diff --git a/.cursor-plugin/plugin.json b/.cursor-plugin/plugin.json
index 14094e79..d3089608 100644
--- a/.cursor-plugin/plugin.json
+++ b/.cursor-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
   "name": "devtools-for-agents",
   "description": "Help your agent build, debug, and verify your code correctly. With Chrome DevTools for agents, your AI agent can interact with the Chrome browser to test code, emulate users, and catch bugs using Chrome DevTools’ capabilities before shipping.",
-  "version": "1.7.0",
+  "version": "1.9.0",
   "author": {
     "name": "Google Chrome"
   },
@@ -12,7 +12,7 @@
     "chrome-devtools": {
       "command": "npx",
       "args": [
-        "chrome-devtools-mcp@1.7.0"
+        "chrome-devtools-mcp@1.9.0"
       ]
     }
   }
diff --git a/.gitattributes b/.gitattributes
index f133a008..e2e3fdb9 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -28,6 +28,7 @@ src/version.ts                         merge=opera-ours
 # Generated artifacts: never hand-merge, always `npm run gen` after the merge.
 package-lock.json                      merge=opera-ours
 docs/tool-reference.md                 merge=opera-ours
-src/bin/chrome-devtools-cli-options.ts merge=opera-ours
+docs/configuration.md                  merge=opera-ours
+src/config/cli-options.ts              merge=opera-ours
 src/telemetry/tool_call_metrics.json   merge=opera-ours
 src/telemetry/flag_usage_metrics.json  merge=opera-ours
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index cd95af73..9080f1b3 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -61,5 +61,5 @@ updates:
     ignore:
       # Ignore tagged releases to fall back to branch commits.
       # Untagged commits get versions like `0.0.0-0.<index>`.
-      - dependency-name: 'devtools-frontend'
+      - dependency-name: 'third_party/devtools-frontend'
         versions: ['> 0.0.0']
diff --git a/.prettierignore b/.prettierignore
index d41b0d3f..85b7594e 100644
--- a/.prettierignore
+++ b/.prettierignore
@@ -3,8 +3,10 @@ CHANGELOG.md
 src/third_party/lighthouse-devtools-mcp-bundle.js
 third_party/devtools-frontend
 
-# Release-please formatting brakes CI checks
+# Release-please formatting breaks CI checks
 .claude-plugin/plugin.json
 .cursor-plugin/plugin.json
 .github/plugin/plugin.json
 gemini-extension.json
+mcp.json
+plugin.json
diff --git a/SECURITY.md b/SECURITY.md
index 2757452a..56044db7 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -1,12 +1,12 @@
 ## Security policy
 
-The Chrome DevTools MCP project takes security very seriously. Please use [Chromium’s process to report security issues](https://www.chromium.org/Home/chromium-security/reporting-security-bugs/).
+The Chrome DevTools MCP project takes security very seriously. Please use [Google Open Source Software Vulnerability Reward Program](https://bughunters.google.com/about/rules/open-source/google-open-source-software-vulnerability-reward-program-rules) to report any security issues.
 
 ### Scope
 
 In general, it is the expectation that the AI agent or client using this MCP server validates any input (including tool calls and parameters) before sending it. The server provides powerful capabilities for browser automation and inspection, and it is the responsibility of the calling agent to ensure these are used safely and as intended.
 
-Several tools in this project have the ability to perform actions such as writing files to disk (e.g., via browser downloads or screenshots) or dynamically loading Chrome extensions. These are intentional, documented features and are not vulnerabilities.
+Several tools in this project have the ability to perform actions such as writing files to disk (e.g., via browser downloads or screenshots), loading source maps, or dynamically loading Chrome extensions. These are intentional, documented features and are not vulnerabilities.
 
 The server returns web content to the client as text (Markdown-like) or
 structured data (`--experimentalStructuredContent`). The web content is returned
@@ -26,5 +26,5 @@ filesystem sandboxing, we recommend using OS sandbox mechanisms.
 
 ### Network guardrails
 
-Optional `--allowed-url-pattern` and `--blocked-url-pattern` arguments configure the browser to reject access to the identified URLs. Note that this is not a complete network sandbox and it only applies to Chrome DevTools targets while `chrome-devtools-mcp` is attached to them.
+Optional `--allowed-url-pattern` and `--blocked-url-pattern` arguments configure the **browser** to reject access to the identified URLs. Note that this is not a complete network sandbox and it only applies to Chrome DevTools targets while `chrome-devtools-mcp` is attached to them.
 To have a full network sandbox, we recommend using a separate OS/VM sandbox mechanism.
diff --git a/docs/UPSTREAM.md b/docs/UPSTREAM.md
index 753bb15f..d29d49cc 100644
--- a/docs/UPSTREAM.md
+++ b/docs/UPSTREAM.md
@@ -6,7 +6,7 @@
 This document is the registry of every intentional divergence from upstream.
 `scripts/verify-upstream-seam.ts` enforces it: unregistered drift in an upstream-owned file fails CI.
 
-- Current fork base: `ec014d1` (upstream, v1.7.0).
+- Current fork base: `7a46acf` (upstream, v1.9.0).
 - Upstream remote: `git remote add upstream https://github.com/ChromeDevTools/chrome-devtools-mcp.git`
 
 ## Intake runbook
@@ -89,7 +89,9 @@ a result:
 | `src/daemon/utils.ts`                                          | App name + index script path from branding                                                                                                                                   | yes                               |
 | `src/utils/check-for-updates.ts`                               | Env key + cache dir from branding                                                                                                                                            | yes                               |
 | `src/bin/check-latest-version.ts`                              | Package name from branding (keep upstream's `getRegistry()`)                                                                                                                 | yes                               |
-| `src/bin/chrome-devtools-mcp-cli-options.ts`                   | Branding strings; `performanceCrux` + `usageStatistics` default/help text from `opera/policy.ts`                                                                             | yes                               |
+| `src/config/mcp-options.ts`                                    | Branding strings; `performanceCrux` + `usageStatistics` default/help text from `opera/policy.ts`                                                                             | yes                               |
+| `src/config/browser-options.ts`                                | Branding references (`REPO_URL`, `CACHE_DIR_NAME`, `MCP_BIN_NAME`) in the browser-option help text                                                                           | yes                               |
+| `src/config/category-options.ts`                               | Adds the `ToolCategory.OPERA` entry so the generated category flags include `categoryOpera`                                                                                  | yes                               |
 | `src/bin/chrome-devtools-mcp-main.ts`                          | Branding strings; calls `enforceTelemetryPolicy()` from `opera/policy.ts`                                                                                                    | yes                               |
 | `src/bin/chrome-devtools-mcp.ts`, `src/bin/chrome-devtools.ts` | Branding strings                                                                                                                                                             | yes                               |
 | `src/telemetry/transformation.ts`                              | Adds `ZodRecord` to the supported telemetry zod types (used by `parameters` on `opera_call_mcp_tool`); maps it to a `_count` metric                                          | yes                               |
@@ -104,16 +106,17 @@ These are name changes, not behaviour changes: the fork's binary, package and en
 so the assertion strings do too. A test that needs a behavioural change indicates the seam is in the
 wrong place.
 
-| Path                                     | Divergence                                                                                                   |
-| ---------------------------------------- | ------------------------------------------------------------------------------------------------------------ |
-| `tests/utils.ts`                         | `CLI_PATH` and the daemon status strings use the Opera names                                                 |
-| `tests/index.test.ts`                    | Opera bin path + env var key                                                                                 |
-| `tests/cli.test.ts`                      | Opera package name; `performanceCrux`/`usageStatistics` expected to default to `false`                       |
-| `tests/utils/check-for-updates.test.ts`  | Opera env var key; drops upstream's downgrade case (see `src/utils/check-for-updates.ts`)                    |
-| `tests/daemon/utils.test.ts`             | `APP_NAME` uses the Opera package name                                                                       |
-| `tests/ToolHandler.test.ts`              | Opera env var keys, plus coverage for the `OperaToolHooks` seam                                              |
-| `tests/telemetry/transformation.test.ts` | Adds coverage for `ZodRecord` telemetry handling (count of record keys)                                      |
-| `tests/McpPage.test.ts`                  | Adds coverage for `resolveElementHandle` distinguishing a rejected lookup from a resolved-but-absent element |
+| Path                                        | Divergence                                                                                                     |
+| ------------------------------------------- | -------------------------------------------------------------------------------------------------------------- |
+| `tests/utils.ts`                            | `CLI_PATH` and the daemon status strings use the Opera names                                                   |
+| `tests/cli.test.ts`                         | Opera package name; `performanceCrux`/`usageStatistics` default to `false`; `categoryOpera` flag on by default |
+| `tests/index.test.ts`                       | Opera bin path + env var key                                                                                   |
+| `tests/utils/check-for-updates.test.ts`     | Opera env var key; drops upstream's downgrade case (see `src/utils/check-for-updates.ts`)                      |
+| `tests/daemon/utils.test.ts`                | `APP_NAME` uses the Opera package name                                                                         |
+| `tests/ToolHandler.test.ts`                 | Opera env var keys, plus coverage for the `OperaToolHooks` seam                                                |
+| `tests/telemetry/transformation.test.ts`    | Adds coverage for `ZodRecord` telemetry handling (count of record keys)                                        |
+| `tests/McpPage.test.ts`                     | Adds coverage for `resolveElementHandle` distinguishing a rejected lookup from a resolved-but-absent element   |
+| `tests/e2e/opera-devtools-commands.test.ts` | Inline assertion strings use `opera-devtools` binary name in restart-command suggestions                       |
 
 ### Upstream files we rename or delete
 
@@ -122,17 +125,19 @@ resolve by hand, keeping the Opera side. Git leaves upstream's copy in the tree
 reflexive `git add -A` brings the file back — `npm run verify-upstream-seam` fails if any path in
 this table reappears.
 
-| Path                                                                                                                                                                                      | What we did                                                                     |
-| ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------- |
-| `tests/e2e/chrome-devtools-commands.test.ts`, `tests/e2e/chrome-devtools-disclaimers.test.ts`, `tests/e2e/chrome-devtools-start-stop.test.ts`, `tests/e2e/chrome-devtools-status.test.ts` | Renamed to `opera-devtools-*`; they drive the Opera-named bin                   |
-| `tests/e2e/telemetry.test.ts`                                                                                                                                                             | Deleted — Opera forces telemetry off, so there is no upload path left to assert |
-| `AGENTS.md`                                                                                                                                                                               | Deleted in favour of Opera's own agent docs                                     |
-| `server.json`, `scripts/verify-server-json-version.ts`, `.github/workflows/publish-to-mcp-registry-on-tag.yml`                                                                            | Deleted — the fork publishes to npm only, never to the MCP registry             |
+| Path                                                                                                                                                                                      | What we did                                                                         |
+| ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------- |
+| `tests/e2e/chrome-devtools-commands.test.ts`, `tests/e2e/chrome-devtools-disclaimers.test.ts`, `tests/e2e/chrome-devtools-start-stop.test.ts`, `tests/e2e/chrome-devtools-status.test.ts` | Renamed to `opera-devtools-*`; they drive the Opera-named bin                       |
+| `tests/e2e/telemetry.test.ts`                                                                                                                                                             | Deleted — Opera forces telemetry off, so there is no upload path left to assert     |
+| `AGENTS.md`                                                                                                                                                                               | Deleted in favour of Opera's own agent docs                                         |
+| `server.json`, `scripts/verify-server-json-version.ts`, `.github/workflows/publish-to-mcp-registry-on-tag.yml`                                                                            | Deleted — the fork publishes to npm only, never to the MCP registry                 |
+| `.release-please-manifest.json`, `release-please-config.json`                                                                                                                             | Deleted — the fork releases via its own publish-on-tag workflow, not release-please |
 
 ### Generated — never hand-merge, always regenerate
 
-`src/bin/chrome-devtools-cli-options.ts`, `src/telemetry/tool_call_metrics.json`,
-`src/telemetry/flag_usage_metrics.json`, `docs/tool-reference.md`, `package-lock.json`.
+`src/config/cli-options.ts`, `src/telemetry/tool_call_metrics.json`,
+`src/telemetry/flag_usage_metrics.json`, `docs/tool-reference.md`, `docs/configuration.md`,
+`package-lock.json`.
 
 ### Opera-owned prose / config (merge=opera-ours)
 
diff --git a/docs/advanced-usage.md b/docs/advanced-usage.md
new file mode 100644
index 00000000..0e95bde6
--- /dev/null
+++ b/docs/advanced-usage.md
@@ -0,0 +1,172 @@
+# Advanced usage
+
+## Concurrent sessions
+
+Most MCP clients start one Chrome DevTools MCP server per conversation. If your
+client shares a single server instance across concurrent agents or subagents,
+start the server with `--experimentalPageIdRouting`. This exposes `pageId` on
+page-scoped tools so each agent can route tool calls to the tab it is working
+with.
+
+```json
+{
+  "mcpServers": {
+    "chrome-devtools": {
+      "command": "npx",
+      "args": [
+        "-y",
+        "chrome-devtools-mcp@latest",
+        "--experimentalPageIdRouting"
+      ]
+    }
+  }
+}
+```
+
+If you run multiple independent MCP client sessions and want each session to
+launch its own temporary Chrome profile, also pass `--isolated`. This avoids
+sharing the default Chrome DevTools MCP user data directory between those
+server instances.
+
+## User data directory
+
+By default, `chrome-devtools-mcp` starts a Chrome's stable channel instance using the following user
+data directory:
+
+- Linux / macOS: `$HOME/.cache/chrome-devtools-mcp/chrome-profile`
+- Windows: `%USERPROFILE%\.cache\chrome-devtools-mcp\chrome-profile`
+
+For non-stable channels, the channel name is appended to the directory name, for example
+`chrome-profile-canary`.
+
+The user data directory is not cleared between runs and is reused for subsequent
+runs with the same channel. Only one browser can use it at a time. Set the `isolated`
+option to `true` to use a temporary user data directory instead which will be cleared
+automatically after the browser is closed.
+
+## Connecting to a running Chrome instance
+
+By default, the Chrome DevTools MCP server will start a new Chrome instance with a dedicated profile. This might not be ideal in all situations:
+
+- If you would like to maintain the same application state when alternating between manual site testing and agent-driven testing.
+- When the MCP needs to sign into a website. Some accounts may prevent sign-in when the browser is controlled via WebDriver (the default launch mechanism for the Chrome DevTools MCP server).
+- If you're running your LLM inside a sandboxed environment, but you would like to connect to a Chrome instance that runs outside the sandbox.
+
+In these cases, start Chrome first and let the Chrome DevTools MCP server connect to it. There are two ways to do so:
+
+- **Automatic connection (available in Chrome 144)**: best for sharing state between manual and agent-driven testing.
+- **Manual connection via remote debugging port**: best when running inside a sandboxed environment.
+
+### Automatically connecting to a running Chrome instance
+
+**Step 1:** Set up remote debugging in Chrome
+
+In Chrome (\>= M144), do the following to set up remote debugging:
+
+1.  Navigate to `chrome://inspect/#remote-debugging` to enable remote debugging.
+2.  Follow the dialog UI to allow or disallow incoming debugging connections.
+
+**Step 2:** Configure Chrome DevTools MCP server to automatically connect to a running Chrome Instance
+
+To connect the `chrome-devtools-mcp` server to the running Chrome instance, use
+`--autoConnect` command line argument for the MCP server.
+
+The following code snippet is an example configuration for gemini-cli:
+
+```json
+{
+  "mcpServers": {
+    "chrome-devtools": {
+      "command": "npx",
+      "args": ["chrome-devtools-mcp@latest", "--autoConnect"]
+    }
+  }
+}
+```
+
+**Step 3:** Test your setup
+
+Make sure your browser is running. Open gemini-cli and run the following prompt:
+
+```none
+Check the performance of https://developers.chrome.com
+```
+
+> [!NOTE]
+> The <code>autoConnect</code> option requires the user to start Chrome. If the user has multiple active profiles, the MCP server will connect to the default profile (as determined by Chrome). The MCP server has access to all open windows for the selected profile.
+
+The Chrome DevTools MCP server will try to connect to your running Chrome
+instance. It shows a dialog asking for user permission.
+
+Clicking **Allow** results in the Chrome DevTools MCP server opening
+[developers.chrome.com](http://developers.chrome.com) and taking a performance
+trace.
+
+### Manual connection using port forwarding
+
+You can connect to a running Chrome instance by using the `--browser-url` option. This is useful if you are running the MCP server in a sandboxed environment that does not allow starting a new Chrome instance.
+
+Here is a step-by-step guide on how to connect to a running Chrome instance:
+
+**Step 1: Configure the MCP client**
+
+Add the `--browser-url` option to your MCP client configuration. The value of this option should be the URL of the running Chrome instance. `http://127.0.0.1:9222` is a common default.
+
+```json
+{
+  "mcpServers": {
+    "chrome-devtools": {
+      "command": "npx",
+      "args": [
+        "chrome-devtools-mcp@latest",
+        "--browser-url=http://127.0.0.1:9222"
+      ]
+    }
+  }
+}
+```
+
+**Step 2: Start the Chrome browser**
+
+> [!WARNING]
+> Enabling the remote debugging port opens up a debugging port on the running browser instance. Any application on your machine can connect to this port and control the browser. Make sure that you are not browsing any sensitive websites while the debugging port is open.
+
+Start the Chrome browser with the remote debugging port enabled. Make sure to close any running Chrome instances before starting a new one with the debugging port enabled. The port number you choose must be the same as the one you specified in the `--browser-url` option in your MCP client configuration.
+
+For security reasons, [Chrome requires you to use a non-default user data directory](https://developer.chrome.com/blog/remote-debugging-port) when enabling the remote debugging port. You can specify a custom directory using the `--user-data-dir` flag. This ensures that your regular browsing profile and data are not exposed to the debugging session.
+
+**macOS**
+
+```bash
+/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --remote-debugging-port=9222 --user-data-dir=/tmp/chrome-profile-stable
+```
+
+**Linux**
+
+```bash
+/usr/bin/google-chrome --remote-debugging-port=9222 --user-data-dir=/tmp/chrome-profile-stable
+```
+
+**Windows**
+
+```bash
+"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --user-data-dir="%TEMP%\chrome-profile-stable"
+```
+
+**Step 3: Test your setup**
+
+After configuring the MCP client and starting the Chrome browser, you can test your setup by running a simple prompt in your MCP client:
+
+```
+Check the performance of https://developers.chrome.com
+```
+
+Your MCP client should connect to the running Chrome instance and receive a performance report.
+
+If you hit VM-to-host port forwarding issues, see the “Remote debugging between virtual machine (VM) and host fails” section in [`troubleshooting.md`](./troubleshooting.md#remote-debugging-between-virtual-machine-vm-and-host-fails).
+
+For more details on remote debugging, see the [Chrome DevTools documentation](https://developer.chrome.com/docs/devtools/remote-debugging/).
+
+## Debugging Chrome on Android
+
+Please consult [these instructions](./debugging-android.md).
diff --git a/docs/cli.md b/docs/cli.md
index a0d8d291..af7a664c 100644
--- a/docs/cli.md
+++ b/docs/cli.md
@@ -11,6 +11,16 @@ npm i chrome-devtools-mcp@latest -g
 chrome-devtools status # check if install worked.
 ```
 
+The CLI enables unrestricted filesystem access by default. Use `--workspace`
+to limit file tools to specific directories. Repeat the flag for more than one
+directory.
+`--allow-unrestricted-paths` still works on its own for compatibility, but it
+cannot be combined with `--workspace`.
+
+```sh
+chrome-devtools start --workspace=/path/to/project --workspace=/path/to/output
+```
+
 ## How it works
 
 The CLI acts as a client to a background `chrome-devtools-mcp` daemon (uses Unix sockets on Linux/Mac and named pipes on Windows).
@@ -23,11 +33,11 @@ The CLI acts as a client to a background `chrome-devtools-mcp` daemon (uses Unix
 # Check if the daemon is running
 chrome-devtools status
 
-# Navigate the current page to a URL
-chrome-devtools navigate_page "https://google.com"
+# Navigate page 1 to a URL
+chrome-devtools navigate_page 1 --url "https://google.com"
 
-# Take a screenshot and save it to a file
-chrome-devtools take_screenshot --filePath screenshot.png
+# Take a screenshot of page 1 and save it to a file
+chrome-devtools take_screenshot 1 --filePath screenshot.png
 
 # Stop the background daemon when finished
 chrome-devtools stop
@@ -42,7 +52,7 @@ Thus, `--categoryExtensions` tools are currently not available in the CLI.
 chrome-devtools <tool> [arguments] [flags]
 ```
 
-- **Required Arguments**: Passed as positional arguments.
+- **Required Arguments**: Passed as positional arguments. Page-scoped tools require `<pageId>` as their first positional argument.
 - **Optional Arguments**: Passed as flags (e.g., `--filePath`, `--fullPage`).
 
 ### Examples
@@ -51,24 +61,38 @@ chrome-devtools <tool> [arguments] [flags]
 
 ```sh
 chrome-devtools new_page "https://example.com"
-chrome-devtools navigate_page "https://web.dev" --type url
+chrome-devtools navigate_page 1 --url "https://web.dev"
 ```
 
 **Interaction:**
 
 ```sh
-# Click an element by its UID from a snapshot
-chrome-devtools click "element-uid-123"
+# Click an element by its UID from a snapshot on page 1
+chrome-devtools click 1 "element-uid-123"
+
+# Fill a form field on page 1
+chrome-devtools fill 1 "input-uid-456" "search query"
+```
+
+**Script Evaluation:**
+
+- When `--categoryExtensions` and `--pageIdRouting` are enabled:
+  - Target a page using `--pageId <number>`: `chrome-devtools evaluate_script "() => document.title" --pageId 1`
+  - Target an extension service worker using `--serviceWorkerId <string>`: `chrome-devtools evaluate_script "() => self.registration.scope" --serviceWorkerId sw-1`
+
+```sh
+# Evaluate a JavaScript expression on page 1
+chrome-devtools evaluate_script "() => document.title" --pageId 1
 
-# Fill a form field
-chrome-devtools fill "input-uid-456" "search query"
+# Evaluate inside an extension service worker
+chrome-devtools evaluate_script "() => self.registration.scope" --serviceWorkerId sw-1
 ```
 
 **Analysis:**
 
 ```sh
-# Run a Lighthouse audit (defaults to navigation mode)
-chrome-devtools lighthouse_audit --mode snapshot
+# Run a Lighthouse audit on page 1 (defaults to navigation mode)
+chrome-devtools lighthouse_audit 1 --mode snapshot
 ```
 
