Aginx Browser MCP Server

One-call risk-control report: did this session hit an anti-bot wall? Taobao/tmall's x5 risk control answers 200 like a normal response — either a redirect onto a punish page (_____tmd_____/punish, punish.taobao.com) or an MTop API body carrying FAIL_SYS_USER_VALIDATE / RGV587 / x5secdata. Returns {total, events:[{url,method,status,kind,via}]} where via says whether the wall was navigated into ("url") or swallowed by an API response ("body"). When there are hits, the response also carries the account name (which identity got walled) and a `handoff` instruction: the engine detects and surfaces but does not auto-bypass — a human opens the live view (/live?session=<id> on the engine's HTTP port), solves the challenge in this session, and the retry rides the cookie that solving sets. Detection only; no automated solving or bypass.

Click an interactive element by its index (from session_state output) inside a live browser session: scrolls it into view and fires a DOM click on the session's current page. Before clicking it re-verifies the element in the same frame — if the page changed since session_state (element detached, disabled, hidden, or covered by an overlay), it returns `clicked:false` with a `reason` ("detached"/"disabled"/"not_visible"/"covered_by") and, when covered, a `covered_by` description of the element that would eat the click — never a silent no-op. A submit click may navigate the session — the returned `url`/`text_after` reflect the page after the action, and session state (cookies, localStorage, globals) persists for follow-up calls. Indexes come from the most recent session_state; re-list after navigation.

Click at viewport coordinates (CSS pixels) via real mouse events — pointerdown/mousedown, pointerup/mouseup, then click on whatever element is hit there. For canvas/map surfaces with no DOM element to index. click_count 2 adds dblclick.

Derive a new browser session from a live one, carrying the full login state: cookies, localStorage/sessionStorage, viewport pin, dialog policy, proxy and keepalive flags. The source session stays untouched. Use to snapshot a logged-in state before risky actions, or to run the same login in parallel tabs. Returns {session_id (new), cloned_from, url, viewport}.

Close a browser session and free its resources. For a persistent session this also drops the on-disk login snapshot - idle expiry keeps it, an explicit close does not.

Read the session's recent page console output (log/info/warn/error) as {url, total, matched, messages:[{ts_ms, level, text, url}]}, newest last. Ring buffer of 500 entries; captures output from page scripts, clicks, evals and navigation alike. Optional filters: level (exact, e.g. "error"), since_ts (epoch ms), url_contains (page URL substring), limit (most recent N matches). The fastest way to see WHY a page misbehaves: click the button, call this, read the error.

Export the session's current cookies. Default (meta absent/false) is the full Set-Cookie form ("name=value; Domain=…; Path=/", flags included) — the login-state reuse face that round-trips with session_create's cookies field. meta:true switches to the metadata-only view (#102): [{name, domain, path, secure, httpOnly, sameSite, expires (unix secs, null = session cookie), hostOnly}] with NO values — cookie values are credentials and never leave the server, so "which auth state exists" (is the session cookie Secure, when does it expire, which domains landed) is answerable without holding a single one.

Create a persistent interactive browser session for multi-step interaction - clicking, typing, scrolling, reading state across page transitions. Use when the agent must INTERACT with a page (login flows, forms, pagination, click-through) rather than read it once. Returns session_id; persists 8 min idle. With persistent:true the login state survives idle eviction and server restarts - the same session_id revives logged-in.

Inspect or flip the session's dialog policy for window.alert/confirm/prompt. Dialogs never block the page: each is auto-answered (default dismiss) and logged into session_console at level "dialog". action "list" reports {policy, prompt_text, dialogs}; "accept" makes subsequent confirm() true and prompt() return prompt_text (or the call's default argument); "dismiss" restores the default.

Drag the mouse from one viewport position to another: press at `from`, `steps` mousemove events, release at `to`. The trajectory is humanized by default (eased velocity, wobble, jittered timing, overshoot) — the shapes anti-bot checks score for; pass humanize:false for exact linear interpolation. Moves AMarker-style drag targets, canvas selections and captcha sliders that only track while the pointer travels.

