== 'object' || msg === null) {
+        responses.push(rpcError(null, -32600, 'invalid request'));
+        continue;
+      }
+      const reply = await server.handle(msg as JsonRpcMessage);
+      if (reply) responses.push(reply);
+    }
+    if (responses.length === 0) return send(res, 202, undefined);
+    return send(res, 200, Array.isArray(parsed) ? responses : responses[0]);
+  };
+}
+
+/** Listen and resolve with the URL. Loopback unless told otherwise. */
+export function serveHttp(server: McpServer, options: HttpOptions = {}): Promise<HttpHandle> {
+  const host = options.host ?? '127.0.0.1';
+  let url = '';
+  const handler = httpHandler(server, options, () => url);
+  const http = createServer((req, res) => {
+    handler(req, res).catch((err: unknown) => {
+      options.log?.(`tron automate: ${err instanceof Error ? err.message : String(err)}`);
+      if (!res.headersSent) send(res, 500, rpcError(null, -32603, 'internal error'));
+      else res.end();
+    });
+  });
+  return new Promise((resolve, reject) => {
+    http.once('error', reject);
+    http.listen(options.port ?? DEFAULT_HTTP_PORT, host, () => {
+      const address = http.address();
+      const port = typeof address === 'object' && address ? address.port : (options.port ?? DEFAULT_HTTP_PORT);
+      const shown = host.includes(':') ? `[${host}]` : host;
+      url = `http://${shown}:${port}`;
+      resolve({
+        url,
+        host,
+        port,
+        server: http,
+        close: () =>
+          new Promise<void>((done) => {
+            http.close(() => done());
+            http.closeAllConnections?.();
+          }),
+      });
+    });
+  });
+}
diff --git a/packages/sdk/src/mcp/index.ts b/packages/sdk/src/mcp/index.ts
index e1507fd5..1dc183a0 100644
--- a/packages/sdk/src/mcp/index.ts
+++ b/packages/sdk/src/mcp/index.ts
@@ -1,8 +1,13 @@
 /**
- * @tronbrowser/sdk — MCP server (PRD M3.6). Local stdio Model Context Protocol
- * server exposing TronBrowser's browser + analyze tools.
+ * @tronbrowser/sdk — MCP server (PRD M3.6 / M3.8). Local Model Context Protocol
+ * server exposing TronBrowser's browser + analyze tools over stdio or HTTP, and
+ * the Obscura-first fetch_page router behind `tron automate`.
  */
 export * from './protocol.js';
 export * from './session.js';
 export * from './tools.js';
 export * from './server.js';
+export * from './obscura.js';
+export * from './automate.js';
+export * from './http.js';
+export * from './chromium.js';
diff --git a/packages/sdk/src/mcp/obscura.test.ts b/packages/sdk/src/mcp/obscura.test.ts
new file mode 100644
index 00000000..4fa51a97
--- /dev/null
+++ b/packages/sdk/src/mcp/obscura.test.ts
@@ -0,0 +1,103 @@
+import { mkdtempSync, writeFileSync, chmodSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { afterAll, describe, expect, it } from 'vitest';
+import { ObscuraClient, resolveObscuraBin, resultText, type ObscuraProcess } from './obscura.js';
+
+const dirs: string[] = [];
+afterAll(() => {
+  for (const d of dirs) rmSync(d, { recursive: true, force: true });
+});
+
+function tmp(): string {
+  const d = mkdtempSync(join(tmpdir(), 'tron-obscura-'));
+  dirs.push(d);
+  return d;
+}
+
+describe('resolveObscuraBin', () => {
+  it('prefers TRON_OBSCURA_BIN, then OBSCURA_BIN, then PATH, and only existing files', () => {
+    const d = tmp();
+    const a = join(d, 'a');
+    const b = join(d, 'b');
+    writeFileSync(a, '');
+    writeFileSync(b, '');
+    expect(resolveObscuraBin({ TRON_OBSCURA_BIN: a, OBSCURA_BIN: b, PATH: '' })).toBe(a);
+    expect(resolveObscuraBin({ TRON_OBSCURA_BIN: join(d, 'missing'), OBSCURA_BIN: b, PATH: '' })).toBe(b);
+    const onPath = join(d, 'obscura');
+    writeFileSync(onPath, '');
+    expect(resolveObscuraBin({ PATH: `${join(d, 'nope')}:${d}` })).toBe(onPath);
+    expect(resolveObscuraBin({ PATH: join(d, 'nope') })).toBeUndefined();
+  });
+});
+
+describe('ObscuraClient', () => {
+  it('reports unavailable and refuses to call without a binary', async () => {
+    const c = new ObscuraClient({ bin: undefined });
+    expect(c.available()).toBe(false);
+    expect(await c.version()).toBeUndefined();
+    await expect(c.call('browser_navigate', { url: 'https://x/' })).rejects.toThrow(/not installed/);
+  });
+
+  it('reads the version from the binary', async () => {
+    const d = tmp();
+    const bin = join(d, 'obscura');
+    writeFileSync(bin, '#!/bin/sh\necho "obscura 0.2.2"\n');
+    chmodSync(bin, 0o755);
+    const c = new ObscuraClient({ bin });
+    expect(c.available()).toBe(true);
+    expect(await c.version()).toBe('0.2.2');
+  });
+
+  it('initializes once, passes tool errors through, and fails pending calls when the engine exits', async () => {
+    const written: string[] = [];
+    let exitCb: (() => void) | undefined;
+    const spawn = (bin: string, args: string[]): ObscuraProcess => {
+      expect(bin).toBe('/x/obscura');
+      expect(args).toEqual(['mcp', '--stealth']);
+      const queue: string[] = [];
+      let wake: (() => void) | undefined;
+      let closed = false;
+      return {
+        stdin: {
+          write(chunk: string) {
+            written.push(chunk);
+            const msg = JSON.parse(chunk) as { id?: number; method: string; params?: { name?: string } };
+            if (msg.id === undefined) return;
+            if (msg.method === 'initialize') queue.push(JSON.stringify({ jsonrpc: '2.0', id: msg.id, result: {} }) + '\n');
+            else if (msg.params?.name === 'bad') queue.push(JSON.stringify({ jsonrpc: '2.0', id: msg.id, result: { content: [{ type: 'text', text: 'nope' }], isError: true } }) + '\n');
+            else if (msg.params?.name === 'hang') return;
+            else queue.push('garbage line\n' + JSON.stringify({ jsonrpc: '2.0', id: msg.id, result: { content: [{ type: 'text', text: 'a' }, { type: 'text', text: 'b' }] } }) + '\n');
+            wake?.();
+          },
+        },
+        stdout: (async function* () {
+          while (!closed) {
+            if (queue.length) { yield Buffer.from(queue.shift() as string); continue; }
+            await new Promise<void>((r) => { wake = r; });
+            wake = undefined;
+          }
+        })(),
+        kill: () => { closed = true; wake?.(); },
+        onExit: (cb) => { exitCb = cb; },
+      };
+    };
+    const c = new ObscuraClient({ bin: '/x/obscura', stealth: true, spawn, timeoutMs: 500 });
+    const ok = await c.call('good');
+    expect(resultText(ok)).toBe('a\nb');
+    expect(ok.isError).toBeUndefined();
+    const bad = await c.call('bad');
+    expect(bad.isError).toBe(true);
+    expect(resultText(bad)).toBe('nope');
+    // One initialize + one initialized notification for the whole life of the process.