 ## Output format
diff --git a/docs/client-configurations.md b/docs/client-configurations.md
new file mode 100644
index 00000000..634a9375
--- /dev/null
+++ b/docs/client-configurations.md
@@ -0,0 +1,406 @@
+# MCP Client configuration
+
+<!--
+When adding a new client configuration, make sure to add it in alphabetical order.
+-->
+
+<details>
+  <summary>Amp</summary>
+  Follow https://ampcode.com/manual#mcp and use the config provided above. You can also install the Chrome DevTools MCP server using the CLI:
+
+```bash
+amp mcp add chrome-devtools -- npx chrome-devtools-mcp@latest
+```
+
+</details>
+
+<details>
+  <summary>Antigravity</summary>
+
+To use the Chrome DevTools MCP server follow the instructions from <a href="https://antigravity.google/docs/mcp">Antigravity's docs</a> to install a custom MCP server. Add the following config to the MCP servers config:
+
+```bash
+{
+  "mcpServers": {
+    "chrome-devtools": {
+      "command": "npx",
+      "args": [
+        "-y",
+        "chrome-devtools-mcp@latest",
+        "--browser-url=http://127.0.0.1:9222"
+      ]
+    }
+  }
+}
+```
+
+This will make the Chrome DevTools MCP server automatically connect to the browser that Antigravity is using. If you are not using port 9222, make sure to adjust accordingly.
+
+Chrome DevTools MCP will not start the browser instance automatically using this approach because the Chrome DevTools MCP server connects to Antigravity's built-in browser. If the browser is not already running, you have to start it first by clicking the Chrome icon at the top right corner.
+
+</details>
+
+<details>
+  <summary>Bob</summary>
+
+Follow the <a href="https://bob.ibm.com/docs/ide/configuration/mcp/mcp-in-bob">IBM Bob MCP guide</a> and add the Chrome DevTools MCP server to your Bob MCP configuration. Use the global config (`~/.bob/mcp.json`) to apply it across all workspaces, or a project config (`.bob/mcp.json`) to scope it to one project:
+
+```json
+{
+  "mcpServers": {
+    "chrome-devtools": {
+      "command": "npx",
+      "args": ["-y", "chrome-devtools-mcp@latest"]
+    }
+  }
+}
+```
+
+You can edit these files from **Bob panel → Settings → MCP → Edit Global MCP** (or **Edit Project MCP**). Bob hot-reloads on save. Once the server appears in the MCP tab, switch to the **🌎 Browser Dev** mode to get guided browser debugging directly in Bob.
+
+</details>
+
+<details>
+  <summary>Claude Code</summary>
+
+**Install via CLI (MCP only)**
+
+Use the Claude Code CLI to add the Chrome DevTools MCP server (<a href="https://code.claude.com/docs/en/mcp">guide</a>):
+
+```bash
+claude mcp add chrome-devtools --scope user npx chrome-devtools-mcp@latest
+```
+
+**Install as a Plugin (MCP + Skills)**
+
+> [!NOTE]
+> If you already had Chrome DevTools MCP installed previously for Claude Code, make sure to remove it first from your installation and configuration files.
+
+To install Chrome DevTools MCP with skills, add the marketplace registry in Claude Code:
+
+```sh
+/plugin marketplace add ChromeDevTools/chrome-devtools-mcp
+```
+
+Then, install the plugin:
+
+```sh
+/plugin install chrome-devtools-mcp@chrome-devtools-plugins
+```
+
+Restart Claude Code to have the MCP server and skills load (check with `/skills`).
+
+> [!TIP]
+> If the plugin installation fails with a `Failed to clone repository` error (e.g., HTTPS connectivity issues behind a corporate firewall), see the [troubleshooting guide](./troubleshooting.md#claude-code-plugin-installation-fails-with-failed-to-clone-repository) for workarounds, or use the CLI installation method above instead.
+
+</details>
+
+<details>
+  <summary>Cline</summary>
+  Follow https://docs.cline.bot/mcp/configuring-mcp-servers and use the config provided above.
+</details>
+
+<details>
+  <summary>Codex</summary>
+  Follow the <a href="https://developers.openai.com/codex/mcp/#configure-with-the-cli">configure MCP guide</a>
+  using the standard config from above. You can also install the Chrome DevTools MCP server using the Codex CLI:
+
+```bash
+codex mcp add chrome-devtools -- npx chrome-devtools-mcp@latest
+```
+
+**On Windows 11**
+
+Configure the Chrome install location and increase the startup timeout by updating `.codex/config.toml` and adding the following `env` and `startup_timeout_ms` parameters:
+
+```
+[mcp_servers.chrome-devtools]
+command = "cmd"
+args = [
+    "/c",
+    "npx",
+    "-y",
+    "chrome-devtools-mcp@latest",
+]
+env = { SystemRoot="C:\\Windows", PROGRAMFILES="C:\\Program Files" }
+startup_timeout_ms = 20_000
+```
+
+</details>
+
+<details>
+  <summary>Command Code</summary>
+
+Use the Command Code CLI to add the Chrome DevTools MCP server (<a href="https://commandcode.ai/docs/mcp">MCP guide</a>):
+
+```bash
+cmd mcp add chrome-devtools --scope user npx chrome-devtools-mcp@latest
+```
+
+</details>
+
+<details>
+  <summary>Copilot CLI</summary>
+
+Start Copilot CLI:
+
+```
+copilot
+```
+
+Start the dialog to add a new MCP server by running:
+
+```
+/mcp add
+```
+
+Configure the following fields and press `CTRL+S` to save the configuration:
+
+- **Server name:** `chrome-devtools`
+- **Server Type:** `[1] Local`
+- **Command:** `npx -y chrome-devtools-mcp@latest`
+
+</details>
+
+<details>
+  <summary>Copilot / VS Code</summary>
+
+**Install as a Plugin (Recommended)**
+
+The easiest way to get up and running is to install `chrome-devtools-mcp` as an agent plugin.
+This bundles the **MCP server** and all **skills** together, so your agent gets both the tools
+and the expert guidance it needs to use them effectively.
+
+1.  Open the **Command Palette** (`Cmd+Shift+P` on macOS or `Ctrl+Shift+P` on Windows/Linux).
+2.  Search for and run the **Chat: Install Plugin From Source** command.
+3.  Paste in our repository name: `ChromeDevTools/chrome-devtools-mcp`.
+
+That's it! Your agent is now supercharged with Chrome DevTools capabilities.
+
+---
+
+**Install as an MCP Server (MCP only)**
+
+**Click the button to install:**
+
+[<img src="https://img.shields.io/badge/VS_Code-VS_Code?style=flat-square&label=Install%20Server&color=0098FF" alt="Install in VS Code">](https://vscode.dev/redirect/mcp/install?name=io.github.ChromeDevTools%2Fchrome-devtools-mcp&config=%7B%22command%22%3A%22npx%22%2C%22args%22%3A%5B%22-y%22%2C%22chrome-devtools-mcp%22%5D%2C%22env%22%3A%7B%7D%7D)
+
+[<img src="https://img.shields.io/badge/VS_Code_Insiders-VS_Code_Insiders?style=flat-square&label=Install%20Server&color=24bfa5" alt="Install in VS Code Insiders">](https://insiders.vscode.dev/redirect?url=vscode-insiders%3Amcp%2Finstall%3F%257B%2522name%2522%253A%2522io.github.ChromeDevTools%252Fchrome-devtools-mcp%2522%252C%2522config%2522%253A%257B%2522command%2522%253A%2522npx%2522%252C%2522args%2522%253A%255B%2522-y%2522%252C%2522chrome-devtools-mcp%2522%255D%252C%2522env%2522%253A%257B%257D%257D%257D)
+
+**Or install manually:**
+
+Follow the VS Code [MCP configuration guide](https://code.visualstudio.com/docs/copilot/chat/mcp-servers#_add-an-mcp-server) using the standard config from above, or use the CLI:
+
+For macOS and Linux:
+
+```bash
+code --add-mcp '{"name":"io.github.ChromeDevTools/chrome-devtools-mcp","command":"npx","args":["-y","chrome-devtools-mcp"],"env":{}}'
+```
+
+For Windows (PowerShell):
+
+```powershell
+code --add-mcp '{"""name""":"""io.github.ChromeDevTools/chrome-devtools-mcp""","""command""":"""npx""","""args""":["""-y""","""chrome-devtools-mcp"""]}'
+```
+
+</details>
+
+<details>
+  <summary>Cursor</summary>
+
+**Click the button to install:**
+
+[<img src="https://cursor.com/deeplink/mcp-install-dark.svg" alt="Install in Cursor">](https://cursor.com/en/install-mcp?name=chrome-devtools&config=eyJjb21tYW5kIjoibnB4IC15IGNocm9tZS1kZXZ0b29scy1tY3BAbGF0ZXN0In0%3D)
+
+**Or install manually:**
+
+Go to `Cursor Settings` -> `MCP` -> `New MCP Server`. Use the config provided above.
+
+</details>
+
+<details>
+  <summary>Devin CLI</summary>
+
+**Install via CLI (MCP only)**
+
+Use the Devin CLI to add the Chrome DevTools MCP server (<a href="https://docs.devin.ai/cli/extensibility/mcp/configuration">guide</a>):
+
+```bash
+devin mcp add chrome-devtools -- npx chrome-devtools-mcp@latest
+```
+
+</details>
+
+<details>
+  <summary>Factory CLI</summary>
+Use the Factory CLI to add the Chrome DevTools MCP server (<a href="https://docs.factory.ai/cli/configuration/mcp">guide</a>):
+
+```bash
+droid mcp add chrome-devtools "npx -y chrome-devtools-mcp@latest"
+```
+
+</details>
+
+<details>
+  <summary>Gemini CLI</summary>
+Install the Chrome DevTools MCP server using the Gemini CLI.
+
+**Project wide:**
+
+```bash
+# Either MCP only:
+gemini mcp add chrome-devtools npx chrome-devtools-mcp@latest
+# Or as a Gemini extension (MCP+Skills):
+gemini extensions install --auto-update https://github.com/ChromeDevTools/chrome-devtools-mcp
+```
+
+**Globally:**
+
+```bash
+gemini mcp add -s user chrome-devtools npx chrome-devtools-mcp@latest
+```
+
+Alternatively, follow the <a href="https://github.com/google-gemini/gemini-cli/blob/main/docs/tools/mcp-server.md#how-to-set-up-your-mcp-server">MCP guide</a> and use the standard config from above.
+
+</details>
+
+<details>
+  <summary>Gemini Code Assist</summary>
+  Follow the <a href="https://cloud.google.com/gemini/docs/codeassist/use-agentic-chat-pair-programmer#configure-mcp-servers">configure MCP guide</a>
+  using the standard config from above.
+</details>
+
+<details>
+  <summary>Grok Build CLI</summary>
+
+```bash
+grok mcp add chrome-devtools npx chrome-devtools-mcp@latest
+```
+
+See the <a href="https://docs.x.ai/build/features/skills-plugins-marketplaces">docs</a> for more options
+</details>
+
+<details>
+  <summary>JetBrains AI Assistant & Junie</summary>
+
+Go to `Settings | Tools | AI Assistant | Model Context Protocol (MCP)` -> `Add`. Use the config provided above.
+The same way chrome-devtools-mcp can be configured for JetBrains Junie in `Settings | Tools | Junie | MCP Settings` -> `Add`. Use the config provided above.
+
+</details>
+
+<details>
+  <summary>Kiro</summary>
+
+In **Kiro Settings**, go to `Configure MCP` > `Open Workspace or User MCP Config` > Use the configuration snippet provided above.
+
+Or, from the IDE **Activity Bar** > `Kiro` > `MCP Servers` > `Click Open MCP Config`. Use the configuration snippet provided above.
+
+</details>
+
+<details>
+  <summary>Katalon Studio</summary>
+
+The Chrome DevTools MCP server can be used with <a href="https://docs.katalon.com/katalon-studio/studioassist/mcp-servers/setting-up-chrome-devtools-mcp-server-for-studioassist">Katalon StudioAssist</a> via an MCP proxy.
+
+**Step 1:** Install the MCP proxy by following the <a href="https://docs.katalon.com/katalon-studio/studioassist/mcp-servers/setting-up-mcp-proxy-for-stdio-mcp-servers">MCP proxy setup guide</a>.
+
+**Step 2:** Start the Chrome DevTools MCP server with the proxy:
+
+```bash
+mcp-proxy --transport streamablehttp --port 8080 -- npx -y chrome-devtools-mcp@latest
+```
+
+**Note:** You may need to pick another port if 8080 is already in use.
+
+**Step 3:** In Katalon Studio, add the server to StudioAssist with the following settings:
+
+- **Connection URL:** `http://127.0.0.1:8080/mcp`
+- **Transport type:** `HTTP`
+
+Once connected, the Chrome DevTools MCP tools will be available in StudioAssist.
+
+</details>
+
+<details>
+  <summary>Mistral Vibe</summary>
+
+Add in ~/.vibe/config.toml:
+
+```toml
+[[mcp_servers]]
+name = "chrome-devtools"
+transport = "stdio"
+command = "npx"
+args = ["chrome-devtools-mcp@latest"]
+```
+
+</details>
+
+<details>
+  <summary>OpenCode</summary>
+
+Add the following configuration to your `opencode.json` file. If you don't have one, create it at `~/.config/opencode/opencode.json` (<a href="https://opencode.ai/docs/mcp-servers">guide</a>):
+
+```json
+{
+  "$schema": "https://opencode.ai/config.json",
+  "mcp": {
+    "chrome-devtools": {
+      "type": "local",
+      "command": ["npx", "-y", "chrome-devtools-mcp@latest"]
+    }
+  }
+}
+```
+
+</details>
+
+<details>
+  <summary>Qoder</summary>
+
+In **Qoder Settings**, go to `MCP Server` > `+ Add` > Use the configuration snippet provided above.
+
+Alternatively, follow the <a href="https://docs.qoder.com/user-guide/chat/model-context-protocol">MCP guide</a> and use the standard config from above.
+
+</details>
+
+<details>
+  <summary>Qoder CLI</summary>
+
+Install the Chrome DevTools MCP server using the Qoder CLI (<a href="https://docs.qoder.com/cli/using-cli#mcp-servers">guide</a>):
+
+**Project wide:**
+
+```bash
+qodercli mcp add chrome-devtools -- npx chrome-devtools-mcp@latest
+```
+
+**Globally:**
+
+```bash
+qodercli mcp add -s user chrome-devtools -- npx chrome-devtools-mcp@latest
+```
+
+</details>
+
+<details>
+  <summary>Visual Studio</summary>
+
+**Click the button to install:**
+
+[<img src="https://img.shields.io/badge/Visual_Studio-Install-C16FDE?logo=visualstudio&logoColor=white" alt="Install in Visual Studio">](https://vs-open.link/mcp-install?%7B%22name%22%3A%22chrome-devtools%22%2C%22command%22%3A%22npx%22%2C%22args%22%3A%5B%22chrome-devtools-mcp%40latest%22%5D%7D)
+
+</details>
+
+<details>
+  <summary>Warp</summary>
+
+Go to `Settings | AI | Manage MCP Servers` -> `+ Add` to [add an MCP Server](https://docs.warp.dev/knowledge-and-collaboration/mcp#adding-an-mcp-server). Use the config provided above.
+
+</details>
+
+<details>
+  <summary>Windsurf</summary>
+  Follow the <a href="https://docs.windsurf.com/windsurf/cascade/mcp#mcp-config-json">configure MCP guide</a>
+  using the standard config from above.
+</details>
diff --git a/docs/configuration.md b/docs/configuration.md
new file mode 100644
index 00000000..f2d6da4e
--- /dev/null
+++ b/docs/configuration.md
@@ -0,0 +1,275 @@
+# Configuration
+
+The Chrome DevTools MCP server supports the following configuration option:
+
+<!-- BEGIN AUTO GENERATED OPTIONS -->
+
+- **`--categoryEmulation`/ `--category-emulation`**
+  Set to false to exclude tools related to emulation.
+  - **Type:** boolean
+  - **Default:** `true`
+
+- **`--categoryPerformance`/ `--category-performance`**
+  Set to false to exclude tools related to performance.
+  - **Type:** boolean
+  - **Default:** `true`
+
+- **`--categoryNetwork`/ `--category-network`**
+  Set to false to exclude tools related to network.
+  - **Type:** boolean
+  - **Default:** `true`
+
+- **`--categoryExtensions`/ `--category-extensions`**
+  Set to true to include tools related to extensions. Note: This feature is currently only supported with a pipe connection. autoConnect, browserUrl, and wsEndpoint are not supported with this feature until 149 will be released.
+  - **Type:** boolean
+  - **Default:** `false`
+
+- **`--categoryExperimentalThirdParty`/ `--category-experimental-third-party`**
+  Set to true to enable third-party developer tools exposed by the inspected page itself
+  - **Type:** boolean
+  - **Default:** `false`
+
+- **`--categoryPwa`/ `--category-pwa`**
+  Set to true to include tools for automating Progressive Web Apps (install, launch, uninstall, and OS state). This feature is only supported with a pipe connection; autoConnect, browserUrl, and wsEndpoint are not supported.
+  - **Type:** boolean
+  - **Default:** `false`
+
+- **`--autoConnect`/ `--auto-connect`**
+  If specified, automatically connects to a browser (Chrome 144+) running locally from the user data directory identified by the channel param (default channel is stable). Requires the remote debugging server to be started in the Chrome instance via chrome://inspect/#remote-debugging.
+  - **Type:** boolean
+  - **Default:** `false`
+
+- **`--browserUrl`/ `--browser-url`, `-u`**
+  Connect to a running, debuggable Chrome instance (e.g. `http://127.0.0.1:9222`). For more details see: https://github.com/operasoftware/opera-devtools-mcp#connecting-to-a-running-chrome-instance.
+  - **Type:** string
+  - **Default:** `false`
+
+- **`--wsEndpoint`/ `--ws-endpoint`, `-w`**
+  WebSocket endpoint to connect to a running Chrome instance (e.g., ws://127.0.0.1:9222/devtools/browser/<id>). Alternative to --browserUrl.
+  - **Type:** string
+  - **Default:** `false`
+
+- **`--wsHeaders`/ `--ws-headers`**
+  Custom headers for WebSocket connection in JSON format (e.g., '{"Authorization":"Bearer token"}'). Only works with --wsEndpoint.
+  - **Type:** string
+  - **Default:** `false`
+
+- **`--headless`**
+  Whether to run in headless (no UI) mode.
+  - **Type:** boolean
+  - **Default:** `false`
+
+- **`--executablePath`/ `--executable-path`, `-e`**
+  Path to custom Chrome executable.
+  - **Type:** string
+  - **Default:** `false`
+
+- **`--isolated`**
+  If specified, creates a temporary user-data-dir that is automatically cleaned up after the browser is closed. Defaults to false.
+  - **Type:** boolean
+  - **Default:** `false`
+
+- **`--userDataDir`/ `--user-data-dir`**
+  Path to the user data directory for Chrome. Default is $HOME/.cache/opera-devtools-mcp/chrome-profile$CHANNEL_SUFFIX_IF_NON_STABLE
+  - **Type:** string
+  - **Default:** `false`
+
+- **`--channel`**
+  Specify a different Chrome channel that should be used. The default is the stable channel version.
+  - **Type:** string
+  - **Choices:** `canary`, `dev`, `beta`, `stable`
+  - **Default:** `false`
+
+- **`--proxyServer`/ `--proxy-server`**
+  Proxy server configuration for Chrome passed as --proxy-server when launching the browser. See https://www.chromium.org/developers/design-documents/network-settings/ for details.
+  - **Type:** string
+  - **Default:** `false`
+
+- **`--chromeArg`/ `--chrome-arg`**
+  Additional arguments for Chrome. Only applies when Chrome is launched by opera-devtools-mcp.
+  - **Type:** array
+  - **Default:** `false`
+
+- **`--ignoreDefaultChromeArg`/ `--ignore-default-chrome-arg`**
+  Explicitly disable default arguments for Chrome. Only applies when Chrome is launched by opera-devtools-mcp.
+  - **Type:** array
+  - **Default:** `false`
+
+- **`--logFile`/ `--log-file`**
+  Path to a file to write debug logs to. Set the env variable `DEBUG` to `*` to enable verbose logs. Useful for submitting bug reports.
+  - **Type:** string
+  - **Default:** `false`
+
+- **`--viewport`**
+  Initial viewport size for the Chrome instances started by the server. For example, `1280x720`. In headless mode, max size is 3840x2160px.
+  - **Type:** string
+  - **Default:** `false`
+
+- **`--acceptInsecureCerts`/ `--accept-insecure-certs`**
+  If enabled, ignores errors relative to self-signed and expired certificates. Use with caution.
+  - **Type:** boolean
+  - **Default:** `false`
+
+- **`--pageIdRouting`/ `--page-id-routing`**
+  Require pageId on page-scoped tools and route requests by page ID (useful for concurrent agent sessions). Use --no-page-id-routing to disable.
+  - **Type:** boolean
+  - **Default:** `true`
+
+- **`--experimentalDevtools`/ `--experimental-devtools`**
+  Whether to enable automation over DevTools targets
+  - **Type:** boolean
+  - **Default:** `false`
+
+- **`--experimentalVision`/ `--experimental-vision`**
+  Whether to enable coordinate-based tools such as click_at(x,y). Usually requires a computer-use model able to produce accurate coordinates by looking at screenshots.
+  - **Type:** boolean
+  - **Default:** `false`
+
+- **`--memoryDebugging`/ `--memory-debugging`, `--experimentalMemory`**
+  Whether to enable memory debugging tools.
+  - **Type:** boolean
+  - **Default:** `false`
+
+- **`--experimentalStructuredContent`/ `--experimental-structured-content`**
+  Whether to output structured formatted content.
+  - **Type:** boolean
+  - **Default:** `false`
+
+- **`--experimentalIncludeAllPages`/ `--experimental-include-all-pages`**
+  Whether to include all kinds of pages such as webviews or background pages as pages.
+  - **Type:** boolean
+  - **Default:** `false`
+
+- **`--experimentalScreencast`/ `--experimental-screencast`**
+  Exposes experimental screencast tools (requires ffmpeg). Install ffmpeg https://www.ffmpeg.org/download.html and ensure it is available in the MCP server PATH.
+  - **Type:** boolean
+  - **Default:** `false`
+
+- **`--experimentalFfmpegPath`/ `--experimental-ffmpeg-path`**
+  Path to ffmpeg executable for screencast recording.
+  - **Type:** string
+  - **Default:** `false`
+
+- **`--experimentalScreencastFps`/ `--experimental-screencast-fps`**
+  Frames per second to use for screencast recording. Lower values can reduce memory pressure on pages that produce frames faster than ffmpeg can encode them.
+  - **Type:** number
+  - **Default:** `false`
+
+- **`--blockedUrlPattern`/ `--blocked-url-pattern`**
+  Restricts browser's network access by blocking specified URL patterns (uses https://urlpattern.spec.whatwg.org/). Silently detaches from targets with blocked URLs upon connection, and blocks runtime requests (including navigations and subresources). Accepts an array of patterns.
+  - **Type:** array
+  - **Default:** `false`
+
+- **`--allowedUrlPattern`/ `--allowed-url-pattern`**
+  Restricts browser's network access by allowing only specified URL patterns (uses https://urlpattern.spec.whatwg.org/). Requires Chrome 149+. Silently detaches from targets with unallowed URLs upon connection, and blocks runtime requests (including navigations and subresources). Accepts an array of patterns.
+  - **Type:** array
+  - **Default:** `false`
+
+- **`--performanceCrux`/ `--performance-crux`**
+  Set to true to enable sending URLs from performance traces to CrUX API to get field performance data.
+  - **Type:** boolean
+  - **Default:** `false`
+
+- **`--usageStatistics`/ `--usage-statistics`**
+  Set to true to opt-in to usage statistics collection. Google collects usage data to improve the tool, handled under the Google Privacy Policy (https://policies.google.com/privacy). This is independent from Chrome browser metrics. Disabled if `OPERA_DEVTOOLS_NO_USAGE_STATISTICS` or `CI` env variables are set.
+  - **Type:** boolean
+  - **Default:** `false`
+
+- **`--javascriptEvaluation`/ `--javascript-evaluation`**
+  Set to false to disable JavaScript execution. When disabled, evaluation tools (evaluate_script and slim evaluate) are disabled, the initScript parameter in navigate_page is turned off, and navigating to javascript:, data:, or vbscript: URLs is disallowed.
+  - **Type:** boolean
+  - **Default:** `true`
+
+- **`--sourceMaps`/ `--source-maps`**
+  Whether to enable source maps in DevTools. Use --no-source-maps to disable.
+  - **Type:** boolean
+  - **Default:** `true`
+
+- **`--screenshotFormat`/ `--screenshot-format`**
+  Override the default output format used by take_screenshot when the caller does not specify one. JPEG and WebP are ~3-5x smaller than PNG, which reduces transfer and storage size. To reduce context size use --screenshotMaxWidth / --screenshotMaxHeight, since image tokens scale with dimensions rather than encoded bytes. Unset preserves the existing default ("png").
+  - **Type:** string
+  - **Choices:** `jpeg`, `png`, `webp`
+  - **Default:** `false`
+
+- **`--screenshotQuality`/ `--screenshot-quality`**
+  Override the default compression quality (0-100) used by take_screenshot for JPEG and WebP when the caller does not specify one. Lower values mean smaller files. Ignored for PNG. Unset preserves the Puppeteer default.
+  - **Type:** number
+  - **Default:** `false`
+
+- **`--screenshotMaxWidth`/ `--screenshot-max-width`**
+  Maximum width in pixels for screenshots. If the captured image is wider, it is downscaled (preserving aspect ratio) before being returned. Reduces context size in AI conversations. Unset means no resize.
+  - **Type:** number
+  - **Default:** `false`
+
+- **`--screenshotMaxHeight`/ `--screenshot-max-height`**
+  Maximum height in pixels for screenshots. If the captured image is taller, it is downscaled (preserving aspect ratio) before being returned. Can be combined with --screenshot-max-width; the smaller scale factor wins. Unset means no resize.
+  - **Type:** number
+  - **Default:** `false`
+
+- **`--slim`**
+  Exposes a "slim" set of 3 tools covering navigation, script execution and screenshots only. Useful for basic browser tasks.
+  - **Type:** boolean
+  - **Default:** `false`
+
+- **`--redactNetworkHeaders`/ `--redact-network-headers`**
+  If true, redacts some of the network headers considered sensitive before returning to the client.
+  - **Type:** boolean
+  - **Default:** `false`
+
+- **`--allowUnrestrictedPaths`/ `--allow-unrestricted-paths`**
+  If set, disables the default path restriction that applies when the MCP client does not negotiate the roots capability. By default, file-writing tools are restricted to the OS temp directory when no roots are configured. Use this only when connecting a trusted local client that does not implement MCP roots and requires access to paths outside the temp directory.
+  - **Type:** boolean
+  - **Default:** `false`
+
+- **`--filesystemRoot`/ `--filesystem-root`, `--workspace`**
+  A directory that filesystem tools are allowed to access. May be specified more than once.
+  - **Type:** array
+  - **Default:** `OS temp directory`
+
+- **`--config`**
+  Path to JSON configuration file.
+  - **Type:** string
+  - **Default:** `false`
+
+<!-- END AUTO GENERATED OPTIONS -->
+
+Pass them via the `args` property in the JSON configuration. For example:
+
+```json
+{
+  "mcpServers": {
+    "chrome-devtools": {
+      "command": "npx",
+      "args": [
+        "chrome-devtools-mcp@latest",
+        "--channel=canary",
+        "--headless=true",
+        "--isolated=true"
+      ]
+    }
+  }
+}
+```
+
+## Connecting via WebSocket with custom headers
+
+You can connect directly to a Chrome WebSocket endpoint and include custom headers (e.g., for authentication):
+
+```json
+{
+  "mcpServers": {
+    "chrome-devtools": {
+      "command": "npx",
+      "args": [
+        "chrome-devtools-mcp@latest",
+        "--wsEndpoint=ws://127.0.0.1:9222/devtools/browser/<id>",
+        "--wsHeaders={\"Authorization\":\"Bearer YOUR_TOKEN\"}"
+      ]
+    }
+  }
+}
+```
+
+To get the WebSocket endpoint from a running Chrome instance, visit `http://127.0.0.1:9222/json/version` and look for the `webSocketDebuggerUrl` field.
+
+You can also run `npx chrome-devtools-mcp@latest --help` to see all available configuration options.
diff --git a/docs/tool-reference.md b/docs/tool-reference.md
index dba00260..09aa576c 100644
--- a/docs/tool-reference.md
+++ b/docs/tool-reference.md
@@ -39,7 +39,7 @@
   - [`take_snapshot`](#take_snapshot)
   - [`screencast_start`](#screencast_start)
   - [`screencast_stop`](#screencast_stop)
-- **[Memory](#memory)** (12 tools)
+- **[Memory](#memory)** (13 tools)
   - [`take_heapsnapshot`](#take_heapsnapshot)
   - [`close_heapsnapshot`](#close_heapsnapshot)
   - [`compare_heapsnapshots`](#compare_heapsnapshots)
@@ -52,6 +52,7 @@
   - [`get_heapsnapshot_retainers`](#get_heapsnapshot_retainers)
   - [`get_heapsnapshot_retaining_paths`](#get_heapsnapshot_retaining_paths)
   - [`get_heapsnapshot_summary`](#get_heapsnapshot_summary)
+  - [`query_heapsnapshot_objects`](#query_heapsnapshot_objects)
 - **[Opera](#opera)** (14 tools)
   - [`opera_authenticate_mcp_server`](#opera_authenticate_mcp_server)
   - [`opera_call_mcp_tool`](#opera_call_mcp_tool)
@@ -93,6 +94,7 @@
 
 **Parameters:**
 
+- **pageId** (number) **(required)**: Targets a specific page by ID.
 - **uid** (string) **(required)**: The uid of an element on the page from the page content snapshot
 - **dblClick** (boolean) _(optional)_: Set to true for double clicks. Default is false.
 - **includeSnapshot** (boolean) _(optional)_: Whether to include a snapshot in the response. Default is false.
@@ -106,6 +108,7 @@
 **Parameters:**
 
 - **from_uid** (string) **(required)**: The uid of the element to [`drag`](#drag)
+- **pageId** (number) **(required)**: Targets a specific page by ID.
 - **to_uid** (string) **(required)**: The uid of the element to drop into
 - **includeSnapshot** (boolean) _(optional)_: Whether to include a snapshot in the response. Default is false.
 
@@ -117,6 +120,7 @@
 
 **Parameters:**
 
+- **pageId** (number) **(required)**: Targets a specific page by ID.
 - **uid** (string) **(required)**: The uid of an element on the page from the page content snapshot
 - **value** (string) **(required)**: The value to [`fill`](#fill) in. "true" or "false" for checkboxes and toggles, "true" for radio buttons.
 - **includeSnapshot** (boolean) _(optional)_: Whether to include a snapshot in the response. Default is false.
@@ -130,6 +134,7 @@
 **Parameters:**
 
 - **elements** (array) **(required)**: Elements from snapshot to [`fill`](#fill) out.
+- **pageId** (number) **(required)**: Targets a specific page by ID.
 - **includeSnapshot** (boolean) _(optional)_: Whether to include a snapshot in the response. Default is false.
 
 ---
@@ -141,6 +146,7 @@
 **Parameters:**
 
 - **action** (enum: "accept", "dismiss") **(required)**: Whether to dismiss or accept the dialog
+- **pageId** (number) **(required)**: Targets a specific page by ID.
 - **promptText** (string) _(optional)_: Optional prompt text to enter into the dialog.
 
 ---
@@ -151,6 +157,7 @@
 
 **Parameters:**
 
+- **pageId** (number) **(required)**: Targets a specific page by ID.
 - **uid** (string) **(required)**: The uid of an element on the page from the page content snapshot
 - **includeSnapshot** (boolean) _(optional)_: Whether to include a snapshot in the response. Default is false.
 
@@ -163,6 +170,7 @@
 **Parameters:**
 
 - **key** (string) **(required)**: A key or a combination (e.g., "Enter", "Control+A", "Control++", "Control+Shift+R"). Modifiers: Control, Shift, Alt, Meta
+- **pageId** (number) **(required)**: Targets a specific page by ID.
 - **includeSnapshot** (boolean) _(optional)_: Whether to include a snapshot in the response. Default is false.
 
 ---
@@ -173,6 +181,7 @@
 
 **Parameters:**
 
+- **pageId** (number) **(required)**: Targets a specific page by ID.
 - **text** (string) **(required)**: The text to type
 - **submitKey** (string) _(optional)_: Optional key to press after typing. E.g., "Enter", "Tab", "Escape"
 
@@ -185,6 +194,7 @@
 **Parameters:**
 
 - **filePaths** (array) **(required)**: One or more files paths to upload. File paths have to be local to the browser instance (not the MCP).
+- **pageId** (number) **(required)**: Targets a specific page by ID.
 - **uid** (string) **(required)**: The uid of the file input element or an element that will open file chooser on the page from the page content snapshot
 - **includeSnapshot** (boolean) _(optional)_: Whether to include a snapshot in the response. Default is false.
 
@@ -196,6 +206,7 @@
 
 **Parameters:**
 
+- **pageId** (number) **(required)**: Targets a specific page by ID.
 - **x** (number) **(required)**: The x coordinate
 - **y** (number) **(required)**: The y coordinate
 - **dblClick** (boolean) _(optional)_: Set to true for double clicks. Default is false.
@@ -229,6 +240,7 @@
 
 **Parameters:**
 
+- **pageId** (number) **(required)**: Targets a specific page by ID.
 - **handleBeforeUnload** (enum: "accept", "dismiss") _(optional)_: Whether to auto accept or beforeunload dialogs triggered by this navigation. Default is accept.
 - **ignoreCache** (boolean) _(optional)_: Whether to ignore cache on reload.
 - **initScript** (string) _(optional)_: A JavaScript script to be executed on each new document before any other scripts for the next navigation.
@@ -246,7 +258,7 @@
 
 - **url** (string) **(required)**: URL to load in a new page.
 - **background** (boolean) _(optional)_: Whether to open the page in the background without bringing it to the front. Default is false (foreground).
-- **isolatedContext** (string) _(optional)_: If specified, the page is created in an isolated browser context with the given name. Pages in the same browser context share cookies and storage. Pages in different browser contexts are fully isolated.
+- **isolatedContext** (string) _(optional)_: If specified, the page is created in an isolated browser context with the given name. Pages in the same browser context share cookies and storage. Pages in different browser contexts are fully isolated (useful for clean-slate testing of cookies and authentication).
 - **timeout** (integer) _(optional)_: Maximum wait time in milliseconds. If set to 0, the default timeout will be used.
 
