Skip to main content

​
Browser Tool

The browser_open tool enables the agent to open URLs in the Brave browser with strict domain allowlisting.
This tool is opt-in and disabled by default for security.

​
Configuration

[browser]
enabled = true
allowed_domains = ["docs.rs", "github.com", "stackoverflow.com"]
Security requirement: You must specify allowed domains. Empty list = tool disabled.

​
Parameters

​
url
string
required
Full URL to open in the browser

​
Usage

{
  "name": "browser_open",
  "arguments": {
    "url": "https://docs.rs/tokio"
  }
}
Result: 
{
  "success": true,
  "output": "Opened URL in browser: https://docs.rs/tokio",
  "error": null
}

​
Domain Validation

From src/tools/browser_open.rs: 
fn is_domain_allowed(url: &str, allowed: &[String]) -> bool {
    let parsed = Url::parse(url)?;
    let domain = parsed.domain()?;
    
    allowed.iter().any(|allowed_domain| {
        domain == allowed_domain || 
        domain.ends_with(&format!(".{}", allowed_domain))
    })
}

​
Subdomain Matching

Allowlisting github.com also allows:
  • github.com
  • api.github.com
  • raw.githubusercontent.com

​
Platform Support

PlatformMethodBinary
macOSopen command/usr/bin/open
Linuxbrave-browser or xdg-open/usr/bin/brave-browser
Windowsstart commandcmd.exe /c start

​
Common Use Cases

​
Documentation Lookup

{"url": "https://docs.rs/tokio/latest/tokio/"}

​
Issue Tracking

{"url": "https://github.com/dallay/corvus/issues/42"}

​
Stack Overflow Reference

{"url": "https://stackoverflow.com/questions/12345678"}

​
Error Handling

​
Blocked Domain

// Input
{"url": "https://malicious-site.com"}

// Output
{
  "success": false,
  "output": "",
  "error": "Domain not in allowed list: malicious-site.com"
}

​
Invalid URL

{
  "success": false,
  "output": "",
  "error": "Invalid URL format"
}

​
Browser Not Found

{
  "success": false,
  "output": "",
  "error": "Brave browser not found. Install from https://brave.com"
}

​
Implementation Reference

Source: src/tools/browser_open.rs 
pub struct BrowserOpenTool {
    allowed_domains: Vec<String>,
}

#[async_trait]
impl Tool for BrowserOpenTool {
    fn name(&self) -> &str { "browser_open" }
    
    async fn execute(&self, args: Value) -> Result<ToolResult> {
        let url = args["url"].as_str()?;
        
        // Validate domain
        if !is_domain_allowed(url, &self.allowed_domains) {
            return Err("Domain not allowed");
        }
        
        // Open in browser
        #[cfg(target_os = "macos")]
        Command::new("open").arg(url).spawn()?;
        
        #[cfg(target_os = "linux")]
        Command::new("brave-browser").arg(url).spawn()?;
        
        Ok(ToolResult::success(format!("Opened: {url}")))
    }
}

​
Security Considerations

Never allowlist: Top-level domains (*.com), wildcard patterns (*), or untrusted sites.
Start with a minimal allowlist and add domains as needed. Each domain increases attack surface.
For development environments: 
[browser]
allowed_domains = [
    "docs.rs",
    "doc.rust-lang.org",
    "github.com",
    "stackoverflow.com",
    "localhost",
]
For production: 
[browser]
enabled = false  # disable unless required

​
Alternatives

If you need programmatic web access without opening a browser, use:
  • http_request tool (fetch and parse HTML/JSON)
  • web_search_tool (search engine integration)