+    expect(written.filter((w) => w.includes('"initialize"'))).toHaveLength(1);
+    expect(written.filter((w) => w.includes('notifications/initialized'))).toHaveLength(1);
+    expect(c.running()).toBe(true);
+
+    const pending = c.call('hang');
+    await new Promise((r) => setImmediate(r)); // let the request register before the engine dies
+    exitCb?.();
+    await expect(pending).rejects.toThrow(/exited/);
+    expect(c.running()).toBe(false);
+  });
+});
diff --git a/packages/sdk/src/mcp/obscura.ts b/packages/sdk/src/mcp/obscura.ts
new file mode 100644
index 00000000..d0e51d1f
--- /dev/null
+++ b/packages/sdk/src/mcp/obscura.ts
@@ -0,0 +1,231 @@
+/**
+ * Obscura as an engine (PRD M3.8). Obscura is a headless browser with its own
+ * rendering engine and a real V8: it starts in milliseconds, renders a light
+ * page in tens of milliseconds and holds ~30 MB doing it, which is the scraping
+ * profile Chromium cannot match. It ships an MCP server, so the SDK drives it
+ * as an MCP client over stdio (newline-delimited JSON-RPC on a child process).
+ *
+ * Stdio on purpose: Obscura's HTTP transport answers the first request on a
+ * connection fast and then stalls every later request on that connection by
+ * ~4 s, and a child process needs no port anyway.
+ */
+import { spawn } from 'node:child_process';
+import { execFile } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { delimiter, join } from 'node:path';
+import type { JsonRpcMessage, McpContent } from './protocol.js';
+
+export interface ObscuraToolResult {
+  content: McpContent[];
+  isError?: boolean;
+}
+
+/** The bits of a child process the client needs; fakes stand in for tests. */
+export interface ObscuraProcess {
+  stdin: { write(chunk: string): unknown };
+  stdout: AsyncIterable<string | Uint8Array>;
+  kill(): void;
+  onExit(cb: () => void): void;
+}
+
+export type ObscuraSpawner = (bin: string, args: string[]) => ObscuraProcess;
+
+export interface ObscuraOptions {
+  /** Path to the obscura binary. Default: resolveObscuraBin(); an explicit undefined means none. */
+  bin?: string | undefined;
+  /** Run Obscura with --stealth (Chrome TLS fingerprint + tracker blocklist). */
+  stealth?: boolean;
+  /** Per-call timeout; a call past it rejects and the engine is restarted. */
+  timeoutMs?: number;
+  spawn?: ObscuraSpawner;
+}
+
+export const DEFAULT_OBSCURA_TIMEOUT_MS = 30_000;
+
+/**
+ * Where the obscura binary is. `TRON_OBSCURA_BIN` is what the `tron` CLI sets
+ * (the installer puts Obscura next to the launcher), `OBSCURA_BIN` is the
+ * convention the rest of the fleet uses, then PATH.
+ */
+export function resolveObscuraBin(env: NodeJS.ProcessEnv = process.env): string | undefined {
+  for (const key of ['TRON_OBSCURA_BIN', 'OBSCURA_BIN']) {
+    const value = env[key];
+    if (value && existsSync(value)) return value;
+  }
+  for (const dir of (env.PATH ?? '').split(delimiter)) {
+    if (!dir) continue;
+    const candidate = join(dir, 'obscura');
+    if (existsSync(candidate)) return candidate;
+  }
+  return undefined;
+}
+
+const defaultSpawn: ObscuraSpawner = (bin, args) => {
+  const child = spawn(bin, args, { stdio: ['pipe', 'pipe', 'ignore'] });
+  return {
+    stdin: child.stdin,
+    stdout: child.stdout,
+    kill: () => {
+      child.kill();
+    },
+    onExit: (cb) => {
+      child.once('exit', cb);
+      child.once('error', cb);
+    },
+  };
+};
+
+interface Pending {
+  resolve: (msg: JsonRpcMessage) => void;
+  reject: (err: Error) => void;
+  timer: NodeJS.Timeout;
+}
+
+export class ObscuraClient {
+  readonly bin: string | undefined;
+  readonly #stealth: boolean;
+  readonly #timeoutMs: number;
+  readonly #spawn: ObscuraSpawner;
+  #proc: ObscuraProcess | undefined;
+  #ready: Promise<void> | undefined;
+  #nextId = 1;
+  readonly #pending = new Map<number, Pending>();
+
+  constructor(options: ObscuraOptions = {}) {
+    // An explicit `bin: undefined` means "none"; only an absent key resolves.
+    this.bin = 'bin' in options ? options.bin : resolveObscuraBin();
+    this.#stealth = options.stealth ?? false;
+    this.#timeoutMs = options.timeoutMs ?? DEFAULT_OBSCURA_TIMEOUT_MS;
+    this.#spawn = options.spawn ?? defaultSpawn;
+  }
+
+  /** True when there is a binary to run. Nothing is spawned until the first call. */
+  available(): boolean {
+    return this.bin !== undefined;
+  }
+
+  running(): boolean {
+    return this.#proc !== undefined;
+  }
+
+  /** `obscura --version`, or undefined when the binary is missing or broken. */
+  version(): Promise<string | undefined> {
+    const bin = this.bin;
+    if (!bin) return Promise.resolve(undefined);
+    return new Promise((resolve) => {
+      execFile(bin, ['--version'], { timeout: 5000 }, (err, stdout) => {
+        resolve(err ? undefined : stdout.trim().replace(/^obscura\s+/, ''));
+      });
+    });
+  }
+
+  /** Call one Obscura MCP tool; rejects on transport failure or timeout. */
+  async call(name: string, args: Record<string, unknown> = {}, timeoutMs = this.#timeoutMs): Promise<ObscuraToolResult> {
+    await this.#ensure();
+    const msg = await this.#request('tools/call', { name, arguments: args }, timeoutMs);
+    if (msg.error) throw new Error(msg.error.message);
+    const result = (msg.result ?? {}) as Partial<ObscuraToolResult>;
+    return { content: result.content ?? [], ...(result.isError ? { isError: true } : {}) };
+  }
+
+  /** Stop the engine. The next call starts a fresh one. */
+  async close(): Promise<void> {
+    const proc = this.#proc;
+    this.#proc = undefined;
+    this.#ready = undefined;
+    this.#failAll(new Error('Obscura closed'));
+    proc?.kill();
+  }
+
+  #ensure(): Promise<void> {
+    if (!this.bin) return Promise.reject(new Error('Obscura is not installed (set TRON_OBSCURA_BIN or put obscura on PATH).'));
+    if (this.#ready) return this.#ready;
+    const proc = this.#spawn(this.bin, ['mcp', ...(this.#stealth ? ['--stealth'] : [])]);
+    this.#proc = proc;
+    proc.onExit(() => {
+      if (this.#proc === proc) {
+        this.#proc = undefined;
+        this.#ready = undefined;
+      }
+      this.#failAll(new Error('Obscura exited'));
+    });
+    void this.#read(proc);
+    this.#ready = this.#request(
+      'initialize',
+      { protocolVersion: '2024-11-05', capabilities: {}, clientInfo: { name: 'tronbrowser', version: '3.9' } },
+      this.#timeoutMs,
+    ).then((msg) => {
+      if (msg.error) throw new Error(msg.error.message);