 ---
@@ -268,6 +280,7 @@
 
 **Parameters:**
 
+- **pageId** (number) **(required)**: Targets a specific page by ID.
 - **text** (array) **(required)**: Non-empty list of texts. Resolves when any value appears on the page.
 - **timeout** (integer) _(optional)_: Maximum wait time in milliseconds. If set to 0, the default timeout will be used.
 
@@ -277,10 +290,11 @@
 
 ### `emulate`
 
-**Description:** Emulates various features on the selected page.
+**Description:** Emulates various features on the target page.
 
 **Parameters:**
 
+- **pageId** (number) **(required)**: Targets a specific page by ID.
 - **colorScheme** (enum: "dark", "light", "auto") _(optional)_: [`Emulate`](#emulate) the dark or the light mode. Set to "auto" to reset to the default.
 - **cpuThrottlingRate** (number) _(optional)_: Represents the CPU slowdown factor. Omit or set the rate to 1 to disable throttling
 - **extraHttpHeaders** (string) _(optional)_: Extra HTTP headers as a JSON string object, e.g. {"X-Custom": "value", "Authorization": "Bearer token"}. Headers are included into every HTTP request originating from the page and persist across navigations until cleared. Pass an empty string to clear all extra headers.
@@ -293,11 +307,12 @@
 
 ### `resize_page`
 
-**Description:** Resizes the selected page's window so that the page has specified dimension
+**Description:** Resizes the page's window so that the page has specified dimension
 
 **Parameters:**
 
 - **height** (number) **(required)**: Page height
+- **pageId** (number) **(required)**: Targets a specific page by ID.
 - **width** (number) **(required)**: Page width
 
 ---
@@ -312,27 +327,30 @@
 
 - **insightName** (string) **(required)**: The name of the Insight you want more information on. For example: "DocumentLatency" or "LCPBreakdown"
 - **insightSetId** (string) **(required)**: The id for the specific insight set. Only use the ids given in the "Available insight sets" list.
+- **pageId** (number) **(required)**: Targets a specific page by ID.
 
 ---
 
 ### `performance_start_trace`
 
-**Description:** Start a performance trace on the selected webpage. Use to find frontend performance issues, Core Web Vitals (LCP, INP, CLS), and improve page load speed.
+**Description:** Start a performance trace on the target webpage. Use to find frontend performance issues, Core Web Vitals (LCP, INP, CLS), and improve page load speed.
 
 **Parameters:**
 
+- **pageId** (number) **(required)**: Targets a specific page by ID.
 - **autoStop** (boolean) _(optional)_: Determines if the trace recording should be automatically stopped.
 - **filePath** (string) _(optional)_: The absolute file path, or a file path relative to the current working directory, to save the raw trace data. For example, trace.json.gz (compressed) or trace.json (uncompressed).
-- **reload** (boolean) _(optional)_: Determines if, once tracing has started, the current selected page should be automatically reloaded. Navigate the page to the right URL using the [`navigate_page`](#navigate_page) tool BEFORE starting the trace if reload or autoStop is set to true.
+- **reload** (boolean) _(optional)_: Determines if, once tracing has started, the target page should be automatically reloaded. Navigate the page to the right URL using the [`navigate_page`](#navigate_page) tool BEFORE starting the trace if reload or autoStop is set to true.
 
 ---
 
 ### `performance_stop_trace`
 
-**Description:** Stop the active performance trace recording on the selected webpage.
+**Description:** Stop the active performance trace recording on the target webpage.
 
 **Parameters:**
 
+- **pageId** (number) **(required)**: Targets a specific page by ID.
 - **filePath** (string) _(optional)_: The absolute file path, or a file path relative to the current working directory, to save the raw trace data. For example, trace.json.gz (compressed) or trace.json (uncompressed).
 
 ---
@@ -341,10 +359,11 @@
 
 ### `get_network_request`
 
-**Description:** Gets a network request by an optional reqid, if omitted returns the currently selected request in the DevTools Network panel.
+**Description:** Gets a network request by an optional reqid, if omitted returns the currently selected request in the DevTools Network panel. Useful for inspecting request headers (including 'Cookie') and response headers (including 'Set-Cookie' and directives).
 
 **Parameters:**
 
+- **pageId** (number) **(required)**: Targets a specific page by ID.
 - **reqid** (number) _(optional)_: The reqid of the network request. If omitted returns the currently selected request in the DevTools Network panel.
 - **requestFilePath** (string) _(optional)_: The absolute or relative path to a .network-request file to save the request body to. If omitted, the body is returned inline.
 - **responseFilePath** (string) _(optional)_: The absolute or relative path to a .network-response file to save the response body to. If omitted, the body is returned inline.
@@ -353,10 +372,11 @@
 
 ### `list_network_requests`
 
-**Description:** Lists the most recent requests for the currently selected page since the last navigation.
+**Description:** Lists the most recent requests for the target page since the last navigation.
 
 **Parameters:**
 
+- **pageId** (number) **(required)**: Targets a specific page by ID.
 - **includePreservedRequests** (boolean) _(optional)_: Set to true to return the preserved requests over the last 3 navigations.
 - **pageIdx** (integer) _(optional)_: Page number to return (0-based). When omitted, returns the first page.
 - **pageSize** (integer) _(optional)_: Maximum number of requests to return. When omitted, returns all requests.
@@ -368,14 +388,15 @@
 
 ### `evaluate_script`
 
-**Description:** Evaluate a JavaScript function inside the currently selected page. Returns the response as JSON, so returned values have to be JSON-serializable.
+**Description:** Evaluate a JavaScript function inside the target page. Returns the response as JSON, so returned values have to be JSON-serializable.
 
 **Parameters:**
 
-- **function** (string) **(required)**: A JavaScript function declaration to be executed by the tool in the currently selected page.
+- **function** (string) **(required)**: A JavaScript function declaration to be executed by the tool in the target page.
   Example without arguments: `() => document.title` or `async () => await fetch("example.com")`.
   Example with arguments: `(el) => el.innerText`
 
+- **pageId** (number) **(required)**: Targets a specific page by ID.
 - **args** (array) _(optional)_: An optional list of arguments to pass to the function.
 - **dialogAction** (string) _(optional)_: Handle dialogs while execution. "accept", "dismiss", or string for response of window.prompt. Defaults to accept.
 - **filePath** (string) _(optional)_: The absolute or relative path to a file to save the script output to. If omitted, the output is returned inline.
@@ -390,6 +411,7 @@
 **Parameters:**
 
 - **msgid** (number) **(required)**: The msgid of a console message on the page from the listed console messages
+- **pageId** (number) **(required)**: Targets a specific page by ID.
 
 ---
 
@@ -399,6 +421,7 @@
 
 **Parameters:**
 
+- **pageId** (number) **(required)**: Targets a specific page by ID.
 - **device** (enum: "desktop", "mobile") _(optional)_: Device to [`emulate`](#emulate).
 - **mode** (enum: "navigation", "snapshot") _(optional)_: "navigation" reloads &amp; audits. "snapshot" analyzes current state.
 - **outputDirPath** (string) _(optional)_: Directory for reports. If omitted, uses temporary files.
@@ -407,10 +430,11 @@
 
 ### `list_console_messages`
 
-**Description:** List all console messages for the currently selected page since the last navigation.
+**Description:** List all console messages for the target page since the last navigation.
 
 **Parameters:**
 
+- **pageId** (number) **(required)**: Targets a specific page by ID.
 - **includePreservedMessages** (boolean) _(optional)_: Set to true to return the preserved messages over the last 3 navigations.
 - **includeStackTraces** (boolean) _(optional)_: Set to true to include the stack trace for each message when available. Increases the response size.
 - **pageIdx** (integer) _(optional)_: Page number to return (0-based). When omitted, returns the first page.
@@ -426,6 +450,7 @@
 
 **Parameters:**
 
+- **pageId** (number) **(required)**: Targets a specific page by ID.
 - **filePath** (string) _(optional)_: The absolute path, or a path relative to the current working directory, to save the screenshot to instead of attaching it to the response.
 - **format** (enum: "png", "jpeg", "webp") _(optional)_: Type of format to save the screenshot as. Default is "png"
 - **fullPage** (boolean) _(optional)_: If set to true takes a screenshot of the full page instead of the currently visible viewport. Incompatible with uid.
@@ -436,12 +461,13 @@
 
 ### `take_snapshot`
 
-**Description:** Take a text snapshot of the currently selected page based on the a11y tree. The snapshot lists page elements along with a unique
+**Description:** Take a text snapshot of the target page based on the a11y tree. The snapshot lists page elements along with a unique
 identifier (uid). Always use the latest snapshot. Prefer taking a snapshot over taking a screenshot. The snapshot indicates the element selected
 in the DevTools Elements panel (if any).
 
 **Parameters:**
 
+- **pageId** (number) **(required)**: Targets a specific page by ID.
 - **filePath** (string) _(optional)_: The absolute path, or a path relative to the current working directory, to save the snapshot to instead of attaching it to the response.
 - **verbose** (boolean) _(optional)_: Whether to include all possible information available in the full a11y tree. Default is false.
 
@@ -449,19 +475,22 @@ in the DevTools Elements panel (if any).
 
 ### `screencast_start`
 
-**Description:** Starts recording a screencast (video) of the selected page in specified format. (requires flag: --experimentalScreencast=true)
+**Description:** Starts recording a screencast (video) of the target page in specified format. (requires flag: --experimentalScreencast=true)
 
 **Parameters:**
 
+- **pageId** (number) **(required)**: Targets a specific page by ID.
 - **filePath** (string) _(optional)_: Output file path (.webm,.mp4 are supported). Uses mkdtemp to generate a unique path if not provided.
 
 ---
 
 ### `screencast_stop`
 
-**Description:** Stops the active screencast recording on the selected page. (requires flag: --experimentalScreencast=true)
+**Description:** Stops the active screencast recording on the target page. (requires flag: --experimentalScreencast=true)
 
-**Parameters:** None
+**Parameters:**
+
+- **pageId** (number) **(required)**: Targets a specific page by ID.
 
 ---
 
@@ -469,11 +498,12 @@ in the DevTools Elements panel (if any).
 
 ### `take_heapsnapshot`
 
-**Description:** Capture a heap snapshot of the currently selected page. Use to analyze the memory distribution of JavaScript objects and debug memory leaks.
+**Description:** Capture a heap snapshot of the target page. Use to analyze the memory distribution of JavaScript objects and debug memory leaks.
 
 **Parameters:**
 
 - **filePath** (string) **(required)**: A path to a .heapsnapshot file to save the heapsnapshot to.
+- **pageId** (number) **(required)**: Targets a specific page by ID.
 
 ---
 
@@ -560,9 +590,9 @@ in the DevTools Elements panel (if any).
 - **filePath** (string) **(required)**: A path to a .heapsnapshot file to read.
 - **nodeId** (number) **(required)**: The node ID to get outgoing edges for.
 - **excludePrimitives** (boolean) _(optional)_: Whether to exclude primitive target nodes. Default is true.
-- **minRetainedSize** (number) _(optional)_: Minimum retained size in bytes for target nodes.
 - **pageIdx** (number) _(optional)_: The page index for pagination.
 - **pageSize** (number) _(optional)_: The page size for pagination.
+- **retainedSize** (string) _(optional)_: Inclusive retained size range (e.g. "1MB-2MB", "-1MB", or "1MB-") for target nodes. A single value is treated as a minimum. Currently, only the lower bound is applied.
 - **sortBy** (enum: "retainedSize", "selfSize", "name") _(optional)_: Sort order for edges. Default is retainedSize.
 
 ---
@@ -615,6 +645,25 @@ in the DevTools Elements panel (if any).
 
 ---
 
+### `query_heapsnapshot_objects`
+
+**Description:** Loads a memory heapsnapshot and queries objects matching specific filters (className, propertyName, nodeType, retainedSize, selfSize, isDetached, sortBy). (requires flag: --memoryDebugging=true)
+
+**Parameters:**
+
+- **filePath** (string) **(required)**: A path to a .heapsnapshot file to read.
+- **className** (string) _(optional)_: Optional regex or text matching object class name.
+- **isDetached** (boolean) _(optional)_: Whether to filter for detached DOM nodes.
+- **nodeType** (string) _(optional)_: Optional V8 node type filter (e.g. object, closure, string, array, code).
+- **pageIdx** (number) _(optional)_: The page index for pagination.
+- **pageSize** (number) _(optional)_: The page size for pagination.
+- **propertyName** (string) _(optional)_: Optional property name filter for outgoing reference edges.
+- **retainedSize** (string) _(optional)_: Inclusive retained size range (e.g. "1MB-2MB", "-1MB", or "1MB-"). A single value is treated as a minimum.
+- **selfSize** (string) _(optional)_: Inclusive self size range (e.g. "1MB-2MB", "-1MB", or "1MB-"). A single value is treated as a minimum.
+- **sortBy** (enum: "retainedSize", "selfSize", "id") _(optional)_: Sort order for results. Default is retainedSize.
+
+---
+
 ## Opera
 
 ### `opera_authenticate_mcp_server`
@@ -623,6 +672,7 @@ in the DevTools Elements panel (if any).
 
 **Parameters:**
 
+- **pageId** (number) **(required)**: Targets a specific page by ID.
 - **server** (string) **(required)**: The MCP server name to authenticate.
 
 ---
@@ -633,6 +683,7 @@ in the DevTools Elements panel (if any).
 
 **Parameters:**
 
+- **pageId** (number) **(required)**: Targets a specific page by ID.
 - **server** (string) **(required)**: The MCP server name (from [`opera_list_mcp_servers`](#opera_list_mcp_servers)).
 - **tool** (string) **(required)**: The tool name to execute on the server.
 - **parameters** (unknown) _(optional)_: Parameters to pass to the tool. Omit if the tool takes none.
@@ -645,6 +696,7 @@ in the DevTools Elements panel (if any).
 
 **Parameters:**
 
+- **pageId** (number) **(required)**: Targets a specific page by ID.
 - **prompt** (string) **(required)**: The prompt to send to Opera AI.
 - **conversationId** (string) _(optional)_: Conversation ID to continue an existing conversation. Omit to start a new conversation.
 - **model** (string) _(optional)_: Model ID to use for the chat. Omit to use the browser default. Use [`opera_list_models`](#opera_list_models) to discover available IDs.
@@ -658,6 +710,7 @@ in the DevTools Elements panel (if any).
 
 **Parameters:**
 
+- **pageId** (number) **(required)**: Targets a specific page by ID.
 - **server** (string) **(required)**: The MCP server name to connect.
 
 ---
@@ -668,6 +721,7 @@ in the DevTools Elements panel (if any).
 
 **Parameters:**
 
+- **pageId** (number) **(required)**: Targets a specific page by ID.
 - **server** (string) **(required)**: The MCP server name to disable.
 
 ---
@@ -678,6 +732,7 @@ in the DevTools Elements panel (if any).
 
 **Parameters:**
 
+- **pageId** (number) **(required)**: Targets a specific page by ID.
 - **prompt** (string) **(required)**: The action to perform, described in natural language.
 - **openFullTabView** (boolean) _(optional)_: When true, activate the created do tab so the user sees it immediately. Default false (tab created in the background). Only meaningful for headed sessions.
 
@@ -689,6 +744,7 @@ in the DevTools Elements panel (if any).
 
 **Parameters:**
 
+- **pageId** (number) **(required)**: Targets a specific page by ID.
 - **server** (string) **(required)**: The MCP server name to enable.
 
 ---
@@ -697,7 +753,9 @@ in the DevTools Elements panel (if any).
 
 **Description:** List MCP servers registered in the browser, including their connection status. Only available when connected to Opera Neon.
 
-**Parameters:** None
+**Parameters:**
+
+- **pageId** (number) **(required)**: Targets a specific page by ID.
 
 ---
 
@@ -707,6 +765,7 @@ in the DevTools Elements panel (if any).
 
 **Parameters:**
 
+- **pageId** (number) **(required)**: Targets a specific page by ID.
 - **server** (string) **(required)**: The MCP server name (from [`opera_list_mcp_servers`](#opera_list_mcp_servers)).
 
 ---
@@ -715,7 +774,9 @@ in the DevTools Elements panel (if any).
 
 **Description:** List available AI models for Opera chat. Returns model IDs, display names, and which is the default. Only available when connected to Opera Neon.
 
-**Parameters:** None
+**Parameters:**
+
+- **pageId** (number) **(required)**: Targets a specific page by ID.
 
 ---
 
@@ -725,6 +786,7 @@ in the DevTools Elements panel (if any).
 
 **Parameters:**
 
+- **pageId** (number) **(required)**: Targets a specific page by ID.
 - **prompt** (string) **(required)**: Description of what to create or generate.
 - **conversationId** (string) _(optional)_: Conversation ID to continue an existing conversation. Omit to start a new conversation.
 - **openFullTabView** (boolean) _(optional)_: When true, activate the created make tab so the user sees it immediately. Default false (tab created in the background). Only meaningful for headed sessions.
@@ -737,6 +799,7 @@ in the DevTools Elements panel (if any).
 
 **Parameters:**
 
+- **pageId** (number) **(required)**: Targets a specific page by ID.
 - **server** (string) **(required)**: The MCP server name to register.
 - **url** (string) **(required)**: The HTTP URL of the MCP server.
 
@@ -748,6 +811,7 @@ in the DevTools Elements panel (if any).
 
 **Parameters:**
 
+- **pageId** (number) **(required)**: Targets a specific page by ID.
 - **prompt** (string) **(required)**: The topic or question to research.
 - **openFullTabView** (boolean) _(optional)_: When true, activate the created research tab so the user sees it immediately. Default false (tab created in the background). Only meaningful for headed sessions.
 - **researchType** (enum: "local", "one-minute", "deep") _(optional)_: Depth of research. "local" uses only on-page context, "one-minute" performs a quick web search, "deep" performs a thorough multi-source search.
@@ -760,6 +824,7 @@ in the DevTools Elements panel (if any).
 
 **Parameters:**
 
+- **pageId** (number) **(required)**: Targets a specific page by ID.
 - **server** (string) **(required)**: The MCP server name to unregister.
 
 ---
@@ -826,6 +891,7 @@ in the DevTools Elements panel (if any).
 
 **Parameters:**
 
+- **pageId** (number) **(required)**: Targets a specific page by ID.
 - **toolName** (string) **(required)**: The name of the tool to execute
 - **params** (string) _(optional)_: The JSON-stringified parameters to pass to the tool
 
@@ -841,7 +907,9 @@ following command to the script:
 This might be helpful when the third-party developer tools return non-serializable values or when composing
 third-party developer tools with additional functionality. (requires flag: --categoryExperimentalThirdParty=true)
 
-**Parameters:** None
+**Parameters:**
+
+- **pageId** (number) **(required)**: Targets a specific page by ID.
 
 ---
 
@@ -855,6 +923,7 @@ third-party developer tools with additional functionality. (requires flag: --cat
 
 **Parameters:**
 
+- **pageId** (number) **(required)**: Targets a specific page by ID.
 - **toolName** (string) **(required)**: The name of the WebMCP tool to execute
 - **input** (string) _(optional)_: The JSON-stringified parameters to pass to the WebMCP tool
 
@@ -864,7 +933,9 @@ third-party developer tools with additional functionality. (requires flag: --cat
 
 **Description:** Lists all WebMCP tools the page exposes. (requires flag: --categoryExperimentalWebmcp=true)
 
-**Parameters:** None
+**Parameters:**
+
+- **pageId** (number) **(required)**: Targets a specific page by ID.
 
