WebBrain separates model tier from conversation mode.
- Tier (
compact,mid,full) is a per-provider setting. It controls how many normal browser-agent tools a model sees. - Mode (
ask,act,dev) is chosen per conversation. It controls what kind of task the user is allowing.
| Mode | What it allows |
|---|---|
| Ask | Read-only. No clicking, typing, navigating, or downloading. |
| Act | The selected tier's normal browser tools. |
| Dev | Requires a Mid or Full provider. Adds a source/style/debug appendix, including deeper DOM/frame inspection for Mid-tier Dev runs. Compact Dev is blocked before an LLM request is sent. |
| Tier | Intended model class | Normal tool surface |
|---|---|---|
compact |
very small local models | Shortest prompt and a small normal Act tool set. No scheduling, iframe, download-resource, or advanced DOM/UI fallbacks. |
mid |
capable local models | Common task tools: downloads, scheduling, iframe tools, form verification. No Full-only advanced fallbacks. |
full |
frontier/cloud or large local models | Everything, including hover, drag-drop, frames, and shadow DOM. |
Tier defaults and resolution rules are documented in providers and models.
Legend: Yes = available · - = not available · C = Chrome only · Dev = Dev-mode add-on (Mid/Full providers; not Compact).
| Tool | Ask | Compact | Mid | Full | Dev |
|---|---|---|---|---|---|
get_accessibility_tree |
Yes | Yes | Yes | Yes | - |
read_page |
Yes | Yes | Yes | Yes | - |
read_pdf |
Yes | No | Yes | Yes | - |
list_webmcp_tools |
C | No | C | C | - |
execute_webmcp_tool |
No | No | C | C | - |
read_page_source |
No | No | No | No | Yes |
get_window_info |
Yes | Yes | Yes | Yes | - |
get_interactive_elements |
Yes | No | Yes | Yes | - |
scroll |
Yes | Yes | Yes | Yes | - |
extract_data |
Yes | Yes | Yes | Yes | - |
inspect_element_styles |
No | No | No | No | Yes |
wait_for_stable |
Yes | No | Yes | Yes | - |
get_selection |
Yes | Yes | Yes | Yes | - |
done |
Yes | Yes | Yes | Yes | - |
clarify |
No | Yes | Yes | Yes | - |
fetch_url |
Yes | Yes | Yes | Yes | - |
research_url |
Yes | No | Yes | Yes | - |
list_downloads |
Yes | No | Yes | Yes | - |
click_ax |
No | Yes | Yes | Yes | - |
type_ax |
No | Yes | Yes | Yes | - |
set_field |
No | Yes | Yes | Yes | - |
resize_window |
No | No | No | Yes | - |
click |
No | Yes | Yes | Yes | - |
type_text |
No | Yes | Yes | Yes | - |
press_keys |
No | Yes | Yes | Yes | - |
navigate |
No | Yes | Yes | Yes | - |
wait_for_element |
No | Yes | Yes | Yes | - |
new_tab |
No | Yes | Yes | Yes | - |
scratchpad_write |
No | Yes | Yes | Yes | - |
progress_update |
No | Yes | Yes | Yes | - |
progress_read |
No | Yes | Yes | Yes | - |
download_social_media |
No | No | Yes | Yes | - |
solve_captcha |
No | No | Yes | Yes | - |
go_back |
No | No | Yes | Yes | - |
go_forward |
No | No | Yes | Yes | - |
schedule_resume |
No | No | Yes | Yes | - |
schedule_task |
No | No | Yes | Yes | - |
iframe_read |
No | No | Yes | Yes | - |
iframe_click |
No | No | Yes | Yes | - |
iframe_type |
No | No | Yes | Yes | - |
read_downloaded_file |
No | No | Yes | Yes | - |
download_files |
No | No | Yes | Yes | - |
download_resource_from_page |
No | No | Yes | Yes | - |
upload_file |
No | No | Yes | Yes | - |
verify_form |
No | No | Yes | Yes | - |
hover |
No | No | No | Yes | - |
drag_drop |
No | No | No | Yes | - |
get_shadow_dom |
No | No | No | Yes | Yes |
shadow_dom_query |
No | No | No | C | C |
get_frames |
No | No | No | Yes | Yes |
inject_css |
No | No | No | No | C |
remove_injected_css |
No | No | No | No | C |
patch_element |
No | No | No | No | C |
revert_patch |
No | No | No | No | C |
execute_js |
No | No | No | No | Yes |
read_console |
No | No | No | No | C |
inspect_network_requests |
No | No | No | No | C |
inspect_event_listeners |
No | No | No | No | C |
highlight_element |
No | No | No | No | C |
Shadow DOM note: The accessibility tree only traverses light DOM. On Web Component-heavy pages (Stripe, Salesforce, Shopify), use
get_interactive_elementsfirst; in Full Act or Dev mode, useget_shadow_dom/shadow_dom_queryfor targeted reads.
Skill tools. Loaded skills can append tool schemas for the current run. The
bundled FreeSkillz.xyz skill, for example, can expose read_youtube_transcript
plus resolve_public_media / download_public_media. These are not hard-coded:
before the skill is loaded (or if it is removed), the tools are absent. Ask mode
still filters out mutating and download tools even when their owning skill is
loaded. See skills.
WebMCP (experimental, opt-in). The list_webmcp_tools /
execute_webmcp_tool rows apply only when Experimental WebMCP is enabled
under Settings → General → Advanced. The setting is off by default; while off,
the tools and their prompt guidance are omitted from model requests. WebMCP
annotations such as readOnly are page-authored hints, not a security boundary.
Every invocation requires Act or Dev, fresh per-call confirmation, and the
normal capability × registration-frame-origin permission. WebMCP currently
requires a supporting Chrome build/page configuration; Firefox does not expose
these tools.
Dev tools are only exposed in Dev mode, and Dev mode is blocked for
Compact-tier providers. Chrome's reversible editing tools return patch IDs:
inject_css pairs with remove_injected_css, and patch_element pairs with
revert_patch.
inject_css/remove_injected_cssapply and undo temporary CSS bypatchId. Each patch is unique and bound to the exact page document, and its metadata is kept in session storage so a service-worker restart does not lose the undo handle. Navigating invalidates the old handle instead of letting it affect a replacement page.patch_element/revert_patchmake structured inline-style, class, and attribute changes with exact before/after values. Browser-equivalent style and HTML attribute names are canonicalized before the undo record is created, contradictory set/remove operations are rejected, and executable URL attributes rejectjavascript:values (including formaction).highlight_elementprovides a temporary pointer-transparent target overlay; because it inserts live DOM, it uses the temporary Dev-patch permission.execute_jsruns an async JavaScript function body in the page main world. Chrome uses CDPRuntime.evaluatewith a 15-second execution limit; Firefox uses its MV2 content-script evaluator. The tool is host-permission gated and receives a fresh submit confirmation.read_console,inspect_network_requests,inspect_event_listenersprovide bounded diagnostics on Chrome. Capture starts before either streaming or non-streaming Dev runs and stops when the tab leaves Dev mode or its conversation is cleared; leaving Dev drains every tab with active capture even if the panel switched tabs, removes handlers and buffers, and disables the matching CDP domains. Listener inspection briefly adds and restores an internal target attribute, follows open-shadow hosts when collecting ancestors, and therefore uses the same host permission as temporary Dev patches. Network headers and bodies are omitted by default, sensitive header names (including common API/subscription-key variants) are redacted before buffering, and page-derived diagnostic output is treated as untrusted content.
- Adding a tool — the checklist for new or changed tools
- Accessibility tree and refs
- Security model and prompt-injection defense