@raultov/browser-control-mcp 0.10.0-beta.14 → 0.10.0-beta.15

package/CHANGELOG.md

@@ -10,6 +10,53 @@ from a copy of its code: entries describe the differences from that release.
 
 ## [Unreleased]
 
+## [0.10.0-beta.15] - 2026-11-02
+
+Public **BETA**. Fixes from a comparison round against Playwright MCP,
+chrome-devtools-mcp and a Puppeteer MCP (now repeatable with
+`make compare`): `snapshot` lists a native `<select>`'s options, marks
+rejected fields `[invalid]` with their error, and gives refs to draggable
+elements and drop zones; `fill_input` picks several options of a
+`<select multiple>`; `press_key` takes `Control+a`; `navigate` and `reload`
+name HTTP authentication (Firefox waited 30 s on its prompt). Behaviour
+changes: on a `<select multiple>`, `fill_input` selects exactly the options
+its text names (it added one); the error for a missing option names it.
+
+### Fixed
+
+- `snapshot` and `find_in_snapshot` list the options of a native `<select>`
+  under its combobox, with `[selected]` and `[disabled]` and optgroups as
+  groups: only the chosen one showed, so an agent had to guess a label to
+  learn the choices. `snapshot` lists the first 25 and says how many more;
+  `find_in_snapshot` searches them all. Options have no ref: `fill_input`
+  picks one by its label or value. (#46)
+- `navigate` and `reload` to a page behind HTTP authentication (401) fail at
+  once saying so, with the scheme and realm of its challenge and how to log
+  in (the credentials in the URL, which the browser keeps for the session):
+  Chrome only said `net::ERR_INVALID_AUTH_CREDENTIALS`, and Firefox showed
+  its prompt while the call waited 30 s and answered the previous page.
+  (#50)
+- `press_key` takes a key written with its modifiers, `Control+a`,
+  `Shift+Tab` or `ControlOrMeta+c` (Meta on macOS, Control elsewhere), as
+  agents write it after Playwright; they add to `modifiers`. It failed with
+  `Unknown key 'Control+a'`. (#51)
+- `get_network_logs`' note on responses without a body says they are still
+  loading or were never read by the page: Chrome never finishes a `fetch`
+  whose body the page did not consume, and the old wording (an open event
+  stream, no body until it ends) suggested that waiting would help. (#51)
+- `snapshot` marks a field the page or the browser rejects `[invalid]`
+  (`aria-invalid`, or `:user-invalid` once the user changed it or tried to
+  submit), with `[error="..."]` from its `aria-errormessage`,
+  `aria-describedby` or the browser's validation message: after a submit an
+  agent could not tell which fields were rejected. (#49)
+- `snapshot` gives a ref to an element made draggable (`draggable="true"`,
+  marked `[draggable]`) and to a drop zone (an `ondrop` or `ondragover`
+  attribute): both were plain text, so `drag` needed CSS selectors. (#48)
+- `fill_input` (and `fill_form`) on a `<select multiple>` selects exactly
+  the options named one per line of `text` (none for an empty one), firing
+  `input` and `change` once; an unknown line fails naming it, with nothing
+  changed. It could only add one option at a time. (#47)
+
 ## [0.10.0-beta.14] - 2026-11-01
 
 Public **BETA**. `emulate` gains `user_agent`, `locale`, `timezone` and

package/README.md

@@ -13,7 +13,7 @@ It is the successor of
 from a copy of its code) and complements Playwright MCP or
 chrome-devtools-mcp with runtime JavaScript debugging on both browsers.
 
-> **Status: BETA (0.10.0-beta.14).** This version contains known bugs and differences
+> **Status: BETA (0.10.0-beta.15).** This version contains known bugs and differences
 > between Chrome and Firefox (see [Limitations and TODO](#limitations-and-todo))
 > and parts that have not been verified (see [Untested](#untested)). Tool
 > replies may change in incompatible ways before 1.0. Please report problems
@@ -27,7 +27,9 @@ Measured on 2026-10-31 with browser-control-mcp built from the current
 sources, `@playwright/mcp` 0.0.83 and `chrome-devtools-mcp` 1.12.0, driven by
 the same stdio client through the same tasks on Chrome 156 (headless,
 Linux). Every outcome was checked in the page, not taken from the reply.
-Tokens are estimated as characters / 4 for every server.
+Tokens are estimated as characters / 4 for every server. browser-control's
+tool lists and the HTTP authentication row were measured again on
+2026-11-02, after the fixes of #46 to #51.
 
