What an AI agent can do in your browser without asking
Of the 97 tools offered to an agent, 65 are classed low risk (they read or observe), 16 medium (they change state a reload clears or start a recording), 14 high (they act on a page or touch credentials) and 2 depend on their arguments — and the approval gate that can ask first ships switched off.
Updated · T3rnel Browser 1.3.0
How tools are classed
Every tool is assigned a risk level in the approval gate. Reading and observing is low; changing state that a reload clears, or starting a recording, is medium; acting on a page, filling forms, running script or touching credentials is high. A tool the gate does not name is high by rule.
| Level | Count |
|---|---|
| Low | 65 |
| Medium | 16 |
| High | 14 |
| By arguments | 2 |
The high-risk set
browser_click, browser_fill, browser_type, browser_press, browser_select, browser_evaluate, browser_upload, browser_record_replay, browser_vault_save, browser_vault_load, browser_vault_delete, browser_cache_clear, browser_form_fill, browser_form_clear
What is never offered to an agent
Three licence tools that move real licence material — collecting a purchased key, rotating one by email, releasing a device seat — stay callable from the side panel only. They are hidden from the tool list and refused if an MCP client asks, so a model with a stolen session cannot run them.
Why the gate is off by default
The default used to be high. It was changed deliberately: the only prompt on the MCP path is the one-time pairing approval at first connection, and a gate that interrupts every action gets disabled outright. The full gate stays available and unchanged in Settings.
Questions
Is the approval gate on by default?
No. It ships in mode off: installing the extension and allowing AI/MCP automation is the consent, because a gate that interrupts daily use trains people to turn it off. Arm it in Settings.
What do the approval modes do?
off runs everything; high asks before tools that change pages; all asks before every mutation. You can also keep always-ask and never-ask lists per tool, and protect URL patterns.
What happens to a tool the gate has not classified?
It is treated as high risk. A new tool cannot become silently trusted by being forgotten.