Execute arbitrary JavaScript in a live browser session and return the result. Runs in the session's current page, so DOM mutations, globals and storage persist across calls — unlike the stateless eval tool, which loads its own throwaway page each call. Script-driven navigation moves the session's URL. JS exceptions are reported with name, line/column and stack.

Export a browser session's recorded action log. Format "bash" (default) returns a runnable curl script that replays every recorded action (navigate/click/input/scroll/eval) against a fresh session on this server — hand it to a shell or cron, zero model tokens. Format "jsonl" returns the raw action log, one JSON object per line. Format "json" returns a flow.json document — the same recording as editable ops ({op, args}) with cookies/storage stripped — that flow_run replays server-side.

Type text into an input/textarea element by its index (from session_state output), focusing it and dispatching input/change events. events:"full" is the complete human typing gesture: per-character keydown/keypress/input/keyup cycles, trailing change, then blur — the tail blur commits on forms that save in onBlur (React capture listeners, #100). In full mode a newline in the text types as the Enter key (key:'Enter', keyCode 13 — "type + Enter submit"): a textarea keeps the newline in its value, a single-line input stays single-line, the page's Enter listeners fire before the blur, and if the key wasn't canceled the input's form submits implicitly (Chrome's default action; preventDefault on the key or submit events vetoes it, so chat inputs that swallow Enter stay unsubmitted). Any characters — newlines, quotes, backslashes — ride through as-is. A refused fill answers filled:false with a reason (readonly/disabled/detached/no-element/wrong-tag/script-error) instead of a silent write. Hidden inputs are legitimate targets and are filled normally.

List live browser sessions with idle age and the time left before auto-eviction. Use to discover a session to reuse instead of creating a new one; sessions expire after 8 min idle.

Navigate a browser session to a new URL.

Read the session's network request log. filter="media" extracts playback/stream URLs (m3u8/HLS, mp4, dash, flv...) actually requested by the page's player at runtime - the reliable way to get a real video link, since links embedded in page HTML are often decoys. Media elements and player iframes the engine never fetches (video/audio/source/iframe src) are merged in as candidates: via="network" entries are confirmed requests, via="dom" entries are candidates carrying their tag (iframes = kind "iframe", navigate into them to sniff). Default returns every request as compact rows (method/url/status/type/size/nav); include_headers=true adds each request's outbound header set to its row (#97). Each row's nav is the navigation generation that issued it and the payload's top-level nav is the current one - a lower row nav belongs to an earlier (e.g. timed-out) navigation attempt (#101). Navigate to the video page first, let it load, then call this.

Replace the session's document-start preload group (empty array clears). Sources run before each new document's own scripts — including inline <script> tags — which is the only hook that beats pages whose signing layer captures window.fetch/XHR natives at parse time (xhs's inline jsvmp). Set before the first navigate; applies to every navigation from then on.

Screenshot the session's CURRENT DOM state (mutations from clicks/evals included) as a base64 PNG via the built-in renderer. Width/height default to the session's viewport, so session_viewport + session_screenshot shows the responsive layout. Returns {url, width, height, image_base64, format}.

Scroll the page up or down by a number of viewport-heights.

Select files on a file input programmatically (Playwright setInputFiles semantics): builds File objects from base64 content, assigns them to input.files, then dispatches input+change so framework onChange handlers fire. Selector-addressed because file inputs are often hidden and absent from the session_state index.

Get the current page state as an indexed list of interactive elements. Returns compact text with [N] indexes for use with click/input tools.

Snapshot the session's localStorage/sessionStorage for the current origin: {url, local_storage, session_storage}. Feed it back via session_create's `storage` field to restore a logged-in state in a new session — the half of login state that cookies can't carry (many sites keep the session token in localStorage). Call before the session idles out.