 **What each one can do**
 
@@ -41,6 +43,7 @@ Tokens are estimated as characters / 4 for every server.
 | Snapshot of a long page | **bounded at 50 000 characters**, `find_in_snapshot` searches the rest | unbounded | unbounded |
 | Waits for the page to react after an action | ✓ ~50 ms when nothing reacts | ✓ ~500 ms | ✓ ~200 ms |
 | Clicking a covered or hidden element | **fails at once, naming the overlay** | fails after a 5 s timeout | reports success (the overlay gets the click) |
+| Page behind HTTP authentication (401) | **fails at once naming its scheme and realm and how to log in** (credentials in the URL), on Chrome and Firefox | fails with `net::ERR_INVALID_AUTH_CREDENTIALS` | reports success, with `net::ERR_INVALID_AUTH_CREDENTIALS` in the text |
 | Mock requests, offline mode | ✓ | ✓ | offline only |
 | PDF | ✓ file or inline | ✓ file | ✗ |
 | Cookies and web storage | ✓ values hidden unless asked | ✓ values shown | ✗ |
@@ -55,8 +58,8 @@ Tokens are estimated as characters / 4 for every server.
 
 | Task | browser-control-mcp | Playwright MCP | chrome-devtools-mcp |
 | --- | --- | --- | --- |
-| Tool list in context, default tools | 6 450 tokens | 5 330 tokens | 7 770 tokens |
-| Tool list in context, every opt-in tool on | 9 910 tokens | 12 040 tokens | not measured (optional categories) |
+| Tool list in context, default tools | 6 730 tokens | 5 330 tokens | 7 770 tokens |
+| Tool list in context, every opt-in tool on | 10 390 tokens | 12 040 tokens | not measured (optional categories) |
 | Snapshot of Hacker News | **4 588 tokens** | 12 356 tokens | 6 869 tokens |
 | Snapshot of Wikipedia "Web browser" | **12 643 tokens** (cut, searchable) | 34 349 tokens | 27 656 tokens |
 | Snapshot of MDN `<input>` | **12 625 tokens** (cut, searchable) | 158 077 tokens | 76 654 tokens |
@@ -119,19 +122,19 @@ see the note.
 | `close_tab` | ✓ | ✓ | |
 | `list_tabs` | ✓ | ✓ | |
 | `switch_tab` | ✓ | ✓ | |
-| `navigate` | ✓ | ✓ | `history: "back"` or `"forward"` instead of `url` moves one entry in the tab's history and waits for the page to load (also when it comes from the back-forward cache, which fires no `load`); at either end it fails without moving; a URL the browser saves instead of opening (a download: `Content-Disposition: attachment`, or a type such as CSV) fails saying so, and the tab stays where it was; a page that pauses at a breakpoint or opens a dialog while loading fails at once naming it (see `resume`, `handle_dialog`) |
-| `reload` | ✓ | ✓ | a pause or a dialog while loading fails at once, as with `navigate` |
+| `navigate` | ✓ | ✓ | `history: "back"` or `"forward"` instead of `url` moves one entry in the tab's history and waits for the page to load (also when it comes from the back-forward cache, which fires no `load`); at either end it fails without moving; a URL the browser saves instead of opening (a download: `Content-Disposition: attachment`, or a type such as CSV) fails saying so, and the tab stays where it was; a page behind HTTP authentication (401) fails at once naming its scheme and realm and how to log in (credentials in the URL, `http://user:password@host/path`, which the browser keeps for the session); a page that pauses at a breakpoint or opens a dialog while loading fails at once naming it (see `resume`, `handle_dialog`) |
+| `reload` | ✓ | ✓ | a pause, a dialog or HTTP authentication while loading fails at once, as with `navigate` |
 | `scroll` | ✓ | ✓ | reports the window positions before and after |
 | `emulate` | ✓ | partial | `emulation` group; `width`/`height`, `device_scale_factor`, `mobile` (touch), `color_scheme`, `reduced_motion`, `forced_colors`, `media` (`print`), `user_agent`, `locale`, `timezone` (checked by the page's `Intl` first), `geolocation` (the page is granted the permission to read it), `reset`; each call adds to the earlier ones; answers what the page now sees (with the position it reads); Firefox: no `mobile` or media options (BiDi has no media or touch emulation yet; they fail naming them) |
 | `wait_for` | ✓ | ✓ | waits (checking every 100 ms, at most 30 s) until a visible text appears or is gone, a selector is `visible` / `hidden` / `attached` / `detached`, or the URL contains a text; a dialog or debugger pause ends the wait at once |
 | `inspect_dom` | ✓ | ✓ | includes open shadow roots and same-origin iframes (cross-origin ones are noted); at most 100 000 characters without `query` (cut in the page) |