 ---
 
diff --git a/gemini-extension.json b/gemini-extension.json
index 7d12bcaf..13cdf143 100644
--- a/gemini-extension.json
+++ b/gemini-extension.json
@@ -1,11 +1,11 @@
 {
   "name": "chrome-devtools-mcp",
-  "version": "1.7.0",
+  "version": "1.9.0",
   "mcpServers": {
     "chrome-devtools": {
       "command": "npx",
       "args": [
-        "chrome-devtools-mcp@1.7.0"
+        "chrome-devtools-mcp@1.9.0"
       ]
     }
   }
diff --git a/mcp.json b/mcp.json
new file mode 100644
index 00000000..9e194da0
--- /dev/null
+++ b/mcp.json
@@ -0,0 +1,14 @@
+{
+  "$schema": "https://agent-plugins.org/schemas/1.0.0/mcp.schema.json",
+  "mcpServers": {
+    "chrome-devtools": {
+      "type": "stdio",
+      "command": "npx",
+      "args": [
+        "--prefix",
+        "${PLUGIN_DATA}",
+        "chrome-devtools-mcp@1.9.0"
+      ]
+    }
+  }
+}
diff --git a/package-lock.json b/package-lock.json
index 1f6c3c59..2bd68289 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -29,15 +29,15 @@
         "@types/yargs": "^17.0.33",
         "@typescript-eslint/eslint-plugin": "^8.43.0",
         "@typescript-eslint/parser": "^8.43.0",
-        "core-js": "3.49.0",
+        "core-js": "3.50.0",
         "eslint": "^10.7.0",
         "eslint-import-resolver-typescript": "^4.4.4",
         "eslint-plugin-import": "^2.32.0",
         "globals": "^17.0.0",
         "lighthouse": "13.4.1",
         "prettier": "^3.6.2",
-        "puppeteer": "25.6.0",
-        "rollup": "4.62.4",
+        "puppeteer": "25.10.0",
+        "rollup": "4.63.1",
         "rollup-plugin-cleanup": "^3.2.1",
         "rollup-plugin-license": "^3.6.0",
         "semver": "^7.7.4",
@@ -49,6 +49,18 @@
       },
       "engines": {
         "node": "^20.19.0 || ^22.12.0 || >=23"
+      },
+      "peerDependencies": {
+        "@blackwell-systems/gcf": "^2.2.2",
+        "@toon-format/toon": "^4.1.0"
+      },
+      "peerDependenciesMeta": {
+        "@blackwell-systems/gcf": {
+          "optional": true
+        },
+        "@toon-format/toon": {
+          "optional": true
+        }
       }
     },
     "node_modules/@apm-js-collab/code-transformer": {
@@ -735,13 +747,13 @@
       "license": "BSD-3-Clause"
     },
     "node_modules/@puppeteer/browsers": {
-      "version": "3.2.0",
-      "resolved": "https://registry.npmjs.org/@puppeteer/browsers/-/browsers-3.2.0.tgz",
-      "integrity": "sha512-LlBrE8oqGfU7b1Nk2d5Q1SbuPhZxTj0cJEMDPEws28OjNMELlflekmPPuf4FnK03x0ZRjKaYwJElUcKK4kyqJA==",
+      "version": "3.2.2",
+      "resolved": "https://registry.npmjs.org/@puppeteer/browsers/-/browsers-3.2.2.tgz",
+      "integrity": "sha512-q2BU4YfO9h/Wt7IcWPcggpOOqLk2Tbs1hDwolvKZrweRjy751OJBKMN9zO5bfD0pzU7X/tvKw/exQds4pM/LOg==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
-        "modern-tar": "^0.8.0",
+        "modern-tar": "^0.8.4",
         "yargs": "^18.0.0"
       },
       "bin": {
@@ -860,9 +872,9 @@
       }
     },
     "node_modules/@rollup/rollup-android-arm-eabi": {
-      "version": "4.62.4",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm-eabi/-/rollup-android-arm-eabi-4.62.4.tgz",
-      "integrity": "sha512-RrPokAb7dmbxFoeO3TloqHyOjgye8RkBhSqmp4aJMIex4c9r46ZstPnleDQOq1t46VOVjwIuwNogIqbodV1Vvg==",
+      "version": "4.63.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm-eabi/-/rollup-android-arm-eabi-4.63.1.tgz",
+      "integrity": "sha512-UZ8sUxPTiHWYX9QNdJedb1kDZSpS1t/VPWBWGSgqHNi9w3Cu6IXvu2mzbhiTiPvtrqgTQJ+zqiAq2iPIPilpaQ==",
       "cpu": [
         "arm"
       ],
@@ -874,9 +886,9 @@
       ]
     },
     "node_modules/@rollup/rollup-android-arm64": {
-      "version": "4.62.4",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm64/-/rollup-android-arm64-4.62.4.tgz",
-      "integrity": "sha512-JKuJc+pnpks2pjy7L/N3v/cAkZxYlnmuZoD840ldbMI5KDbC4iO9NKwPKYdjYFCMAIIlBzYSFHxIJVYzRo2/8A==",
+      "version": "4.63.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm64/-/rollup-android-arm64-4.63.1.tgz",
+      "integrity": "sha512-cQ4nFQABN5cDvDpbvJ7bMStCpnaVxynZrRMfUJYgxcIk9Sh54FIO1vtfkg0B69REjER77ioZ/ov+eAApx/KmLQ==",
       "cpu": [
         "arm64"
       ],
@@ -888,9 +900,9 @@
       ]
     },
     "node_modules/@rollup/rollup-darwin-arm64": {
-      "version": "4.62.4",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-arm64/-/rollup-darwin-arm64-4.62.4.tgz",
-      "integrity": "sha512-krw5uS2STmvJ02x0uTXHbqQNuz+9eZ1iw+qXk9dmW2gvV4jV7O2hEoOnuhFrpOPiel1mBFtqbxYZZtC46hXLOw==",
+      "version": "4.63.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-arm64/-/rollup-darwin-arm64-4.63.1.tgz",
+      "integrity": "sha512-FQNqd1lRy/0QhDk3xeRIkSBiCpXCiDnZO3YLVdcDKN1UBiKToNftCzcXYNLshmPDUMlu2TdeS8tGcsU6f3YF1Q==",
       "cpu": [
         "arm64"
       ],
@@ -902,9 +914,9 @@
       ]
     },
     "node_modules/@rollup/rollup-darwin-x64": {
-      "version": "4.62.4",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-x64/-/rollup-darwin-x64-4.62.4.tgz",
-      "integrity": "sha512-wsTxtgApb4PrOsNJIm0FZ1h3WvCC+k9uxLJ4ad75hgoS4NiRes2SoJFlDAyMwiUY8IssDqGcHbXuN0sx1tfF1A==",
+      "version": "4.63.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-x64/-/rollup-darwin-x64-4.63.1.tgz",
+      "integrity": "sha512-pvD16V939D3CloK0+qikpGaxiPrDUXTe7Y5cWOMkMSy7m1cawa8EGy/kXYi/G/cKAC4HDAbSnzCIk1WmsoOKXg==",
       "cpu": [
         "x64"
       ],
@@ -916,9 +928,9 @@
       ]
     },
     "node_modules/@rollup/rollup-freebsd-arm64": {
-      "version": "4.62.4",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-arm64/-/rollup-freebsd-arm64-4.62.4.tgz",
-      "integrity": "sha512-GUOnQlyZe3yAXhWOtOMsn5Qkrv5E5mZXa0thbARWi5Ei2szlVXJFQhddZ4HbAzh8q92w5twp+CQvs/eFanz9YQ==",
+      "version": "4.63.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-arm64/-/rollup-freebsd-arm64-4.63.1.tgz",
+      "integrity": "sha512-pcFGeL2345VwdTnJhA6zLbew+YgWB0qBG2+dMtXjCicf6+rm6kO6cOoh5VnTe0ZMrMRgRyuHmCJxZWrIdzYuOw==",
       "cpu": [
         "arm64"
       ],
@@ -930,9 +942,9 @@
       ]
     },
     "node_modules/@rollup/rollup-freebsd-x64": {
-      "version": "4.62.4",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-x64/-/rollup-freebsd-x64-4.62.4.tgz",
-      "integrity": "sha512-/Y7f3QuxjzPKsjA/rfEDa3+0vXqyjmJ50Ln8dPpCmWkKTrUoWHG1cWhTqaAMLob2m2nESWuC7yGrREz019Ztqg==",
+      "version": "4.63.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-x64/-/rollup-freebsd-x64-4.63.1.tgz",
+      "integrity": "sha512-mRJlqSRulVzcKq/LKA6ICSIc3K/l4fzlVn/gePn2nXIHy8seRi5z/eeRE0d/XMBxcMldiXtQTSpRj0tkkC3g8Q==",
       "cpu": [
         "x64"
       ],
@@ -944,9 +956,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-arm-gnueabihf": {
-      "version": "4.62.4",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-gnueabihf/-/rollup-linux-arm-gnueabihf-4.62.4.tgz",
-      "integrity": "sha512-81wiiX3v7aqy+T+bT61TJ78yJjRquqFFTTbAPt08imfQQzkPIW8t6aJbkTagtCCrXMNc9D66+geqlK7ydLPNqA==",
+      "version": "4.63.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-gnueabihf/-/rollup-linux-arm-gnueabihf-4.63.1.tgz",
+      "integrity": "sha512-YDUNvVM85TI3g/1OpnqKP1h4NeW/j64DfWMf+G3M809xNk1bJSnpFp4sh83NpmVE5DXnkh8ULor4LTVZKoYLHw==",
       "cpu": [
         "arm"
       ],
@@ -961,9 +973,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-arm-musleabihf": {
-      "version": "4.62.4",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-musleabihf/-/rollup-linux-arm-musleabihf-4.62.4.tgz",
-      "integrity": "sha512-9kmDIvNZqdoHOBZgNtpTBeLWYO/LVipM3H/j62P8848/l/VPEQL6N3uxU9pvP1oZAsXyC2MEnFP3ovRjo7WYNQ==",
+      "version": "4.63.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-musleabihf/-/rollup-linux-arm-musleabihf-4.63.1.tgz",
+      "integrity": "sha512-7Mcn71p9ZuQFAj+h+dhQXy/yeLePRS2yKRnmW1DijA9thKO5qap0GNOIQK4yQ6iP3SU0Mrb/yWo8h8vgRba8lw==",
       "cpu": [
         "arm"
       ],
@@ -978,9 +990,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-arm64-gnu": {
-      "version": "4.62.4",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-gnu/-/rollup-linux-arm64-gnu-4.62.4.tgz",
-      "integrity": "sha512-CcnXHWnXg69g+DX5VWL3FHts3qMRN2uVEHX+BZvGLdd07/gXkn3ePjYtO1LDJvxkGKVHMclKBRa1QUTH+6toYQ==",
+      "version": "4.63.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-gnu/-/rollup-linux-arm64-gnu-4.63.1.tgz",
+      "integrity": "sha512-4YiLQTX6U4CSl0L9cluep9A9W6UmTfqBDc2/CH6wlu54pl4E7Jn3cOD8oxzvBDEGk/JMKgJ47C8g+radF7mwvg==",
       "cpu": [
         "arm64"
       ],
@@ -995,9 +1007,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-arm64-musl": {
-      "version": "4.62.4",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-musl/-/rollup-linux-arm64-musl-4.62.4.tgz",
-      "integrity": "sha512-iFOibiHnTRuhrWLlRsOQFdZJJIa7S8OwkneJr4ocALP16u5yk6lWLINFwhHaEqBFMsKDUZofLkGos7+CPzGB3g==",
+      "version": "4.63.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-musl/-/rollup-linux-arm64-musl-4.63.1.tgz",
+      "integrity": "sha512-2ra8F7w8OquwZN9z2/fKFnli69wa8PLwaVzRMIPGb13ByMJwC28Fbp8YcVGoUhlYMTt7j5j9bNgpysrN2UM+vw==",
       "cpu": [
         "arm64"
       ],
@@ -1012,9 +1024,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-loong64-gnu": {
-      "version": "4.62.4",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loong64-gnu/-/rollup-linux-loong64-gnu-4.62.4.tgz",
-      "integrity": "sha512-XnWYMI7euHlb5a871xPja+Gm7DRCFU+FGRrtS2sMq9N8FvqtpagUy6gD4YOemC5MRk9xbh8+jYMEJbigFQwsgA==",
+      "version": "4.63.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loong64-gnu/-/rollup-linux-loong64-gnu-4.63.1.tgz",
+      "integrity": "sha512-Sy20ncyhjmBP0Ml+UvQbimjlk6VFgjW5uNP+qqwHB00mTE8Bl2C1TuHTlRwK2YoXeZbee5lP2XevBWVkAQAtSQ==",
       "cpu": [
         "loong64"
       ],
@@ -1029,9 +1041,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-loong64-musl": {
-      "version": "4.62.4",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loong64-musl/-/rollup-linux-loong64-musl-4.62.4.tgz",
-      "integrity": "sha512-qGDAlO0U8xedCcsdRm9oaoQY8DAx/QT7uIxJWhCdx0ceIWX783UC9QSYkdpzAe29wNiVfp24+bZdQmn49o45SQ==",
+      "version": "4.63.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loong64-musl/-/rollup-linux-loong64-musl-4.63.1.tgz",
+      "integrity": "sha512-noITLp8oNjYliPnGWmLyelIHwULGqbHloQHGw1rtxbWhTuWooRpnZarZQJ1y9EUC4szuCusCc+HEpUtxpIwYvA==",
       "cpu": [
         "loong64"
       ],
@@ -1046,9 +1058,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-ppc64-gnu": {
-      "version": "4.62.4",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-gnu/-/rollup-linux-ppc64-gnu-4.62.4.tgz",
-      "integrity": "sha512-ru4H6ezD7ysA5EiEK6qkkaEb4modH8CTej6kUy/gQi20u3kB3G7Zn8snXXkeJSCOFKG/rbPPtM/+9Wgas1961w==",
+      "version": "4.63.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-gnu/-/rollup-linux-ppc64-gnu-4.63.1.tgz",
+      "integrity": "sha512-hlxxXd+F1mWiAcaFR7Sv9ZQT6m6UfI8+Vy/kFJzztq2pDMU/0wZ9sish0iszNZvsQDo8Gc0i5yuFEOz5dDf6fA==",
       "cpu": [
         "ppc64"
       ],
@@ -1063,9 +1075,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-ppc64-musl": {
-      "version": "4.62.4",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-musl/-/rollup-linux-ppc64-musl-4.62.4.tgz",
-      "integrity": "sha512-2W4MO5WQVJnbJaZdvDb9rhBDuFU1nKIepPFpJUBsTh2k1YY2g+ODViaWuyOAjQ5cOP7NvrvLzt3wvHOoiAvc7w==",
+      "version": "4.63.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-musl/-/rollup-linux-ppc64-musl-4.63.1.tgz",
+      "integrity": "sha512-EF7OpqQTQ/BvGqLzUi4rEHuagCV9MugAUXSHemwPW5vxZ75RR+jxO/2j95Ph2dalMpFHSVECjRoioHZgA9zOYA==",
       "cpu": [
         "ppc64"
       ],
@@ -1080,9 +1092,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-riscv64-gnu": {
-      "version": "4.62.4",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-gnu/-/rollup-linux-riscv64-gnu-4.62.4.tgz",
-      "integrity": "sha512-+fxjfuoAmVMCYV5QyjoIpu0cp5DOiOTeqYFk1AVaxGr+/ravWLX89XfQmptsoWcaVy/TGf2hexzbUOrCQIL1CQ==",
+      "version": "4.63.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-gnu/-/rollup-linux-riscv64-gnu-4.63.1.tgz",
+      "integrity": "sha512-wQO3JesW9PRkwlabQ27y7sPfVOOTLRG73I4F2UYHG5PXun3J9U3y+b7ezVKSYbsvSKGQ1k1cq8Qlun4C9kLt3w==",
       "cpu": [
         "riscv64"
       ],
@@ -1097,9 +1109,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-riscv64-musl": {
-      "version": "4.62.4",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-musl/-/rollup-linux-riscv64-musl-4.62.4.tgz",
-      "integrity": "sha512-jTn8JfHGL4djjFxPuM06LmNUJDsst2jeVlsd9OmIH6zc5sC9K6rIuO4YajXatLUpBmBKl6b35ro1QZocLi+tcA==",
+      "version": "4.63.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-musl/-/rollup-linux-riscv64-musl-4.63.1.tgz",
+      "integrity": "sha512-ouAGwhO6wHRXdnOVCOsB0tRFkA7nhNB2Nwax6oECXN0YiN8EYUTBAOudADOB1PI+yDL61TeNx/u7MVCzksNbkQ==",
       "cpu": [
         "riscv64"
       ],
@@ -1114,9 +1126,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-s390x-gnu": {
-      "version": "4.62.4",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-s390x-gnu/-/rollup-linux-s390x-gnu-4.62.4.tgz",
-      "integrity": "sha512-oCJCJL4pXsoDcP2QZ+JVlPTIRc6266zsIaeJJsWImmF7HO0W8nb6HuSgZlMWxJwaPf8ehbSw8yo0EUw925hKsA==",
+      "version": "4.63.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-s390x-gnu/-/rollup-linux-s390x-gnu-4.63.1.tgz",
+      "integrity": "sha512-q2R38Sn+1J8RxhfJ+T54wSWmyKXWec+9jgDfqO2AtArEqHO5R2aeayp5H5OYLr5UYDVGsVaZPEFUooMhYCdz5A==",
       "cpu": [
         "s390x"
       ],
@@ -1131,9 +1143,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-x64-gnu": {
-      "version": "4.62.4",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-gnu/-/rollup-linux-x64-gnu-4.62.4.tgz",
-      "integrity": "sha512-W69hukhZ3KKNRCaMIEzKvcFye42hh0FE1+YoYaf5+Ikacuftoco6yO/xouz0hc5d5W/s3yBro5jRiuEE/Q5vUw==",
+      "version": "4.63.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-gnu/-/rollup-linux-x64-gnu-4.63.1.tgz",
+      "integrity": "sha512-gfI5T24WLLuFfSKw7Go/zDXjAAV0fny0swTaDv+WjK7vqcw4cRhFfdsyKL1n+ukI+ooBxn3bVQnyrn06WpI50w==",
       "cpu": [
         "x64"
       ],
@@ -1148,9 +1160,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-x64-musl": {
-      "version": "4.62.4",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-musl/-/rollup-linux-x64-musl-4.62.4.tgz",
-      "integrity": "sha512-qiXbGG2jkjXhzXpsFZSR2Xpb8DN/UaxYsbb/STbuR/6fpaDgRmmaq1B/LmtF2wQFOFOSsK2jdE0RZ3a0zHn4QA==",
+      "version": "4.63.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-musl/-/rollup-linux-x64-musl-4.63.1.tgz",
+      "integrity": "sha512-4h6XqthmB4Hspji84wvgk+ElodTsGj+dbZqHJHHtKxj4mYq0ANSEEPX9ys3moJueqsRjwpaJYH7874Itwnj2ow==",
       "cpu": [
         "x64"
       ],
@@ -1165,9 +1177,9 @@
       ]
     },
     "node_modules/@rollup/rollup-openbsd-x64": {
-      "version": "4.62.4",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-openbsd-x64/-/rollup-openbsd-x64-4.62.4.tgz",
-      "integrity": "sha512-nWeM//hxv8mIo6jD7Hu4o48DVmV9pbV6gsKaWU+4NFyqHoPKwrkRiZGLKUhOBk8qNmDmpwFtPKg80Bo/Tn4xiQ==",
+      "version": "4.63.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-openbsd-x64/-/rollup-openbsd-x64-4.63.1.tgz",
+      "integrity": "sha512-dlfCOa87o1VAYegLQ9EKilx2JCeRofiyPGhTCmqnuXZ6bMPiycO1rq1+sKoulAp7pGLIsTIw+1x5R+zgh5LhhA==",
       "cpu": [
         "x64"
       ],
@@ -1179,9 +1191,9 @@
       ]
     },
     "node_modules/@rollup/rollup-openharmony-arm64": {
-      "version": "4.62.4",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-openharmony-arm64/-/rollup-openharmony-arm64-4.62.4.tgz",
-      "integrity": "sha512-s62SQ/vgsRSvMwDkOEfTqfgASF0f26ZNaQuTA6Aok5lrikf89yI2W0gFHvZb2Jpgc6N8JnOKZgCK2iciO3CsxQ==",
+      "version": "4.63.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-openharmony-arm64/-/rollup-openharmony-arm64-4.63.1.tgz",
+      "integrity": "sha512-cjkLbOlfcm3QGhMM1J5zaZjsw1GggbN6rw9UTSSRrPrR1KkcXnN7Uq9rPw34xImQ9VOY9GN+6u2Zj80B9ptkcw==",
       "cpu": [
         "arm64"
       ],
@@ -1193,9 +1205,9 @@
       ]
     },
     "node_modules/@rollup/rollup-win32-arm64-msvc": {
-      "version": "4.62.4",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-arm64-msvc/-/rollup-win32-arm64-msvc-4.62.4.tgz",
-      "integrity": "sha512-J6wGf8TVGbXJq+HH+ttTvrcfNKPbuZecV6KT1B8I18BC5IURUh5kl4Yl5OEP5eFIUoI5BWxCsyYMhFsDx8kekw==",
+      "version": "4.63.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-arm64-msvc/-/rollup-win32-arm64-msvc-4.63.1.tgz",
+      "integrity": "sha512-Li1KdUnWGE4N3e1F/B4RTB1ms+nG4WBgjByO46pkeBVX/2UBsY53xf5vK9WygVmnH3RwncIST7lkSdLSY6P9lg==",
       "cpu": [
         "arm64"
       ],
@@ -1207,9 +1219,9 @@
       ]
     },
     "node_modules/@rollup/rollup-win32-ia32-msvc": {
-      "version": "4.62.4",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-ia32-msvc/-/rollup-win32-ia32-msvc-4.62.4.tgz",
-      "integrity": "sha512-zmfrQd/0wu6oJs8Vq8KwY/YtsKSsLtKe/HwAP4Wqy8LhWjeT55fHRAkOhYQ12wI3ayS4Tt12d5CDRD7N96SAYQ==",
+      "version": "4.63.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-ia32-msvc/-/rollup-win32-ia32-msvc-4.63.1.tgz",
+      "integrity": "sha512-t4ZYOSoLTgwhuFMrmTMLx/+i1DQVK7HYqMc6kY46EApwi8X0nIVphzdNoThU3xt6n+N5urG1/gxBdCaKDLavfg==",
       "cpu": [
         "ia32"
       ],
@@ -1221,9 +1233,9 @@
       ]
     },
     "node_modules/@rollup/rollup-win32-x64-gnu": {
-      "version": "4.62.4",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-gnu/-/rollup-win32-x64-gnu-4.62.4.tgz",
-      "integrity": "sha512-qPzHqdj9rfUD+w79dtE07zi/kFwKyCJqplp5K5ygeLTp7jLpAoc16OAH39HSmRC9UpozaecsleI8uAdEj6v2yw==",
+      "version": "4.63.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-gnu/-/rollup-win32-x64-gnu-4.63.1.tgz",
+      "integrity": "sha512-RgroPfMmKlD1RzSDxvwgcPiy2HNQKoYV7OmwIXDsk73uKW5t6B/V8KIy27SMv/FNXFo/oSBtWc9J0X7t91ezZg==",
       "cpu": [
         "x64"
       ],
@@ -1235,9 +1247,9 @@
       ]
     },
     "node_modules/@rollup/rollup-win32-x64-msvc": {
-      "version": "4.62.4",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-msvc/-/rollup-win32-x64-msvc-4.62.4.tgz",
-      "integrity": "sha512-zD6NdeWEByGE9QF9vCrlJ5YQB4oq9q91kPZS37Jwj5hOkvR1lTBSpsKhKDw4IJtbQ35LsTS1HD9DZYGKIshU1Q==",
+      "version": "4.63.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-msvc/-/rollup-win32-x64-msvc-4.63.1.tgz",
+      "integrity": "sha512-at8QVep6S3h5Y6gSbdGU06bRY5WJkf6WUduM9YtvYMbYhB1MOFfUgc6kehitQXzOtMSaT70q7f9ydPhpqu821w==",
       "cpu": [
         "x64"
       ],
@@ -2731,12 +2743,15 @@
       }
     },
     "node_modules/core-js": {
-      "version": "3.49.0",
-      "resolved": "https://registry.npmjs.org/core-js/-/core-js-3.49.0.tgz",
-      "integrity": "sha512-es1U2+YTtzpwkxVLwAFdSpaIMyQaq0PBgm3YD1W3Qpsn1NAmO3KSgZfu+oGSWVu6NvLHoHCV/aYcsE5wiB7ALg==",
+      "version": "3.50.0",
+      "resolved": "https://registry.npmjs.org/core-js/-/core-js-3.50.0.tgz",
+      "integrity": "sha512-BRWgOLKkFeCgRudR6zrs8p9XJZcE14grzKMMssoYrk6krtuEZ7MTKPIY5RzOnqsEKIR9kst7wNzphttraT+Yqw==",
       "dev": true,
       "hasInstallScript": true,
       "license": "MIT",
+      "engines": {
+        "node": "*"
+      },
       "funding": {
         "type": "opencollective",
         "url": "https://opencollective.com/core-js"
@@ -2931,9 +2946,9 @@
       }
     },
     "node_modules/devtools-protocol": {
-      "version": "0.0.1653615",
-      "resolved": "https://registry.npmjs.org/devtools-protocol/-/devtools-protocol-0.0.1653615.tgz",
-      "integrity": "sha512-pGVkY3T/qXxAp2nFPodwYqOevk6ncNMSmvL8QfRCx5ZWGd6Vor7AFNmyaA8Zs6uJyP1QAfjuLandCgvSix1BNA==",
+      "version": "0.0.1666840",
+      "resolved": "https://registry.npmjs.org/devtools-protocol/-/devtools-protocol-0.0.1666840.tgz",
+      "integrity": "sha512-gCcO42XCHKEs7Ag0S7aGYsnJ7hlgrO3qderYqeiY0Eqk+0GFfuvT13IA0hHreJTa2KCdDVyGMeOhdMNmrrTjVg==",
       "dev": true,
       "license": "BSD-3-Clause"
     },
@@ -5509,9 +5524,9 @@
       "license": "MIT"
     },
     "node_modules/modern-tar": {
-      "version": "0.8.1",
-      "resolved": "https://registry.npmjs.org/modern-tar/-/modern-tar-0.8.1.tgz",
-      "integrity": "sha512-G/OFF6yTWgdGWS5IvhcrETxsgjsUdotEtHhW2nffB5vP5uCwkhnn38qRO7h6RF4uV0UlqyHx/bq2Vd5Oco4uoQ==",
+      "version": "0.8.5",
+      "resolved": "https://registry.npmjs.org/modern-tar/-/modern-tar-0.8.5.tgz",
+      "integrity": "sha512-snEhs+6G5Tjd4I7tLCDOaoln2RgE0bD19RzEKgvgK2hZ5VKy3MpLhLTZ2fWpXSTg4K2cyPwp+VHATFJhxfnOeA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -6034,18 +6049,18 @@
       }
     },
     "node_modules/puppeteer": {
-      "version": "25.6.0",
-      "resolved": "https://registry.npmjs.org/puppeteer/-/puppeteer-25.6.0.tgz",
-      "integrity": "sha512-TXUolDddU4AwISjOOrGk2AhJDpbM/ZDt2KvGIqz74EOk+8bKwXFo+acUvP1sQx3hUda7owOeNuuT1UnJT1o0qA==",
+      "version": "25.10.0",
+      "resolved": "https://registry.npmjs.org/puppeteer/-/puppeteer-25.10.0.tgz",
+      "integrity": "sha512-9ZfkiaZDQWpGPJp9XTS+Bkn/D78hPvYmtjPfIBeybn05oeY6Jj7aiSbYdfcSQD2UMvC0vE7Yi9PSDo179euRzw==",
       "dev": true,
       "hasInstallScript": true,
       "license": "Apache-2.0",
       "dependencies": {
-        "@puppeteer/browsers": "3.2.0",
+        "@puppeteer/browsers": "3.2.2",
         "chromium-bidi": "17.0.2",
-        "devtools-protocol": "0.0.1653615",
+        "devtools-protocol": "0.0.1666840",
         "lilconfig": "^3.1.3",
-        "puppeteer-core": "25.6.0",
+        "puppeteer-core": "25.10.0",
         "typed-query-selector": "^2.12.2"
       },
       "bin": {
@@ -6056,18 +6071,18 @@
       }
     },
     "node_modules/puppeteer-core": {
-      "version": "25.6.0",
-      "resolved": "https://registry.npmjs.org/puppeteer-core/-/puppeteer-core-25.6.0.tgz",
-      "integrity": "sha512-GJ67rjZdVQzZmD2Ab0cgttfQN9j387QYMv3t6MN3/4nmjursNt6M5Utj4/T/4y0AwNrSwJzjw6Q/zuWFEIizOg==",
+      "version": "25.10.0",
+      "resolved": "https://registry.npmjs.org/puppeteer-core/-/puppeteer-core-25.10.0.tgz",
+      "integrity": "sha512-Hy5eMQshOEMil4JUUx03h5pw1HYkYCso1RG/gcpPlFSd4cYPOcopxcXEAxpLPOkOPJb9LIJtwxuj66bSdvknFg==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
-        "@puppeteer/browsers": "3.2.0",
+        "@puppeteer/browsers": "3.2.2",
         "chromium-bidi": "17.0.2",
-        "devtools-protocol": "0.0.1653615",
+        "devtools-protocol": "0.0.1666840",
         "typed-query-selector": "^2.12.2",
-        "webdriver-bidi-protocol": "0.4.2",
-        "ws": "^8.21.1"
+        "webdriver-bidi-protocol": "0.4.3",
+        "ws": "^8.21.3"
       },
       "engines": {
         "node": ">=22.12.0"
@@ -6245,9 +6260,9 @@
       }
     },
     "node_modules/rollup": {
-      "version": "4.62.4",
-      "resolved": "https://registry.npmjs.org/rollup/-/rollup-4.62.4.tgz",
-      "integrity": "sha512-RXOqwaPsBGjMNMa4sQjDjHieHEZDFoj/Rdr46l2MU5DfEs16wHJPC2RPTPHWhNl+M3aI472LLqFkFKut4SblOg==",
+      "version": "4.63.1",
+      "resolved": "https://registry.npmjs.org/rollup/-/rollup-4.63.1.tgz",
+      "integrity": "sha512-3Df9jsstwhccuEfmAMi9l8XUh/GOkVObmFTU7CCVBysEbcOZLl84jCtaAZMcPiMz2EGKsATzQcU+Xr3n/wU6cg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -6262,31 +6277,31 @@
       },
       "optionalDependencies": {
         "@napi-rs/lzma-linux-x64-gnu": "1.5.1",
-        "@rollup/rollup-android-arm-eabi": "4.62.4",
-        "@rollup/rollup-android-arm64": "4.62.4",
-        "@rollup/rollup-darwin-arm64": "4.62.4",
-        "@rollup/rollup-darwin-x64": "4.62.4",
-        "@rollup/rollup-freebsd-arm64": "4.62.4",
-        "@rollup/rollup-freebsd-x64": "4.62.4",
-        "@rollup/rollup-linux-arm-gnueabihf": "4.62.4",
-        "@rollup/rollup-linux-arm-musleabihf": "4.62.4",
-        "@rollup/rollup-linux-arm64-gnu": "4.62.4",
-        "@rollup/rollup-linux-arm64-musl": "4.62.4",
-        "@rollup/rollup-linux-loong64-gnu": "4.62.4",
-        "@rollup/rollup-linux-loong64-musl": "4.62.4",
-        "@rollup/rollup-linux-ppc64-gnu": "4.62.4",
-        "@rollup/rollup-linux-ppc64-musl": "4.62.4",
-        "@rollup/rollup-linux-riscv64-gnu": "4.62.4",
-        "@rollup/rollup-linux-riscv64-musl": "4.62.4",
-        "@rollup/rollup-linux-s390x-gnu": "4.62.4",
-        "@rollup/rollup-linux-x64-gnu": "4.62.4",
-        "@rollup/rollup-linux-x64-musl": "4.62.4",
-        "@rollup/rollup-openbsd-x64": "4.62.4",
-        "@rollup/rollup-openharmony-arm64": "4.62.4",
-        "@rollup/rollup-win32-arm64-msvc": "4.62.4",
-        "@rollup/rollup-win32-ia32-msvc": "4.62.4",
-        "@rollup/rollup-win32-x64-gnu": "4.62.4",
-        "@rollup/rollup-win32-x64-msvc": "4.62.4",
+        "@rollup/rollup-android-arm-eabi": "4.63.1",
+        "@rollup/rollup-android-arm64": "4.63.1",
+        "@rollup/rollup-darwin-arm64": "4.63.1",
+        "@rollup/rollup-darwin-x64": "4.63.1",
+        "@rollup/rollup-freebsd-arm64": "4.63.1",
+        "@rollup/rollup-freebsd-x64": "4.63.1",
+        "@rollup/rollup-linux-arm-gnueabihf": "4.63.1",
+        "@rollup/rollup-linux-arm-musleabihf": "4.63.1",
+        "@rollup/rollup-linux-arm64-gnu": "4.63.1",
+        "@rollup/rollup-linux-arm64-musl": "4.63.1",
+        "@rollup/rollup-linux-loong64-gnu": "4.63.1",
+        "@rollup/rollup-linux-loong64-musl": "4.63.1",
+        "@rollup/rollup-linux-ppc64-gnu": "4.63.1",
+        "@rollup/rollup-linux-ppc64-musl": "4.63.1",
+        "@rollup/rollup-linux-riscv64-gnu": "4.63.1",
+        "@rollup/rollup-linux-riscv64-musl": "4.63.1",
+        "@rollup/rollup-linux-s390x-gnu": "4.63.1",
+        "@rollup/rollup-linux-x64-gnu": "4.63.1",
+        "@rollup/rollup-linux-x64-musl": "4.63.1",
+        "@rollup/rollup-openbsd-x64": "4.63.1",
+        "@rollup/rollup-openharmony-arm64": "4.63.1",
+        "@rollup/rollup-win32-arm64-msvc": "4.63.1",
+        "@rollup/rollup-win32-ia32-msvc": "4.63.1",
+        "@rollup/rollup-win32-x64-gnu": "4.63.1",
+        "@rollup/rollup-win32-x64-msvc": "4.63.1",
         "fsevents": "~2.3.2"
       }
     },
@@ -7347,9 +7362,9 @@
       }
     },
     "node_modules/webdriver-bidi-protocol": {
-      "version": "0.4.2",
-      "resolved": "https://registry.npmjs.org/webdriver-bidi-protocol/-/webdriver-bidi-protocol-0.4.2.tgz",
-      "integrity": "sha512-VSV+fzfChirL3e7jay2yUC7B4HQCGtEWEg/MSSQbK+qWbqeGlRLlXTzPpYr3XGUvbpDHumWZBJxgesg4N7dbtA==",
+      "version": "0.4.3",
+      "resolved": "https://registry.npmjs.org/webdriver-bidi-protocol/-/webdriver-bidi-protocol-0.4.3.tgz",
+      "integrity": "sha512-uuN0goWfxP22B7J/uAgBpOYNPttC+XVseYE+rSY5+rQ+YBeVz/VORw8WbmLVcqW78zNg5A4qnjNXYUWR3il2ig==",
       "dev": true,
       "license": "Apache-2.0"
     },
@@ -7514,9 +7529,9 @@
       "license": "ISC"
     },
     "node_modules/ws": {
-      "version": "8.21.1",
-      "resolved": "https://registry.npmjs.org/ws/-/ws-8.21.1.tgz",
-      "integrity": "sha512-+0NTnW77fFN/DjQi6k/Sq/Yvk4Sgajw7urW8V+asjXnRgDs9gyGkdb7EzgfhA4goXsRIZKE28fzIXBHEzhuiWw==",
+      "version": "8.21.3",
+      "resolved": "https://registry.npmjs.org/ws/-/ws-8.21.3.tgz",
+      "integrity": "sha512-201TZ/kPWxoPr/OKWjquZR1SWKXcvxdH+e1xrx89b3YbmzLMFCLfnaG1HFIgWzJOEWZ7MvpK++odZufgYR50Rw==",
       "dev": true,
       "license": "MIT",
       "engines": {
diff --git a/package.json b/package.json
index acf015a7..8585c484 100644
--- a/package.json
+++ b/package.json
@@ -68,15 +68,15 @@
     "@types/yargs": "^17.0.33",
     "@typescript-eslint/eslint-plugin": "^8.43.0",
     "@typescript-eslint/parser": "^8.43.0",
-    "core-js": "3.49.0",
+    "core-js": "3.50.0",
     "eslint": "^10.7.0",
     "eslint-import-resolver-typescript": "^4.4.4",
     "eslint-plugin-import": "^2.32.0",
     "globals": "^17.0.0",
     "lighthouse": "13.4.1",
     "prettier": "^3.6.2",
-    "puppeteer": "25.6.0",
-    "rollup": "4.62.4",
+    "puppeteer": "25.10.0",
+    "rollup": "4.63.1",
     "rollup-plugin-cleanup": "^3.2.1",
     "rollup-plugin-license": "^3.6.0",
     "semver": "^7.7.4",
@@ -86,6 +86,18 @@
     "yargs": "18.1.0",
     "zod": "^3.25.76"
   },
+  "peerDependencies": {
+    "@blackwell-systems/gcf": "^2.2.2",
+    "@toon-format/toon": "^4.1.0"
+  },
+  "peerDependenciesMeta": {
+    "@toon-format/toon": {
+      "optional": true
+    },
+    "@blackwell-systems/gcf": {
+      "optional": true
+    }
+  },
   "engines": {
     "node": "^20.19.0 || ^22.12.0 || >=23"
   },
@@ -94,5 +106,12 @@
       "eslint": "$eslint"
     },
     "puppeteer-core": "$puppeteer"
+  },
+  "allowScripts": {
+    "core-js": false,
+    "@google/genai": false,
+    "protobufjs": false,
+    "unrs-resolver": false,
+    "puppeteer": true
   }
 }
diff --git a/plugin.json b/plugin.json
new file mode 100644
index 00000000..1d2d40fb
--- /dev/null
+++ b/plugin.json
@@ -0,0 +1,20 @@
+{
+  "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
+  "name": "chrome-devtools",
+  "version": "1.9.0",
+  "description": "Reliable Chrome automation, debugging, and performance analysis for AI agents.",
+  "author": {
+    "name": "Google Chrome",
+    "url": "https://developer.chrome.com/"
+  },
+  "homepage": "https://developer.chrome.com/docs/devtools/agents",
+  "repository": "https://github.com/ChromeDevTools/chrome-devtools-mcp",
+  "license": "Apache-2.0",
+  "keywords": [
+    "browser",
+    "chrome",
+    "debugging",
+    "mcp",
+    "performance"
+  ]
+}
diff --git a/scripts/eval_gemini.ts b/scripts/eval_gemini.ts
index 3fcd4c45..6041feb8 100644
--- a/scripts/eval_gemini.ts
+++ b/scripts/eval_gemini.ts
@@ -19,8 +19,8 @@ const ROOT_DIR = path.resolve(import.meta.dirname, '..');
 const SCENARIOS_DIR = path.join(import.meta.dirname, 'eval_scenarios');
 const SKILL_PATH = path.join(ROOT_DIR, 'skills', 'chrome-devtools', 'SKILL.md');
 
