MCP tools & local HTTP API

1. check_connection → list_profiles
2. open_profile with the exact profile_id; retain the returned browser_session_id.
3. browser_pages to select the exact page_id.
4. browser_snapshot to get fresh element references and a snapshot_id.
5. Use matching session, page, snapshot, and element references for actions. Take a new snapshot after page changes.
6. release_browser when finished. Use close_profile only when asked to close the profile.

A profile has one exclusive controlling client at a time. IDs are opaque and cannot be reused after a browser restart. Choose visible mode when a person needs to sign in or inspect the work; headless is for compatible background tasks.

Profiles & pages

• check_connection
• list_profiles
• open_profile
• close_profile
• release_browser
• browser_pages
• browser_new_page
• browser_close_page
• browser_activate_page

Navigation & interaction

• browser_navigate
• browser_back
• browser_forward
• browser_reload
• browser_snapshot
• browser_click
• browser_click_coordinates
• browser_type
• browser_press
• browser_hover
• browser_select
• browser_scroll
• browser_drag
• browser_wait
• browser_handle_next_dialog

Data & files

• browser_screenshot
• browser_upload_files
• browser_get_cookies
• browser_set_cookies
• browser_clear_cookies
• browser_storage_get
• browser_storage_set
• browser_storage_clear
• browser_grant_permissions
• browser_prepare_download
• browser_wait_download
• browser_evaluate

These are tool names, not complete request schemas. The connected MCP server advertises current parameter names and required fields to the AI client; use that schema instead of guessing arguments. Cookie, storage, upload, and JavaScript tools can access sensitive data.

Enable Local API only if a local integration needs HTTP. Copy the current loopback endpoint and access token from AI Assistant (API & MCP in earlier builds); the port is assigned dynamically. MCP remains available with HTTP disabled.

GET http://127.0.0.1:<port>/v1/status
Authorization: Bearer <access-token>
X-IFox9-Client-ID: my-integration

The token is required. The optional client ID is recommended and must be 1–64 ASCII letters, digits, underscores, or hyphens. Examples use placeholders only. Never publish your real token.

GET /v1/profiles lists profiles; POST /v1/profiles/open opens one. Successful responses use {"ok":true,"data":…}; failures use {"ok":false,"error":{"code":…,"message":…}}. See common error codes.

The HTTP listener binds to 127.0.0.1, validates Host headers, and does not enable browser CORS. Do not expose it through a public reverse proxy or publish its discovery files. Token rotation invalidates old credentials; update your local integration afterwards.