-| `snapshot` | ✓ | ✓ | outline of the page: role, name, states, value and a ref (`e12`) per element, through open shadow roots and same-origin iframes, and on Chrome closed shadow roots too (pages up to 20 000 elements; their elements are reached by ref, not by `>>>`); frames of another origin are read too (at most 20, 5 deep), their iframe marked `[frame=f2]` and their refs prefixed (`f2e5`), and `selector: "f2"` outlines one; tables without headers (`th`, `thead`, `caption`) are layout and leave only their content, and a cell is named by its text only when it holds nothing else; comboboxes, spinbuttons and sliders built with ARIA show their value (the field's text, `aria-valuetext` or `aria-valuenow`, the option a button-like combobox shows), progress bars and meters theirs (`40/100`), and a `<details>` summary `[expanded=true|false]`; what the page made inert is left out: `inert` subtrees and, while a modal `<dialog>` is open (marked `[modal]`), everything outside it; an element that is only clickable (a handler or a pointer cursor) is one named line, unless it holds links, buttons or fields, which are listed under it; at most 50 000 characters (`selector` and `depth` narrow it); the same JavaScript on both browsers |
+| `snapshot` | ✓ | ✓ | outline of the page: role, name, states, value and a ref (`e12`) per element, through open shadow roots and same-origin iframes, and on Chrome closed shadow roots too (pages up to 20 000 elements; their elements are reached by ref, not by `>>>`); frames of another origin are read too (at most 20, 5 deep), their iframe marked `[frame=f2]` and their refs prefixed (`f2e5`), and `selector: "f2"` outlines one; tables without headers (`th`, `thead`, `caption`) are layout and leave only their content, and a cell is named by its text only when it holds nothing else; comboboxes, spinbuttons and sliders built with ARIA show their value (the field's text, `aria-valuetext` or `aria-valuenow`, the option a button-like combobox shows), progress bars and meters theirs (`40/100`), and a `<details>` summary `[expanded=true|false]`; a field the page rejects (`aria-invalid`) or the browser does (`:user-invalid`, once the user changed it or tried to submit) is `[invalid]`, with `[error="..."]` from its `aria-errormessage`, `aria-describedby` or the browser's validation message; a native `<select>` lists its options under its combobox (`[selected]`, `[disabled]`, optgroups as groups; no refs: `fill_input` picks one), the first 25 and how many more, all of them for `find_in_snapshot`; what the page made inert is left out: `inert` subtrees and, while a modal `<dialog>` is open (marked `[modal]`), everything outside it; an element that is only clickable (a handler or a pointer cursor), draggable (`draggable="true"`, marked `[draggable]`) or a drop zone (`ondrop`/`ondragover`) is one named line with a ref for `drag`, unless it holds links, buttons or fields, which are listed under it; at most 50 000 characters (`selector` and `depth` narrow it); the same JavaScript on both browsers |
 | `find_in_snapshot` | ✓ | ✓ | `text` (case-insensitive) or `regex` over the whole outline; matching lines under their ancestors, at most 20 |
 | `save_pdf` | ✓ | ✓ | `files` group; prints the tab as the browser's print does (`landscape`, `print_background`, `scale` 0.1–2, `page_ranges` like `1-3, 5`); with `path` (an absolute `.pdf` under the upload roots) writes the file and answers `{path, bytes, pages}`, else returns the PDF as an embedded `application/pdf` resource (at most 5 MB); Chrome `Page.printToPDF`, Firefox `browsingContext.print` |
 | `capture_screenshot` | ✓ | ✓ | `format` `png`, `jpeg` (or `jpg`) or `webp`; `full_page` at most 16 384 px per side (a text note says when cut); `selector` captures one element (CSS, `host >>> inner` or a snapshot ref), scrolled into view, whole even when taller than the viewport |
 | `click_element` | ✓ | ✓ | scrolls the element into view; `button` (left/right/middle), `click_count` (2 = double click) and `modifiers`; fails without clicking when it is hidden, covered (its own label on top does not count: styled checkboxes and switches are clicked through it; a covered element first gets the mouse, so controls shown only on hover are revealed and clicked) or a disabled control, whose handler would never run; an element a CSS selector does not find yet, or a disabled control, is checked again for up to 2 s, as pages add elements and enable buttons a moment after the previous action (a ref that names nothing, a hidden or a covered element fail at once); `host >>> inner` selectors reach open shadow roots and same-origin iframes (also in `fill_input`, `scroll`, `wait_for`); a dialog or debugger pause the click causes is noted in a successful reply (`{dialog}` or `{paused, location}`) |
