What the agent can do

The agent's browser tools, reading and extracting page content, files, credentials, the navigation policy, and external tools.

Browser tools

The agent's tools are browser_navigate, browser_observe and one browser_<action> per platform action — click, type, select, press, scroll, hover, wait, click_at, back, forward, reload, switch_tab, close_tab, new_tab, dialog_policy, upload — with the same parameters as the browser API. Every page-changing tool returns the observation after it, so a task costs one model turn per action.

browser_observe takes options:

Observations name pagination controls (a Pagination: line) and any recognised challenge wall (a Challenge: line, with the rule not to retry the page). Image bytes are never stored; the trace keeps their size and digest.

Reading and extracting

Three read-only tools spend no observation and keep the current frame valid:

• browser_text { format: 'markdown' | 'text', max_chars, offset } — the page as Markdown (headings, lists, links, tables, code); default 24000 characters, at most 65536, from offset; the result names offset, total_chars and next_offset.
• browser_find { text | role | name, max } — the matching tree lines with their refs.
• browser_extract { query, output_schema?, start_from_char?, already_collected? } — a second model request on the run's connection reads one Markdown window of the page and answers the query, as free text or JSON validated against output_schema. Bounded to 10,000 characters inline, with the whole result saved to the run's Workspace when longer; it reports where the window ended for a continuation and skips already_collected identifiers across pages. Each call is a model request in usage (agent.usage with source: "extract"); an unusable result is extract_failed.

Files

The run's Workspace is where the agent reads inputs and writes results: files it produces carry the run_id. browser_upload { ref, path } hands a Workspace file to a file input — the platform stages the bytes privately in the browser's Worker and the upload action accepts only staged files. See Workspaces.

Credentials

A run may name project login credentials (credential_ids, at most 16). Each becomes a placeholder the agent can type — {{secret:<name>}}, from the credential's name — that the browser substitutes only on the credential's allowed_origins. Observations, snapshots and run events show the placeholder wherever the value appears; the model never receives the value. Credentials are created by owners and admins in the console's vault; there is no route that reveals a stored secret.

Navigation policy

allowed_domains, blocked_domains and block_raw_ip bound where the run's browser may go: host patterns (example.com, *.example.com, https://example.com, host:port). A refused navigation — the agent's tool, or a link the page follows — is navigation_blocked and reported in the next observation. A run on an existing browser must match its policy; a session keeps its policy across runs.

External tools

integration_ids gives the agent HTTP or MCP tools the project's administrators have connected and tested. Their arguments become the request body; results come back as tool output. Nothing is retried automatically; an outcome the platform cannot confirm is tool_outcome_unknown. See Integrations.

What it cannot do

• Run page JavaScript, use CDP or a Playwright endpoint: only navigation, observation and the actions above.
• Produce trusted pointer input: clicks are synthetic DOM activation, with occlusion checks.
• Pass a CAPTCHA or a bot-challenge wall: it reports the block; the judge marks blocked.
• Reach another project's resources, or a browser another run owns.