browser_eval

// WHEN AI AGENTS USE THIS TOOL

AI agents may call browser_eval to permanently remove or destroy resources in Midnight Nextjs. Without a policy, an autonomous agent could delete critical data in a loop with no way to undo the damage. Intercept blocks destructive tools by default and requires explicit human approval before enabling them.

// WHY ENFORCE A POLICY ON BROWSER_EVAL

Without a policy, an AI agent could call browser_eval in a loop, permanently destroying resources in Midnight Nextjs. There is no undo for destructive operations. Intercept blocks this tool by default and only allows it when a human explicitly approves the action.

// RECOMMENDED POLICY

Destructive tools permanently remove data. Block by default. Only enable with explicit approval workflows.

midnight-next-js-mcp.yaml

tools:
  browser_eval:
    rules:
      - action: deny
        reason: "Blocked by default — enable with approval"

See the full Midnight Nextjs policy for all 35 tools.

// DETAILS

Tool Name browser_eval

Category Destructive

MCP Server Midnight Nextjs MCP Server

Risk Level Critical

// MORE MIDNIGHT NEXTJS TOOLS

Financial midnight_transfer_tokens Destructive init Destructive nextjs_call Destructive nextjs_index Execute midnight_call_contract Execute midnight_compile_contract Execute midnight_deploy_contract Execute midnight_init

View all 35 tools →

// WHAT CAN GO WRONG

Agents calling destructive-class tools like browser_eval have been implicated in these attack patterns. Read the full case and prevention policy for each:

Browse the full MCP Attack Database →

// OTHER DESTRUCTIVE TOOLS ACROSS MCP SERVERS

Other tools in the Destructive risk category across the catalogue. The same policy patterns (deny, require_approval) apply to each.

AbraFlexi contact_delete AbraFlexi evidence_delete AbraFlexi invoice_issued_delete AbraFlexi product_delete ACR — Agent Composition Records acknowledge_threat AdButler campaign_bulk_delete_catalog_ad_items

// IN CONTEXT OF CRITICAL RISK

browser_eval is one of the critical-risk operations in Midnight Nextjs. For the full severity-focused view — only the critical-risk tools with their recommended policies — see the breakdown for this server, or browse all critical-risk tools across every MCP server.

// RELATED READING

// FAQ

What does the browser_eval tool do? +

Automate and test web applications using Playwright browser automation. This tool connects to playwright-mcp server and provides access to all Playwright capabilities. CRITICAL FOR PAGE VERIFICATION: When verifying pages in Next.js projects (especially during upgrades or testing), you MUST use browser automation to load pages in a real browser instead of curl or simple HTTP requests. This is because: - Browser automation actually renders the page and executes JavaScript (curl only fetches HTML) - Detects runtime errors, hydration issues, and client-side problems that curl cannot catch - Verifies the full user experience, not just HTTP status codes - Captures browser console errors and warnings via console_messages action IMPORTANT FOR NEXT.JS PROJECTS: If working with a Next.js application, PRIORITIZE using the 'nextjs_index' and 'nextjs_call' tools instead of browser console log forwarding. Next.js has built-in MCP integration that provides superior error reporting, build diagnostics, and runtime information directly from the Next.js dev server. Only use browser_eval's console_messages action as a fallback when these Next.js tools are not available or when you specifically need to test client-side browser behavior that Next.js runtime cannot capture. Available actions: - start: Start browser automation (automatically installs if needed). Verbose logging is always enabled. - navigate: Navigate to a URL - click: Click on an element - type: Type text into an element - fill_form: Fill multiple form fields at once - evaluate: Execute JavaScript in browser context - screenshot: Take a screenshot of the page - console_messages: Get browser console messages (for Next.js, prefer nextjs_index/nextjs_call tools instead) - close: Close the browser - drag: Perform drag and drop - upload_file: Upload files - list_tools: List all available browser automation tools from the server Note: The playwright-mcp server will be automatically installed if not present.. It is categorised as a Destructive tool in the Midnight Nextjs MCP Server, which means it can permanently delete or destroy data. Block by default and require explicit approval.

How do I enforce a policy on browser_eval? +

Add a rule in your Intercept YAML policy under the tools section for browser_eval. You can allow, deny, rate-limit, or validate arguments. Then run Intercept as a proxy in front of the Midnight Nextjs MCP server.

What risk level is browser_eval? +

browser_eval is a Destructive tool with critical risk. Critical-risk tools should be blocked by default and only enabled with explicit human approval.

Can I rate-limit browser_eval? +

Yes. Add a rate_limit block to the browser_eval rule in your Intercept policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block browser_eval completely? +

Set action: deny in the Intercept policy for browser_eval. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides browser_eval? +

browser_eval is provided by the Midnight Nextjs MCP server (midnight-nextjs-mcp). Intercept sits as a proxy in front of this server to enforce policies before tool calls reach the server.

Let agents act without letting them run wild.