+      proc.stdin.write(JSON.stringify({ jsonrpc: '2.0', method: 'notifications/initialized' }) + '\n');
+    });
+    this.#ready.catch(() => this.close());
+    return this.#ready;
+  }
+
+  async #read(proc: ObscuraProcess): Promise<void> {
+    let buffer = '';
+    try {
+      for await (const chunk of proc.stdout) {
+        buffer += typeof chunk === 'string' ? chunk : Buffer.from(chunk).toString('utf8');
+        let nl: number;
+        while ((nl = buffer.indexOf('\n')) >= 0) {
+          const line = buffer.slice(0, nl).trim();
+          buffer = buffer.slice(nl + 1);
+          if (!line) continue;
+          let msg: JsonRpcMessage;
+          try {
+            msg = JSON.parse(line) as JsonRpcMessage;
+          } catch {
+            continue;
+          }
+          if (typeof msg.id !== 'number') continue;
+          const pending = this.#pending.get(msg.id);
+          if (!pending) continue;
+          this.#pending.delete(msg.id);
+          clearTimeout(pending.timer);
+          pending.resolve(msg);
+        }
+      }
+    } catch {
+      // stream closed; onExit handles the rest
+    }
+  }
+
+  #request(method: string, params: Record<string, unknown>, timeoutMs: number): Promise<JsonRpcMessage> {
+    const proc = this.#proc;
+    if (!proc) return Promise.reject(new Error('Obscura is not running'));
+    const id = this.#nextId++;
+    return new Promise<JsonRpcMessage>((resolve, reject) => {
+      const timer = setTimeout(() => {
+        this.#pending.delete(id);
+        reject(new Error(`Obscura timed out after ${timeoutMs}ms on ${method}`));
+        // A stuck engine stays stuck; start over next time.
+        void this.close();
+      }, timeoutMs);
+      this.#pending.set(id, { resolve, reject, timer });
+      try {
+        proc.stdin.write(JSON.stringify({ jsonrpc: '2.0', id, method, params }) + '\n');
+      } catch (err) {
+        this.#pending.delete(id);
+        clearTimeout(timer);
+        reject(err instanceof Error ? err : new Error(String(err)));
+      }
+    });
+  }
+
+  #failAll(err: Error): void {
+    for (const [id, pending] of this.#pending) {
+      this.#pending.delete(id);
+      clearTimeout(pending.timer);
+      pending.reject(err);
+    }
+  }
+}
+
+/** The text of a tool result, blocks joined. */
+export function resultText(result: ObscuraToolResult): string {
+  return result.content
+    .map((block) => (block.type === 'text' ? block.text : ''))
+    .filter(Boolean)
+    .join('\n');
+}
diff --git a/packages/sdk/src/mcp/server.ts b/packages/sdk/src/mcp/server.ts
index bd1c4a82..8b807a32 100644
--- a/packages/sdk/src/mcp/server.ts
+++ b/packages/sdk/src/mcp/server.ts
@@ -2,15 +2,16 @@
  * Assemble the MCP server from a browser session, and a newline-delimited stdio
  * transport (PRD M3.6). Local only — the host speaks JSON-RPC over stdin/stdout.
  */
-import { McpServer, type McpServerInfo } from './protocol.js';
+import { McpServer, type McpServerInfo, type McpTool } from './protocol.js';
 import type { McpBrowserSession } from './session.js';
 import { browserTools } from './tools.js';
 
 const DEFAULT_INFO: McpServerInfo = { name: 'tronbrowser', version: '3.7' };
 
-export function createMcpServer(session: McpBrowserSession, info: McpServerInfo = DEFAULT_INFO): McpServer {
+export function createMcpServer(session: McpBrowserSession, info: McpServerInfo = DEFAULT_INFO, extras: McpTool[] = []): McpServer {
   const server = new McpServer(info);
   for (const tool of browserTools(session)) server.register(tool);
+  for (const tool of extras) server.register(tool);
   return server;
 }
 
diff --git a/packages/sdk/src/mcp/session.ts b/packages/sdk/src/mcp/session.ts
index 1d4f515b..7f98301c 100644
--- a/packages/sdk/src/mcp/session.ts
+++ b/packages/sdk/src/mcp/session.ts
@@ -48,6 +48,11 @@ export class McpBrowserSession {
     });
   }
 
+  /** True once a tool has launched the managed session and it is still open. */
+  isOpen(): boolean {
+    return this.#current !== undefined;
+  }
+
   async getPage(): Promise<McpPage> {
     this.#current ??= await this.#launch();
     return this.#current.page;
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index a39501ff..66cbb6fb 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -294,6 +294,9 @@ importers:
       '@logicsrc/agentswarm':
         specifier: ^0.1.0
         version: 0.1.0(@langchain/langgraph@1.4.6(@langchain/core@1.2.1(openai@6.45.0(ws@8.21.0)(zod@4.4.3))(ws@8.21.0))(react@19.2.7)(zod@4.4.3))(deepagents@1.10.5(langsmith@0.7.12(openai@6.45.0(ws@8.21.0)(zod@4.4.3))(ws@8.21.0))(openai@6.45.0(ws@8.21.0)(zod@4.4.3))(react@19.2.7)(ws@8.21.0))
+      '@tronbrowser/sdk':
+        specifier: workspace:*
+        version: link:../../packages/sdk
       deepagents:
         specifier: ^1.10.5
         version: 1.10.5(langsmith@0.7.12(openai@6.45.0(ws@8.21.0)(zod@4.4.3))(ws@8.21.0))(openai@6.45.0(ws@8.21.0)(zod@4.4.3))(react@19.2.7)(ws@8.21.0)
@@ -2491,7 +2494,6 @@ packages:
 
   libsql@0.4.7:
     resolution: {integrity: sha512-T9eIRCs6b0J1SHKYIvD8+KCJMcWZ900iZyxdnSCdqxN12Z1ijzT+jY5nrk72Jw4B0HGzms2NgpryArlJqvc3Lw==}
-    cpu: [x64, arm64, wasm32]
     os: [darwin, linux, win32]
 
   lighthouse-logger@1.4.2:
diff --git a/railway.json b/railway.json
index 66168c71..acda150d 100644
--- a/railway.json
+++ b/railway.json
@@ -7,6 +7,10 @@
       "apps/web/**/*",
       "apps/extensions/**/*",
       "services/api/**/*",
+      "packages/browser-core/**/*",
+      "packages/agent-runtime/**/*",
+      "packages/sdk/**/*",
+      "pnpm-lock.yaml",
       "Dockerfile",
       "Caddyfile",
       "start.sh",
diff --git a/services/api/package.json b/services/api/package.json
index 449fefa0..ba0dd1a2 100644
--- a/services/api/package.json
+++ b/services/api/package.json
@@ -20,6 +20,7 @@
     "@langchain/openai": "^1.5.3",
     "@libsql/client": "^0.14.0",
     "@logicsrc/agentswarm": "^0.1.0",
+    "@tronbrowser/sdk": "workspace:*",
     "deepagents": "^1.10.5",
     "fflate": "^0.8.3",
     "hono": "^4.6.14"
diff --git a/services/api/scripts/mcp-smoke.mjs b/services/api/scripts/mcp-smoke.mjs
new file mode 100644
index 00000000..69360f1a
--- /dev/null
+++ b/services/api/scripts/mcp-smoke.mjs
@@ -0,0 +1,59 @@
+// Smoke-test the hosted relay (tronbrowser.dev/mcp/tron) against the real
+// engines, without the rest of the API: serves the relay on loopback, runs the
+// MCP handshake, a few fetches through both engines, a private-target refusal
+// and a screenshot, then checks no tab was left open.
