Weavetab MCP server
dev.weavetab/mcp·v2.5.0·3 starsOpen automation engine for AI agents. Control live browsers and desktop apps locally.
3 stars156 downloads/wk
Reviews
Write oneNobody has reviewed Weavetab yet.
If you have run it, two minutes of your experience saves the next person an afternoon.
Weavetab tools (42, 2 write)
write = sends, deletes, buys or postsRead from the package source without running it. The installed server may list more.
browser_automationInject self-running background script for monitoring/polling. Cleared on tab close. Don't use persistent scripts for expensive ops.
browser_burstHIGH-SPEED MULTI-ACTION PIPELINE: Executes 2 or more sequential browser actions in a single round-trip without waiting for LLM turns between steps. PREFER THIS over individual single-action calls (e.g. typing + pressing Enter, filling multiple form fields, clicking tabs/buttons then waiting, searching, navigating + reading) to drastically slash latency and token burn. Supports native primitives (b
browser_canvasFor ALL canvas content (charts, games, graphs). Use 'get_image' to read pixels, 'draw' to simulate gestures. Do NOT use browser_click here.
browser_captchaAutonomous CAPTCHA detection and solving.
browser_checkpointSnapshot and restore browser state (cookies, localStorage, sessionStorage, and scroll/URL) into named checkpoints to time-travel and rollback failed automation branches.
browser_clickClick a DOM element. Use browser_canvas for charts/canvas. If stuck_warning=true, stop and use browser_map. Pass mark: N to click a numbered element from browser_map({ visual: true/"auto" }) without any DOM re-scan.
browser_clipboardRead or write to the system clipboard.
browser_console1-5ms latency. Read or clear buffered console API messages, JS exceptions, and network errors.
browser_cookiesManage browser cookies.
browser_detectCRITICAL INITIALIZATION TOOL. Detect available browsers and configured desktop apps (Discord, Slack, etc.). Call this FIRST before interacting with the environment to know if apps are online/offline and what tabs they have open.
browser_dialogAccept or dismiss JS dialogs (alert, confirm, prompt). Browser sessions only.
browser_emulateEmulate browser conditions over CDP: network throttling (Slow 3G, Fast 3G, 4G, Offline), CPU throttling rate, Geolocation coordinates, Timezone, and User Agent string overrides.
browser_evalwrite actionRun arbitrary JS via CDP. Good for extracting app state. Cannot traverse shadow DOM/cross-origin iframes.
browser_extract_designExtract design tokens (colors, typography, spacing, shadows, CSS variables), semantic HTML layouts, and clean CSS into structured files and an LLM design blueprint. Ideal for cloning websites, UI components, and design systems with 100% pixel fidelity.
browser_fillSmart multi-field form-filling and input inspector. Call with scan:true (or empty) to get a lightweight list of all editable inputs on the page without dumping the full DOM. Fill multiple fields in a single turn.
browser_findInstant text & keyword search across page text, labels, and placeholders. Returns matched element coordinates, selectors, and ref IDs.
browser_githubInteract with GitHub repositories without burning browser turns. Analyze repo trees, read raw source files, search/inspect issues, and examine PR diffs and review comments.
browser_highlightHighlight elements on page. Supports single or multiple candidates (refs) with styles ('consideration' for candidate evaluation, 'target' for lock-on, 'danger' for destructive actions, 'success', or 'shimmer'), floating badges, and configurable duration.
browser_inspect15-35ms latency, zero waste. Deep DOM inspection. Useful for debugging failed clicks, verifying z-index & visibility, or computed styles.
browser_keyPress a keyboard key.
browser_mapSnapshot interactive DOM with volatile ref IDs that invalidate after DOM mutations. For complex SPAs (e.g. GitHub dashboards), use `scope` or `query` to reduce tokens. For forms/pagination/sequential loops, ALWAYS use `delta: true` to save 97% tokens. For canvas/WebGL/Figma pages where the DOM has < 5 interactive elements, use `visual: "auto"` to get a numbered screenshot — then use browser_click(
browser_navigateNavigate to a URL or launch/focus a configured Electron app.
browser_network_interceptIntercept/stub network responses (e.g. mock APIs, block tracking) OR retrieve detailed raw protocol network telemetry (TLS/SSL certificate info, microsecond timing breakdown, and OS-level failure reasons).
browser_officeRead and extract structured content from office documents (Excel, Word, PDF, CSV). Note: PDF/Word extraction requires local binary dependencies (e.g., poppler) and output is truncated by max_chars/max_rows limits. Two modes: - **url** — fetch a document URL using the browser's live session cookies (works for authenticated downloads, SharePoint, Google Drive exports, etc). Automatically detects for
browser_pattern_learnRead, register, update, and record execution outcomes for named workflow patterns and site quirks in ~/.weavetab-system/memory/sites/. Use action='get' at session start to inspect a site profile and decide between fast-path replay (reliability ≥ 0.8) or exploratory navigation. Use action='learn' after completing a multi-step flow to persist it. Use action='record_execution' to update reliability s
browser_pdfPrint the current page to a PDF file.
browser_performanceRetrieve page performance metrics.
