@raultov/browser-control-mcp 0.7.0-beta.11 → 0.8.0-beta.12

package/CHANGELOG.md

@@ -10,6 +10,33 @@ from a copy of its code: entries describe the differences from that release.
 
 ## [Unreleased]
 
+## [0.8.0-beta.12] - 2026-10-31
+
+Public **BETA**. Reaches into frames of another origin (payment forms,
+embedded editors, playgrounds, widgets), which Playwright MCP already did:
+`snapshot` reads them in place with frame refs (`f2e5`), and the input tools
+act in them through those refs, on Chrome and Firefox. Behaviour changes:
+`snapshot` and `find_in_snapshot` now show the content of such frames
+instead of a "not readable" line, iframes read get a `[frame=f2]` mark, and
+selectors starting with `f` and a number (`f2e5`, `f2 >>> css`) name
+elements of those frames.
+
+### Added
+
+- Frames of another origin (payment forms, embedded editors and playgrounds,
+  widgets): `snapshot` and `find_in_snapshot` read them in place, at most 20
+  and 5 deep, marking each iframe with its frame number (`[frame=f2]`) and
+  prefixing its refs (`f2e5`); `snapshot` with `selector: "f2"` outlines one
+  frame. Every selector argument takes those refs and `f2 >>> css`:
+  `click_element`, `hover`, `drag`, `fill_input`, `fill_form`, `press_key`,
+  `scroll`, `wait_for` and `upload_file` check and act in the frame. Chrome
+  reaches an out-of-process frame through its own target (attached for the
+  call) and an in-process one through its document, and sends mouse events
+  to the tab offset by where the frame shows; Firefox acts in the frame's
+  browsing context. Before, such a frame was a "not readable" line and
+  nothing inside it could be reached. `evaluate_js` still runs in the page,
+  and `capture_screenshot` refuses an element inside such a frame. (#27)
+
 ## [0.7.0-beta.11] - 2026-10-31
 
 Public **BETA**. Closes gaps with Playwright MCP and chrome-devtools-mcp and

package/README.md

@@ -13,7 +13,7 @@ It is the successor of
 from a copy of its code) and complements Playwright MCP or
 chrome-devtools-mcp with runtime JavaScript debugging on both browsers.
 
-> **Status: BETA (0.7.0-beta.11).** This version contains known bugs and differences
+> **Status: BETA (0.8.0-beta.12).** This version contains known bugs and differences
 > between Chrome and Firefox (see [Limitations and TODO](#limitations-and-todo))
 > and parts that have not been verified (see [Untested](#untested)). Tool
 > replies may change in incompatible ways before 1.0. Please report problems
@@ -37,6 +37,7 @@ Tokens are estimated as characters / 4 for every server.
 | Firefox | **✓ next to Chrome, same tools** | ✓ one browser per server | ✗ |
 | Several browsers and instances at once | **✓** | ✗ | ✗ |
 | Selectors | CSS, snapshot refs, `host >>> inner` into shadow roots and iframes | CSS, snapshot refs | snapshot refs only |
+| Frames of another origin (payment forms, embedded editors) | ✓ in the snapshot, refs `f2e5` for every input tool | ✓ refs `f1e5` | ✗ |
 | Snapshot of a long page | **bounded at 50 000 characters**, `find_in_snapshot` searches the rest | unbounded | unbounded |
 | Waits for the page to react after an action | ✓ ~50 ms when nothing reacts | ✓ ~500 ms | ✓ ~200 ms |
 | Clicking a covered or hidden element | **fails at once, naming the overlay** | fails after a 5 s timeout | reports success (the overlay gets the click) |
@@ -54,8 +55,8 @@ Tokens are estimated as characters / 4 for every server.
 
