Assistants and MCP
Grants and approvals
Grant by capability, not all or nothing. Choose the context, the access classes and when Arx asks before a change.
This page is a first draft. It may change before the public beta.
Every client has three settings in Settings → Advanced → Local assistants (MCP): which context it can see, which access classes it holds, and when Arx asks before a change. Reading tabs, taking screenshots, reading pages and clicking on them are separate permissions, and each assistant sees only the tools its grant covers.
Open a client's grant, add the Work space, turn on Page content and Interact with pages, and switch approval from Every time to Only for closing or removing.
Context
Permitted context is a list of profiles, spaces and tabs.
- A profile grant covers all of its spaces, folders, tabs and Favorites, including spaces created later.
- A space grant covers its folders and tabs.
- Favorites otherwise need their own tab grants.
- Private windows are never exposed.
Some classes only work with whole-profile grants: history, downloads, and managing spaces and profiles.
Allow the focused tab shortcut lets the assistant say “the focused tab” instead of naming one: it passes "focused" as both targetID and expectedRevision. Arx picks the selected tab of the focused window when the tool runs, only if your grant covers it, and tells the assistant which tab it used.
Access classes
| Setting in Arx | Class | What it allows |
|---|---|---|
| Read browser organization | read | Lists the granted spaces, folders and tabs with sanitized URLs, and waits for pages to finish loading. Every other class also needs this one. |
| Allow page screenshots | screenshots | Viewport, region, element and full-page screenshots. They include visible page content and embedded frames. |
| Read page text and semantic elements | pageContent | Bounded text and semantic snapshots of permitted pages, PDF export and PDF text. Form values and password subtrees are left out. |
| Interact with pages | interact | Clicks, typing, text replacement, option selection, key presses, scrolling, hovering, dragging, page dialogs and media controls. Needs page content too. |
| Organize tabs and folders | organize | Opens, navigates, moves, pins, renames and closes tabs and folders, opens Peek and Little Arx, manages Split View and restores archived tabs. |
| Manage profiles and spaces | browserAdmin | Creates, renames, reorders and deletes spaces and profiles. Deleting a profile erases its browsing data. Needs a whole-profile grant. |
| Search browsing history | history | Searches visited pages of whole-profile grants. URLs drop query and fragment; titles can still be private. |
| See and control downloads | downloads | Lists downloads of whole-profile grants, cancels them and shows finished files in Finder. Private downloads never appear. |
| Upload files | files | Answers file choosers a page opens with files from your Mac. Every upload still asks you, showing each file. |
| Allow sign-in requests | signIn | The assistant can ask you to sign in. See Sign-ins stay with you. |
There is no class for running JavaScript, reading the clipboard, reading saved passwords or touching the file system, and no tool for them.
When Arx asks
Ask before changes is a standing choice that survives restarts. Arx decides how risky each action is, never the assistant. Reading never asks.
| Setting | Policy | What happens |
|---|---|---|
| Every time | alwaysAsk | Every change waits for you, unless you allow scoped commands for 15 minutes. |
| Only for closing or removing | destructiveOnly | Changes run. Closing tabs, deleting folders, spaces, profiles and saved entries still ask. |
| Never | never | No action asks. The grant stands until you change it. |
When a change needs approval, Arx shows Assistant requests a browser change with the action, its target and any warning, and you choose Allow once or Decline. Allow scoped commands for 15 minutes gives a temporary pass; Require approval again ends it early.
Two things ask every time, whatever the policy:
- Uploading files. Arx shows every path.
- Accepting a page dialog or permission request, including any text sent to a prompt.
A batch of up to 16 steps asks once for the whole list: One approval covers exactly these steps, in this order.
Activity
Recent activity lists operation names and outcomes, up to 128 entries for the current app session. Page text, typed text and field values are never logged.