One call answers "where did this session land": verdict is one of challenge (risk control engaged — punish page or a 200-status API body that swallowed the wall; the response carries a handoff instruction for a human to solve it in the live view), captcha (explicit CAPTCHA interstitial), login (bounced to a login form — auth expired), empty, landed (normal 2xx content page), or unknown (couldn't classify — read facts; a non-2xx main document lands here with facts.doc_status carrying the number, so a zhihu-style burst 403 is branchable). The facts sheet also carries challenge_events, requests, console_errors and the fired signals. Pure code over signals the engine already holds (current URL, risk-control rows, main document status/size, console errors) — no screenshots, no page evals, single-digit milliseconds. Verdict observes, it never bypasses.

Set the session's viewport (device emulation): scripts see innerWidth/innerHeight move, media queries like (max-width: 600px) re-evaluate, element rects re-anchor, and mobile=true flips pointer/hover matchMedia answers to coarse/none. Omitted width/height keeps the current value.

Wait until a CSS selector matches or a JS predicate turns truthy, with a timeout. The page's event loop keeps running while waiting (fetches, timers, promise chains progress), so this replaces blind sleeps for async content: navigate, session_wait for '.price-card', then click/read. Returns {matched, elapsed_ms, detail:{tag,text} or the predicate value}; errors with `timeout ...` naming the selector/predicate on expiry. Exactly one of selector/predicate.

Delete a named login identity: stored record AND live jar. Cookie values are credentials — delete means gone. Sessions currently running as the account keep their in-process jar handle, but nothing writes back. Returns {deleted: name}, or an error naming the account if it does not exist.

List named login identities (the multi-account layer) with metadata only: name, cookie domains, cookie count, updated_at, the last account_verify verdict, and the identity's persona User-Agent (each account is one stable device: its own UA and hardware fingerprint, drawn once and reused). Cookie values are credentials and never leave the server. Use to see which identities exist before session_create {account} picks one.

Open a site's login page AS a named account and close the login loop. Creates the session as the account (private jar, device persona), navigates to `url`, and reports which generic login gates the page shows — needs: password | sms | qr | slider (QR scan like xiaohongshu, SMS code, password form, slider/captcha) — plus a session_verdict classification and, when a human step is needed, the session_id and a /live handoff so a person can finish it in the live view (the engine detects and describes; it never fills credentials or solves challenges). With `predicate` and no human gates detected, waits for the automatic bounce, then teaches + stamps the account's verify spec — later account_verify calls re-check it bare. Cookies write back after every action, so a login finished in /live is already persisted. status is "logged_in" (verify stamped), "waiting" (drive session_wait/session_input on session_id, or re-call account_login after the human finishes — the account's shared jar already holds it), or "opened" (no predicate given).

Check whether a named account is still logged in. Teach-once: the first call passes url + predicate (a JS expression truthy on a logged-in page, e.g. !!document.querySelector('.user-nick')); the spec is remembered and later calls can be bare. Runs in a scratch session AS the account (private jar), so the probe doubles as a cookie refresh. Returns {name, logged_in, url, checked_at}.

Install a third-party flow from DupHub into the server's workflow directory, making it runnable by name via flow_run. Pulls the template's manifest, verifies every file's sha256 against it (a package that fails anywhere is not installed), requires a valid flow.json with a steps array, and lands atomically under workflow/<name>/ — replacing any previous install, overriding a same-named built-in. The receipt lists files, total bytes, step count, and how many steps carry scripts (eval_steps) — third-party scripts run with this engine's privileges in session pages, so review before running. Source remote is env-configured (AGINXBROWSER_DUPHUB_URL), never a parameter.

Run a flow — a recorded, editable JSON browser-session script — deterministically, with zero model tokens. Steps are {op, args, expect?, save?}: ops cover navigate/click/click_xy/input/scroll/eval/wait/screenshot/state/cookies; {{var}} placeholders in args are filled from vars; expect asserts (url_contains | selector | text_contains | eval_truthy) abort with evidence on failure; save collects a step's output into the receipt. Source the flow inline via "flow", or by "name" from the server's workflow/<name>/flow.json (unknown name → error lists installed workflows). Pass session_id to reuse a live session (e.g. from import_curl) so login state and flows compose. The receipt carries status ok/failed, saved outputs, the session_id (kept alive), and on failure the failing step, reason and a diagnostic screenshot — fix the flow or take the session over from there.

