High-risk tools in OpenChrome
40 of the 106 tools in OpenChrome are classified as high risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.
Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.
Tools at high risk
-
geolocationExecuteSet or clear geolocation override.
-
oc_task_cancelExecuteRequest cancellation of a background task. Best-effort: the runner
-
actExecuteExecute multi-step browser actions from a natural language instruction. Parses and runs click, type, select, scroll, hover, navigate, and wait steps in sequence.\n\nWhen to use:...
-
batch_executeExecuteExecute JS across multiple tabs in parallel.
-
emulate_deviceExecuteEmulate device viewport and UA via preset or custom.
-
execute_planExecuteExecute a cached plan by ID, bypassing per-step LLM calls. Falls back gracefully on failure for manual retry.
-
javascript_toolExecuteExecute JavaScript code in the context of the current page. The code runs in the page
-
navigateExecuteNavigate to a URL, or go forward/back in browser history. Use
-
oc_performance_insightsExecuteCapture a CDP performance trace and return named insights
-
oc_pilot_run_with_recoveryExecutePilot-only bounded deterministic recovery wrapper for one tool call under declared safe recipes. Requires --pilot and OPENCHROME_CONTRACT_RUNTIME=1.
-
oc_run_startExecuteStart an opt-in OpenChrome run ledger. Returns {run_id,status,pathless metadata}.
-
oc_stopExecuteShut down OpenChrome and close Chrome. Auto-relaunched on next tool call.
-
oc_task_run_completeExecuteEnter a terminal TaskRun state (COMPLETED, FAILED, or CANCELLED). Terminal TaskRuns are immutable.
-
oc_task_run_startExecuteStart an opt-in goal-level TaskRun. Tracks user goal, success criteria, progress summary, item progress, and evidence across multiple OpenChrome tool calls without changing exis...
-
oc_task_startExecuteCreate a task-level browser harness envelope, or launch a long-running tool as a background task. Returns a task_id
-
oc_task_waitExecuteBlock until the task reaches a terminal state (COMPLETED / FAILED /
-
wait_forExecuteWait for a condition. Strongly prefer
-
computerExecuteUse a mouse and keyboard to interact with a web browser, and take screenshots.
-
crawlExecuteRecursively crawl a website via BFS. Opens pages in new tabs, extracts text and links, follows them up to max_depth. Respects robots.txt and scope constraints.\n\nWhen to use: E...
-
interactExecuteFind element by natural language; click/hover/double_click it; wait for DOM settle; return state.\n\nWhen to use: One described element action, with coordinate fallback for Shad...
-
networkExecuteSimulate network conditions.
-
oc_pilot_handoff_redeemExecutePilot-tier: redeem a single-use handoff token previously minted by
-
oc_proxy_hookExecutePilot-tier (--pilot + OPENCHROME_PROXY_HOOK=1): bind host-supplied
-
oc_skill_replayExecutePilot-tier. Replay a recorded skill (steps + optional contract)
-
oc_task_finishExecuteFinish a host-driven task envelope as completed, failed, or cancelled.
-
page_pdfExecuteGenerate PDF from page. Saves to path or returns base64.
-
page_reloadExecuteReload the current page.
-
workflow_initExecuteInitialize a workflow with multiple isolated workers for parallel browser ops.
-
drag_dropExecuteDrag and drop by selector or coordinates. Pass intent=
-
file_uploadExecuteUpload files to a file input element on the page. Pass intent=
-
fill_formExecuteFill form fields and optionally submit. Pass intent=
-
form_inputExecuteSet values in form elements using element reference ID from the read_page tool.
-
lightweight_scrollExecuteScroll page via JS. Returns new scroll position.
-
oc_copy_to_clipboardExecuteCopy text to the system clipboard. Useful for copying MCP server URLs or config snippets.
-
oc_open_host_settingsExecuteOpen the MCP connector settings page for a web AI host in the default browser.
-
oc_pilot_handoff_createExecutePilot-tier: mint a single-use handoff token that lets another agent
-
oc_session_resumeExecuteRestore working context after context compaction.
-
oc_totp_generateExecuteGenerate a current TOTP 2FA code for a domain. Requires TOTP secret to be configured.
-
tabs_createExecuteCreates a new empty tab in the MCP session
-
workerExecuteManage workers. Actions:
Attacks that target this class
High-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.