Navigates the currently selected page to a URL, or performs back/forward/reload navigation. This tool only navigates; it does not clear cookies, storage, cache, or site data. Waits for DOMContentLoaded event (not full page load). Default timeout is 10 seconds. After navigation, stale script IDs a...
AI agents invoke navigate_page to trigger actions in JS Reverse MCP. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call — builds kicked off, notifications sent, workflows started.
While navigation itself does not delete data or move money, it is an Execute category tool because it triggers external browser operations whose effects depend on the supplied URL argument. An AI agent given this tool could navigate to malicious sites, trigger unintended application workflows, or cause the browser to load content with side effects.
From the tool's definition The tool 'navigates the currently selected page to a URL' and 'performs back/forward/reload navigation'. Navigation is an external operation that triggers state changes in the browser and can load arbitrary web content with side effects dependent on the URL…
Attacks that exploit this kind of access
Navigates the currently selected page to a URL, or performs back/forward/reload navigation. This tool only navigates; it does not clear cookies, storage, cache, or site data. Waits for DOMContentLoaded event (not full page load). Default timeout is 10 seconds. After navigation, stale script IDs are cleared and fresh ones are captured automatically when the debugger is enabled. Tracked code URL breakpoints and XHR/Fetch breakpoints are restored across navigation when possible. It is categorised as a Execute tool in the JS Reverse MCP MCP Server, which means it can trigger actions or run processes. Use rate limits and argument validation.
Register the JS Reverse MCP server in PolicyLayer and add a rule for navigate_page: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches JS Reverse MCP. Nothing to install.
navigate_page is a Execute tool with high risk. Execute tools should be rate-limited and have argument validation enabled.
Yes. Add a rate_limit block to the navigate_page rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.
Set action: deny in the PolicyLayer policy for navigate_page. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.
navigate_page is provided by the JS Reverse MCP server (zhizhuodemao/js-reverse-mcp). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.