List flow packages installable from the hub (env-configured AGINXBROWSER_DUPHUB_URL, default the public DupHub) — flow discovery: flow_install takes a name, this is how you learn the names. Each entry carries name/description/version/downloads; feed the name to flow_install. Queries the market's kind=agx-flow filter (flows are templates whose package root carries flow.json) and re-filters client-side, so clones never surface as flows. A hub predating the kind protocol reports kind_filter unsupported instead of guessing.

Render a markdown document into a deterministic, self-contained HTML artifact - the document layer, so the agent never writes HTML by hand. Prose rides a plain offline shell (no fonts, no scripts); archify fenced code blocks carry typed zero-coordinate diagram JSON (sequence, workflow, architecture, dataflow, lifecycle families) and render to inline SVG via the layout engine. Same input, same bytes: the receipt carries the sha256 so determinism is verifiable. theme picks light (default) or dark; preset picks the palette family — classic (default), signal-flow, blueprint, editorial — orthogonal to theme; colors bake at generation time (presentation attributes, not CSS variables), and the receipt records both preset and theme. quality picks the composition audit profile — standard (default) or showcase, the delivery gate: the receipt's diagrams[].composition grades route crossings, ambiguous corridors, label clearance (2px standard / 4px showcase), route rhythm, and node text projected to the 930px reader width; the audit never changes the artifact bytes. Mermaid sources are the agent's job to translate, not the engine's: flowchart/graph → workflow (lanes + columns), sequenceDiagram → sequence, stateDiagram-v2 → lifecycle (bands), erDiagram/class → architecture (grid + boundaries) — read the topology and emit the matching zero-coordinate archify JSON; the engine accepts only archify JSON. A broken diagram degrades to a visible code block and lands in receipt.diagnostics; an authored route preset that cannot be honored is self-repaired to a verified semantic substitute and disclosed in receipt diagrams[].repairs - the document still renders. A fence may also carry views: [{id,label,nodes,note?}] (node ids of the active family), emitted as guided-view tabs above the diagram plus an inlined viewer script - clicking a tab lights the member nodes and the routes between them (subgraph), clicking a node lights it with its direct neighbors (ego graph), everything else dims; a view's optional note shows as a caption while it is active (the story layer). window.agxViewer in a session drives and reads the same state programmatically: {focus,view,state} as before, plus route(i,from,to) which returns and lights the shortest authored directed path between two nodes (null when unreachable, state untouched), and reach(i,id,down|up) which returns and lights the authored downstream/upstream closure ({nodes,links}); both dim the rest of the diagram. diagrams[].views in the receipt lists the tabs. motion: true bakes an entrance choreography into the artifact: pure-declarative CSS animation with zero scripts - headings split into per-glyph (CJK) / per-word (latin) spans that rise in with expo easing, prose blocks stagger up an nth-child delay ladder, diagram figures grow in with a back ease (GSAP's easing math as public cubic-bezier equivalents, nothing embedded); the diagrams themselves play a flow story on the same clock - nodes land beat by beat, solid edges draw in (dash-offset), dashed returns fade, sequence messages arrive as sent - with a timed caption strip under each figure as the subtitles, which becomes a static transcript under prefers-reduced-motion; the file itself animates in any browser and the receipt records motion plus diagrams[].story (beat times and captions - the hook for muxing voice later). With session_id the artifact is also loaded into that session (local, free) and the reply carries viewport acceptance: scroll extents measured in the live session and graded fits/tall/wide/oversized, telling the agent how to read the page back. Diagram vocabulary adapted from archify (MIT).