+//
+//   pnpm --filter @tronbrowser/api build
+//   TRON_MCP_CHROMIUM_BIN=/opt/ungoogled-chromium/chrome OBSCURA_BIN=/opt/obscura/obscura \
+//     node services/api/scripts/mcp-smoke.mjs
+import { serve } from '@hono/node-server';
+import { tronRelay } from '../dist/mcp/tron.js';
+
+const port = Number(process.env.PORT || 38790);
+const relay = tronRelay({ log: (l) => console.error('[relay]', l) });
+const server = serve({ fetch: relay.app.fetch, port, hostname: '127.0.0.1' }, () => console.error(`smoke: relay on 127.0.0.1:${port}`));
+const base = `http://127.0.0.1:${port}/`;
+const post = (body) => fetch(base, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(body) }).then((r) => r.json());
+const short = (s) => s.slice(0, 70).replace(/\n/g, ' ');
+
+let failed = 0;
+const check = (label, ok, detail) => {
+  console.log(`${ok ? 'ok  ' : 'FAIL'} ${label}${detail ? `  ${detail}` : ''}`);
+  if (!ok) failed++;
+};
+
+try {
+  const health = await (await fetch(base)).json();
+  check('GET describes the relay', health.ok === true && Array.isArray(health.tools), JSON.stringify(health));
+  const init = await post({ jsonrpc: '2.0', id: 1, method: 'initialize', params: {} });
+  check('initialize', init.result?.serverInfo?.name === 'tronbrowser');
+
+  let id = 2;
+  const cases = [
+    ['https://example.com/', {}, 'obscura'],
+    ['https://github.com/h4ckf0r0day/obscura', { engine: 'chromium', max_chars: 2000 }, 'chromium'],
+    ['https://news.ycombinator.com/', { format: 'links', max_chars: 3000 }, undefined],
+  ];
+  for (const [url, extra, expectEngine] of cases) {
+    const r = (await post({ jsonrpc: '2.0', id: id++, method: 'tools/call', params: { name: 'fetch_page', arguments: { url, ...extra } } })).result;
+    if (r.isError) {
+      check(`fetch ${url}`, false, r.content[0].text);
+      continue;
+    }
+    const outcome = JSON.parse(r.content[1].text);
+    check(`fetch ${url}`, !expectEngine || outcome.engine === expectEngine, `${r.content[1].text} | ${short(r.content[0].text)}`);
+  }
+  const priv = (await post({ jsonrpc: '2.0', id: id++, method: 'tools/call', params: { name: 'fetch_page', arguments: { url: 'http://localhost:8090/api/healthz' } } })).result;
+  check('private target refused', priv.isError === true, priv.content[0].text);
+
+  const shot = (await post({ jsonrpc: '2.0', id: id++, method: 'tools/call', params: { name: 'screenshot_page', arguments: { url: 'https://example.com/' } } })).result;
+  const png = shot.isError ? null : Buffer.from(shot.content[0].data, 'base64');
+  check('screenshot_page is a PNG', png !== null && png.subarray(1, 4).toString() === 'PNG', shot.isError ? shot.content[0].text : `${png.length} bytes`);
+
+  check('no tab left open', relay.engines?.chromium.openPages() === 0, `open=${relay.engines?.chromium.openPages()}`);
+} finally {
+  await relay.close();
+  server.close();
+}
+console.log(failed ? `smoke: ${failed} failed` : 'smoke: all good');
+process.exit(failed ? 1 : 0);
diff --git a/services/api/src/index.ts b/services/api/src/index.ts
index 5b814de2..89ab8f81 100644
--- a/services/api/src/index.ts
+++ b/services/api/src/index.ts
@@ -12,6 +12,7 @@ import { sendEmail } from './email.js';
 import { store } from './store/routes.js';
 import { swarmRoutes } from './swarm.js';
 import { dnsRoutes } from './dns.js';
+import { tronRelay } from './mcp/tron.js';
 import { safeRedirect } from './redirect.js';
 import { extLoginTarget } from './ext-login.js';
 
@@ -59,6 +60,12 @@ app.route('/api/swarm', swarmRoutes({ currentUser }));
 /* ---------- DNS verifier (signed-in ops tool for /dns) ---------- */
 app.route('/api/dns', dnsRoutes({ currentUser }));
 
+/* ---------- OpenMCP relay: tronbrowser.dev/mcp/tron (Obscura + ungoogled-chromium) ---------- */
+// Public, keyless, stateless: fetch_page / screenshot_page only, one fresh tab
+// per call, capped and rate-limited. The descriptor a catalog reads is the
+// static /.well-known/openmcp.json. TRON_MCP_DISABLED=1 turns it off.
