Allow raw telemetry page reads

[rgarcia]

summary

• add opt-in raw telemetry reads while preserving compact output by default
• enforce raw reads with explicit categories, limit <= 5, and a 1 MiB serialized-response cap
• reject screenshot PNGs from raw JSON responses
• preserve API-owned time and tail semantics; label replay arguments as best-effort because archives can change
• document omitted fields, output bounds, and replay consistency

verification

• bun test (198 tests)
• bunx tsc --noEmit
• bunx prettier --check src/lib/mcp/tools/browsers.ts src/lib/mcp/tools/browsers.test.ts

---

Note

Medium Risk
Changes MCP telemetry response shape and size limits for agents debugging sessions; raw mode can expose sensitive network/console payloads but is gated and capped.

Overview
Adds opt-in raw telemetry for manage_browsers get_telemetry: default compact output is unchanged, but callers can set compact=false with explicit categories and a limit of 1–5 to get full upstream event envelopes (headers, bodies, etc.) instead of stripped fields.

Compact, category-filtered pages now include raw_replay_best_effort—tool arguments to re-request the same cursor page in raw mode (best-effort; retention/timing may differ). Raw mode rejects screenshot category, blocks png in event data, and errors if the serialized page exceeds 1 MiB.

registerBrowserCapabilities accepts injectable McpDependencies (kernel client factory) so browser tools/resources are testable; new browsers.test.ts covers replay, time-window semantics, limits, and resource reads.

^{Reviewed by Cursor Bugbot for commit 53ca6b7. Bugbot is set up for automated code reviews on this repo. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
mcp	Ready	Preview	Aug 12, 2026 8:57pm

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: Incomplete dependency injection wiring
  • registerBrowserCapabilities now passes the injected dependencies into both browser resource registration helpers so tools and resources share the same Kernel client factory.

Or push these changes by commenting:

@cursor push 2164925829

Preview (2164925829)

diff --git a/src/lib/mcp/tools/browsers.ts b/src/lib/mcp/tools/browsers.ts
--- a/src/lib/mcp/tools/browsers.ts
+++ b/src/lib/mcp/tools/browsers.ts
@@ -329,27 +329,36 @@
   server: McpServer,
   dependencies: McpDependencies = defaultMcpDependencies,
 ) {
-  registerJsonResourceCollection(server, {
-    name: "browsers",
-    uriTemplate: "kernel://orgs/{organizationId}/projects/{projectId}/browsers",
-    emptyText: "No browsers found",
-    read: async (client) => {
-      const browsers = [];
-      for await (const browser of client.browsers.list()) {
-        browsers.push(browser);
-      }
-      return browsers;
+  registerJsonResourceCollection(
+    server,
+    {
+      name: "browsers",
+      uriTemplate:
+        "kernel://orgs/{organizationId}/projects/{projectId}/browsers",
+      emptyText: "No browsers found",
+      read: async (client) => {
+        const browsers = [];
+        for await (const browser of client.browsers.list()) {
+          browsers.push(browser);
+        }
+        return browsers;
+      },
     },
-  });
+    dependencies,
+  );
 
-  registerJsonResourceTemplate(server, {
-    name: "browser",
-    uriTemplate:
-      "kernel://orgs/{organizationId}/projects/{projectId}/browsers/{sessionId}",
-    variableName: "sessionId",
-    resourceLabel: "Browser session",
-    read: (client, sessionId) => client.browsers.retrieve(sessionId),
-  });
+  registerJsonResourceTemplate(
+    server,
+    {
+      name: "browser",
+      uriTemplate:
+        "kernel://orgs/{organizationId}/projects/{projectId}/browsers/{sessionId}",
+      variableName: "sessionId",
+      resourceLabel: "Browser session",
+      read: (client, sessionId) => client.browsers.retrieve(sessionId),
+    },
+    dependencies,
+  );
 
   // manage_browsers -- Manage browser sessions and read archived telemetry
   server.tool(

_{You can send follow-ups to the cloud agent here.}

^{Reviewed by Cursor Bugbot for commit e9a2a1f. Configure here.}

[masnwilliams]

the raw-read capability makes sense, but this needs a bounded output contract and a real replay consistency model before merging. the current implementation can emit very large MCP responses and calls equal query parameters an “exact page” even though the archive can mutate between reads. requesting changes on those two blockers.

the duration parser is also protocol duplication caused by the replay design; i’d prefer the API to own normalization and snapshot semantics. if local parsing remains, please isolate it and cover the grammar and precision edge cases.

[masnwilliams]

latest commit addresses the review findings: raw reads are bounded, replay is explicitly best-effort without changing API time semantics, and the duplicate duration parser is gone. the new boundary regressions pass, and CI and BugBot are green.