Types text into the element that matches the selector, or wherever the focus is. Give credential instead of text to type a saved password or secret: the platform types it without the model seeing it.

Inputs

Name	Type	Default	Allowed values	Description
`sessionId`required	`string`	–	–	The session's id, from `session_create`.
`text`	`string`	–	–	The text to type. Give text or credential, not both.
`selector`	`string`	–	–	Type into this element first.
`credential`	`string`	–	–	The name of a saved credential (see credentials_list) to type instead of text. With `MCP_TOOLS=directory` the server leaves this out.
`field`	`string`	–	`username`, `password`, `otp`	Which part of a password to type. otp is the current 2FA code, when the password has a 2FA code source. With codeSource push or url, typing otp waits for the code your system sends. Leave it out for a secret. With `MCP_TOOLS=directory` the server leaves this out.

This tool works in a session with a browser. On a shell-only session (created with browser: false) it answers browser_disabled. See the three kinds of session.

sessionId is the id that session_create returned. The server keeps no default session. If that session is stopped, this tool resumes it first, as it was (a resume starts a machine again, and billing with it).

Example call

This is what an MCP client sends. You do not write it yourself: ask the model in plain words and it calls the tool.

tools/call

{  "name": "browser_type",  "arguments": {    "sessionId": "6c1f3c9e-1d2a-4f67-9b0e-1b2c3d4e5f60",    "text": "cloud browsers",    "selector": "input[name=q]"  }}

What it returns

A confirmation, or the error.

Result

Typed.

When a call fails, the result is marked as an error. Its text starts with the API’s error code, such as unauthorized or session_not_running, followed by its message.

Annotations

The server tells every client what this tool does to the world, so a client can decide what to ask you about before it runs.

Annotation	Value
`title`	Type text
`readOnlyHint`	`false`
`destructiveHint`	`false`
`openWorldHint`	`true`

Good to know

Text you type is sent to the model client like any other tool input. Do not put passwords in a chat: save them as credentials and type them by name, for example {"credential": "SHOP", "field": "password", "selector": "#password"}.
A credential with sites (every password) needs a selector, goes only into that field, and only when the field's page is on one of its sites. Anywhere else it fails.
A password whose codeSource is push or url makes an otp call wait, up to the credential's code timeout (5 minutes by default), for the code your system sends. If no code arrives, the call fails with credential_code_timeout.
A credential with scope shell is not for the AI: browser_type is refused for it.
The reply says what was typed by name (for example Typed %SHOP.password% into #password), never the value.
Afterwards the session hides the value in browser_read, the page's elements, errors and shell output (the text shows %SHOP.password%), and a screenshot covers the field. This hides a value; it does not protect it: code that runs in the page or the session (an evaluate action in browser_act, a command in shell_exec) can still read the field and print it, for example reversed or in base64. Use a password only in sessions whose pages and scripts you trust.
With MCP_TOOLS=directory the server leaves out credential and field, and text is required.

The same thing with the API

Endpoint	Reference
`POST /v1/sessions/{id}/browser/actions`	Run browser actions

These docs describe a beta API. Endpoints, fields and SDK methods may change before general availability; breaking changes will be listed in the changelog.