+if (process.env.TRON_MCP_DISABLED !== '1') app.route('/mcp/tron', tronRelay().app);
+
 /* ---------- Extension sign-in (adopts an existing website session) ---------- */
 // The browser extension calls this instead of /coinpay/login directly: it can't
 // use chrome.identity (see ext-login.ts), so it passes an on-origin
diff --git a/services/api/src/mcp/guard.test.ts b/services/api/src/mcp/guard.test.ts
new file mode 100644
index 00000000..035dca12
--- /dev/null
+++ b/services/api/src/mcp/guard.test.ts
@@ -0,0 +1,69 @@
+import { describe, expect, it } from 'vitest';
+import { acceptableUrl, clientKey, isPrivateAddress, RateLimiter } from './guard.js';
+
+describe('isPrivateAddress', () => {
+  it('knows the ranges a relay must never reach', () => {
+    for (const ip of ['127.0.0.1', '10.1.2.3', '172.16.0.1', '172.31.255.255', '192.168.1.1', '169.254.169.254', '0.0.0.0', '100.64.0.1', '224.0.0.1', '::1', '::', 'fe80::1', 'fd00::1', 'fc00::1', '::ffff:10.0.0.1', 'ff02::1']) {
+      expect(isPrivateAddress(ip), ip).toBe(true);
+    }
+    for (const ip of ['8.8.8.8', '1.1.1.1', '172.32.0.1', '100.128.0.1', '2606:4700::1111', '::ffff:8.8.8.8']) {
+      expect(isPrivateAddress(ip), ip).toBe(false);
+    }
+    expect(isPrivateAddress('not-an-ip')).toBe(true);
+  });
+});
+
+describe('acceptableUrl', () => {
+  const publicDns = async () => ['93.184.216.34'];
+  it('accepts a public https URL after resolving it', async () => {
+    const v = await acceptableUrl('https://example.com/a?b=1', publicDns);
+    expect(v).toEqual({ ok: true, url: 'https://example.com/a?b=1' });
+  });
+  it('refuses non-http schemes, credentials, and empty input', async () => {
+    expect((await acceptableUrl('ftp://example.com/', publicDns)).ok).toBe(false);
+    expect((await acceptableUrl('file:///etc/passwd', publicDns)).ok).toBe(false);
+    expect((await acceptableUrl('https://user:pw@example.com/', publicDns)).ok).toBe(false);
+    expect((await acceptableUrl('', publicDns)).ok).toBe(false);
+    expect((await acceptableUrl(undefined, publicDns)).ok).toBe(false);
+    expect((await acceptableUrl('nope', publicDns)).ok).toBe(false);
+  });
+  it('refuses private names and literal private addresses without resolving', async () => {
+    const never = async () => { throw new Error('should not resolve'); };
+    for (const url of ['http://localhost:8090/', 'http://api.localhost/', 'http://web.railway.internal/', 'http://printer.local/', 'http://127.0.0.1/', 'http://[::1]/', 'http://169.254.169.254/latest/meta-data', 'http://10.0.0.5/']) {
+      const v = await acceptableUrl(url, never);
+      expect(v.ok, url).toBe(false);
+    }
+  });
+  it('refuses a public name that resolves to a private address, or does not resolve', async () => {
+    const rebinding = async () => ['93.184.216.34', '10.0.0.5'];
+    const v = await acceptableUrl('https://evil.example/', rebinding);
+    expect(v.ok).toBe(false);
+    expect((v as { error: string }).error).toMatch(/private address/);
+    const dead = async () => { throw new Error('ENOTFOUND'); };
+    expect((await acceptableUrl('https://nope.invalid/', dead)).ok).toBe(false);
+    expect((await acceptableUrl('https://nope.invalid/', async () => [])).ok).toBe(false);
+  });
+});
+
+describe('RateLimiter', () => {
+  it('allows a burst, then refills over time, per key', () => {
+    let t = 0;
+    const rl = new RateLimiter({ burst: 3, perMinute: 60, now: () => t });
+    expect([rl.take('a'), rl.take('a'), rl.take('a'), rl.take('a')]).toEqual([true, true, true, false]);
+    expect(rl.take('b')).toBe(true); // another caller is unaffected
+    t += 1000; // one token a second at 60/min
+    expect(rl.take('a')).toBe(true);
+    expect(rl.take('a')).toBe(false);
+    t += 60_000;
+    expect([rl.take('a'), rl.take('a'), rl.take('a'), rl.take('a')]).toEqual([true, true, true, false]); // capped at burst
+  });
+});
+
+describe('clientKey', () => {
+  const headers = (h: Record<string, string>) => ({ get: (n: string) => h[n.toLowerCase()] });
+  it('takes the first X-Forwarded-For hop, then X-Real-IP, then unknown', () => {
+    expect(clientKey(headers({ 'x-forwarded-for': '203.0.113.9, 10.0.0.1' }))).toBe('203.0.113.9');
+    expect(clientKey(headers({ 'x-real-ip': '203.0.113.7' }))).toBe('203.0.113.7');
+    expect(clientKey(headers({}))).toBe('unknown');
+  });
+});
diff --git a/services/api/src/mcp/guard.ts b/services/api/src/mcp/guard.ts
new file mode 100644
index 00000000..480cf30b
--- /dev/null
+++ b/services/api/src/mcp/guard.ts
@@ -0,0 +1,123 @@
+/**
+ * What a public, keyless browser relay has to refuse before it renders
+ * anything: private and loopback targets (the container's own API, Railway's
+ * private network, cloud metadata) and callers who lean on it too hard.
+ * Pure functions plus one small token bucket, so the route is testable
+ * without a browser.
+ */
+import { lookup } from 'node:dns/promises';
+import { isIP } from 'node:net';
+
+export type Verdict = { ok: true; url: string } | { ok: false; error: string };
+
+const BLOCKED_HOST = /(^|\.)(localhost|local|internal|railway\.internal|home\.arpa)$/i;
+
+/** True for loopback, link-local, RFC1918, CGNAT, multicast, unspecified, and their v6 forms. */
+export function isPrivateAddress(ip: string): boolean {
+  const kind = isIP(ip);
+  if (kind === 4) return privateV4(ip);
+  if (kind === 6) {
+    const lower = ip.toLowerCase();
+    if (lower === '::' || lower === '::1') return true;
+    const mapped = /^::ffff:(\d+\.\d+\.\d+\.\d+)$/.exec(lower);
+    if (mapped) return privateV4(mapped[1] as string);
+    if (lower.startsWith('fe8') || lower.startsWith('fe9') || lower.startsWith('fea') || lower.startsWith('feb')) return true; // fe80::/10
+    if (lower.startsWith('fc') || lower.startsWith('fd')) return true; // fc00::/7
+    if (lower.startsWith('ff')) return true; // multicast
+    return false;
+  }
+  return true; // not an address at all: refuse
+}
+
+function privateV4(ip: string): boolean {
+  const parts = ip.split('.').map(Number);
+  const [a, b] = parts as [number, number, number, number];
+  if (a === 0 || a === 10 || a === 127) return true;
+  if (a === 169 && b === 254) return true;
+  if (a === 172 && b >= 16 && b <= 31) return true;
+  if (a === 192 && b === 168) return true;
+  if (a === 100 && b >= 64 && b <= 127) return true; // CGNAT
+  if (a >= 224) return true; // multicast + reserved
+  return false;
+}
+
+export type Lookup = (host: string) => Promise<string[]>;
+
+const defaultLookup: Lookup = async (host) => (await lookup(host, { all: true })).map((r) => r.address);
+
+/**
+ * Only public http(s) URLs. The name is checked, then what it resolves to, so
+ * `http://api.attacker.tld` pointing at 10.0.0.5 is refused before any engine
+ * connects. (The engines re-resolve; Chromium also carries host-resolver rules
+ * for the same ranges and Obscura blocks private targets itself.)