-import type {CapturedFunctionCall, TestScenario} from './eval_result.ts';
-import {Result} from './eval_result.ts';
+import type {CapturedFunctionCall, TestScenario} from './eval_result.js';
+import {Result} from './eval_result.js';
 export type {CapturedFunctionCall, TestScenario};
 export {Result};
 
@@ -41,6 +41,7 @@ async function runSingleScenario(
   modelId: string,
   debug: boolean,
   includeSkill: boolean,
+  skillPath: string = SKILL_PATH,
   extraServerArgs: string[] = [],
 ): Promise<void> {
   const debugLog = (...args: unknown[]) => {
@@ -62,12 +63,12 @@ async function runSingleScenario(
 
     // Prepend skill content if requested
     if (includeSkill) {
-      if (!fs.existsSync(SKILL_PATH)) {
+      if (!fs.existsSync(skillPath)) {
         throw new Error(
-          `Skill file not found at ${SKILL_PATH}. Please ensure the skill file exists.`,
+          `Skill file not found at ${skillPath}. Please ensure the skill file exists.`,
         );
       }
-      const skillContent = fs.readFileSync(SKILL_PATH, 'utf-8');
+      const skillContent = fs.readFileSync(skillPath, 'utf-8');
       scenario.prompt = `${skillContent}\n\n---\n\n${scenario.prompt}`;
     }
 
@@ -106,7 +107,7 @@ async function runSingleScenario(
     });
     env['CHROME_DEVTOOLS_MCP_NO_USAGE_STATISTICS'] = 'true';
 
-    const args = [serverPath];
+    const args = [serverPath, '--isolated'];
     if (!debug) {
       args.push('--headless');
     }
@@ -200,6 +201,9 @@ async function main() {
         type: 'boolean',
         default: false,
       },
+      'skill-path': {
+        type: 'string',
+      },
       'server-args': {
         type: 'string',
       },
@@ -210,7 +214,10 @@ async function main() {
   const modelId = values.model;
   const debug = values.debug;
   const repeat = values.repeat;
-  const includeSkill = values['include-skill'];
+  const includeSkill = values['include-skill'] || Boolean(values['skill-path']);
+  const skillPath = values['skill-path']
+    ? path.resolve(ROOT_DIR, values['skill-path'])
+    : SKILL_PATH;
   const extraServerArgs = values['server-args']
     ? values['server-args'].split(/\s+/)
     : [];
@@ -245,6 +252,7 @@ async function main() {
             modelId,
             debug,
             includeSkill,
+            skillPath,
             extraServerArgs,
           );
           console.log(`✔ ${path.relative(ROOT_DIR, scenarioPath)} (Run ${i})`);
diff --git a/scripts/eval_result.ts b/scripts/eval_result.ts
index 9b734b29..8460b56d 100644
--- a/scripts/eval_result.ts
+++ b/scripts/eval_result.ts
@@ -22,7 +22,7 @@ export class Result {
   }
 
   get hasPageIdRouting(): boolean {
-    return this.serverArgs.includes('--experimental-page-id-routing');
+    return !this.serverArgs.includes('--no-page-id-routing');
   }
 
   get remainingCalls(): CapturedFunctionCall[] {
@@ -31,7 +31,7 @@ export class Result {
 
   /**
    * Consumes initial page navigation/setup boilerplate.
-   * - Ignores/skips leading list_pages calls.
+   * - Ignores/skips leading or trailing list_pages calls.
    * - Asserts that new_page or navigate_page was called.
    * - Determines the expected pageId.
    * - Returns the active pageId.
@@ -49,6 +49,10 @@ export class Result {
     );
     this.nextCallIndex++;
 
+    if (this.calls[this.nextCallIndex]?.name === 'list_pages') {
+      this.nextCallIndex++;
+    }
+
     const isNewPage = navCall.name === 'new_page';
     let pageId: number | undefined;
     if (this.hasPageIdRouting) {
@@ -102,6 +106,6 @@ export interface TestScenario {
     path: string;
     htmlContent: string;
   };
-  /** Extra CLI flags passed to the MCP server (e.g. '--experimental-page-id-routing'). */
+  /** Extra CLI flags passed to the MCP server (e.g. '--no-page-id-routing'). */
   serverArgs?: string[];
 }
diff --git a/scripts/eval_scenarios/cookie_banner_conformance_test.ts b/scripts/eval_scenarios/cookie_banner_conformance_test.ts
new file mode 100644
index 00000000..0871ed7c
--- /dev/null
+++ b/scripts/eval_scenarios/cookie_banner_conformance_test.ts
@@ -0,0 +1,52 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import assert from 'node:assert';
+
+import type {TestScenario} from '../eval_gemini.js';
+
+export const scenario: TestScenario = {
+  prompt:
+    'Open <TEST_URL> in an isolated browser context called banner-test to check the cookie consent banner, take a snapshot, and click Decline.',
+  maxTurns: 5,
+  htmlRoute: {
+    path: '/cookie_banner_test.html',
+    htmlContent: `
+      <h1>Cookie Consent Test</h1>
+      <div id="cookie-banner">
+        <p>We use cookies to improve your experience.</p>
+        <button id="accept-btn">Accept All</button>
+        <button id="decline-btn">Decline</button>
+      </div>
+    `,
+  },
+  expectations: result => {
+    const newPageCall = result.calls.find(c => c.name === 'new_page');
+    assert.ok(
+      newPageCall,
+      'Expected new_page to be called for isolated context testing',
+    );
+    assert.strictEqual(
+      newPageCall.args.isolatedContext,
+      'banner-test',
+      "Expected isolatedContext to be 'banner-test'",
+    );
+
+    const pageId = result.consumePageNavigation();
+    assert.ok(result.remainingCalls.length >= 2);
+    const snapshotCall = result.calls.find(c => c.name === 'take_snapshot');
+    assert.ok(snapshotCall, 'Expected take_snapshot to be called');
+    const clickCall = result.calls.find(c => c.name === 'click');
+    assert.ok(clickCall, 'Expected click to be called');
+    assert.ok(
+      clickCall.args.uid,
+      'Expected click to specify a valid element uid',
+    );
+    if (result.hasPageIdRouting && pageId !== undefined) {
+      assert.strictEqual(clickCall.args.pageId, pageId);
+    }
+  },
+};
diff --git a/scripts/eval_scenarios/cookie_debugging_test.ts b/scripts/eval_scenarios/cookie_debugging_test.ts
new file mode 100644
index 00000000..2947a56c
--- /dev/null
+++ b/scripts/eval_scenarios/cookie_debugging_test.ts
@@ -0,0 +1,41 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import assert from 'node:assert';
+
+import type {TestScenario} from '../eval_gemini.js';
+
+export const scenario: TestScenario = {
+  prompt:
+    'Navigate to <TEST_URL> and inspect the network request headers to diagnose the authentication failure.',
+  maxTurns: 6,
+  htmlRoute: {
+    path: '/cookie_auth_test.html',
+    htmlContent: `
+      <h1>Authentication Test</h1>
+      <script>
+        fetch('/api/user', {
+          headers: { 'Accept': 'application/json' },
+          credentials: 'include'
+        });
+      </script>
+    `,
+  },
+  expectations: result => {
+    result.consumePageNavigation();
+    const listRequestsCall = result.calls.find(
+      c => c.name === 'list_network_requests',
+    );
+    assert.ok(listRequestsCall, 'Expected list_network_requests to be called');
+    const getRequestCall = result.calls.find(
+      c => c.name === 'get_network_request',
+    );
+    assert.ok(
+      getRequestCall,
+      'Expected get_network_request to be called to inspect headers',
+    );
+  },
+};
diff --git a/scripts/eval_scenarios/cookie_httponly_trigger_test.ts b/scripts/eval_scenarios/cookie_httponly_trigger_test.ts
new file mode 100644
index 00000000..0411e20d
--- /dev/null
+++ b/scripts/eval_scenarios/cookie_httponly_trigger_test.ts
@@ -0,0 +1,31 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import assert from 'node:assert';
+
+import type {TestScenario} from '../eval_gemini.js';
+
+export const scenario: TestScenario = {
+  prompt:
+    'Reload the page <TEST_URL> and inspect the network request headers to view the active HttpOnly cookie.',
+  maxTurns: 4,
+  htmlRoute: {
+    path: '/cookie_httponly_test.html',
+    htmlContent: `
+      <h1>HttpOnly Session Test</h1>
+    `,
+  },
+  expectations: result => {
+    result.consumePageNavigation();
+    const getRequestCall = result.calls.find(
+      c => c.name === 'get_network_request',
+    );
+    assert.ok(
+      getRequestCall,
+      'Expected get_network_request to be called to inspect HttpOnly headers',
+    );
+  },
+};
diff --git a/scripts/eval_scenarios/cookie_issues_audit_test.ts b/scripts/eval_scenarios/cookie_issues_audit_test.ts
new file mode 100644
index 00000000..4682c558
--- /dev/null
+++ b/scripts/eval_scenarios/cookie_issues_audit_test.ts
@@ -0,0 +1,30 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import assert from 'node:assert';
+
+import type {TestScenario} from '../eval_gemini.ts';
+
+export const scenario: TestScenario = {
+  prompt:
+    'Navigate to <TEST_URL> and inspect the console issues to check for cookie security or SameSite policy warnings.',
+  maxTurns: 3,
+  htmlRoute: {
+    path: '/cookie_issues_test.html',
+    htmlContent: `
+      <h1>Cookie Issues Test</h1>
+      <p>Testing SameSite and CHIPS issues</p>
+    `,
+  },
+  expectations: result => {
+    const pageId = result.consumePageNavigation();
+    assert.ok(result.remainingCalls.length >= 1);
+    result.assertNextCall('list_console_messages', {
+      types: ['issue'],
+      ...(result.hasPageIdRouting ? {pageId} : {}),
+    });
+  },
+};
diff --git a/scripts/eval_scenarios/page_focus_keyboard_test.ts b/scripts/eval_scenarios/page_focus_keyboard_test.ts
index f56c7c62..9812b868 100644
--- a/scripts/eval_scenarios/page_focus_keyboard_test.ts
+++ b/scripts/eval_scenarios/page_focus_keyboard_test.ts
@@ -9,7 +9,6 @@ import assert from 'node:assert';
 import type {TestScenario} from '../eval_gemini.ts';
 
 export const scenario: TestScenario = {
-  serverArgs: ['--experimental-page-id-routing'],
   prompt: `Open two pages in the same isolated context "session":
 - Page 1 at data:text/html,<textarea id="ta"></textarea>
 - Page 2 at data:text/html,<h1>Other</h1>
diff --git a/scripts/eval_scenarios/page_id_routing_concurrent_form_test.ts b/scripts/eval_scenarios/page_id_routing_concurrent_form_test.ts
new file mode 100644
index 00000000..2443f460
--- /dev/null
+++ b/scripts/eval_scenarios/page_id_routing_concurrent_form_test.ts
@@ -0,0 +1,70 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import assert from 'node:assert';
+
+import type {TestScenario} from '../eval_gemini.ts';
+
+const PAGE_A_URL =
+  'data:text/html,<form id="login-form"><input type="text" id="username" placeholder="Username" /><input type="password" id="password" placeholder="Password" /><button type="submit" id="submit-login">Log In</button></form>';
+const PAGE_B_URL =
+  'data:text/html,<form id="feedback-form"><input type="text" id="email" placeholder="Email" /><textarea id="comments" placeholder="Comments"></textarea><button type="submit" id="submit-feedback">Send</button></form>';
+
+export const scenario: TestScenario = {
+  prompt: `Open two new pages in isolated contexts:
+- Page A (isolatedContext "login_ctx") at ${PAGE_A_URL}
+- Page B (isolatedContext "feedback_ctx") at ${PAGE_B_URL}
+
+Take a snapshot of both pages. Then, perform the following actions individually in the exact order specified below:
+1. Fill "admin" into the Username input on Page A.
+2. Fill "user@example.com" into the Email input on Page B.
+3. Fill "secret123" into the Password input on Page A.
+4. Fill "Great tools!" into the Comments textarea on Page B.
+
+Finally, submit both forms by clicking the submit buttons on Page A and Page B.`,
+  maxTurns: 15,
+  expectations: result => {
+    const newPages = result.calls.filter(c => c.name === 'new_page');
+    assert.strictEqual(newPages.length, 2, 'Should open 2 pages');
+    const snapshots = result.calls.filter(c => c.name === 'take_snapshot');
+    assert.ok(snapshots.length >= 2, 'Should snapshot both pages');
+
+    const fills = result.calls.filter(c => c.name === 'fill');
+    assert.strictEqual(
+      fills.length,
+      4,
+      'Should fill 4 inputs across the forms',
+    );
+
+    // Verify that each fill targeted the correct pageId based on its value/element
+    for (const fill of fills) {
+      const value = String(fill.args['value'] || '');
+      if (value === 'admin' || value === 'secret123') {
+        assert.strictEqual(
+          fill.args['pageId'],
+          2,
+          `Filling '${value}' should target login page (pageId 2)`,
+        );
+      } else if (value === 'user@example.com' || value === 'Great tools!') {
+        assert.strictEqual(
+          fill.args['pageId'],
+          3,
+          `Filling '${value}' should target feedback page (pageId 3)`,
+        );
+      } else {
+        assert.fail(`Unexpected fill value: ${value}`);
+      }
+    }
+
+    // Verify no select_page calls were made between the interleaved actions
+    const selects = result.calls.filter(c => c.name === 'select_page');
+    assert.strictEqual(
+      selects.length,
+      0,
+      'Should not use select_page when pageId routing is active',
+    );
+  },
+};
diff --git a/scripts/eval_scenarios/page_id_routing_cross_page_state_test.ts b/scripts/eval_scenarios/page_id_routing_cross_page_state_test.ts
new file mode 100644
index 00000000..9f0fda54
--- /dev/null
+++ b/scripts/eval_scenarios/page_id_routing_cross_page_state_test.ts
@@ -0,0 +1,93 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import assert from 'node:assert';
+
+import type {TestScenario} from '../eval_gemini.ts';
+
+const PAGE_COUNTER =
+  'data:text/html,<h1>Counter Page</h1><button id="inc-btn" onclick="document.getElementById(\'count\').innerText = parseInt(document.getElementById(\'count\').innerText) + 1">Increment</button><div id="count">0</div>';
+const PAGE_INPUT =
+  'data:text/html,<h1>Input Page</h1><label for="val-input">Enter Counter Value:</label><input type="text" id="val-input" /><button id="submit-btn">Submit</button>';
+
+export const scenario: TestScenario = {
+  prompt: `Open two new pages:
+- Page A at ${PAGE_COUNTER}
+- Page B at ${PAGE_INPUT}
+
+Take snapshot of both pages and then perform the following steps:
+1. Click the "Increment" button on Page A twice.
+2. Take a snapshot of Page A to read the updated counter value.
+3. On Page B, fill that exact counter value into the input field, and click the "Submit" button.`,
+  maxTurns: 12,
+  expectations: result => {
+    const newPages = result.calls.filter(c => c.name === 'new_page');
+    assert.strictEqual(newPages.length, 2, 'Should open 2 pages');
+
+    const clicks = result.calls.filter(c => c.name === 'click');
+    assert.ok(
+      clicks.length >= 3,
+      'Should click increment twice and then submit',
+    );
+
+    // First click and second click should target the increment button on Page A
+    const counterClicks = clicks.filter(c => c.args['pageId'] === 2);
+    assert.strictEqual(
+      counterClicks.length,
+      2,
+      'Should click increment button on Page A exactly twice',
+    );
+
+    // There should be a snapshot of Page A to read the value
+    const snapshots = result.calls.filter(c => c.name === 'take_snapshot');
+    const counterSnapshot = snapshots.find(s => s.args['pageId'] === 2);
+    assert.ok(
+      counterSnapshot,
+      'Should snapshot Page A to read the counter value',
+    );
+
+    // The fill and final click should target Page B
+    const fills = result.calls.filter(
+      c => c.name === 'fill' || c.name === 'fill_form',
+    );
+    assert.strictEqual(
+      fills.length,
+      1,
+      'Should fill the input field on Page B',
+    );
+    assert.strictEqual(fills[0].args['pageId'], 3, 'Fill should target Page B');
+
+    let filledValue = '';
+    if (fills[0].name === 'fill_form') {
+      const elements = fills[0].args['elements'];
+      assert.ok(Array.isArray(elements), 'elements should be an array');
+      filledValue = elements[0]['value'];
+    } else if (fills[0].name === 'fill') {
+      filledValue = String(fills[0].args['value']);
+    }
+
+    assert.strictEqual(
+      filledValue,
+      '2',
+      'Should fill the value "2" (since we incremented twice)',
+    );
+
+    const finalClick = clicks[clicks.length - 1];
+    assert.strictEqual(
+      finalClick.args['pageId'],
+      3,
+      'Submit click should target Page B',
+    );
+
+    // Verify no select_page calls were made between the interleaved actions
+    const selects = result.calls.filter(c => c.name === 'select_page');
+    assert.strictEqual(
+      selects.length,
+      0,
+      'Should not use select_page when pageId routing is active',
+    );
+  },
+};
diff --git a/scripts/eval_scenarios/page_id_routing_test.ts b/scripts/eval_scenarios/page_id_routing_test.ts
index a65c9e83..864c6bf6 100644
--- a/scripts/eval_scenarios/page_id_routing_test.ts
+++ b/scripts/eval_scenarios/page_id_routing_test.ts
@@ -9,7 +9,6 @@ import assert from 'node:assert';
 import type {TestScenario} from '../eval_gemini.ts';
 
 export const scenario: TestScenario = {
-  serverArgs: ['--experimental-page-id-routing'],
   prompt: `Open two new pages in isolated contexts:
 - Page A (isolatedContext "contextA") at data:text/html,<button>Click A</button>
 - Page B (isolatedContext "contextB") at data:text/html,<button>Click B</button>
diff --git a/scripts/generate-cli.ts b/scripts/generate-cli.ts
index 2afd354f..15cf2d8d 100644
--- a/scripts/generate-cli.ts
+++ b/scripts/generate-cli.ts
@@ -12,18 +12,17 @@ import path from 'node:path';
 import {Client} from '@modelcontextprotocol/sdk/client/index.js';
 import {StdioClientTransport} from '@modelcontextprotocol/sdk/client/stdio.js';
 
-import {parseArguments} from '../build/src/bin/chrome-devtools-mcp-cli-options.js';
-import {buildFlag} from '../build/src/index.js';
+import {mcpOptions, parseArguments} from '../build/src/config/mcp-options.js';
 import {
-  labels,
-  ToolCategory,
-  OFF_BY_DEFAULT_CATEGORIES,
-} from '../build/src/tools/categories.js';
+  isCategoryOffByDefault,
+  categoryToFlagName,
+} from '../build/src/config/category-options.js';
+import {labels, ToolCategory} from '../build/src/tools/categories.js';
 import {createTools} from '../build/src/tools/tools.js';
 
 const OUTPUT_PATH = path.join(
   import.meta.dirname,
-  '../src/bin/chrome-devtools-cli-options.ts',
+  '../src/config/cli-options.ts',
 );
 
 async function fetchTools() {
@@ -110,7 +109,7 @@ function schemaToCLIOptions(schema: JsonSchema): CliOption[] {
 async function generateCli() {
   const tools = await fetchTools();
 
-  const staticTools = createTools(parseArguments());
+  const staticTools = createTools(parseArguments('0.0.0', [], {}));
   const toolNameToCategoryEnum = new Map<string, string>();
   const toolNameToConditions = new Map<string, string[]>();
 
@@ -168,15 +167,18 @@ async function generateCli() {
     let description = tool.description;
     const requiredFlags: string[] = [];
 
-    const isOffByDefault = OFF_BY_DEFAULT_CATEGORIES.includes(categoryEnum);
+    const isOffByDefault = isCategoryOffByDefault(categoryEnum);
     if (isOffByDefault) {
-      const categoryFlag = buildFlag(categoryEnum);
+      const categoryFlag = categoryToFlagName(categoryEnum);
       requiredFlags.push(`--${categoryFlag}=true`);
     }
 
     const conditions = toolNameToConditions.get(tool.name) || [];
     for (const condition of conditions) {
-      requiredFlags.push(`--${condition}=true`);
+      const option = mcpOptions[condition as keyof typeof mcpOptions];
+      if (!option || !('default' in option) || option.default !== true) {
+        requiredFlags.push(`--${condition}=true`);
+      }
     }
 
     if (requiredFlags.length > 0) {
@@ -199,7 +201,12 @@ async function generateCli() {
  * Modified by Opera Software AS.
  */
 
-// NOTE: do not edit manually. Auto-generated by 'npm run cli:generate'.
+/**
+ * @fileoverview
+ * WARNING: This file is auto-generated by 'npm run cli:generate'.
+ * Do not edit this file manually.
+ */
+
 
 export interface ArgDef {
   name: string;
diff --git a/scripts/generate-docs.ts b/scripts/generate-docs.ts
index 10bfdf33..e496d335 100644
--- a/scripts/generate-docs.ts
+++ b/scripts/generate-docs.ts
@@ -8,19 +8,20 @@ import fs from 'node:fs';
 
 import type {Tool} from '@modelcontextprotocol/sdk/types.js';
 
-import {cliOptions} from '../build/src/bin/chrome-devtools-mcp-cli-options.js';
-import type {ParsedArguments} from '../build/src/bin/chrome-devtools-mcp-cli-options.js';
-import {buildFlag} from '../build/src/index.js';
 import {
-  ToolCategory,
-  OFF_BY_DEFAULT_CATEGORIES,
-  labels,
-} from '../build/src/tools/categories.js';
+  mcpOptions,
+  type ParsedArguments,
+} from '../build/src/config/mcp-options.js';
+import {
+  isCategoryOffByDefault,
+  categoryToFlagName,
+} from '../build/src/config/category-options.js';
+import {ToolCategory, labels} from '../build/src/tools/categories.js';
+import {pageIdSchema} from '../build/src/tools/ToolDefinition.js';
 import {createTools} from '../build/src/tools/tools.js';
 
 const OUTPUT_PATH = './docs/tool-reference.md';
 const SLIM_OUTPUT_PATH = './docs/slim-tool-reference.md';
-const README_PATH = './README.md';
 
 // Extend the MCP Tool type to include our annotations
 interface ToolWithAnnotations extends Tool {
@@ -92,9 +93,19 @@ function addCrossLinks(text: string, tools: ToolWithAnnotations[]): string {
   return result;
 }
 
+function hasOffByDefaultConditions(tool: ToolWithAnnotations): boolean {
+  for (const condition of tool.annotations?.conditions || []) {
+    const option = mcpOptions[condition as keyof typeof mcpOptions];
+    if (!option || !('default' in option) || option.default !== true) {
+      return true;
+    }
+  }
+  return false;
+}
+
 function sortTools(a: ToolWithAnnotations, b: ToolWithAnnotations): number {
-  const aHasConditions = Boolean(a.annotations?.conditions?.length > 0);
-  const bHasConditions = Boolean(b.annotations?.conditions?.length > 0);
+  const aHasConditions = hasOffByDefaultConditions(a);
+  const bHasConditions = hasOffByDefaultConditions(b);
 
   if (aHasConditions && !bHasConditions) {
     return 1;
@@ -106,61 +117,30 @@ function sortTools(a: ToolWithAnnotations, b: ToolWithAnnotations): number {
   return a.name.localeCompare(b.name);
 }
 
-function generateToolsTOC(
-  categories: Record<string, ToolWithAnnotations[]>,
-  sortedCategories: string[],
-): string {
-  let toc = '';
-
-  for (const category of sortedCategories) {
-    const categoryTools = categories[category];
-    const categoryName = labels[category];
-    toc += `- **${categoryName}** (${categoryTools.length} tools)\n`;
-
-    // Sort tools within category for TOC
-    categoryTools.sort(sortTools);
-    for (const tool of categoryTools) {
-      const anchorLink = tool.name.toLowerCase();
-      toc += `  - [\`${tool.name}\`](docs/tool-reference.md#${anchorLink})\n`;
-    }
-  }
-
-  return toc;
-}
-
-function updateReadmeWithToolsTOC(toolsTOC: string): void {
-  const readmeContent = fs.readFileSync(README_PATH, 'utf8');
-
-  const beginMarker = '<!-- BEGIN AUTO GENERATED TOOLS -->';
-  const endMarker = '<!-- END AUTO GENERATED TOOLS -->';
-
-  const beginIndex = readmeContent.indexOf(beginMarker);
-  const endIndex = readmeContent.indexOf(endMarker);
-
-  if (beginIndex === -1 || endIndex === -1) {
-    console.warn('Could not find auto-generated tools markers in README.md');
-    return;
-  }
-
-  const before = readmeContent.substring(0, beginIndex + beginMarker.length);
-  const after = readmeContent.substring(endIndex);
-
-  const updatedContent = before + '\n\n' + toolsTOC + '\n' + after;
-
-  fs.writeFileSync(README_PATH, updatedContent);
-  console.log('Updated README.md with tools table of contents');
+interface OptionConfig {
+  hidden?: boolean;
+  alias?: string;
+  description?: string;
+  describe?: string;
+  type?: string;
+  choices?: string[];
+  default?: unknown;
 }
 
 function generateConfigOptionsMarkdown(): string {
   let markdown = '';
 
-  for (const [optionName, optionConfig] of Object.entries(cliOptions)) {
+  for (const [optionName, optionConfig] of Object.entries(
+    mcpOptions as Record<string, OptionConfig>,
+  )) {
     // Skip hidden options
     if (optionConfig.hidden) {
       continue;
     }
 
