Skip to content

WebRun Browser Automation

by webrun.ai · remote · no sign-in to list tools · v1.0.2 · published by ai.webrun

Run multi-step tasks in a real Chrome browser: persistent environments, live view, human takeover.

Deletes · 12Final · 1Changes · 2

21 tools: 12 can delete or cancel things, 1 do something that can't be undone, 2 change things and 6 only read.

Scanned Oct 21, 2026

3 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http webrun https://api.webrun.ai/mcp --header 'Authorization: <your-authorization>'

Findings

Matches of fixed checks, with the text they matched.

1 warn2 info
  • The server marks "screenshot" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "screenshot" says "screenshot": a word for reading.

    What this check looks for
  • The description mentions "credentials".

    Matched text

    description: "...en the browser agent needs human input (credentials, clarification, approval). The response..."

    What this check looks for
  • The description mentions "credentials".

    Matched text

    description: "...flowId or exact title. Read-only; proxy credentials are masked."

    What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

21 tools

Deletes or cancels 12Claude Code: deny
  • browser_taskExecute a browser automation task in a real Chrome browser running in a WebRun cloud environment (docs.webrun.ai).No findings

    Why it is in this group

    • The description's first verb is "execute": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Execute a browser automation task in a real Chrome browser running in a WebRun cloud environment (docs.webrun.ai). Creates a session, runs the task, and auto-terminates. Best for simple one-off tasks that no saved workflow covers. May navigate, fill forms, and submit data on third-party websites as the task requires. Do NOT use this to run or test a saved workflow — use trigger_workflow instead: only a workflow run carries the workflow's own rules, tracking and memory, so a session run will behave differently. If the user says "run it", "run it once", "test it" or "try it" about a workflow, that means trigger_workflow, not this tool.

    Annotations the server declares

    • title: Run browser task
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • create_sessionCreate a persistent session in a real Chrome browser running in a WebRun cloud environment (docs.webrun.ai), for multi-step interactive work.No findings

    Why it is in this group

    • The name "create_session" says "create": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Create a persistent session in a real Chrome browser running in a WebRun cloud environment (docs.webrun.ai), for multi-step interactive work. Returns a sessionId for subsequent commands. With an initial task the browser may act on third-party websites immediately. Do NOT use this to run or test a saved workflow — use trigger_workflow instead: only a workflow run carries the workflow's own rules, tracking and memory, so a session run will behave differently.

    Annotations the server declares

    • title: Create browser session
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • guardrail_responseRespond to a guardrail trigger when the browser agent needs human input (credentials, clarification, approval).1 finding

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it destructive (destructiveHint: true).

    Findings

    • Info

      The description mentions "credentials".

      Matched text

      description: "...en the browser agent needs human input (credentials, clarification, approval). The response..."

      What this check looks for
    Description, as the server wrote it
    Respond to a guardrail trigger when the browser agent needs human input (credentials, clarification, approval). The response is handed to the live agent, which continues acting on it.

    Annotations the server declares

    • title: Answer guardrail prompt
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • pause_agentPause an active scheduled agent — it stops firing until resumed.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Pause an active scheduled agent — it stops firing until resumed. Get agentId from list_agents.

    Annotations the server declares

    • title: Pause scheduled agent
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • pause_session_taskPause the task currently running in a browser session.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Pause the task currently running in a browser session. Resume it later with resume_session_task.

    Annotations the server declares

    • title: Pause session task
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: true
  • resume_agentResume a paused scheduled agent — recomputes its next run and reactivates it.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Resume a paused scheduled agent — recomputes its next run and reactivates it. A completed work-list agent restarts with a fresh full pass. Refuses if the agent's expiry has passed (extend it on the dashboard first).

    Annotations the server declares

    • title: Resume scheduled agent
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • resume_session_taskResume a previously paused task in a browser session.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Resume a previously paused task in a browser session.

    Annotations the server declares

    • title: Resume session task
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: true
  • send_taskSend a new task to an existing browser session (from create_session).No findings

    Why it is in this group

    • The name "send_task" says "send": a word for sending, and what is sent cannot be taken back.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Send a new task to an existing browser session (from create_session). The real Chrome browser may navigate, fill forms, and submit data on third-party websites as the task requires.

    Annotations the server declares

    • title: Send task to session
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • stop_session_taskCancel the task currently running in a browser session, keeping the session alive for new tasks.No findings

    Why it is in this group

    • The name "stop_session_task" says "stop": a word for a change.
    • The description's first verb is "cancel": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Cancel the task currently running in a browser session, keeping the session alive for new tasks.