+ */
+export async function acceptableUrl(value: unknown, resolve: Lookup = defaultLookup): Promise<Verdict> {
+  if (typeof value !== 'string' || !value.trim()) return { ok: false, error: 'url is required' };
+  let url: URL;
+  try {
+    url = new URL(value.trim());
+  } catch {
+    return { ok: false, error: `Not a URL: ${value}` };
+  }
+  if (url.protocol !== 'http:' && url.protocol !== 'https:') return { ok: false, error: 'Only http(s) URLs are fetched' };
+  if (url.username || url.password) return { ok: false, error: 'Credentials in the URL are not accepted' };
+  const host = url.hostname.replace(/^\[|\]$/g, '');
+  if (!host || BLOCKED_HOST.test(host)) return { ok: false, error: `Refusing to fetch ${host || '(empty host)'}` };
+  if (isIP(host)) {
+    if (isPrivateAddress(host)) return { ok: false, error: `Refusing to fetch a private address (${host})` };
+    return { ok: true, url: url.toString() };
+  }
+  let addresses: string[];
+  try {
+    addresses = await resolve(host);
+  } catch {
+    return { ok: false, error: `${host} does not resolve` };
+  }
+  if (!addresses.length) return { ok: false, error: `${host} does not resolve` };
+  const bad = addresses.find(isPrivateAddress);
+  if (bad) return { ok: false, error: `Refusing to fetch ${host}: it resolves to a private address` };
+  return { ok: true, url: url.toString() };
+}
+
+/** Per-key token bucket: `burst` calls at once, refilled at `perMinute`. */
+export class RateLimiter {
+  readonly #buckets = new Map<string, { tokens: number; at: number }>();
+  readonly #burst: number;
+  readonly #perMs: number;
+  readonly #now: () => number;
+
+  constructor(options: { burst: number; perMinute: number; now?: () => number }) {
+    this.#burst = options.burst;
+    this.#perMs = options.perMinute / 60_000;
+    this.#now = options.now ?? Date.now;
+  }
+
+  /** Take one token for `key`; false when the caller has to wait. */
+  take(key: string): boolean {
+    const now = this.#now();
+    const bucket = this.#buckets.get(key) ?? { tokens: this.#burst, at: now };
+    bucket.tokens = Math.min(this.#burst, bucket.tokens + (now - bucket.at) * this.#perMs);
+    bucket.at = now;
+    if (bucket.tokens < 1) {
+      this.#buckets.set(key, bucket);
+      return false;
+    }
+    bucket.tokens -= 1;
+    this.#buckets.set(key, bucket);
+    if (this.#buckets.size > 10_000) this.#sweep(now);
+    return true;
+  }
+
+  #sweep(now: number): void {
+    for (const [key, bucket] of this.#buckets) {
+      if (now - bucket.at > 10 * 60_000) this.#buckets.delete(key);
+    }
+  }
+}
+
+/** The caller's address behind Railway's edge and Caddy: first hop of X-Forwarded-For. */
+export function clientKey(headers: { get(name: string): string | undefined | null }): string {
+  const forwarded = headers.get('x-forwarded-for') ?? '';
+  const first = forwarded.split(',')[0]?.trim();
+  return first || headers.get('x-real-ip') || 'unknown';
+}
diff --git a/services/api/src/mcp/tron.test.ts b/services/api/src/mcp/tron.test.ts
new file mode 100644
index 00000000..67522250
--- /dev/null
+++ b/services/api/src/mcp/tron.test.ts
@@ -0,0 +1,129 @@
+import { describe, expect, it } from 'vitest';
+import type { FetchArgs } from '@tronbrowser/sdk';
+import { tronRelay, MAX_CHARS_CAP, MAX_TIMEOUT_S } from './tron.js';
+
+const publicDns = async () => ['93.184.216.34'];
+
+function relay(over: Parameters<typeof tronRelay>[0] = {}) {
+  const fetched: FetchArgs[] = [];
+  let release: (() => void) | undefined;
+  const r = tronRelay({
+    lookup: publicDns,
+    log: () => {},
+    fetch: async (args) => {
+      fetched.push(args);
+      if (args.url.includes('slow')) await new Promise<void>((res) => { release = res; });
+      return { text: `page ${args.url}`, outcome: { engine: 'obscura', url: args.url, format: args.format, ms: 5, chars: 10 } };
+    },
+    screenshot: async () => Buffer.from('PNG'),
+    ...over,
+  });
+  const post = (body: unknown, headers: Record<string, string> = {}) =>
+    r.app.request('/', { method: 'POST', headers: { 'content-type': 'application/json', ...headers }, body: typeof body === 'string' ? body : JSON.stringify(body) });
+  const call = async (name: string, args: Record<string, unknown>, headers: Record<string, string> = {}) => {
+    const res = await post({ jsonrpc: '2.0', id: 1, method: 'tools/call', params: { name, arguments: args } }, headers);
+    return (await res.json()).result as { content: Array<{ type: string; text?: string; data?: string }>; isError?: boolean };
+  };
+  return { ...r, post, call, fetched, release: () => release?.() };
+}
+
+describe('tronbrowser.dev/mcp/tron', () => {
+  it('describes itself on GET and lists only the stateless tools', async () => {
+    const r = relay();
+    const res = await r.app.request('/');
+    const body = await res.json();
+    expect(body.ok).toBe(true);
+    expect(body.descriptor).toBe('https://tronbrowser.dev/.well-known/openmcp.json');
+    expect(body.tools).toEqual(['fetch_page', 'screenshot_page']);
+    const list = await (await r.post({ jsonrpc: '2.0', id: 1, method: 'tools/list' })).json();
+    expect(list.result.tools.map((t: { name: string }) => t.name)).toEqual(['fetch_page', 'screenshot_page']);
+  });
+
+  it('runs the MCP handshake over plain JSON and answers notifications with 202', async () => {
+    const r = relay();
+    const init = await r.post({ jsonrpc: '2.0', id: 1, method: 'initialize', params: { protocolVersion: '2025-06-18' } });
+    expect(init.status).toBe(200);
+    expect((await init.json()).result.serverInfo.name).toBe('tronbrowser');
+    expect((await r.post({ jsonrpc: '2.0', method: 'notifications/initialized' })).status).toBe(202);
+    expect((await r.post('{oops')).status).toBe(400);
+    const batch = await (await r.post([{ jsonrpc: '2.0', id: 1, method: 'ping' }, 5])).json();
+    expect(batch).toHaveLength(2);
+    expect(batch[1].error.code).toBe(-32600);
+  });
+
+  it('fetch_page returns the page and the outcome line', async () => {
+    const r = relay();
+    const out = await r.call('fetch_page', { url: 'https://example.com/', format: 'text' });
+    expect(out.isError).toBeUndefined();
+    expect(out.content[0]!.text).toBe('page https://example.com/');
+    expect(JSON.parse(out.content[1]!.text!)).toMatchObject({ engine: 'obscura', format: 'text' });
+    expect(r.fetched[0]).toMatchObject({ url: 'https://example.com/', format: 'text', engine: 'auto' });
+  });
+
+  it('caps max_chars and the Obscura budget for a public caller', async () => {
+    const r = relay();
+    await r.call('fetch_page', { url: 'https://example.com/', max_chars: 10_000_000, timeout_s: 600 });
+    expect(r.fetched[0]!.maxChars).toBe(MAX_CHARS_CAP);
+    expect(r.fetched[0]!.budgetMs).toBe(MAX_TIMEOUT_S * 1000);
+  });
+
+  it('refuses private targets before touching an engine', async () => {
+    const r = relay();
+    for (const url of ['http://localhost:8090/api/healthz', 'http://169.254.169.254/', 'http://10.0.0.1/', 'file:///etc/passwd']) {
+      const out = await r.call('fetch_page', { url });
+      expect(out.isError, url).toBe(true);
+    }
+    const shot = await r.call('screenshot_page', { url: 'http://127.0.0.1/' });
+    expect(shot.isError).toBe(true);
+    expect(r.fetched).toHaveLength(0);
+  });
+
+  it('refuses a name that resolves to a private address', async () => {
+    const r = relay({ lookup: async () => ['10.9.9.9'] });
+    const out = await r.call('fetch_page', { url: 'https://rebind.example/' });
+    expect(out.isError).toBe(true);
+    expect(out.content[0]!.text).toMatch(/private address/);
+  });
+
+  it('screenshot_page returns PNG image content', async () => {
+    const r = relay();
+    const out = await r.call('screenshot_page', { url: 'https://example.com/' });
+    const img = out.content[0]!;
+    expect(img.type).toBe('image');
+    expect(Buffer.from(img.data!, 'base64').toString()).toBe('PNG');
+  });
+
+  it('rate-limits tool calls per caller address, not the handshake', async () => {
+    let t = 0;
+    const r = relay({ rate: { burst: 2, perMinute: 60 }, now: () => t });
+    const a = { 'x-forwarded-for': '203.0.113.1' };
+    expect((await r.call('fetch_page', { url: 'https://example.com/' }, a)).isError).toBeUndefined();
+    expect((await r.call('fetch_page', { url: 'https://example.com/' }, a)).isError).toBeUndefined();
+    const third = await r.call('fetch_page', { url: 'https://example.com/' }, a);
+    expect(third.isError).toBe(true);
+    expect(third.content[0]!.text).toMatch(/Rate limited/);
+    // Another caller and the handshake are unaffected.