-    const aliasText = optionConfig.alias ? `, \`-${optionConfig.alias}\`` : '';
+    const aliasText = optionConfig.alias
+      ? `, \`${optionConfig.alias.length === 1 ? '-' : '--'}${optionConfig.alias}\``
+      : '';
     const description = optionConfig.description || optionConfig.describe || '';
 
     // Convert camelCase to dash-case
@@ -185,7 +165,7 @@ function generateConfigOptionsMarkdown(): string {
     }
 
     // Add default if available
-    markdown += `  - **Default:** \`${optionConfig.default ?? 'false'}\`\n`;
+    markdown += `  - **Default:** \`${optionConfig.defaultDescription ?? optionConfig.default ?? 'false'}\`\n`;
 
     markdown += '\n';
   }
@@ -193,8 +173,9 @@ function generateConfigOptionsMarkdown(): string {
   return markdown.trim();
 }
 
-function updateReadmeWithOptionsMarkdown(optionsMarkdown: string): void {
-  const readmeContent = fs.readFileSync(README_PATH, 'utf8');
+function updateConfigurationWithOptionsMarkdown(optionsMarkdown: string): void {
+  const configPath = './docs/configuration.md';
+  const readmeContent = fs.readFileSync(configPath, 'utf8');
 
   const beginMarker = '<!-- BEGIN AUTO GENERATED OPTIONS -->';
   const endMarker = '<!-- END AUTO GENERATED OPTIONS -->';
@@ -203,7 +184,9 @@ function updateReadmeWithOptionsMarkdown(optionsMarkdown: string): void {
   const endIndex = readmeContent.indexOf(endMarker);
 
   if (beginIndex === -1 || endIndex === -1) {
-    console.warn('Could not find auto-generated options markers in README.md');
+    console.warn(
+      'Could not find auto-generated options markers in ./docs/configuration.md',
+    );
     return;
   }
 
@@ -212,8 +195,8 @@ function updateReadmeWithOptionsMarkdown(optionsMarkdown: string): void {
 
   const updatedContent = before + '\n\n' + optionsMarkdown + '\n\n' + after;
 
-  fs.writeFileSync(README_PATH, updatedContent);
-  console.log('Updated README.md with options markdown');
+  fs.writeFileSync(configPath, updatedContent);
+  console.log('Updated configuration.md with options markdown');
 }
 
 // Helper to convert Zod schema to JSON schema-like object for docs
@@ -328,8 +311,8 @@ async function generateReference(
 
     markdown += `## ${categoryName}\n\n`;
 
-    if (OFF_BY_DEFAULT_CATEGORIES.includes(category)) {
-      const flagName = `--${buildFlag(category)}`;
+    if (isCategoryOffByDefault(category)) {
+      const flagName = `--${categoryToFlagName(category)}`;
 
       markdown += `> NOTE: The ${categoryName} category is not active by default. Use the '${flagName}' flag.\n\n`;
     }
@@ -346,15 +329,18 @@ async function generateReference(
 
         const requiredFlags: string[] = [];
 
-        const isOffByDefault = OFF_BY_DEFAULT_CATEGORIES.includes(category);
+        const isOffByDefault = isCategoryOffByDefault(category);
         if (isOffByDefault) {
-          const categoryFlag = buildFlag(category);
+          const categoryFlag = categoryToFlagName(category);
           requiredFlags.push(`--${categoryFlag}=true`);
         }
 
         const conditions = tool.annotations?.conditions || [];
         for (const condition of conditions) {
-          requiredFlags.push(`--${condition}=true`);
+          const option = mcpOptions[condition as keyof typeof mcpOptions];
+          if (!option || !('default' in option) || option.default !== true) {
+            requiredFlags.push(`--${condition}=true`);
+          }
         }
 
         if (requiredFlags.length > 0) {
@@ -432,7 +418,7 @@ async function generateReference(
 }
 
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
-function getToolsAndCategories(tools: any) {
+function getToolsAndCategories(tools: any, slim = false) {
   // Convert ToolDefinitions to ToolWithAnnotations
   const toolsWithAnnotations: ToolWithAnnotations[] = tools
     .filter(tool => {
@@ -453,8 +439,12 @@ function getToolsAndCategories(tools: any) {
       const properties: Record<string, TypeInfo> = {};
       const required: string[] = [];
 
+      const toolSchema = {
+        ...tool.schema,
+        ...(tool.pageScoped && !slim ? pageIdSchema : {}),
+      };
       for (const [key, schema] of Object.entries(
-        tool.schema as unknown as Record<string, ZodSchema>,
+        toolSchema as unknown as Record<string, ZodSchema>,
       )) {
         const info = getZodTypeInfo(schema);
         properties[key] = info;
@@ -487,8 +477,8 @@ function getToolsAndCategories(tools: any) {
   // Sort categories using the enum order
   const categoryOrder = Object.values(ToolCategory);
   const sortedCategories = Object.keys(categories).sort((a, b) => {
-    const aOff = OFF_BY_DEFAULT_CATEGORIES.includes(a as ToolCategory);
-    const bOff = OFF_BY_DEFAULT_CATEGORIES.includes(b as ToolCategory);
+    const aOff = isCategoryOffByDefault(a);
+    const bOff = isCategoryOffByDefault(b);
 
     if (aOff !== bOff) {
       return aOff ? 1 : -1;
@@ -518,7 +508,9 @@ async function generateToolDocumentation(): Promise<void> {
 
     {
       const {toolsWithAnnotations, categories, sortedCategories} =
-        getToolsAndCategories(createTools({slim: false} as ParsedArguments));
+        getToolsAndCategories(
+          createTools({slim: false, pageIdRouting: true} as ParsedArguments),
+        );
       await generateReference(
         'Chrome DevTools MCP Tool Reference',
         OUTPUT_PATH,
@@ -526,15 +518,14 @@ async function generateToolDocumentation(): Promise<void> {
         categories,
         sortedCategories,
       );
-
-      // Generate tools TOC and update README
-      const toolsTOC = generateToolsTOC(categories, sortedCategories);
-      updateReadmeWithToolsTOC(toolsTOC);
     }
 
     {
       const {toolsWithAnnotations, categories, sortedCategories} =
-        getToolsAndCategories(createTools({slim: true} as ParsedArguments));
+        getToolsAndCategories(
+          createTools({slim: true} as ParsedArguments),
+          true,
+        );
       await generateReference(
         'Chrome DevTools MCP Slim Tool Reference',
         SLIM_OUTPUT_PATH,
@@ -546,7 +537,7 @@ async function generateToolDocumentation(): Promise<void> {
 
     // Generate and update configuration options
     const optionsMarkdown = generateConfigOptionsMarkdown();
-    updateReadmeWithOptionsMarkdown(optionsMarkdown);
+    updateConfigurationWithOptionsMarkdown(optionsMarkdown);
     process.exit(0);
   } catch (error) {
     console.error('Error generating documentation:', error);
diff --git a/scripts/update_metrics.ts b/scripts/update_metrics.ts
index f6bb5ef0..75037831 100644
--- a/scripts/update_metrics.ts
+++ b/scripts/update_metrics.ts
@@ -7,10 +7,7 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 
-import {
-  cliOptions,
-  parseArguments,
-} from '../build/src/bin/chrome-devtools-mcp-cli-options.js';
+import {mcpOptions, parseArguments} from '../build/src/config/mcp-options.js';
 import {ErrorCode} from '../build/src/telemetry/errors.js';
 import {
   getPossibleFlagMetrics,
@@ -92,7 +89,7 @@ function writeFlagUsageMetrics() {
     }
   }
 
-  const newMetrics = getPossibleFlagMetrics(cliOptions);
+  const newMetrics = getPossibleFlagMetrics(mcpOptions);
   const mergedMetrics = applyToExisting<FlagMetric>(
     existingMetrics,
     newMetrics,
diff --git a/skills/a11y-debugging/SKILL.md b/skills/a11y-debugging/SKILL.md
index 183a78f2..324c81c2 100644
--- a/skills/a11y-debugging/SKILL.md
+++ b/skills/a11y-debugging/SKILL.md
@@ -5,6 +5,8 @@ description: Uses Chrome DevTools MCP for accessibility (a11y) debugging and aud
 
 ## Core Concepts
 
+**Page Targeting**: Page-scoped tools (`take_snapshot`, `list_console_messages`, `evaluate_script`, `press_key`, `take_screenshot`, `lighthouse_audit`, etc.) require a `pageId` parameter. Retrieve available page IDs using `list_pages` or from `new_page`.
+
 **Accessibility Tree vs DOM**: Visually hiding an element (e.g., `CSS opacity: 0`) behaves differently for screen readers than `display: none` or `aria-hidden="true"`. The `take_snapshot` tool returns the accessibility tree of the page, which represents what assistive technologies "see", making it the most reliable source of truth for semantic structure.
 
 **Reading web.dev documentation**: If you need to research specific accessibility guidelines (like `https://web.dev/articles/accessible-tap-targets`), you can append `.md.txt` to the URL (e.g., `https://web.dev/articles/accessible-tap-targets.md.txt`) to fetch the clean, raw markdown version. This is much easier to read!
diff --git a/skills/chrome-devtools-cli/SKILL.md b/skills/chrome-devtools-cli/SKILL.md
index 6b7749a3..093c3a36 100644
--- a/skills/chrome-devtools-cli/SKILL.md
+++ b/skills/chrome-devtools-cli/SKILL.md
@@ -11,9 +11,9 @@ _Note: If this is your very first time using the CLI, see [references/installati
 
 ## AI Workflow
 
-1. **Execute**: Run tools directly (e.g., `chrome-devtools list_pages`). The background server starts implicitly; **do not** run `start`/`status`/`stop` before each use.
-2. **Inspect**: Use `take_snapshot` to get an element `<uid>`.
-3. **Act**: Use `click`, `fill`, etc. State persists across commands.
+1. **Execute**: Run tools directly. If you don't know the target page's ID, run `chrome-devtools list_pages` to find it. The background server starts implicitly; **do not** run `start`/`status`/`stop` before each use.
+2. **Inspect**: Use `chrome-devtools take_snapshot <pageId>` to get an element `<uid>`.
+3. **Act**: Use `chrome-devtools click <pageId> <uid>`, `chrome-devtools fill <pageId> <uid> <value>`, etc. State persists across commands.
 
 Snapshot example:
 
@@ -24,12 +24,7 @@ uid=1_0 RootWebArea "Example Domain" url="https://example.com/"
 
 ## Permissions & File Access
 
-By default, the server only has access to the **OS temp directory** (as defined by Node APIs, `os.tmpdir()`). File-saving parameters (`--filePath`, `--outputDirPath`) and `upload_file` outside the temp directory require unrestricted filesystem access:
-
-```bash
-# Start daemon with full filesystem access
-chrome-devtools start --allowUnrestrictedPaths=true
-```
+By default, the CLI has full filesystem access (`--allowUnrestrictedPaths=true`), allowing file-saving parameters (`--filePath`, `--outputDirPath`) and `upload_file` to access files anywhere on the system. Pass `--allowUnrestrictedPaths=false` if you want to restrict file access to the OS temp directory.
 
 ## Command Usage
 
@@ -44,23 +39,23 @@ chrome-devtools <tool> [arguments] [flags]
 ## Input Automation (<uid> from snapshot)
 
 ```bash
-chrome-devtools take_snapshot # Take a text snapshot of the page to get UIDs for elements
-chrome-devtools click "id" # Clicks on the provided element
-chrome-devtools click "id" --dblClick true --includeSnapshot true # Double clicks and returns a snapshot
-chrome-devtools drag "src" "dst" # Drag an element onto another element
-chrome-devtools drag "src" "dst" --includeSnapshot true # Drag an element and return a snapshot
-chrome-devtools fill "id" "text" # Type text into an input, textarea, or select an option
-chrome-devtools fill "id" "text" --includeSnapshot true # Fill an element and return a snapshot
-chrome-devtools handle_dialog accept # Handle a browser dialog (accept/dismiss)
-chrome-devtools handle_dialog dismiss --promptText "hi" # Dismiss a dialog with prompt text
-chrome-devtools hover "id" # Hover over the provided element
-chrome-devtools hover "id" --includeSnapshot true # Hover over an element and return a snapshot
-chrome-devtools press_key "Enter" # Press a key or key combination ("Control+A", "Escape")
-chrome-devtools press_key "Control+A" --includeSnapshot true # Press a key and return a snapshot
-chrome-devtools type_text "hello" # Type text using keyboard into a focused input
-chrome-devtools type_text "hello" --submitKey "Enter" # Type text and press a submit key
-chrome-devtools upload_file "id" "file.txt" # Upload a file through a provided element
-chrome-devtools upload_file "id" "file.txt" --includeSnapshot true # Upload a file and return a snapshot
+chrome-devtools take_snapshot 1 # Take a text snapshot of the page to get UIDs for elements
+chrome-devtools click 1 "id" # Clicks on the provided element
+chrome-devtools click 1 "id" --dblClick true --includeSnapshot true # Double clicks and returns a snapshot
+chrome-devtools drag 1 "src" "dst" # Drag an element onto another element
+chrome-devtools drag 1 "src" "dst" --includeSnapshot true # Drag an element and return a snapshot
+chrome-devtools fill 1 "id" "text" # Type text into an input, textarea, or select an option
+chrome-devtools fill 1 "id" "text" --includeSnapshot true # Fill an element and return a snapshot
+chrome-devtools handle_dialog 1 accept # Handle a browser dialog (accept/dismiss)
+chrome-devtools handle_dialog 1 dismiss --promptText "hi" # Dismiss a dialog with prompt text
+chrome-devtools hover 1 "id" # Hover over the provided element
+chrome-devtools hover 1 "id" --includeSnapshot true # Hover over an element and return a snapshot
+chrome-devtools press_key 1 "Enter" # Press a key or key combination ("Control+A", "Escape")
+chrome-devtools press_key 1 "Control+A" --includeSnapshot true # Press a key and return a snapshot
+chrome-devtools type_text 1 "hello" # Type text using keyboard into a focused input
+chrome-devtools type_text 1 "hello" --submitKey "Enter" # Type text and press a submit key
+chrome-devtools upload_file 1 "id" "file.txt" # Upload a file through a provided element
+chrome-devtools upload_file 1 "id" "file.txt" --includeSnapshot true # Upload a file and return a snapshot
 ```
 
 ## Navigation
@@ -68,11 +63,11 @@ chrome-devtools upload_file "id" "file.txt" --includeSnapshot true # Upload a fi
 ```bash
 chrome-devtools close_page 1 # Closes the page by its index
 chrome-devtools list_pages # Get a list of pages open in the browser
-chrome-devtools navigate_page --url "https://example.com" # Navigates the currently selected page to a URL
-chrome-devtools navigate_page --type "reload" --ignoreCache true # Reload page ignoring cache
-chrome-devtools navigate_page --url "https://example.com" --timeout 5000 # Navigate with a timeout
-chrome-devtools navigate_page --handleBeforeUnload "accept" # Handle before unload dialog
-chrome-devtools navigate_page --type "back" --initScript "foo()" # Navigate back and run an init script
+chrome-devtools navigate_page 1 --url "https://example.com" # Navigates the currently selected page to a URL
+chrome-devtools navigate_page 1 --type "reload" --ignoreCache true # Reload page ignoring cache
+chrome-devtools navigate_page 1 --url "https://example.com" --timeout 5000 # Navigate with a timeout
+chrome-devtools navigate_page 1 --handleBeforeUnload "accept" # Handle before unload dialog
+chrome-devtools navigate_page 1 --type "back" --initScript "foo()" # Navigate back and run an init script
 chrome-devtools new_page "https://example.com" # Creates a new page
 chrome-devtools new_page "https://example.com" --background true --timeout 5000 # Create new page in background
 chrome-devtools new_page "https://example.com" --isolatedContext "ctx" # Create new page with isolated context
@@ -83,27 +78,27 @@ chrome-devtools select_page 1 --bringToFront true # Select a page and bring it t
 ## Emulation
 
 ```bash
-chrome-devtools emulate --networkConditions "Offline" # Emulate network conditions
-chrome-devtools emulate --cpuThrottlingRate 4 --geolocation "0x0" # Emulate CPU throttling and geolocation
-chrome-devtools emulate --colorScheme "dark" --viewport "1920x1080" # Emulate color scheme and viewport
-chrome-devtools emulate --userAgent "Mozilla/5.0..." # Emulate user agent
-chrome-devtools resize_page 1920 1080 # Resizes the selected page's window
+chrome-devtools emulate 1 --networkConditions "Offline" # Emulate network conditions
+chrome-devtools emulate 1 --cpuThrottlingRate 4 --geolocation "0x0" # Emulate CPU throttling and geolocation
+chrome-devtools emulate 1 --colorScheme "dark" --viewport "1920x1080" # Emulate color scheme and viewport
+chrome-devtools emulate 1 --userAgent "Mozilla/5.0..." # Emulate user agent
+chrome-devtools resize_page 1 1920 1080 # Resizes the selected page's window
 ```
 
 ## Performance
 
 ```bash
-chrome-devtools performance_analyze_insight "1" "LCPBreakdown" # Get more details on a specific Performance Insight
-chrome-devtools performance_start_trace true false # Starts a performance trace recording (reload, autoStop)
-chrome-devtools performance_start_trace true true --filePath "t.json.gz" # Start trace and save to a file
-chrome-devtools performance_stop_trace # Stops the active performance trace
-chrome-devtools performance_stop_trace --filePath "t.json.gz" # Stop trace and save to a file
+chrome-devtools performance_analyze_insight 1 "1" "LCPBreakdown" # Get more details on a specific Performance Insight (pageId, insightSetId, insightName)
+chrome-devtools performance_start_trace 1 --reload true --autoStop false # Starts a performance trace recording (reload, autoStop)
+chrome-devtools performance_start_trace 1 --reload true --autoStop true --filePath "t.json.gz" # Start trace and save to a file
+chrome-devtools performance_stop_trace 1 # Stops the active performance trace
+chrome-devtools performance_stop_trace 1 --filePath "t.json.gz" # Stop trace and save to a file
 ```
 
 ## Memory
 
 ```bash
-chrome-devtools take_heapsnapshot "./snap.heapsnapshot" # Capture a memory heap snapshot
+chrome-devtools take_heapsnapshot 1 "./snap.heapsnapshot" # Capture a memory heap snapshot
 ```
 
 ### Memory Debugging (requires `--memoryDebugging=true`)
@@ -125,33 +120,33 @@ chrome-devtools close_heapsnapshot "./snap.heapsnapshot" # Free memory from load
 ## Network
 
 ```bash
-chrome-devtools get_network_request # Get the currently selected network request
-chrome-devtools get_network_request --reqid 1 --requestFilePath "req.md" # Get request by id and save to file
-chrome-devtools get_network_request --responseFilePath "res.md" # Save response body to file
-chrome-devtools list_network_requests # List all network requests
-chrome-devtools list_network_requests --pageSize 50 --pageIdx 0 # List network requests with pagination
-chrome-devtools list_network_requests --resourceTypes Fetch # Filter requests by resource type
-chrome-devtools list_network_requests --includePreservedRequests true # Include preserved requests
+chrome-devtools get_network_request 1 # Get the currently selected network request for page 1
+chrome-devtools get_network_request 1 --reqid 1 --requestFilePath "req.md" # Get request by id and save to file
+chrome-devtools get_network_request 1 --responseFilePath "res.md" # Save response body to file
+chrome-devtools list_network_requests 1 # List all network requests for page 1
+chrome-devtools list_network_requests 1 --pageSize 50 --pageIdx 0 # List network requests with pagination
+chrome-devtools list_network_requests 1 --resourceTypes Fetch # Filter requests by resource type
+chrome-devtools list_network_requests 1 --includePreservedRequests true # Include preserved requests
 ```
 
 ## Debugging & Inspection
 
 ```bash
-chrome-devtools evaluate_script "() => document.title" # Evaluate a JavaScript function on the page
-chrome-devtools evaluate_script "(a) => a.innerText" --args 1_4 # Evaluate JS with UID arguments
-chrome-devtools get_console_message 1 # Gets a console message by its ID
-chrome-devtools lighthouse_audit --mode "navigation" # Run Lighthouse audit for navigation
-chrome-devtools lighthouse_audit --mode "snapshot" --device "mobile" # Run Lighthouse audit for a snapshot on mobile
-chrome-devtools lighthouse_audit --outputDirPath ./out # Run Lighthouse audit and save reports
-chrome-devtools list_console_messages # List all console messages
-chrome-devtools list_console_messages --pageSize 20 --pageIdx 1 # List console messages with pagination
-chrome-devtools list_console_messages --types error --types info # Filter console messages by type
-chrome-devtools list_console_messages --includePreservedMessages true # Include preserved messages
-chrome-devtools take_screenshot # Take a screenshot of the page viewport
-chrome-devtools take_screenshot --fullPage true --format "jpeg" --quality 80 # Take a full page screenshot as JPEG with quality
-chrome-devtools take_screenshot --uid "id" --filePath "s.png" # Take a screenshot of an element
-chrome-devtools take_snapshot # Take a text snapshot of the page from the a11y tree
-chrome-devtools take_snapshot --verbose true --filePath "s.txt" # Take a verbose snapshot and save to file
+chrome-devtools evaluate_script "() => document.title" --pageId 1 # Evaluate a JavaScript function on page 1
+chrome-devtools evaluate_script "(a) => a.innerText" --pageId 1 --args 1_4 # Evaluate JS with UID arguments on page 1
+chrome-devtools get_console_message 1 1 # Gets a console message by its ID
+chrome-devtools lighthouse_audit 1 --mode "navigation" # Run Lighthouse audit for navigation
+chrome-devtools lighthouse_audit 1 --mode "snapshot" --device "mobile" # Run Lighthouse audit for a snapshot on mobile
+chrome-devtools lighthouse_audit 1 --outputDirPath ./out # Run Lighthouse audit and save reports
+chrome-devtools list_console_messages 1 # List all console messages
+chrome-devtools list_console_messages 1 --pageSize 20 --pageIdx 1 # List console messages with pagination
+chrome-devtools list_console_messages 1 --types error --types info # Filter console messages by type
+chrome-devtools list_console_messages 1 --includePreservedMessages true # Include preserved messages
+chrome-devtools take_screenshot 1 # Take a screenshot of the page viewport
+chrome-devtools take_screenshot 1 --fullPage true --format "jpeg" --quality 80 # Take a full page screenshot as JPEG with quality
+chrome-devtools take_screenshot 1 --uid "id" --filePath "s.png" # Take a screenshot of an element
+chrome-devtools take_snapshot 1 # Take a text snapshot of the page from the a11y tree
+chrome-devtools take_snapshot 1 --verbose true --filePath "s.txt" # Take a verbose snapshot and save to file
 ```
 
 ## Extensions
@@ -178,20 +173,19 @@ chrome-devtools uninstall_pwa "https://example.com/" # Uninstall PWA and close w
 Experimental tools are disabled by default. Enable them with the corresponding flag during `start`.
 
 ```bash
-chrome-devtools click_at 100 200 # Clicks at the provided coordinates (requires --experimentalVision=true)
-chrome-devtools screencast_start --filePath "screen.mp4" # Starts a screencast recording (requires --experimentalScreencast=true and ffmpeg)
-chrome-devtools screencast_stop # Stops the active screencast
-chrome-devtools list_webmcp_tools # List all WebMCP tools (requires --categoryExperimentalWebmcp=true)
-chrome-devtools execute_webmcp_tool "tool_name" '{"arg":"val"}' # Execute a WebMCP tool (requires --categoryExperimentalWebmcp=true)
-chrome-devtools list_3p_developer_tools # List third-party developer tools (requires --categoryExperimentalThirdParty=true)
-chrome-devtools execute_3p_developer_tool "tool_name" '{"arg":"val"}' # Execute third-party developer tool (requires --categoryExperimentalThirdParty=true)
+chrome-devtools click_at 1 100 200 # Clicks at the provided coordinates on page 1 (requires --experimentalVision=true)
+chrome-devtools screencast_start 1 --filePath "screen.mp4" # Starts a screencast recording on page 1 (requires --experimentalScreencast=true and ffmpeg)
+chrome-devtools screencast_stop 1 # Stops the active screencast on page 1
+chrome-devtools list_webmcp_tools 1 # List all WebMCP tools on page 1 (requires --categoryExperimentalWebmcp=true)
+chrome-devtools execute_webmcp_tool 1 "tool_name" --input '{"arg":"val"}' # Execute a WebMCP tool on page 1 (requires --categoryExperimentalWebmcp=true)
+chrome-devtools list_3p_developer_tools 1 # List third-party developer tools on page 1 (requires --categoryExperimentalThirdParty=true)
+chrome-devtools execute_3p_developer_tool 1 "tool_name" --params '{"arg":"val"}' # Execute third-party developer tool on page 1 (requires --categoryExperimentalThirdParty=true)
 ```
 
 ## Service Management
 
 ```bash
 chrome-devtools start   # Start or restart chrome-devtools-mcp
-chrome-devtools start --allowUnrestrictedPaths=true # Start with full filesystem access
 chrome-devtools start --headless=false # Start with visible browser window
 chrome-devtools status  # Checks if chrome-devtools-mcp is running
 chrome-devtools stop    # Stop chrome-devtools-mcp if any
diff --git a/skills/chrome-devtools/SKILL.md b/skills/chrome-devtools/SKILL.md
index d62f66ec..d74727c3 100644
--- a/skills/chrome-devtools/SKILL.md
+++ b/skills/chrome-devtools/SKILL.md
@@ -11,7 +11,8 @@ Addional tooling can be enabled by providing the following flags:
 - For extension tooling, use the `--categoryExtensions` flag.
 - For memory tooling, use the `--memoryDebugging` flag.
 
-**Page selection**: Tools operate on the currently selected page. Use `list_pages` to see available pages, then `select_page` to switch context.
+**Page targeting**: Page-scoped tools require a `pageId` parameter to target a specific page. Use `list_pages` to see available pages and their IDs (e.g. `pageId: 1`), or use the ID returned when creating a page with `new_page`.
+Note: For `evaluate_script`, `pageId` is required when targeting pages. However, when `--categoryExtensions` is enabled, `pageId` is optional so you can pass `serviceWorkerId` instead to evaluate inside an extension background service worker.
 **Element interaction**: Use `take_snapshot` to get page structure with element `uid`s. Each element has a unique `uid` for interaction. If an element isn't found, take a fresh snapshot - the element may have been removed or the page changed.
 
 ## Workflow Patterns
@@ -20,8 +21,8 @@ Addional tooling can be enabled by providing the following flags:
 
 1. Navigate: `navigate_page` or `new_page`
 2. Wait: `wait_for` to ensure content is loaded if you know what you look for.
-3. Snapshot: `take_snapshot` to understand page structure
-4. Interact: Use element `uid`s from snapshot for `click`, `fill`, etc.
+3. Snapshot: `take_snapshot` with `pageId` to understand page structure
+4. Interact: Use element `uid`s from snapshot for `click`, `fill`, etc., passing the corresponding `pageId`.
 
 ### Efficient data retrieval
 
@@ -59,7 +60,7 @@ You can send multiple tool calls in parallel, but maintain correct order: naviga
 1. **Install**: Use `install_extension` with the path to the unpacked extension.
 2. **Identify**: Get the extension ID from the response or by calling `list_extensions`.
 3. **Trigger Action**: Use `trigger_extension_action` to open the popup or side panel if applicable.
-4. **Verify Service Worker**: Use `evaluate_script` with `serviceWorkerId` to check extension state or trigger background actions.
+4. **Verify Service Worker**: Use `evaluate_script` with `serviceWorkerId` (omitting `pageId` and `args`) to check extension state or trigger background actions. When evaluating in a page, pass `pageId` (omitting `serviceWorkerId`).
 5. **Verify Page Behavior**: Navigate to a page where the extension operates and use `take_snapshot` to check if content scripts injected elements or modified the page correctly.
 