    Annotations the server declares

    • title: Stop session task
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: true
  • terminate_sessionEnd a browser session and free its resources.No findings

    Why it is in this group

    • The name "terminate_session" says "terminate": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    End a browser session and free its resources. The session and any running task cannot be resumed afterwards.

    Annotations the server declares

    • title: Terminate session
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: true
  • trigger_workflowRun a workflow now in its deployed environment.No findings

    Why it is in this group

    • The name "trigger_workflow" says "trigger": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Run a workflow now in its deployed environment. This is the ONLY correct way to run or TEST a saved workflow — a run started here carries the workflow's rules, tracking and memory; browser_task/create_session runs do not. When the user says "run it", "run it once", "test it" or "try it" about a workflow, this is the tool they mean. Drives a real Chrome browser: the run may navigate, fill forms, and submit data on third-party websites as the workflow's prompt requires. Pass values for the workflow's {{variables}} in `variables` (stored variableValues defaults fill any gaps). Returns a sessionId — poll get_task_status for the result.

    Annotations the server declares

    • title: Trigger workflow
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • update_workflowUpdate an existing workflow.No findings

    Why it is in this group

    • The name "update_workflow" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Update an existing workflow. Supply workflowId plus only the fields to change: prompt, trigger, schedule, run settings, variables, presentation. Object and array fields are replaced whole; pass null to clear an optional field. Renaming via title keeps the slug stable. The stored schedule stays a saved setting — scheduled agents already deployed from this workflow keep their own timing. promptTemplate follows the same Goal / Ground rules / Stages / Output runbook contract as create_workflow (see that field's description). memoryContract is the exception to whole-replace: supplying its three fields updates them while platform tracking details are preserved.

    Annotations the server declares

    • title: Update workflow
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
Can't be undone 1Claude Code: ask
  • screenshotCapture a screenshot of the current browser page in an active session.1 finding

    Why it is in this group

    • The name "screenshot" says "screenshot": a word for reading.
    • The description's first verb is "capture": a word that usually means money moves, which cannot be taken back.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "screenshot" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "screenshot" says "screenshot": a word for reading.

      What this check looks for
    Description, as the server wrote it
    Capture a screenshot of the current browser page in an active session. Returns the screenshot as an inline image. Read-only.

    Annotations the server declares

    • title: Take screenshot
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
Changes things 2Claude Code: ask
  • create_agentCreate a scheduled agent — a recurring or one-time automation that runs on a timer in a real Chrome browser.No findings

    Why it is in this group

    • The name "create_agent" says "create": a word for a change.
    Description, as the server wrote it
    Create a scheduled agent — a recurring or one-time automation that runs on a timer in a real Chrome browser. Two modes. WORKFLOW MODE: pass workflowId plus a schedule — the platform copies everything else (prompt, starting URL, output contract, model, proxy, policy, files) from the workflow and bakes your variables into the prompt; results and memory stay centralised on the workflow. STANDALONE MODE: omit workflowId and provide name, prompt (a Goal / Ground rules / Stages / Output browsing runbook — see the prompt field description), and a schedule; the connection's environment is used automatically. Ask the user only what it should do and when it should run, in plain language — pick sensible defaults for everything else and state them; never ask about environments or technical settings. Results are delivered to your connected chat and appear in session history.

    Annotations the server declares

    • title: Create scheduled agent
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • create_workflowCreate a new saved workflow.No findings

    Why it is in this group

    • The name "create_workflow" says "create": a word for a change.
    Description, as the server wrote it
    Create a new saved workflow. READINESS BAR: if you could not execute the prompt yourself as a human in a browser — which site, which records, which fields, delivered where, matched to each recipient how — it is not ready; first collect the missing business facts from the user (see the TASK INTERVIEW in the server instructions), then create. Requires title and promptTemplate — write the prompt as a browsing runbook following the Goal / Ground rules / Stages / Output contract in the promptTemplate field description. For tasks that must handle each new item exactly once (new messages, forward once, skip seen), memoryContract is REQUIRED — three plain-English fields addressed to the agent: groundRules, memoryInstruction and itemIdentity (see the field descriptions); the platform wires the tracking itself — never write memory or tracking steps into the prompt. Created in the connection's environment automatically — omit environmentId and never ask the user to choose one. Write the user's concrete values (names, URLs, numbers) directly into the prompt; use {{variables}} ONLY when the user explicitly wants a reusable template with per-run inputs. Everything else is optional and defaults sensibly — do not quiz the user about settings. A supplied schedule is stored as a setting only — the workflow does not run on a timer until deployed via create_agent. To run or TEST the workflow, use trigger_workflow ONLY — never browser_task or create_session.