 | Task | browser-control-mcp | Playwright MCP | chrome-devtools-mcp |
 | --- | --- | --- | --- |
-| Tool list in context, default tools | 6 430 tokens | 5 330 tokens | 7 770 tokens |
-| Tool list in context, every opt-in tool on | 9 880 tokens | 12 040 tokens | not measured (optional categories) |
+| Tool list in context, default tools | 6 450 tokens | 5 330 tokens | 7 770 tokens |
+| Tool list in context, every opt-in tool on | 9 910 tokens | 12 040 tokens | not measured (optional categories) |
 | Snapshot of Hacker News | **4 588 tokens** | 12 356 tokens | 6 869 tokens |
 | Snapshot of Wikipedia "Web browser" | **12 643 tokens** (cut, searchable) | 34 349 tokens | 27 656 tokens |
 | Snapshot of MDN `<input>` | **12 625 tokens** (cut, searchable) | 158 077 tokens | 76 654 tokens |
@@ -124,7 +125,7 @@ see the note.
 | `emulate` | ✓ | partial | `emulation` group; `width`/`height`, `device_scale_factor`, `mobile` (touch), `color_scheme`, `reduced_motion`, `forced_colors`, `media` (`print`), `reset`; answers what the page now sees; Firefox: viewport and device pixel ratio only (BiDi has no media or touch emulation yet; those options fail naming them) |
 | `wait_for` | ✓ | ✓ | waits (checking every 100 ms, at most 30 s) until a visible text appears or is gone, a selector is `visible` / `hidden` / `attached` / `detached`, or the URL contains a text; a dialog or debugger pause ends the wait at once |
 | `inspect_dom` | ✓ | ✓ | includes open shadow roots and same-origin iframes (cross-origin ones are noted); at most 100 000 characters without `query` (cut in the page) |
-| `snapshot` | ✓ | ✓ | outline of the page: role, name, states, value and a ref (`e12`) per element, through open shadow roots and same-origin iframes; tables without headers (`th`, `thead`, `caption`) are layout and leave only their content, and a cell is named by its text only when it holds nothing else; comboboxes, spinbuttons and sliders built with ARIA show their value (the field's text, `aria-valuetext` or `aria-valuenow`, the option a button-like combobox shows); an element that is only clickable (a handler or a pointer cursor) is one named line, unless it holds links, buttons or fields, which are listed under it; at most 50 000 characters (`selector` and `depth` narrow it); the same JavaScript on both browsers |
+| `snapshot` | ✓ | ✓ | outline of the page: role, name, states, value and a ref (`e12`) per element, through open shadow roots and same-origin iframes; frames of another origin are read too (at most 20, 5 deep), their iframe marked `[frame=f2]` and their refs prefixed (`f2e5`), and `selector: "f2"` outlines one; tables without headers (`th`, `thead`, `caption`) are layout and leave only their content, and a cell is named by its text only when it holds nothing else; comboboxes, spinbuttons and sliders built with ARIA show their value (the field's text, `aria-valuetext` or `aria-valuenow`, the option a button-like combobox shows); an element that is only clickable (a handler or a pointer cursor) is one named line, unless it holds links, buttons or fields, which are listed under it; at most 50 000 characters (`selector` and `depth` narrow it); the same JavaScript on both browsers |
 | `find_in_snapshot` | ✓ | ✓ | `text` (case-insensitive) or `regex` over the whole outline; matching lines under their ancestors, at most 20 |
 | `save_pdf` | ✓ | ✓ | `files` group; prints the tab as the browser's print does (`landscape`, `print_background`, `scale` 0.1–2, `page_ranges` like `1-3, 5`); with `path` (an absolute `.pdf` under the upload roots) writes the file and answers `{path, bytes, pages}`, else returns the PDF as an embedded `application/pdf` resource (at most 5 MB); Chrome `Page.printToPDF`, Firefox `browsingContext.print` |
 | `capture_screenshot` | ✓ | ✓ | `format` `png`, `jpeg` (or `jpg`) or `webp`; `full_page` at most 16 384 px per side (a text note says when cut); `selector` captures one element (CSS, `host >>> inner` or a snapshot ref), scrolled into view, whole even when taller than the viewport |
@@ -410,7 +411,13 @@ claude mcp add browser-control-mcp -- npx -y @raultov/browser-control-mcp
   their ancestors. The `selector` of `click_element`, `fill_input`,
   `scroll` and `wait_for` takes such a ref, a CSS selector, or
   `host >>> inner` to reach into an open shadow root or a same-origin
-  iframe (`#checkout >>> #card-number`, chainable). An element keeps its ref
+  iframe (`#checkout >>> #card-number`, chainable). A frame of another
+  origin (a payment form, an embedded editor) is read as well, through its
+  own target on Chrome and its own browsing context on Firefox: its iframe
+  line says `[frame=f2]` and its elements have refs such as `f2e5`, which
+  every selector argument takes, as does `f2 >>> css`; the input tools then
+  check and act in that frame (one call acts in one document: `fill_form`
+  and `drag` refuse selectors of two frames). An element keeps its ref
   in later snapshots while it is in the page; refs end when the page
   navigates (a stale ref fails saying so). Roles and names are computed in
   the page, an approximation of the browser's accessibility tree that is
@@ -613,6 +620,10 @@ incompatible:
 - `get_network_logs` with `include_details: true` has no total size limit (each
   Firefox body is capped at 2 MB): use `url_filter` on busy pages.
 - The Docker image is amd64 only.
+- Frames of another origin: `evaluate_js` runs in the page only, and
+  `capture_screenshot` cannot clip to an element inside such a frame (pass
+  the iframe's ref instead); `snapshot` reads at most 20 of them, 5 deep;
+  the coordinates in the replies of the input tools are the frame's.
 
 ## Untested
 

package/npm-shrinkwrap.json

@@ -19,7 +19,7 @@
       "hasInstallScript": true,
       "license": "MIT",
       "name": "@raultov/browser-control-mcp",
-      "version": "0.7.0-beta.11"
+      "version": "0.8.0-beta.12"
     },
     "node_modules/detect-libc": {
       "engines": {
@@ -48,5 +48,5 @@
     }
   },
   "requires": true,
-  "version": "0.7.0-beta.11"
+  "version": "0.8.0-beta.12"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "artifactDownloadUrls": [
-    "https://github.com/raultov/browser-control-mcp/releases/download/v0.7.0-beta.11"
+    "https://github.com/raultov/browser-control-mcp/releases/download/v0.8.0-beta.12"
   ],
   "author": "raultov <raultov@protonmail.com>",
   "bin": {
@@ -92,7 +92,7 @@
       "zipExt": ".tar.xz"
     }
   },
-  "version": "0.7.0-beta.11",
+  "version": "0.8.0-beta.12",
   "volta": {
     "node": "18.14.1",
     "npm": "9.5.0"