Tool Reference

Every task runs the same loop: start a session, read available_actions in the response, dispatch one, repeat, then close the session.

start_session(url)
-> dispatch_action(session_id, action, params)   # repeat, re-reading available_actions each time
-> extract_content(session_id)                   # when you need the page as structured records
-> close_session(session_id)

The catalog is not fixed: map your own sites on demand and those configs resolve automatically. The server is agent-agnostic, so the same tools work from any MCP-capable runtime.

Side-effect annotations come from source: readOnlyHint (no writes), destructiveHint (can change or delete external state), idempotentHint (calling twice is safe), openWorldHint (interacts with external sites). Each tool section below adds its parameters and a usage note.

Starts a session on a supported site and returns the landing screen: session_id, the current screen, and available_actions with full parameter schemas. Read available_actions before calling dispatch_action; it is the source of truth for what the site can do.

Rate limited per user per hour.

Usage note: treat a site as unavailable only when the response is screen: "unsupported_site" with no capture_url. Then stop calling Rindler tools for that domain and do not retry start_session.

Executes one action on the current session, using an action name and params from the previous response's available_actions. Returns the new screen state and a fresh action set.

This is the one tool that changes external site state: it submits forms, orders, messages, and applications, and replays re-execute.

Usage note: never invent action names or params. Use only names from the latest available_actions or global_actions, and pass params exactly as each schema describes. For variants (submit_contact_form, submit_contact_form__v2), choose by form_label, not the __vN suffix.

Reads structured data from the current page. With an extraction schema for the current screen it returns parsed records as listings or listing fields, plus a filters array of the page's live filter controls on faceted screens. It falls back to a raw ARIA accessibility tree only when no schema is registered; structured records come first, the raw tree is the last resort by design.

Usage note: a screen's filters are not static. They change with context (a marketplace's vehicle category adds make, model, and year), so re-read filters from the current page instead of assuming a fixed set.

Reads text from a PDF linked from a page (course catalogs, tuition sheets, policy documents). Returns text per page with 1-based page numbers plus page_count, the document's true length even when you ask for a subset. It fetches the URL anonymously and sends no cookies, so it reads only what a signed-out visitor could; a PDF behind a login is not yet supported.

Usage note: do not navigate to a PDF and call extract_content on it; a PDF has no accessibility tree, so the page looks empty. Use extract_document with the URL, and narrow long documents with query or pages. On failure it returns a stable error_code (not_a_pdf, pdf_no_text_layer, document_too_large, fetch_failed, and others); see Errors.

Closes a session and releases its browser. Call it as soon as the user's task on that site is complete so the browser frees immediately instead of waiting for the idle timeout.

Usage note: closing an already-closed or unknown session_id is a safe no-op. Close promptly.

Generates an OAuth 2.0 PKCE authorization URL for a site.

Usage note: normally you do not call this yourself. Your runtime's first tool call returns an authorization link it opens in the browser, with no API key and nothing to paste. If you mint a URL directly, present it right away. The pending state expires after 10 minutes.

Blocks until the user has finished signing into an auth-gated site, then reports whether the login session is ready. Use it after start_session (or an authed dispatch_action) returns a capture_url and an auth_context saying the user must sign in: share the capture_url, then loop await_auth until it returns status "captured". Output is { "status": "pending" | "captured", "site": "<domain>" }.

Usage note: it does not sign the user in, only reports readiness. Loop on "pending" until "captured", then re-dispatch the action. Capture links expire after 15 minutes, so always use the capture_url from the most recent response.

Views and clears the logins the user is signed into. Each entry is a durable saved login (ephemeral=false, signs in automatically on the next visit) or a temporary live session (ephemeral=true) that expires on its own. No credential or cookie values are ever returned, only non-secret metadata.

Usage note: temporary live sessions are never cleared by either action; they expire on their own. A missing_user_id error means the user is not signed in and cookie management is unavailable.

Stores and recalls durable agent memory across runs, scoped to the signed-in user. No other user's memory is ever returned.

Usage note: recalled items are point-in-time observations. Verify any load-bearing claim against the current state of the site or code before acting on it.

Some mapped actions capture a file (a CSV or PDF export, a statement, a transaction history). When a dispatch_action result's data contains a download object, the file was captured server-side, not on the user's machine.

• data.download.url present: a direct, no-login link that serves the file and expires in about 30 minutes. Surface it to the user immediately (for example a Markdown link named with data.download.filename), not manual steps.
• data.download present but no url: the file was captured, but a link could not be generated. Say so; do not fabricate a link.
• error_code download_capture_failed or download_capture_unsupported: the download triggered in the remote browser but could not be retrieved or delivered. It did not succeed and is not in the user's downloads folder. Report the error and offer to retry. Both codes are on the Errors page.

A response may include a handoff_available object with provider, capability, target_url, target_supported, and reason. It means the current screen embeds a third-party flow with its own deterministic mapping, for example a restaurant site whose ordering runs on an embedded ordering platform.

• target_supported: true: the embedded flow has its own Rindler config. Tell the user the option exists, then call start_session with target_url to switch into it; discard the original session.
• target_supported: false: the option exists but has no config yet. Surface that honestly and continue the current session; start_session on the target would just return unsupported_site.
• The target_url in the object is the only valid handoff target. Never invent one.

The server also registers a small set of internal and admin tools (schema synthesis, fleet introspection). Normal user tokens cannot call them; they are not part of the public surface and are not documented here.

• Set up in one command and run a first task: Quick Start.
• Stable error codes returned by the tools and how to handle each: Errors.