+    expect((await r.call('fetch_page', { url: 'https://example.com/' }, { 'x-forwarded-for': '203.0.113.2' })).isError).toBeUndefined();
+    expect((await r.post({ jsonrpc: '2.0', id: 9, method: 'ping' }, a)).status).toBe(200);
+    t += 1000;
+    expect((await r.call('fetch_page', { url: 'https://example.com/' }, a)).isError).toBeUndefined();
+  });
+
+  it('answers Busy past the concurrency cap instead of queueing', async () => {
+    const r = relay({ maxConcurrent: 1 });
+    const slow = r.call('fetch_page', { url: 'https://slow.example/' });
+    await new Promise((res) => setTimeout(res, 10));
+    const busy = await r.call('fetch_page', { url: 'https://example.com/' });
+    expect(busy.isError).toBe(true);
+    expect(busy.content[0]!.text).toMatch(/Busy/);
+    r.release();
+    expect((await slow).isError).toBeUndefined();
+    expect((await r.call('fetch_page', { url: 'https://example.com/' })).isError).toBeUndefined();
+  });
+
+  it('rejects oversized bodies', async () => {
+    const r = relay();
+    const res = await r.post({ jsonrpc: '2.0', id: 1, method: 'ping', params: { pad: 'x'.repeat(1024 * 1024 + 1) } });
+    expect(res.status).toBe(413);
+  });
+});
diff --git a/services/api/src/mcp/tron.ts b/services/api/src/mcp/tron.ts
new file mode 100644
index 00000000..e255c02c
--- /dev/null
+++ b/services/api/src/mcp/tron.ts
@@ -0,0 +1,220 @@
+/**
+ * tronbrowser.dev/mcp/tron: the hosted OpenMCP relay. Obscura first for
+ * scraping, the ungoogled-chromium engine as the fallback for full-JS pages,
+ * the same `fetch_page` router `tron automate` runs locally, plus a
+ * `screenshot_page`. Public and keyless, so it is stateless on purpose: every
+ * call gets a fresh tab that is closed afterwards, nothing is remembered
+ * between calls, targets are public hosts only, and callers are capped.
+ *
+ * The descriptor a catalog reads is the static /.well-known/openmcp.json on
+ * this origin (served by Caddy), which is what makes the listing verified.
+ */
+import { Hono } from 'hono';
+import {
+  DirectChromium,
+  fetchPage,
+  McpBrowserSession,
+  McpServer,
+  ObscuraClient,
+  parseFetchArgs,
+  resolveChromiumBin,
+  resolveObscuraBin,
+  type FetchArgs,
+  type FetchOutcome,
+  type JsonRpcMessage,
+  type McpContent,
+} from '@tronbrowser/sdk';
+import { acceptableUrl, clientKey, RateLimiter, type Lookup } from './guard.js';
+
+export const DESCRIPTOR_URL = 'https://tronbrowser.dev/.well-known/openmcp.json';
+export const MAX_CONCURRENT = 3;
+export const RATE_BURST = 20;
+export const RATE_PER_MINUTE = 30;
+export const MAX_BODY_BYTES = 1024 * 1024;
+export const MAX_CHARS_CAP = 400_000;
+export const MAX_TIMEOUT_S = 45;
+
+export interface Fetched {
+  text: string;
+  outcome: FetchOutcome;
+}
+
+/** The engine side, injectable so the route is testable without a browser. */
+export interface TronRelayDeps {
+  fetch?: (args: FetchArgs) => Promise<Fetched>;
+  screenshot?: (url: string) => Promise<Uint8Array>;
+  lookup?: Lookup;
+  now?: () => number;
+  maxConcurrent?: number;
+  rate?: { burst: number; perMinute: number };
+  log?: (line: string) => void;
+}
+
+export interface TronRelay {
+  app: Hono;
+  server: McpServer;
+  /** Engines in use, when the real ones were built. */
+  engines?: { obscura: ObscuraClient; chromium: DirectChromium };
+  close(): Promise<void>;
+}
+
+/** Real engines: Obscura on stdio, one Chromium shared across calls, one fresh tab per call. */
+export function realEngines(log: (line: string) => void = () => {}) {
+  const obscuraBin = process.env.OBSCURA_BIN ?? resolveObscuraBin();
+  const obscura = new ObscuraClient({ bin: obscuraBin, stealth: process.env.TRON_MCP_STEALTH === '1' });
+  const chromium = new DirectChromium({
+    bin: process.env.TRON_MCP_CHROMIUM_BIN ?? resolveChromiumBin(),
+    headless: true,
+    blockPrivate: true,
+    noSandbox: process.getuid?.() === 0 || process.env.TRON_MCP_NO_SANDBOX === '1',
+    idleMs: Number(process.env.TRON_MCP_IDLE_MS ?? 5 * 60_000),
+    log,
+  });
+  const fetch = async (args: FetchArgs): Promise<Fetched> => {
+    // A session per call: the router opens a tab only if Obscura is not enough.