Cut a rendered page into pages and package as PDF, PNGs, PPTX or DOCX. Print mode (no selector) paginates the document into fixed-height pages (default 794x1123, A4 @96dpi), breaking at top-level block boundaries — no half-cut text where a break can land on a block edge. Slides mode (selector set) makes one page per match, sized to that element — generate an HTML deck with one .slide per page and each becomes a deck page. format "pdf" (default) returns base64 image-based PDF; "png" returns one base64 PNG per page in pages_base64; "pptx" returns a base64 PPTX (one slide per page, deck-sized to the largest page); "docx" returns a base64 DOCX (one page-sized section per page, each section keeps its own height). Returns page count and packaging.

Render a page's animation timelines to an MP4 video. The page's scripts must expose `window.__timelines` — objects with `duration()` and `pause(t)` (a paused gsap.timeline registered there works as-is). Each frame seeks every timeline to t=i/fps and paints the viewport, so the output is deterministic — no wall clock in the pixel values. Audio: `narration[]` places TTS/voice clips at start times (mixed into one AAC track), `audio` adds looped background music, and `subtitles_srt` muxes an SRT as a soft mov_text track and (by default, `burn_subtitles: false` to opt out) burns the same cues into the frame pixels — QuickTime, WeChat and most social embeds ignore the soft track. Requires ffmpeg on the server. Returns base64 MP4 (H.264, yuv420p) plus frame count and durations.

Query the LOCAL CACHE of every page this server has fetched and every search it has run. Check here BEFORE re-fetching or re-searching — a hit is instant and free while a fresh fetch costs 5-60s. Use query for full-text search (works for Chinese substrings and English words), get to pull a page's full cached content, stats for counts, clear to delete rows.

Click an element on a one-off page: loads `url` in a fresh browser context (stateless — no cookies unless passed, no shared state with other calls), waits `wait_secs` after load before clicking, then fires a DOM click on the first CSS-selector match. The click may trigger navigation (link, form submit) — the response `url` and `text_after` are read after that navigation lands. Returns `clicked:false` when the selector matches nothing. For multi-step interaction on a shared page use session_click instead.

Download a file over HTTP(S) with streaming to disk (no memory buffering), SHA-256 integrity hash, and optional resume of interrupted transfers. Filename resolution: explicit param → Content-Disposition → URL tail. Use for binaries, archives, datasets, documents - anything where the agent wants the FILE saved, not its text content read.

Execute JavaScript on a one-off page: loads `url` in a fresh browser context, optionally waits `wait_secs` for the page to settle, evaluates `script` (async/Promise supported) and returns `{url, result}`. Script-driven navigation (location.href, form submit) is drained and reflected in the returned `url`. Stateless — no cookies or page state shared with other calls; when the script needs prior page state or a login, use session_eval.

Fetch a webpage and return clean markdown/html/text. Use whenever the agent needs to READ any web page - blogs, docs, articles, JS-rendered SPAs, Cloudflare-protected sites. Static pages are served over plain HTTP (~100ms tier:"http"); pages that need JS get the full browser (tier:"browser"). render_tier selects auto (default) / http (pure HTTP, refuses the upgrade) / browser (always the JS browser).

Import login state from a real browser in one paste. The human logs into a site in their own Chrome (solving the CAPTCHA/SMS once), opens DevTools → Network, right-clicks any authenticated request → "Copy as cURL", and passes the command here. Returns a live session_id already carrying that site's cookies and sitting on the copied request's URL — the agent continues from where the human left off, no password or second login needed. Works with bash, PowerShell and cmd copy flavors.

Search the web across Baidu/Bing/Sogou/WeChat/Google (aggregated + deduped) and optionally fetch the top results' full content. Use when the agent needs to FIND information online - replaces a search API. Supports image search returning direct image URLs. Optional engines: ["baidu"]-style filter by engine name (invalid names error with the valid list; /doctor lists them with live health). Optional time_range day/week/month/year for news freshness (engines without dated results ignore it). Response carries engine_errors explaining any engine that contributed nothing (CAPTCHA suspension, transient failure).