-| `fill_input` | ✓ | ✓ | picks `<select>` options; sets `date`, `time`, `datetime-local`, `month`, `week`, `range` and `color` inputs to the text in their own format (`2026-10-31`, `13:45`, `72`, `#ff0000`), firing `input` and `change`, noting a value the input adjusted (a range snaps to its step) and failing, without changing it, on a malformed one; fails without typing on elements that cannot take the text; `append: true` types after the content instead of replacing it (a number or email field, which has no caret, is retyped whole); an editor of its own (an element with an `EditContext` or a focusable `textbox` role, or the hidden input of a code editor such as Monaco or Ace) gets the keys a user presses: a click on the editor when its input has no visible box, Control+A (Command+A on macOS) or Control+End, then the text, and the reply says its content could not be checked; in a contenteditable element (including rich text editors such as Slate, Lexical, ProseMirror or CodeMirror 6) it selects the content (a range, then Control+A as a user would) and types over it, so the editor records the edit; types key by key on both (key handlers run; newlines and tabs inserted as text), about 1 ms per character; `change` on leaving the field, or at the end when the window has no focus |
-| `press_key` | ✓ | ✓ | one key (a character, Enter, Tab, Escape, arrows, F1–F12...) with Control / Shift / Alt / Meta held, in `selector` (focused first) or the focused element; a shortcut types nothing |
+| `fill_input` | ✓ | ✓ | picks `<select>` options (on a `<select multiple>`, exactly the ones named one per line; an unknown one changes nothing); sets `date`, `time`, `datetime-local`, `month`, `week`, `range` and `color` inputs to the text in their own format (`2026-10-31`, `13:45`, `72`, `#ff0000`), firing `input` and `change`, noting a value the input adjusted (a range snaps to its step) and failing, without changing it, on a malformed one; fails without typing on elements that cannot take the text; `append: true` types after the content instead of replacing it (a number or email field, which has no caret, is retyped whole); an editor of its own (an element with an `EditContext` or a focusable `textbox` role, or the hidden input of a code editor such as Monaco or Ace) gets the keys a user presses: a click on the editor when its input has no visible box, Control+A (Command+A on macOS) or Control+End, then the text, and the reply says its content could not be checked; in a contenteditable element (including rich text editors such as Slate, Lexical, ProseMirror or CodeMirror 6) it selects the content (a range, then Control+A as a user would) and types over it, so the editor records the edit; types key by key on both (key handlers run; newlines and tabs inserted as text), about 1 ms per character; `change` on leaving the field, or at the end when the window has no focus |
+| `press_key` | ✓ | ✓ | one key (a character, Enter, Tab, Escape, arrows, F1–F12...) with Control / Shift / Alt / Meta held (in `modifiers`, or written before the key as `Control+a`, `Shift+Tab` or `ControlOrMeta+c`: Meta on macOS, Control elsewhere), in `selector` (focused first) or the focused element; a shortcut types nothing |
 | `hover` | ✓ | ✓ | moves the mouse over the element (scrolled into view; fails when hidden or covered) |
 | `drag` | ✓ | ✓ | presses on `from` (checked like `click_element`), moves in steps to the centre of `to` (which must then be in the viewport) and releases: sortable lists, boards, sliders; HTML5 drag and drop is real on Chrome and simulated with script events on Firefox (its WebDriver input starts a native drag but never drops it), and the reply says so |
 | `fill_form` | ✓ | ✓ | several fields in one call: text and `<select>` as `fill_input`, a checkbox or radio takes `true`/`false` and is clicked only when its state differs; stops at the first failing field naming what was done; never echoes values |
@@ -141,7 +144,7 @@ see the note.
 | `cookies` | ✓ | ✓ | `storage` group; `get` / `set` / `delete`: the cookies sent to the page (or `url`) or of a `domain`; values hidden unless `show_values: true` (Chrome `Network.*Cookie*`, Firefox BiDi `storage.*` in the tab's partition) |