+    const session = new McpBrowserSession(() => chromium.page());
+    try {
+      return await fetchPage({ obscura, session }, args);
+    } finally {
+      await session.close().catch(() => {});
+    }
+  };
+  const screenshot = async (url: string): Promise<Uint8Array> => {
+    const tab = await chromium.page();
+    try {
+      await tab.page.goto(url);
+      return await tab.page.screenshot();
+    } finally {
+      await tab.close().catch(() => {});
+    }
+  };
+  return { obscura, chromium, fetch, screenshot };
+}
+
+const text = (t: string): McpContent => ({ type: 'text', text: t });
+const toolError = (message: string) => ({ content: [text(message)], isError: true });
+
+export function tronRelay(deps: TronRelayDeps = {}): TronRelay {
+  const log = deps.log ?? ((line: string) => console.log(`[mcp/tron] ${line}`));
+  const engines = deps.fetch && deps.screenshot ? undefined : realEngines(log);
+  const doFetch = deps.fetch ?? (engines as NonNullable<typeof engines>).fetch;
+  const doShot = deps.screenshot ?? (engines as NonNullable<typeof engines>).screenshot;
+  const lookup = deps.lookup;
+  const maxConcurrent = deps.maxConcurrent ?? MAX_CONCURRENT;
+  const limiter = new RateLimiter({ burst: deps.rate?.burst ?? RATE_BURST, perMinute: deps.rate?.perMinute ?? RATE_PER_MINUTE, ...(deps.now ? { now: deps.now } : {}) });
+  let inFlight = 0;
+
+  // Throws so the MCP layer answers isError; a public relay never queues.
+  async function guarded<T>(work: () => Promise<T>): Promise<T> {
+    if (inFlight >= maxConcurrent) throw new Error(`Busy: ${maxConcurrent} pages are rendering. Try again in a moment.`);
+    inFlight++;
+    try {
+      return await work();
+    } finally {
+      inFlight--;
+    }
+  }
+
+  const server = new McpServer({ name: 'tronbrowser', version: '3.9' });
+  server.register({
+    name: 'fetch_page',
+    description:
+      'Fetch a public web page as markdown, text, links or html. Obscura renders first (fast, light); the ungoogled-chromium engine takes over for JS-heavy pages and bot walls. engine=obscura|chromium pins one. Keyless; a few fetches at a time.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        url: { type: 'string', description: 'Public http(s) URL' },
+        format: { type: 'string', enum: ['markdown', 'text', 'links', 'html'], description: 'Default markdown' },
+        engine: { type: 'string', enum: ['auto', 'obscura', 'chromium'], description: 'Default auto' },
+        max_chars: { type: 'integer', minimum: 1000, description: `Cut the answer here. Default 200000, max ${MAX_CHARS_CAP}.` },
+        timeout_s: { type: 'number', description: `Seconds Obscura gets before Chromium takes over. Default 20, max ${MAX_TIMEOUT_S}.` },
+      },
+      required: ['url'],
+      additionalProperties: false,
+    },
+    handler: async (a) => {
+      const verdict = await acceptableUrl(a.url, lookup);
+      if (!verdict.ok) throw new Error(verdict.error);
+      const args = parseFetchArgs({ ...a, url: verdict.url });
+      args.maxChars = Math.min(args.maxChars, MAX_CHARS_CAP);
+      args.budgetMs = Math.min(args.budgetMs, MAX_TIMEOUT_S * 1000);
+      const r = await guarded(() => doFetch(args));
+      log(`fetch ${r.outcome.engine} ${r.outcome.ms}ms ${r.outcome.chars}c ${args.url}${r.outcome.fellBack ? ` (${r.outcome.fellBack})` : ''}`);
+      return [text(r.text), text(JSON.stringify(r.outcome))];
+    },
+  });
+  server.register({
+    name: 'screenshot_page',
+    description: 'Render a public web page in the ungoogled-chromium engine and return a PNG of the viewport (1280x900).',
+    inputSchema: {
+      type: 'object',
+      properties: { url: { type: 'string', description: 'Public http(s) URL' } },
+      required: ['url'],
+      additionalProperties: false,
+    },
+    handler: async (a) => {
+      const verdict = await acceptableUrl(a.url, lookup);
+      if (!verdict.ok) throw new Error(verdict.error);
+      const started = Date.now();
+      const r = await guarded(() => doShot(verdict.url));
+      log(`screenshot chromium ${Date.now() - started}ms ${verdict.url}`);
+      return [{ type: 'image', data: Buffer.from(r).toString('base64'), mimeType: 'image/png' }];
+    },
+  });
+
+  const app = new Hono();
+  const toolNames = server.tools().map((t) => t.name);
+
+  app.get('/', (c) =>
+    c.json({
+      ok: true,
+      name: 'TronBrowser',
+      mcp: `${new URL(c.req.url).origin}/mcp/tron`,
+      descriptor: DESCRIPTOR_URL,
+      tools: toolNames,
+      engines: engines
+        ? { obscura: engines.obscura.available(), chromium: engines.chromium.available(), chromiumRunning: engines.chromium.running() }
+        : undefined,
+    }),
+  );
+
+  app.post('/', async (c) => {
+    const length = Number(c.req.header('content-length') ?? 0);
+    if (length > MAX_BODY_BYTES) return c.json({ jsonrpc: '2.0', id: null, error: { code: -32600, message: 'body too large' } }, 413);
+    const raw = await c.req.text();
+    if (raw.length > MAX_BODY_BYTES) return c.json({ jsonrpc: '2.0', id: null, error: { code: -32600, message: 'body too large' } }, 413);
+    let parsed: unknown;
+    try {
+      parsed = JSON.parse(raw);
+    } catch {
+      return c.json({ jsonrpc: '2.0', id: null, error: { code: -32700, message: 'parse error' } }, 400);
+    }
+    const messages = Array.isArray(parsed) ? parsed : [parsed];
+    const key = clientKey(c.req.raw.headers);
+    const responses: JsonRpcMessage[] = [];
+    for (const msg of messages) {
+      if (typeof msg !== 'object' || msg === null) {
+        responses.push({ jsonrpc: '2.0', id: null, error: { code: -32600, message: 'invalid request' } } as unknown as JsonRpcMessage);
+        continue;
+      }
+      const m = msg as JsonRpcMessage;
+      if (m.method === 'tools/call' && m.id !== undefined && !limiter.take(key)) {
+        responses.push({ jsonrpc: '2.0', id: m.id, result: toolError(`Rate limited: ${RATE_PER_MINUTE} calls a minute per caller. Slow down.`) });
+        continue;
+      }
+      const reply = await server.handle(m);
+      if (reply) responses.push(reply);
+    }
+    if (responses.length === 0) return c.body(null, 202);
+    return c.json(Array.isArray(parsed) ? responses : responses[0]);
+  });
+
+  return {
+    app,
+    server,
+    ...(engines ? { engines: { obscura: engines.obscura, chromium: engines.chromium } } : {}),
+    async close() {
+      if (engines) await Promise.allSettled([engines.obscura.close(), engines.chromium.close()]);
+    },
+  };
+}