browser_pointerAdvanced pointer control (hover, click, double_click, drag_and_drop, hover_chain). Use hover_chain for Photoshop/Photopea, Figma, and multi-level flyout submenus.
browser_recordingRecord video screencast for compliance/audit. Compiles captured frames into video/animation (.webp, .gif, .webm, .mp4).
browser_scrapeSub-5ms latency, zero waste extraction. Best for batch list extraction, table parsing, targeted data mining. Prefer this over browser_map for pure data extraction. Note: XPath selectors lack shadow-DOM support; use CSS selectors for shadow DOMs.
browser_screenshot95-135ms capture. Best for visual layout validation, canvas/image inspection. For multimodal models only. Text-only models should use browser_map or browser_canvas instead.
browser_scrollScroll the page.
browser_selectSelect an option from a native dropdown.
browser_snapshotCapture or restore an MHTML snapshot. Best for offline archival, replay testing, and compliance audits.
browser_storageManage localStorage and sessionStorage.
browser_tabsManage browser and Electron app tabs/windows (open, switch, close, list). Specify 'app' when targeting desktop apps (e.g. app: 'discord') to avoid opening web browser.
browser_thoughtsAgent-to-user communication. Renders in the middle down of the page. Use 'question' mode to ask a free-text question. Use 'feedback' mode to provide status updates, analysis, or decisions. Supports element anchoring (e.g. 'w:15') and presentation styles ('observation', 'decision', 'warning', 'question').
browser_typeType text into an input field or currently focused element. If id/selector/label is omitted, automatically types directly into document.activeElement without needing a redundant click or browser_map. If target is already focused, skips click to prevent unfocus bugs.
browser_type_secretInject a secret from an environment variable.
browser_uploadwrite actionUpload files to a file input.
browser_viewportSet viewport dimensions and device emulation.
browser_waitPause until a condition is met.
Public scan report
scanner v0.1.10 · 2026-10-28 · same rubric, same numbers if you re-run it
- Code scan278 source files scanned8/25
- –Live reliabilityno gateway calls yet and no remote to proben/a
- –Tool poisoningtools not inspected (local package is not executed); not countedn/a
- Auth qualitylocal package, no credentials required12/15
- Maintenancelast push 4 days ago15/15
- Maintainer identityregistry namespace matches repository owner7/10
Findings (2)
- highShell command built from a string (injection risk)
exec.shell-concatdist/index.js: …" "); try { exec(`npx -y @weavetab/skills@latest ${subArgs}`.trim(), { stdio: "inherit" });… - mediumeval / new Function used
exec.evaldist/tools/automation.js: …turn; } (async function() { return eval(${JSON.stringify(script)}); })().then(fu…
How Weavetab compares
Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.
- Safety score
- 65/100
- higher than 20% of 48,255 servers
- Tools
- 42
- the typical server has 7
- Tools that change things
- 5%
- typical: 0%. Fewer write tools means less an agent can break
- GitHub stars
- 3
- more than 80% of 28,688 servers
- Downloads a week
- 156
- more than 71% of 12,191 servers with a package
What its tools let an agent do: 40 read · 2 change
Install Weavetab in Claude Code, Cursor or VS Code
Runs npx -y @weavetab/mcp on your machine. Read the scan report first; the gateway never runs local packages.
claude mcp add mcp -- npx -y @weavetab/mcp
What the publisher says
From the Weavetab repository's README, as published. We do not edit it. Read it on GitHub
The open automation engine for AI agents.Control live browsers and desktop apps locally with instant execution.
Tool Reference · Documentation · Architecture · Support · Security
Weavetab is the open automation engine for AI agents. It connects models directly to live Chromium browsers and Electron desktop applications via native Chrome DevTools Protocol (CDP) sockets — no WebDriver binaries, no cloud relay, zero telemetry.
Actions execute with sub-10ms latency. Web pages are translated into agent-readable semantic maps with turn-by-turn diffing that reduces token usage by up to 95%. Built-in security enforces local domain policies, role-based access control, and client-side credential injection.
Built and architected by fy2ne.
Why not Playwright or Puppeteer?
The standard approach — Playwright over MCP — works. But it carries fundamental architectural costs that compound at scale.
Architecture
Shortened. The full README is on GitHub.
Nothing above is checked by us. What we check is on the safety report.
Weavetab: common questions
- Is Weavetab MCP server safe?
- With care: it is graded C, so read the findings first (65/100). Read the Weavetab safety report
- How do I install Weavetab?
- It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
- Does Weavetab need an API key?
- Not as far as the registry entry and our scan can tell: no credentials are declared or required.
- Is Weavetab maintained?
- The last commit was 11 days ago (2026-10-24). The latest release is v2.5.0.
- What can I use instead of Weavetab?
- Servers from other publishers that do the same job: Mobilerun MCP server.
- How does Weavetab compare with other MCP servers?
- safety score 65/100 (higher than 20% of 48,255 servers); tools 42 (the typical server has 7); tools that change things 5% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.
Alternatives to Weavetab
Same job from other publishers: the closest match first, then the best rated.
- MobilerunLet AI agents control Android and iOS devices on Mobilerun Cloud: screen, input, apps, workflows.not reviewedEstablishedA