 | `web_storage` | ✓ | ✓ | `storage` group; `get` / `set` / `delete` / `clear` on the page's `localStorage` or `sessionStorage`; values hidden unless `show_values: true` |
 | `get_console_logs` | ✓ | ✓ | one line per message, oldest first: `[level] text @ url:line` (lines from 1), objects and arrays previewed as the console shows them (`{n: 1}`, `[1, 2, 3]`), repeats in a row folded (`[x3]`), uncaught errors marked with up to 5 stack lines indented; `include_details: true` gives the JSON with every field; a message keeps at most 10 000 characters; Firefox: page errors, CSS warnings and platform messages need the debugger port |
-| `get_network_logs` | ✓ | ✓ | one line per request, oldest first (`id METHOD url => status [type]`, or `failed: <reason>` / `pending`), then one per WebSocket frame (payload preview); `request_id` shows one request's headers and body, `include_details: true` every request's as JSON (a binary body has `response_body_encoding: "base64"`; bodies at most 64 000 characters, none over 2 MB; a WebSocket payload keeps 64 000, `payload_len` is the whole); the browser's own requests (`chrome://`, `devtools://`, `data:`, `about:`, extensions) are not logged; Firefox: WebSocket frames need the debugger port |
+| `get_network_logs` | ✓ | ✓ | one line per request, oldest first (`id METHOD url => status [type]`, or `failed: <reason>` / `pending`), then one per WebSocket frame (payload preview); `request_id` shows one request's headers and body, `include_details: true` every request's as JSON (a binary body has `response_body_encoding: "base64"`; bodies at most 64 000 characters, none over 2 MB; a WebSocket payload keeps 64 000, `payload_len` is the whole); the browser's own requests (`chrome://`, `devtools://`, `data:`, `about:`, extensions) are not logged; a note counts the responses with no body because they are still loading or the page never read them (an open stream; on Chrome, a `fetch` whose body the page did not consume); Firefox: WebSocket frames need the debugger port |
 | `mock_route` | ✓ | ✓ | `network` group; requests whose URL matches a glob (`*`, `?`, `\` escapes) get a mocked `status`, `body` (text, at most 1 MB), `content_type` and `headers` without reaching the network; the latest matching route wins; at most 50 routes per tab, kept until `remove_route` or the tab closes (Chrome `Fetch`, not while `enable_proxy_auth` is active; Firefox a `network` intercept) |
 | `list_routes` | ✓ | ✓ | `network` group; the tab's routes with the `hits` each answered |
 | `remove_route` | ✓ | ✓ | `network` group; one route by id, or all |
@@ -683,12 +686,17 @@ incompatible:
 make check        # fmt, clippy -D warnings, tests, docs, duplication, packaging, version
 make e2e          # E2E smoke against real Chrome and Firefox, headless (E2E_VISIBLE=1 shows them; Linux, macOS)
 make check-all    # both
+make compare      # the same tasks on this and other browser MCP servers (tests/compare)
 ```
 
 `make check` is hermetic: it never starts a browser or touches the network.
 `make e2e` runs `tests/run_all_e2e.sh`: the launched-mode smoke for both
 browsers, then the attach mode against browsers started by `tests/chrome.sh`
-and `tests/firefox.sh`. See [AGENTS.md](AGENTS.md) for the conventions.
+and `tests/firefox.sh`. `make compare` runs the scenarios of
+[tests/compare](tests/compare/README.md) (from common tasks to rare ones, each
+with a check) on browser-control and on Playwright MCP, chrome-devtools-mcp
+and a Puppeteer MCP, and compares the outcome, calls and tokens with a saved
+baseline. See [AGENTS.md](AGENTS.md) for the conventions.
 
 ## Releasing
 

package/npm-shrinkwrap.json

@@ -19,7 +19,7 @@
       "hasInstallScript": true,
       "license": "MIT",
       "name": "@raultov/browser-control-mcp",
-      "version": "0.10.0-beta.14"
+      "version": "0.10.0-beta.15"
     },
     "node_modules/detect-libc": {
       "engines": {
@@ -48,5 +48,5 @@
     }
   },
   "requires": true,
-  "version": "0.10.0-beta.14"
+  "version": "0.10.0-beta.15"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "artifactDownloadUrls": [
-    "https://github.com/raultov/browser-control-mcp/releases/download/v0.10.0-beta.14"
+    "https://github.com/raultov/browser-control-mcp/releases/download/v0.10.0-beta.15"
   ],
   "author": "raultov <raultov@protonmail.com>",
   "bin": {
@@ -92,7 +92,7 @@
       "zipExt": ".tar.xz"
     }
   },
-  "version": "0.10.0-beta.14",
+  "version": "0.10.0-beta.15",
   "volta": {
     "node": "18.14.1",
     "npm": "9.5.0"