 ## Troubleshooting
diff --git a/skills/cookie-debugging/SKILL.md b/skills/cookie-debugging/SKILL.md
new file mode 100644
index 00000000..85929b96
--- /dev/null
+++ b/skills/cookie-debugging/SKILL.md
@@ -0,0 +1,149 @@
+---
+name: cookie-debugging
+description: Uses Chrome DevTools MCP for inspecting, debugging, and testing cookies, session state, authentication issues, and cookie consent compliance. Use when diagnosing 401/403 errors, authentication redirects, session expiration, Cookie/Set-Cookie header issues, cookie banner consent conformance, or third-party cookie/SameSite/Partitioned cookie warnings.
+---
+
+## Core Concepts
+
+### HttpOnly vs Client-Side Storage
+
+Cookies marked `HttpOnly` cannot be accessed or modified by client-side JavaScript (`cookieStore` or `document.cookie`). However, the browser **automatically attaches active HttpOnly cookies to outgoing HTTP request headers (`Cookie`)**.
+
+- To inspect current `HttpOnly` values: Look at the `Cookie` request header of any outgoing HTTP request via `get_network_request`.
+- To inspect how cookies were created or configured: Look at the `Set-Cookie` response header of login/auth responses.
+- To inspect non-`HttpOnly` cookies: Use `evaluate_script` with the modern `cookieStore` API (`async () => await cookieStore.getAll()`).
+
+### Session Strategy: Live Tab vs Isolated Context
+
+Choose the right session environment to avoid state contamination (e.g., residual analytics or auth tokens):
+
+| Strategy                            | When to Use                                                                   | Setup / Teardown                                                                                              |
+| :---------------------------------- | :---------------------------------------------------------------------------- | :------------------------------------------------------------------------------------------------------------ |
+| **Live Tab (Active Page)**          | Diagnosing an active user session, live 401/403 error, or current state.      | Operates directly on the currently selected page.                                                             |
+| **Clean-Slate (`isolatedContext`)** | Testing cookie consent banners, first-time visits, or zero-cookie guarantees. | Call `new_page` with a unique `isolatedContext` (e.g. `"consent-audit-1"`). When finished, call `close_page`. |
+
+### Client-Side Capabilities & Limitations
+
+| Action                                                           | Client JavaScript (`cookieStore` / `document.cookie`) | DevTools Network & Context Tools                        |
+| :--------------------------------------------------------------- | :---------------------------------------------------- | :------------------------------------------------------ |
+| **Read Non-HttpOnly**                                            | ✅ `async () => await cookieStore.getAll()`           | ✅ `get_network_request` (Request `Cookie`)             |
+| **Read HttpOnly**                                                | ❌ Blocked by browser security                        | ✅ `get_network_request` (Request `Cookie`)             |
+| **Inspect Attributes** (`Domain`, `Path`, `SameSite`, `Expires`) | ✅ `async () => await cookieStore.getAll()`           | ✅ `get_network_request` (Response `Set-Cookie`)        |
+| **Modify / Delete Non-HttpOnly**                                 | ✅ `async () => await cookieStore.set(...)`           | N/A                                                     |
+| **Modify / Delete HttpOnly**                                     | ❌ **Silent failure** in JavaScript                   | ✅ Use `new_page(isolatedContext: ...)` for clean state |
+
+> [!WARNING]
+> Attempting to clear an `HttpOnly` cookie via JavaScript (`cookieStore.delete` or `document.cookie = "...; max-age=0"`) will silently fail. To test in an unauthenticated or fresh state, always spawn a new isolated context using `new_page` with `isolatedContext`.
+
+---
+
+## Workflow Patterns
+
+### 1. Diagnosing Authentication Failures & Redirects (401 / 403)
+
+When an authenticated page request fails, returns 401/403, or redirects to login:
+
+1. **List Recent Requests**: Call `list_network_requests` with `includePreservedRequests: true`.
+2. **Find the Target Request**: Locate the failing request (401/403) or redirect (302/307).
+3. **Inspect Outgoing `Cookie` Header**: Call `get_network_request` with the `reqid`.
+   - Verify if the `Cookie` header was attached and whether required tokens (e.g. `SESSION_ID`, `auth_token`) were sent.
+4. **Trigger Active Inspection (If no recent request exists)**:
+   - If the cookie was set in a previous session and no network call is listed, trigger a request:
+     - Use `navigate_page` with `reload: true`, OR
+     - Call `evaluate_script` with `() => fetch(window.location.href)`
+   - Then call `get_network_request` on the new request to inspect the active `Cookie` header.
+5. **Trace the Setting Request**: If the cookie is missing or rejected:
+   - Check earlier login/handshake responses for `Set-Cookie` directives:
+     - **Path mismatch**: e.g., `Path=/api` when the request is to `/`.
+     - **Domain mismatch**: e.g., `Domain=api.example.com` preventing cookies on `sub.example.com`.
+     - **Secure flag on HTTP**: `Secure` cookies are never sent over unencrypted `http://`.
+     - **SameSite blocking**: `SameSite=Strict` cookies are omitted on cross-site navigations.
+     - **Expiration**: Check if `Expires` or `Max-Age` elapsed.
+
+### 2. Cookie Banner & Consent Conformance Testing
+
+To verify that no non-essential or tracking cookies are set before consent or when declining:
+
+1. **Start Clean**: Open a fresh isolated context with a dedicated name:
+   ```json
+   {"url": "<PAGE_URL>", "isolatedContext": "consent-test-1"}
+   ```
+2. **Record Baseline Cookies**: Before interacting with the banner, run `evaluate_script` with `async () => await cookieStore.getAll()`.
+3. **Inspect Premature Network Requests & Issues**:
+   - Call `list_network_requests` to ensure no third-party tracking beacons fired before consent.
+   - Call `list_console_messages` with `types: ["issue"]` to check for tracking warnings.
+4. **Interact with Consent Banner**:
+   - Capture snapshot with `take_snapshot` to locate the "Decline" or "Reject All" button `uid`.
+   - Click the button with `click`.
+5. **Verify Cookie Difference**:
+   - Run `evaluate_script` with `async () => await cookieStore.getAll()` after clicking to assert that only strictly necessary or consent-state cookies exist.
+6. **Test Consent Revocation (Lifecycle Audit)**:
+   - When auditing consent withdrawal or preference changes:
+     - Locate and click the "Cookie Settings", "Manage Preferences", or footer privacy trigger (`take_snapshot` $\rightarrow$ `click`).
+     - Deselect non-essential categories or click "Revoke All" / "Save Preferences".
+     - Re-query `cookieStore.getAll()` to verify previously accepted non-essential cookies were cleared or expired.
+     - Call `list_network_requests` on subsequent actions to ensure tracking beacons are no longer fired.
+7. **Teardown Context**: Call `close_page` when the audit is complete to prevent leftover cookies from affecting subsequent tasks.
+
+### 3. Auditing Cookie Security, SameSite & CHIPS (Partitioned Cookies)
+
+1. **Fast-Track: Native DevTools Issues (Recommended)**:
+   - Call `list_console_messages` with:
+     ```json
+     {
+       "types": ["issue"],
+       "includePreservedMessages": true
+     }
+     ```
+   - Check for `CookieIssue` entries, such as:
+     - `SameSiteNoneInsecure`: `SameSite=None` without `Secure`.
+     - `ThirdPartyCookiePhaseout`: Third-party cookie blocked or restricted.
+     - `SchemefulSameSite`: Cross-scheme cookie issues.
+     - `PartitionedCookies`: Invalid CHIPS partitioning attributes.
+2. **Deep Audit: Lighthouse Third-Party Cookies**:
+   - Run `lighthouse_audit` with `mode: "navigation"` and `outputDirPath: "/tmp/lh-report"`.
+   - **Extract the specific cookie audit** without loading the full report into context:
+     ```bash
+     node -e "const r=require('/tmp/lh-report/report.json'); const a=r.audits['third-party-cookies']; console.log(JSON.stringify({score: a?.score, displayValue: a?.displayValue, items: a?.details?.items}))"
+     ```
+
+### 4. Client-Side Cookie Inspection & Manipulation
+
+For client-accessible, non-`HttpOnly` cookies (e.g., UI preferences, non-sensitive feature flags):
+
+1. **Read Cookies & Attributes**:
+   - Use the modern asynchronous Cookie Store API:
+     ```js
+     async () => await cookieStore.getAll();
+     ```
+   - _Fallback for insecure HTTP origins_: `() => document.cookie`.
+2. **Set / Modify Cookie**:
+   - Set client cookie via `cookieStore`:
+     ```js
+     async () =>
+       await cookieStore.set({
+         name: 'theme',
+         value: 'dark',
+         expires: Date.now() + 86400000,
+         sameSite: 'lax',
+       });
+     ```
+3. **Delete Cookie**:
+   - Clear client cookie:
+     ```js
+     async () => await cookieStore.delete('theme');
+     ```
+
+---
+
+## Troubleshooting
+
+- **`cookieStore` is undefined**: `cookieStore` requires a Secure Context (`https://`, `localhost`, or `127.0.0.1`). On non-secure HTTP origins, use `() => document.cookie` or test over HTTPS.
+- **`evaluate_script` returns empty / unresolved Promise**: `cookieStore` methods are asynchronous. Always wrap calls with `async () => await cookieStore.getAll()`.
+- **Cookie not visible in JavaScript**: The cookie is marked `HttpOnly`. Trigger a network request and call `get_network_request` to view it in the `Cookie` request header.
+- **JavaScript deletion did not remove cookie**: The cookie is `HttpOnly` or requires matching `Path` and `Domain` parameters. Use a fresh `isolatedContext` with `new_page` for a clean slate.
+- **Cookie set in response but not sent in requests**:
+  - Verify if page is `http://` while cookie specifies `Secure`.
+  - Check if `Domain` restricts subdomains.
+  - Check `list_console_messages(types: ["issue"])` for browser rejection reasons.
+- **Residual cookies contaminating audits**: Always use `new_page` with a unique `isolatedContext` when running compliance tests, and call `close_page` when done.
diff --git a/skills/debug-optimize-lcp/SKILL.md b/skills/debug-optimize-lcp/SKILL.md
index ebd0aea3..4067d908 100644
--- a/skills/debug-optimize-lcp/SKILL.md
+++ b/skills/debug-optimize-lcp/SKILL.md
@@ -36,8 +36,8 @@ Follow these steps in order. Each step builds on the previous one.
 
 Navigate to the page, then record a trace with reload to capture the full page load including LCP:
 
-1. `navigate_page` to the target URL.
-2. `performance_start_trace` with `reload: true` and `autoStop: true`.
+1. `navigate_page` with `pageId` to the target URL.
+2. `performance_start_trace` with `pageId`, `reload: true` and `autoStop: true`.
 
 The trace results will include LCP timing and available insight sets. Note the insight set IDs from the output — you'll need them in the next step.
 
@@ -50,11 +50,11 @@ Use `performance_analyze_insight` to drill into LCP-specific insights. Look for
 - **RenderBlocking** — Resources blocking the LCP element from rendering.
 - **LCPDiscovery** — Whether the LCP resource was discoverable early.
 
-Call `performance_analyze_insight` with the insight set ID and the insight name from the trace results.
+Call `performance_analyze_insight` with `pageId`, the insight set ID, and the insight name from the trace results.
 
 ### Step 3: Identify the LCP Element
 
-Use `evaluate_script` with the **"Identify LCP Element" snippet** found in [references/lcp-snippets.md](references/lcp-snippets.md) to reveal the LCP element's tag, resource URL, and raw timing data.
+Use `evaluate_script` (with `pageId`) and the **"Identify LCP Element" snippet** found in [references/lcp-snippets.md](references/lcp-snippets.md) to reveal the LCP element's tag, resource URL, and raw timing data.
 
 The `url` field tells you what resource to look for in the network waterfall. If `url` is empty, the LCP element is text-based (no resource to load).
 
@@ -62,8 +62,8 @@ The `url` field tells you what resource to look for in the network waterfall. If
 
 Use `list_network_requests` to see when the LCP resource loaded relative to other resources:
 
-- Call `list_network_requests` filtered by `resourceTypes: ["Image", "Font"]` (adjust based on Step 3).
-- Then use `get_network_request` with the LCP resource's request ID for full details.
+- Call `list_network_requests` with `pageId` filtered by `resourceTypes: ["Image", "Font"]` (adjust based on Step 3).
+- Then use `get_network_request` with `pageId` and the LCP resource's request ID for full details.
 
 **Key Checks:**
 
@@ -72,7 +72,7 @@ Use `list_network_requests` to see when the LCP resource loaded relative to othe
 
 ### Step 5: Inspect HTML for Common Issues
 
-Use `evaluate_script` with the **"Audit Common Issues" snippet** found in [references/lcp-snippets.md](references/lcp-snippets.md) to check for lazy-loaded images in the viewport, missing fetchpriority, and render-blocking scripts.
+Use `evaluate_script` (with `pageId`) and the **"Audit Common Issues" snippet** found in [references/lcp-snippets.md](references/lcp-snippets.md) to check for lazy-loaded images in the viewport, missing fetchpriority, and render-blocking scripts.
 
 ## Optimization Strategies
 
@@ -115,7 +115,7 @@ The HTML document itself takes too long to arrive.
 
 ## Verifying Fixes & Emulation
 
-- **Verification**: Re-run the trace (`performance_start_trace` with `reload: true`) and compare the new subpart breakdown. The bottleneck should shrink.
+- **Verification**: Re-run the trace (`performance_start_trace` with `pageId` and `reload: true`) and compare the new subpart breakdown. The bottleneck should shrink.
 - **Emulation**: Lab measurements differ from real-world experience. Use `emulate` to test under constraints:
-  - `emulate` with `networkConditions: "Fast 3G"` and `cpuThrottlingRate: 4`.
+  - `emulate` with `pageId`, `networkConditions: "Fast 3G"` and `cpuThrottlingRate: 4`.
   - This surfaces issues visible only on slower connections/devices.
diff --git a/skills/memory-leak-debugging/SKILL.md b/skills/memory-leak-debugging/SKILL.md
index 8e77df8b..5f2adc3a 100644
--- a/skills/memory-leak-debugging/SKILL.md
+++ b/skills/memory-leak-debugging/SKILL.md
@@ -7,6 +7,10 @@ description: Diagnoses and resolves memory leaks in JavaScript/Node.js applicati
 
 This skill provides expert guidance and workflows for finding, diagnosing, and fixing memory leaks in JavaScript and Node.js applications using Chrome DevTools MCP tools.
 
+## Prerequisites
+
+Advanced memory debugging tools (`compare_heapsnapshots`, `get_heapsnapshot_details`, etc.) are only available when the server is started with the `--memoryDebugging` flag. First check if these tools are available; if not, try to read the MCP configuration file to check if `--memoryDebugging` is enabled.
+
 ## Core Principles
 
 - **Prefer MCP memory tools:** Do NOT attempt to read raw `.heapsnapshot` files directly, as they are extremely large and will consume too many tokens. Use the Chrome DevTools MCP heap snapshot tools to summarize, compare, and inspect snapshots.
@@ -20,10 +24,10 @@ This skill provides expert guidance and workflows for finding, diagnosing, and f
 
 When investigating a frontend web application memory leak, utilize the `chrome-devtools-mcp` tools to interact with the application and take snapshots.
 
-- Use tools like `click`, `navigate_page`, `fill`, etc., to manipulate the page into the desired state.
+- Use page-scoped tools like `click`, `navigate_page`, `fill`, etc. (specifying `pageId`) to manipulate the page into the desired state.
 - Revert the page back to the original state after interactions to see if memory is released.
 - Repeat the same user interactions 10 times to amplify the leak.
-- Use `take_heapsnapshot` to save `.heapsnapshot` files to disk at baseline, target (after actions), and final (after reverting actions) states.
+- Use `take_heapsnapshot` (with `pageId`) to save `.heapsnapshot` files to disk at baseline, target (after actions), and final (after reverting actions) states.
 
 ### 2. Comparing Snapshots
 
diff --git a/skills/troubleshooting/SKILL.md b/skills/troubleshooting/SKILL.md
index 6793f996..bf5b98c3 100644
--- a/skills/troubleshooting/SKILL.md
+++ b/skills/troubleshooting/SKILL.md
@@ -60,6 +60,7 @@ Identify other error messages from the failed tool call or the MCP initializatio
 
 - `Target closed`
 - "Tool not found" (check if they are using `--slim` which only enables navigation and screenshot tools).
+- Missing `pageId`: Page-scoped tools require a `pageId` argument. Call `list_pages` to find active page IDs.
 - `ProtocolError: Network.enable timed out` or `The socket connection was closed unexpectedly`
 - `Error [ERR_MODULE_NOT_FOUND]: Cannot find module`
 - Any sandboxing or host validation errors.
diff --git a/src/McpContext.ts b/src/McpContext.ts
index 5578e6d4..639216e5 100644
--- a/src/McpContext.ts
+++ b/src/McpContext.ts
@@ -17,6 +17,7 @@ import type {
   HeapSnapshotDetailedClassDiff,
   DuplicateStringGroup,
   HeapEdgesQueryOptions,
+  HeapQueryOptions,
 } from './processors/HeapSnapshotManager.js';
 import {McpPage} from './McpPage.js';
 import {type UncaughtError} from './collectors/PageCollector.js';
@@ -49,6 +50,7 @@ import type {TraceResult} from './processors/PerformanceTrace.js';
 import type {Logger} from './types.js';
 import type {ExtensionServiceWorker} from './types.js';
 import {getTempFilePath, resolveCanonicalPath} from './utils/files.js';
+import {isAllowedUrl} from './utils/url.js';
 interface McpContextOptions {
   // Whether the DevTools windows are exposed as pages for debugging of DevTools.
   experimentalDevToolsDebugging: boolean;
@@ -56,6 +58,8 @@ interface McpContextOptions {
   experimentalIncludeAllPages?: boolean;
   // Whether CrUX data should be fetched.
   performanceCrux: boolean;
+  // Whether source maps are enabled in DevTools.
+  sourceMaps?: boolean;
   // The allow list of URL patterns to allow loading resources.
   allowList?: string[];
   // The block list of URL patterns to block loading resources.
@@ -69,6 +73,8 @@ interface McpContextOptions {
   reconnected?: boolean;
   // Custom navigation timeout in milliseconds to override default.
   navigationTimeout?: number;
+  // Whether extension tools and targets are enabled.
+  categoryExtensions?: boolean;
 }
 
 // Page ids are handed out from a process-wide counter so they stay unique
@@ -163,6 +169,14 @@ export class McpContext implements Context {
 
   #onTargetCreated = async (target: Target) => {
     try {
+      const url = target.url();
+      if (
+        !isAllowedUrl(url, {
+          categoryExtensions: this.#options.categoryExtensions,
+        })
+      ) {
+        return;
+      }
       const page = await target.page();
       if (!page) {
         return;
@@ -225,21 +239,18 @@ export class McpContext implements Context {
     this.#roots = roots;
   }
 
-  async validatePath(filePath?: string): Promise<void> {
+  /**
+   * Validates that the filePath is allowed according to the roots configuration.
+   * Tolerates if parts of the filePath do not exist yet but the file access to
+   * the resolved should only be allowed without following symlinks.
+   */
+  async validatePath(filePath: string): Promise<string>;
+  async validatePath(filePath?: undefined): Promise<undefined>;
+  async validatePath(filePath?: string): Promise<string | undefined>;
+  async validatePath(filePath?: string): Promise<string | undefined> {
     if (filePath === undefined) {
-      return;
-    }
-    // If the client never negotiated roots and the operator has explicitly
-    // opted into unrestricted access via --allow-unrestricted-paths, restore
-    // the previous permissive behavior and skip validation.
-    if (this.#roots === undefined && this.#allowUnrestrictedPaths) {
-      return;
+      return undefined;
     }
-    // roots() always returns at least the temp directory, even if the
-    // connecting client never negotiated the optional `roots` capability.
-    // Path validation must not be skipped just because no workspace roots
-    // were configured.
-    const roots = this.roots();
 
     let canonicalPath: string;
 
@@ -255,6 +266,20 @@ export class McpContext implements Context {
       );
     }
 
+    // If the client never negotiated roots and the operator has explicitly
+    // opted into unrestricted access via --allow-unrestricted-paths, restore
+    // the previous permissive behavior and skip validation.
+    if (this.#roots === undefined && this.#allowUnrestrictedPaths) {
+      // Canonical path might not exist yet so we fallback to
+      // path.resolve(filePath). Consumers should not follow symlinks.
+      return canonicalPath || path.resolve(filePath);
+    }
+    // roots() always returns at least the temp directory, even if the
+    // connecting client never negotiated the optional `roots` capability.
+    // Path validation must not be skipped just because no workspace roots
+    // were configured.
+    const roots = this.roots();
+
     let allowed = false;
     const resolvedRoots = await Promise.allSettled(
       roots.map(async root => {
@@ -293,19 +318,20 @@ export class McpContext implements Context {
         `Access denied: path ${filePath} (canonical: ${canonicalPath}) is not within any of the configured workspace roots.`,
       );
     }
+
+    return canonicalPath || path.resolve(filePath);
   }
 
   async ensureExtension<Extension extends `.${string}`>(
     filePath: string,
     extension: Extension,
   ): Promise<`${string}${Extension}`> {
-    const resolvedPath = path.resolve(filePath);
-    const currentExtension = path.extname(resolvedPath);
-    const outputPath: `${string}${Extension}` = `${resolvedPath.slice(
+    const resolved = await this.validatePath(filePath);
+    const currentExtension = path.extname(resolved);
+    const outputPath: `${string}${Extension}` = `${resolved.slice(
       0,
-      resolvedPath.length - currentExtension.length,
+      resolved.length - currentExtension.length,
     )}${extension}`;
-    await this.validatePath(outputPath);
     return outputPath;
   }
 
@@ -320,7 +346,7 @@ export class McpContext implements Context {
         ctx = await this.browser.createBrowserContext();
         this.#isolatedContexts.set(isolatedContextName, ctx);
       }
-      page = await ctx.newPage();
+      page = await ctx.newPage({background});
     } else {
       page = await this.browser.newPage({background});
     }
@@ -400,6 +426,21 @@ export class McpContext implements Context {
     return page;
   }
 
+  getSelectedMcpPageUrl(page?: McpPage): string | undefined {
+    let targetPage = page;
+    if (!targetPage) {
+      try {
+        targetPage = this.getSelectedMcpPage();
+      } catch {
+        return undefined;
+      }
+    }
+    if (targetPage?.pptrPage?.isClosed() === false) {
+      return targetPage.pptrPage.url();
+    }
+    return undefined;
+  }
+
   async getDevToolsData(page?: McpPage): Promise<DevToolsData | undefined> {
     const targetPage = page ?? this.#selectedPage;
     if (!targetPage) {
@@ -528,6 +569,7 @@ export class McpContext implements Context {
           page.browserContext(),
         ),
         navigationTimeout: this.#options.navigationTimeout,
+        sourceMaps: this.#options.sourceMaps,
       });
       this.#mcpPages.set(page, mcpPage);
       await mcpPage.init();
@@ -576,36 +618,47 @@ export class McpContext implements Context {
     const allPages = (
       await this.browser.pages(this.#options.experimentalIncludeAllPages)
     ).filter(page => {
-      return (
-        this.#options.experimentalDevToolsDebugging ||
-        !page.url().startsWith('devtools://')
-      );
+      if (
+        !this.#options.experimentalDevToolsDebugging &&
+        page.url().startsWith('devtools://')
+      ) {
+        return false;
+      }
+      return isAllowedUrl(page.url(), {
+        categoryExtensions: this.#options.categoryExtensions,
+      });
     });
 
-    const allTargets = this.browser.targets();
-    const extensionTargets = allTargets.filter(target => {
-      return (
-        target.url().startsWith('chrome-extension://') &&
-        target.type() === 'page'
-      );
-    });
+    if (this.#options.categoryExtensions) {
+      const allTargets = this.browser.targets();
+      const extensionTargets = allTargets.filter(target => {
+        return (
+          target.url().startsWith('chrome-extension://') &&
+          target.type() === 'page'
+        );
+      });
 
-    await Promise.allSettled(
-      extensionTargets.map(async target => {
-        try {
-          let page = await target.page();
-          if (!page) {
-            page = await target.asPage();
-          }
-          this.#extensionPages.set(target, page);
-          if (page && !allPages.includes(page)) {
-            allPages.push(page);
+      await Promise.allSettled(
+        extensionTargets.map(async target => {
+          try {
+            let page = await target.page();
+            if (!page) {
+              page = await target.asPage();
+            }
+            this.#extensionPages.set(target, page);
+            if (
+              page &&
+              isAllowedUrl(page.url(), {categoryExtensions: true}) &&
+              !allPages.includes(page)
+            ) {
+              allPages.push(page);
+            }
+          } catch (e) {
+            this.logger?.('Failed to get page for extension target', e);
           }
-        } catch (e) {
-          this.logger?.('Failed to get page for extension target', e);
-        }
-      }),
-    );
+        }),
+      );
+    }
 
     return allPages;
   }
@@ -624,17 +677,17 @@ export class McpContext implements Context {
     filepath: string,
     data: Uint8Array<ArrayBufferLike>,
   ): Promise<void> {
-    await this.validatePath(filepath);
+    const resolved = await this.validatePath(filepath);
 
     try {
-      await fs.mkdir(path.dirname(filepath), {recursive: true});
+      await fs.mkdir(path.dirname(resolved), {recursive: true});
       // Open the file with flags to:
       // - O_WRONLY: Write-only
       // - O_CREAT: Create if it doesn't exist
       // - O_TRUNC: Truncate to zero length if it exists
       // - O_NOFOLLOW: DO NOT follow symlinks.
       // - 0o600: Permissions: read/write for owner, no permissions for others.
-      await fs.writeFile(filepath, data, {
+      await fs.writeFile(resolved, data, {
         flag:
           fs.constants.O_WRONLY |
           fs.constants.O_CREAT |
@@ -738,6 +791,13 @@ export class McpContext implements Context {
     return await this.#heapSnapshotManager.getDuplicateStrings(filePath);
   }
 
+  async queryHeapSnapshotObjects(
+    filePath: string,
+    options: HeapQueryOptions,
+  ): Promise<DevTools.HeapSnapshotModel.HeapSnapshotModel.ItemsRange> {
+    return await this.#heapSnapshotManager.queryObjects(filePath, options);
+  }
+
   async getHeapSnapshotStats(
     filePath: string,
   ): Promise<DevTools.HeapSnapshotModel.HeapSnapshotModel.Statistics> {
@@ -866,8 +926,8 @@ export class McpContext implements Context {
       }
 
       case 'file:': {
-        await this.validatePath(fileURLToPath(url));
-        return await fs.readFile(url, 'utf-8');
+        const resolved = await this.validatePath(fileURLToPath(url));
+        return await fs.readFile(resolved, 'utf-8');
       }
 
       default:
diff --git a/src/McpPage.ts b/src/McpPage.ts
index e1ce94bc..4e4f088b 100644
--- a/src/McpPage.ts
+++ b/src/McpPage.ts
@@ -138,6 +138,7 @@ export class McpPage implements ContextPage {
   #hasNetworkBlockOrAllowlist: boolean;
   #locatorClass: typeof Locator;
   #navigationTimeout: number;
+  #sourceMaps: boolean;
 
   constructor(
     page: Page,
@@ -147,11 +148,13 @@ export class McpPage implements ContextPage {
       locatorClass: typeof Locator;
       isolatedContextName?: string;
       navigationTimeout?: number;
+      sourceMaps?: boolean;
     },
   ) {
     this.#hasNetworkBlockOrAllowlist = options.hasNetworkBlockOrAllowlist;
     this.#locatorClass = options.locatorClass;
     this.#navigationTimeout = options.navigationTimeout ?? NAVIGATION_TIMEOUT;
+    this.#sourceMaps = options.sourceMaps ?? true;
     this.pptrPage = page;
     this.id = id;
     this.isolatedContextName = options.isolatedContextName;
@@ -196,7 +199,9 @@ export class McpPage implements ContextPage {
     }
     try {
       const session = await this.pptrPage.createCDPSession();
-      this.#devtoolsUniverse = await createTargetUniverse(session);
+      this.#devtoolsUniverse = await createTargetUniverse(session, {
+        sourceMaps: this.#sourceMaps,
+      });
     } catch (e) {
       logger?.('Failed to initialize DevTools universe', e);
     }
diff --git a/src/McpResponse.ts b/src/McpResponse.ts
index 2f7d6ff1..083e2f4f 100644
--- a/src/McpResponse.ts
+++ b/src/McpResponse.ts
@@ -8,7 +8,7 @@
 
 import type {WebMCPTool} from 'puppeteer-core';
 
-import type {ParsedArguments} from './bin/chrome-devtools-mcp-cli-options.js';
+import type {ParsedArguments} from './config/mcp-options.js';
 import {ConsoleFormatter} from './formatters/ConsoleFormatter.js';
 import {
   HeapSnapshotFormatter,
diff --git a/src/ToolHandler.ts b/src/ToolHandler.ts
index 21d28230..9f06e746 100644
--- a/src/ToolHandler.ts
+++ b/src/ToolHandler.ts
@@ -8,7 +8,7 @@
  * streaming. Keep the diff to the three `this.hooks?.` call sites.
  */
 