    Annotations the server declares

    • title: Create workflow
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
Only reads 6Claude Code: allow
  • get_task_statusCheck the status of a task previously started in a browser session.No findings

    Why it is in this group

    • The name "get_task_status" says "get": a word for reading.
    Description, as the server wrote it
    Check the status of a task previously started in a browser session. Use to poll for completion or detect guardrails. Read-only: reports on the task without affecting it.

    Annotations the server declares

    • title: Get task status
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • get_workflowFull detail of one workflow: prompt template, {{variables}} and their defaults, trigger + schedule, run settings (starting URL, timezone, model, proxy, output contract, files), mem…1 finding

    Why it is in this group

    • The name "get_workflow" says "get": a word for reading.

    Findings

    • Info

      The description mentions "credentials".

      Matched text

      description: "...flowId or exact title. Read-only; proxy credentials are masked."

      What this check looks for
    Description, as the server wrote it
    Full detail of one workflow: prompt template, {{variables}} and their defaults, trigger + schedule, run settings (starting URL, timezone, model, proxy, output contract, files), memory state, and any pending logins. Identify by workflowId or exact title. Read-only; proxy credentials are masked.

    Annotations the server declares

    • title: Get workflow details
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_agentsList the account's scheduled agents (cron deployments): schedule, status, next/last run, and whether each is standalone or deployed from a workflow.No findings

    Why it is in this group

    • The name "list_agents" says "list": a word for reading.
    Description, as the server wrote it
    List the account's scheduled agents (cron deployments): schedule, status, next/last run, and whether each is standalone or deployed from a workflow. Scoped to the bound environment when this connection has one; pass scope "all" for every environment. Read-only.

    Annotations the server declares

    • title: List scheduled agents
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_environmentsList available browser environments (persistent profiles) for this account.No findings

    Why it is in this group

    • The name "list_environments" says "list": a word for reading.
    Description, as the server wrote it
    List available browser environments (persistent profiles) for this account. Returns environment IDs needed for persistent sessions in browser_task or create_session. Read-only. NOTE: workflows and agents use the connection's environment automatically — you rarely need this tool for those, and should not ask the user to choose an environment.

    Annotations the server declares

    • title: List environments
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_sessionsList all active browser sessions for this account.No findings

    Why it is in this group

    • The name "list_sessions" says "list": a word for reading.
    Description, as the server wrote it
    List all active browser sessions for this account. Read-only.

    Annotations the server declares

    • title: List sessions
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_workflowsList the user's saved workflows (prompt-templated browser automations, docs.webrun.ai).No findings

    Why it is in this group

    • The name "list_workflows" says "list": a word for reading.
    Description, as the server wrote it
    List the user's saved workflows (prompt-templated browser automations, docs.webrun.ai). Shows each workflow's title, schedule, {{variables}}, and run stats. Scoped to the bound environment when this connection has one; pass scope "all" for every environment. Read-only.

    Annotations the server declares

    • title: List workflows
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 1.0.2. Values in angle brackets are yours to fill in.

claude mcp add --transport http webrun https://api.webrun.ai/mcp --header 'Authorization: <your-authorization>'

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__webrun__get_task_status",
      "mcp__webrun__list_sessions",
      "mcp__webrun__list_environments",
      "mcp__webrun__list_workflows",
      "mcp__webrun__get_workflow",
      "mcp__webrun__list_agents"
    ],
    "ask": [
      "mcp__webrun__screenshot",
      "mcp__webrun__create_workflow",
      "mcp__webrun__create_agent"
    ],
    "deny": [
      "mcp__webrun__browser_task",
      "mcp__webrun__create_session",
      "mcp__webrun__send_task",
      "mcp__webrun__pause_session_task",
      "mcp__webrun__resume_session_task",
      "mcp__webrun__stop_session_task",
      "mcp__webrun__terminate_session",
      "mcp__webrun__guardrail_response",
      "mcp__webrun__update_workflow",
      "mcp__webrun__trigger_workflow",
      "mcp__webrun__pause_agent",
      "mcp__webrun__resume_agent"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as webrun. Review it before you use it.