-import type {parseArguments} from './bin/chrome-devtools-mcp-cli-options.js';
+import type {ParsedArguments} from './config/mcp-options.js';
 import type {McpContext} from './McpContext.js';
 import type {McpPage} from './McpPage.js';
 import type {DataFormat} from './McpResponse.js';
@@ -20,11 +20,10 @@ import type {
 } from './opera/toolHandlerHooks.js';
 import {SlimMcpResponse} from './SlimMcpResponse.js';
 import {ClearcutLogger} from './telemetry/ClearcutLogger.js';
-import {bucketizeLatency, buildContext} from './telemetry/transformation.js';
 import type {CallToolResult} from './third_party/index.js';
 import {zod} from './third_party/index.js';
-import type {ToolCategory} from './tools/categories.js';
-import {labels, OFF_BY_DEFAULT_CATEGORIES} from './tools/categories.js';
+import {labels} from './tools/categories.js';
+import {categoryToFlagName} from './config/category-options.js';
 import type {
   DefinedPageTool,
   DevToolsData,
@@ -34,13 +33,9 @@ import type {
 import {pageIdSchema} from './tools/ToolDefinition.js';
 import {logger} from './utils/logger.js';
 import type {Mutex} from './third_party/index.js';
-import {fileURLToPath} from 'node:url';
+import {fileURLToPath, pathToFileURL} from 'node:url';
 import {isLocalhost} from './utils/url.js';
 
-export function buildFlag(category: ToolCategory) {
-  return `category${category.charAt(0).toUpperCase() + category.slice(1)}`;
-}
-
 function buildDisabledMessage(
   toolName: string,
   flag: string,
@@ -48,85 +43,31 @@ function buildDisabledMessage(
 ): string {
   const reason = categoryLabel
     ? `is in category ${categoryLabel} which`
-    : `requires experimental feature ${flag} and`;
+    : `requires ${flag.startsWith('--experimental') ? 'experimental feature' : 'flag'} ${flag} and`;
 
   return `Tool ${toolName} ${reason} is currently disabled. Enable it by running ${CLI_BIN_NAME} start ${flag}=true. For more information check the README.`;
 }
 
-function getCategoryStatus(
-  category: ToolCategory,
-  serverArgs: ReturnType<typeof parseArguments>,
-): {categoryFlag?: string; disabled: boolean} {
-  const categoryFlag = buildFlag(category);
-
-  const flagValue = serverArgs[categoryFlag];
-
-  const isDisabled = OFF_BY_DEFAULT_CATEGORIES.includes(category)
-    ? !flagValue
-    : flagValue === false;
-
-  if (isDisabled) {
-    return {
-      categoryFlag,
-      disabled: true,
-    };
-  }
-
-  return {
-    disabled: false,
-  };
-}
-
-function getConditionStatus(
-  condition: string,
-  serverArgs: ReturnType<typeof parseArguments>,
-): {conditionFlag?: string; disabled: boolean} {
-  if (condition && !serverArgs[condition]) {
-    return {conditionFlag: condition, disabled: true};
-  }
-
-  return {disabled: false};
-}
-
 function getToolStatusInfo(
   tool: ToolDefinition | DefinedPageTool,
-  serverArgs: ReturnType<typeof parseArguments>,
+  serverArgs: ParsedArguments,
 ): {disabled: boolean; reason?: string} {
   const category = tool.annotations.category;
-  const categoryCheck = getCategoryStatus(category, serverArgs);
-
-  if (category && categoryCheck.disabled) {
-    if (!categoryCheck.categoryFlag) {
-      throw new Error(
-        'when the category is disabled there should always be a flag set',
-      );
+  if (category) {
+    const flag = categoryToFlagName(category);
+    if (!serverArgs[flag]) {
+      return {
+        disabled: true,
+        reason: buildDisabledMessage(tool.name, `--${flag}`, labels[category]),
+      };
     }
-
-    return {
-      disabled: true,
-      reason: buildDisabledMessage(
-        tool.name,
-        `--${categoryCheck.categoryFlag}`,
-        labels[category!],
-      ),
-    };
   }
 
   for (const condition of tool.annotations.conditions || []) {
-    const conditionCheck = getConditionStatus(condition, serverArgs);
-    if (conditionCheck.disabled) {
-      if (!conditionCheck.conditionFlag) {
-        throw new Error(
-          'when the condition is disabled there should always be a flag set',
-        );
-      }
-
+    if (!serverArgs[condition]) {
       return {
         disabled: true,
-        reason: buildDisabledMessage(
-          tool.name,
-          `--${conditionCheck.conditionFlag}`,
-        ),
+        reason: buildDisabledMessage(tool.name, `--${condition}`),
       };
     }
   }
@@ -160,14 +101,21 @@ function buildUnknownArgumentsMessage(
   return `Unknown ${unknownLabel} for tool "${toolName}": ${formatArgumentNames(unknownArgumentNames)}. ${expectedArguments} ${correction} and retry.`;
 }
 
-function extractPaths(value: unknown): string[] {
-  if (typeof value === 'string') {
-    return [value];
-  }
-  if (Array.isArray(value)) {
-    return value.filter(item => typeof item === 'string');
+async function validateAndResolvePathOrUrl(
+  filePathOrUrl: string,
+  context: McpContext,
+): Promise<string> {
+  try {
+    const url = new URL(filePathOrUrl);
+    if (url.protocol === 'file:') {
+      return pathToFileURL(await context.validatePath(fileURLToPath(url))).href;
+    } else if (['http:', 'https:', 'ws:', 'wss:'].includes(url.protocol)) {
+      return filePathOrUrl;
+    }
+  } catch {
+    // Suppress parsing errors for regular file paths.
   }
-  return [];
+  return await context.validatePath(filePathOrUrl);
 }
 
 function isLocalBrowser(context: McpContext): boolean {
@@ -203,25 +151,25 @@ async function validateToolFiles(
   context: McpContext,
 ): Promise<void> {
   const isLocal = isLocalBrowser(context);
-  const pathsOrUrlsToValidate: string[] = [];
   for (const [key, option] of Object.entries(tool.verifyFilesSchema)) {
     if (shouldValidateFile(option, isLocal)) {
-      pathsOrUrlsToValidate.push(...extractPaths(params[key]));
-    }
-  }
-  for (const filePathOrUrl of pathsOrUrlsToValidate) {
-    let filePath = filePathOrUrl;
-    try {
-      const url = new URL(filePathOrUrl);
-      if (url.protocol === 'file:') {
-        filePath = fileURLToPath(url);
-      } else if (['http:', 'https:', 'ws:', 'wss:'].includes(url.protocol)) {
-        continue;
+      const val = params[key];
+      if (typeof val === 'string') {
+        params[key] = await validateAndResolvePathOrUrl(val, context);
+      } else if (Array.isArray(val)) {
+        const updated: unknown[] = [];
+        for (const item of val) {
+          if (typeof item === 'string') {
+            updated.push(await validateAndResolvePathOrUrl(item, context));
+          } else {
+            throw new Error(
+              'Unexpected non-string value as a file path or URL',
+            );
+          }
+        }
+        params[key] = updated;
       }
-    } catch {
-      // Suppress parsing errors for regular file paths.
     }
-    await context.validatePath(filePath);
   }
 }
 
@@ -233,7 +181,7 @@ export class ToolHandler {
 
   constructor(
     private readonly tool: ToolDefinition | DefinedPageTool,
-    private readonly serverArgs: ReturnType<typeof parseArguments>,
+    private readonly serverArgs: ParsedArguments,
     private readonly getContext: () => Promise<McpContext>,
     private readonly toolMutex: Mutex,
     private readonly hooks?: OperaToolHooks,
@@ -245,7 +193,7 @@ export class ToolHandler {
     this.inputSchema =
       'pageScoped' in tool &&
       tool.pageScoped &&
-      serverArgs.experimentalPageIdRouting &&
+      serverArgs.pageIdRouting &&
       !serverArgs.slim
         ? {...pageIdSchema, ...tool.schema}
         : tool.schema;
@@ -322,7 +270,7 @@ export class ToolHandler {
           const pageId =
             typeof params.pageId === 'number' ? params.pageId : undefined;
           page =
-            this.serverArgs.experimentalPageIdRouting &&
+            this.serverArgs.pageIdRouting &&
             pageId !== undefined &&
             !this.serverArgs.slim
               ? context.getPageById(pageId)
@@ -354,10 +302,7 @@ export class ToolHandler {
         response.setError(err);
       }
       devToolsData = await context.getDevToolsData(page);
-      const targetPage = page ?? context.getSelectedMcpPage();
-      if (targetPage?.pptrPage?.isClosed() === false) {
-        pageUrl = targetPage.pptrPage.url();
-      }
+      pageUrl = context.getSelectedMcpPageUrl(page);
       // Resolve data format: --experimentalDataFormat takes precedence, fall back to legacy --experimentalToonFormat
       let dataFormat: DataFormat = 'default';
       if (this.serverArgs.experimentalDataFormat) {
@@ -399,14 +344,14 @@ export class ToolHandler {
         isError: true,
       };
     } finally {
-      const context = buildContext(devToolsData, pageUrl);
       void ClearcutLogger.get()?.logToolInvocation({
         toolName: this.tool.name,
         params,
         schema: this.inputSchema,
         success,
-        latencyMs: bucketizeLatency(Date.now() - startTime),
-        context,
+        latencyMs: Date.now() - startTime,
+        devToolsData,
+        pageUrl,
       });
       guard?.[Symbol.dispose]();
     }
diff --git a/src/bin/chrome-devtools-mcp-main.ts b/src/bin/chrome-devtools-mcp-main.ts
index 2142af65..cd354b50 100644
--- a/src/bin/chrome-devtools-mcp-main.ts
+++ b/src/bin/chrome-devtools-mcp-main.ts
@@ -11,7 +11,7 @@ import '../utils/polyfill.js';
 import process from 'node:process';
 
 import {closeBrowser} from '../browser.js';
-import {createMcpServer, logDisclaimers} from '../index.js';
+import {McpServer, logDisclaimers} from '../index.js';
 import {
   ENV_CRASH_ON_UNCAUGHT,
   PACKAGE_NAME,
@@ -25,7 +25,7 @@ import {checkForUpdates} from '../utils/check-for-updates.js';
 import {logger, saveLogsToFile} from '../utils/logger.js';
 import {VERSION} from '../version.js';
 
-import {cliOptions, parseArguments} from './chrome-devtools-mcp-cli-options.js';
+import {mcpOptions, parseArguments} from '../config/mcp-options.js';
 
 await checkForUpdates(`Run \`npm install ${PACKAGE_NAME}@latest\` to update.`);
 
@@ -80,7 +80,7 @@ process.on('SIGHUP', () => {
   void shutdown('SIGHUP');
 });
 
-const {server} = await createMcpServer(args, {
+const server = await McpServer.from(args, {
   logFile,
 });
 const transport = new StdioServerTransport();
@@ -88,4 +88,4 @@ await server.connect(transport);
 logger?.(`${PRODUCT_NAME} connected`);
 logDisclaimers(args);
 void ClearcutLogger.get()?.logDailyActiveIfNeeded();
-void ClearcutLogger.get()?.logServerStart(computeFlagUsage(args, cliOptions));
+void ClearcutLogger.get()?.logServerStart(computeFlagUsage(args, mcpOptions));
diff --git a/src/bin/chrome-devtools.ts b/src/bin/chrome-devtools.ts
index 0c710d9c..802f12b4 100644
--- a/src/bin/chrome-devtools.ts
+++ b/src/bin/chrome-devtools.ts
@@ -31,8 +31,12 @@ import {hideBin, yargs, type CallToolResult} from '../third_party/index.js';
 import {checkForUpdates} from '../utils/check-for-updates.js';
 import {VERSION} from '../version.js';
 
-import {commands} from './chrome-devtools-cli-options.js';
-import {cliOptions, parseArguments} from './chrome-devtools-mcp-cli-options.js';
+import {commands} from '../config/cli-options.js';
+import {
+  mcpOptions,
+  parseArguments,
+  getMcpOptionsForViaCli,
+} from '../config/mcp-options.js';
 
 process.title = CLI_BIN_NAME;
 
@@ -40,35 +44,28 @@ await checkForUpdates(
   `Run \`npm install -g ${PACKAGE_NAME}@latest\` and \`${CLI_BIN_NAME} start\` to update and restart the daemon.`,
 );
 
+const DEFAULT_CLI_ARGS = ['--viaCli'];
+
 async function start(args: string[], sessionId: string) {
-  const combinedArgs = [...args, ...defaultArgs];
+  const combinedArgs = [...DEFAULT_CLI_ARGS, ...args];
   await startDaemon(combinedArgs, sessionId);
   logDisclaimers(parseArguments(VERSION, combinedArgs));
 }
 
-const defaultArgs = ['--viaCli', '--experimentalStructuredContent'];
+function getCliOptions() {
+  const options: Partial<typeof mcpOptions> = {
+    ...getMcpOptionsForViaCli(),
+  };
 
-const startCliOptions = {
-  ...cliOptions,
-} as Partial<typeof cliOptions>;
+  // Missing CLI serialization.
+  delete options.viewport;
 
-// Missing CLI serialization.
-delete startCliOptions.viewport;
+  // Change the defaults for the CLI.
+  delete options.experimentalStructuredContent;
+  delete options.experimentalInteropTools;
 
-// Change the defaults for the CLI.
-delete startCliOptions.experimentalStructuredContent;
-delete startCliOptions.experimentalInteropTools;
-delete startCliOptions.experimentalPageIdRouting;
-if (!('default' in cliOptions.headless)) {
-  throw new Error('headless cli option unexpectedly does not have a default');
-}
-if ('default' in cliOptions.isolated) {
-  throw new Error('isolated cli option unexpectedly has a default');
+  return options;
 }
-startCliOptions.headless!.default = true;
-startCliOptions.isolated!.description =
-  'If specified, creates a temporary user-data-dir that is automatically cleaned up after the browser is closed. Defaults to true unless userDataDir is provided.';
-startCliOptions.categoryExtensions!.default = true;
 
 const y = yargs(hideBin(process.argv))
   .locale('en') // Force English to ensure error string matching works in .fail, all custom messages we output are in English anyways
@@ -108,13 +105,11 @@ const y = yargs(hideBin(process.argv))
           '1. Required parameters MUST be passed as positional arguments (without flags).',
         );
         console.error(
-          '   - INCORRECT: chrome-devtools evaluate_script --expression "() => document.title"',
-        );
-        console.error(
-          '   - CORRECT:   chrome-devtools evaluate_script "() => document.title"',
+          '   - INCORRECT: chrome-devtools click --pageId 1 --uid "1_2"',
         );
+        console.error('   - CORRECT:   chrome-devtools click 1 "1_2"');
         console.error(
-          '2. Optional parameters are passed as double-dash options/flags (e.g. --pageId 1).',
+          '2. Optional parameters are passed as double-dash options/flags (e.g. --dblClick true).',
         );
         console.error(
           '3. Make sure to escape quotes properly for your shell environment.',
@@ -135,7 +130,7 @@ y.command(
   `Start or restart ${MCP_BIN_NAME}`,
   y =>
     y
-      .options(startCliOptions)
+      .options(getCliOptions())
       .example(
         '$0 start --browserUrl http://localhost:9222',
         'Start the server connecting to an existing browser',
@@ -146,13 +141,24 @@ y.command(
       await stopDaemon(argv.sessionId);
     }
     // Defaults but we do not want to affect the yargs conflict resolution.
-    if (argv.isolated === undefined && argv.userDataDir === undefined) {
+    if (
+      argv.isolated === undefined &&
+      argv.userDataDir === undefined &&
+      !argv.autoConnect &&
+      !argv.browserUrl &&
+      !argv.wsEndpoint
+    ) {
       argv.isolated = true;
     }
-    if (argv.headless === undefined) {
+    if (
+      argv.headless === undefined &&
+      !argv.autoConnect &&
+      !argv.browserUrl &&
+      !argv.wsEndpoint
+    ) {
       argv.headless = true;
     }
-    const args = serializeArgs(cliOptions, argv);
+    const args = serializeArgs(mcpOptions, argv);
     await start(args, argv.sessionId);
     process.exit(0);
   },
@@ -279,7 +285,7 @@ for (const [commandName, commandDef] of Object.entries(commands)) {
           : Promise.resolve(undefined);
 
         if (!isDaemonRunning(sessionId)) {
-          await start(serializeArgs(cliOptions, argv), sessionId);
+          await start(serializeArgs(mcpOptions, argv), sessionId);
         }
 
         const commandArgs: Record<string, unknown> = {};
diff --git a/src/bin/opera-devtools-cli-options.ts b/src/bin/opera-devtools-cli-options.ts
index f3367239..f3d46f53 100644
--- a/src/bin/opera-devtools-cli-options.ts
+++ b/src/bin/opera-devtools-cli-options.ts
@@ -5,4 +5,4 @@
  */
 
 // Compatibility shim. The canonical file is generated by `npm run cli:generate`.
-export * from './chrome-devtools-cli-options.js';
+export * from '../config/cli-options.js';
diff --git a/src/bin/opera-devtools-mcp-cli-options.ts b/src/bin/opera-devtools-mcp-cli-options.ts
index e685bae9..0580449f 100644
--- a/src/bin/opera-devtools-mcp-cli-options.ts
+++ b/src/bin/opera-devtools-mcp-cli-options.ts
@@ -5,4 +5,4 @@
  */
 
 // Compatibility shim. Prefer importing the canonical path directly.
-export * from './chrome-devtools-mcp-cli-options.js';
+export * from '../config/mcp-options.js';
diff --git a/src/browser.ts b/src/browser.ts
index 7b7e4638..527cd6e5 100644
--- a/src/browser.ts
+++ b/src/browser.ts
@@ -15,34 +15,21 @@ import type {
   Browser,
   ChromeReleaseChannel,
   LaunchOptions,
-  Target,
 } from './third_party/index.js';
 import {puppeteer} from './third_party/index.js';
 import {logger, puppeteerLogger} from './utils/logger.js';
+import {isAllowedUrl} from './utils/url.js';
 
 let browser: Browser | undefined;
 let browserMode: 'launched' | 'connected' | undefined;
 
-function makeTargetFilter(enableExtensions = false) {
-  const ignoredPrefixes = new Set(['chrome://', 'chrome-untrusted://']);
-  if (!enableExtensions) {
-    ignoredPrefixes.add('chrome-extension://');
-  }
-
-  return function targetFilter(target: Target): boolean {
-    if (target.url() === 'chrome://newtab/') {
-      return true;
-    }
-    // Could be the only page opened in the browser.
-    if (target.url().startsWith('chrome://inspect')) {
+export function makeTargetFilter(enableExtensions = false) {
+  return function targetFilter(target: {url(): string}): boolean {
+    const url = target.url();
+    if (!url) {
       return true;
     }
-    for (const prefix of ignoredPrefixes) {
-      if (target.url().startsWith(prefix)) {
-        return false;
-      }
-    }
-    return true;
+    return isAllowedUrl(url, {categoryExtensions: enableExtensions});
   };
 }
 
diff --git a/src/config/browser-options.ts b/src/config/browser-options.ts
new file mode 100644
index 00000000..89eb37fe
--- /dev/null
+++ b/src/config/browser-options.ts
@@ -0,0 +1,136 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * Modified by Opera Software AS.
+ */
+
+import {CACHE_DIR_NAME, MCP_BIN_NAME, REPO_URL} from '../opera/branding.js';
+
+import type {YargsOptions} from '../third_party/index.js';
+
+export const browserOptions = {
+  autoConnect: {
+    type: 'boolean',
+    description:
+      'If specified, automatically connects to a browser (Chrome 144+) running locally from the user data directory identified by the channel param (default channel is stable). Requires the remote debugging server to be started in the Chrome instance via chrome://inspect/#remote-debugging.',
+    conflicts: ['isolated', 'executablePath'],
+    default: false,
+    coerce: (value: boolean | undefined) => {
+      if (!value) {
+        return;
+      }
+      return value;
+    },
+  },
+  browserUrl: {
+    type: 'string',
+    description: `Connect to a running, debuggable Chrome instance (e.g. \`http://127.0.0.1:9222\`). For more details see: ${REPO_URL}#connecting-to-a-running-chrome-instance.`,
+    alias: 'u',
+    conflicts: ['wsEndpoint'],
+    coerce: (url: string | undefined) => {
+      if (!url) {
+        return;
+      }
+      try {
+        new URL(url);
+      } catch {
+        throw new Error(`Provided browserUrl ${url} is not valid URL.`);
+      }
+      return url;
+    },
+  },
+  wsEndpoint: {
+    type: 'string',
+    description:
+      'WebSocket endpoint to connect to a running Chrome instance (e.g., ws://127.0.0.1:9222/devtools/browser/<id>). Alternative to --browserUrl.',
+    alias: 'w',
+    conflicts: ['browserUrl'],
+    coerce: (url: string | undefined) => {
+      if (!url) {
+        return;
+      }
+      try {
+        const parsed = new URL(url);
+        if (parsed.protocol !== 'ws:' && parsed.protocol !== 'wss:') {
+          throw new Error(
+            `Provided wsEndpoint ${url} must use ws:// or wss:// protocol.`,
+          );
+        }
+        return url;
+      } catch (error) {
+        if ((error as Error).message.includes('ws://')) {
+          throw error;
+        }
+        throw new Error(`Provided wsEndpoint ${url} is not valid URL.`);
+      }
+    },
+  },
+  wsHeaders: {
+    type: 'string',
+    description:
+      'Custom headers for WebSocket connection in JSON format (e.g., \'{"Authorization":"Bearer token"}\'). Only works with --wsEndpoint.',
+    implies: 'wsEndpoint',
+    coerce: (val: string | undefined) => {
+      if (!val) {
+        return;
+      }
+      try {
+        const parsed = JSON.parse(val);
+        if (typeof parsed !== 'object' || Array.isArray(parsed)) {
+          throw new Error('Headers must be a JSON object');
+        }
+        return parsed as Record<string, string>;
+      } catch (error) {
+        throw new Error(
+          `Invalid JSON for wsHeaders: ${(error as Error).message}`,
+        );
+      }
+    },
+  },
+  headless: {
+    type: 'boolean',
+    description: 'Whether to run in headless (no UI) mode.',
+    default: false,
+  },
+  executablePath: {
+    type: 'string',
+    description: 'Path to custom Chrome executable.',
+    conflicts: ['browserUrl', 'wsEndpoint'],
+    alias: 'e',
+  },
+  isolated: {
+    type: 'boolean',
+    description:
+      'If specified, creates a temporary user-data-dir that is automatically cleaned up after the browser is closed. Defaults to false.',
+  },
+  userDataDir: {
+    type: 'string',
+    description: `Path to the user data directory for Chrome. Default is $HOME/.cache/${CACHE_DIR_NAME}/chrome-profile$CHANNEL_SUFFIX_IF_NON_STABLE`,
+    conflicts: ['browserUrl', 'wsEndpoint', 'isolated'],
+  },
+  channel: {
+    type: 'string',
+    description:
+      'Specify a different Chrome channel that should be used. The default is the stable channel version.',
+    choices: ['canary', 'dev', 'beta', 'stable'] as const,
+    conflicts: ['browserUrl', 'wsEndpoint', 'executablePath'],
+  },
+  proxyServer: {
+    type: 'string',
+    description: `Proxy server configuration for Chrome passed as --proxy-server when launching the browser. See https://www.chromium.org/developers/design-documents/network-settings/ for details.`,
+  },
+  chromeArg: {
+    type: 'array',
+    describe: `Additional arguments for Chrome. Only applies when Chrome is launched by ${MCP_BIN_NAME}.`,
+  },
+  ignoreDefaultChromeArg: {
+    type: 'array',
+    describe: `Explicitly disable default arguments for Chrome. Only applies when Chrome is launched by ${MCP_BIN_NAME}.`,
+  },
+} satisfies Record<string, YargsOptions>;
+
+export function getBrowserOptions(): typeof browserOptions {
+  return browserOptions;
+}
diff --git a/src/config/category-options.ts b/src/config/category-options.ts
new file mode 100644
index 00000000..85f198ad
--- /dev/null
+++ b/src/config/category-options.ts
@@ -0,0 +1,116 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import {ToolCategory} from '../tools/categories.js';
+
+export interface CategoryOption {
+  type: 'boolean';
+  describe: string;
+  default?: boolean;
+  hidden?: boolean;
+  conflicts?: string[];
+}
+
+export type CategoryFlagName<T extends ToolCategory = ToolCategory> =
+  `category${Capitalize<T>}`;
+
+export type CategoryFlags = {
+  [K in ToolCategory as CategoryFlagName<K>]: CategoryOption;
+};
+
+const categoryOverrides: Record<
+  ToolCategory,
+  {
+    describe?: string;
+    hidden?: boolean;
+    conflicts?: string[];
+    offByDefault?: boolean;
+  }
+> = {
+  [ToolCategory.INPUT]: {},
+  [ToolCategory.NAVIGATION]: {},
+  [ToolCategory.EMULATION]: {
+    hidden: false,
+  },
+  [ToolCategory.PERFORMANCE]: {
+    hidden: false,
+  },
+  [ToolCategory.NETWORK]: {
+    hidden: false,
+  },
+  [ToolCategory.DEBUGGING]: {},
+  [ToolCategory.MEMORY]: {},
+  [ToolCategory.WEBMCP]: {
+    describe:
+      'Set to true to enable debugging WebMCP tools. Requires Chrome 150+ with the following flag: `--enable-features=WebMCP`',
+    offByDefault: true,
+  },
+  [ToolCategory.EXTENSIONS]: {
+    describe:
+      'Set to true to include tools related to extensions. Note: This feature is currently only supported with a pipe connection. autoConnect, browserUrl, and wsEndpoint are not supported with this feature until 149 will be released.',
+    hidden: false,
+    offByDefault: true,
+  },
+  [ToolCategory.THIRD_PARTY]: {
+    describe:
+      'Set to true to enable third-party developer tools exposed by the inspected page itself',
+    hidden: false,
+    offByDefault: true,
+  },
+  [ToolCategory.PWA]: {
+    describe:
+      'Set to true to include tools for automating Progressive Web Apps (install, launch, uninstall, and OS state). This feature is only supported with a pipe connection; autoConnect, browserUrl, and wsEndpoint are not supported.',
+    conflicts: ['autoConnect', 'browserUrl', 'wsEndpoint'],
+    hidden: false,
+    offByDefault: true,
+  },
+  [ToolCategory.OPERA]: {},
+};
+
+function createOption(category: ToolCategory): CategoryOption {
+  const overrides = categoryOverrides[category];
+  const describe = overrides.offByDefault
+    ? `Set to true to include tools related to ${category}.`
+    : `Set to false to exclude tools related to ${category}.`;
+
+  return {
+    type: 'boolean',
+    describe,
+    hidden: true,
+    ...overrides,
+    ...(overrides.offByDefault ? {} : {default: true}),
+  };
+}
+
+export function categoryToFlagName(category: ToolCategory): CategoryFlagName {
+  return `category${category.charAt(0).toUpperCase()}${category.slice(1)}` as CategoryFlagName;
+}
+
+export function getCategoryOptions(): CategoryFlags {
+  const options = {} as CategoryFlags;
+  for (const category of Object.values(ToolCategory)) {
+    const flagName = categoryToFlagName(category);
+    options[flagName] = createOption(category);
+  }
+
+  return options;
+}
+
+export function isCategoryOffByDefault(category: ToolCategory): boolean {
+  const flagName = categoryToFlagName(category);
+  const option = getCategoryOptions()[flagName];
+  return !('default' in option) || option.default !== true;
+}
+
+export function getOffByDefaultCategories(): ToolCategory[] {
+  const result: ToolCategory[] = [];
+  for (const category of Object.values(ToolCategory)) {
+    if (isCategoryOffByDefault(category)) {
+      result.push(category);
+    }
+  }
+  return result;
+}
diff --git a/src/bin/chrome-devtools-cli-options.ts b/src/config/cli-options.ts
similarity index 80%
rename from src/bin/chrome-devtools-cli-options.ts
rename to src/config/cli-options.ts
index 18e60e52..9f61b5e7 100644
--- a/src/bin/chrome-devtools-cli-options.ts
+++ b/src/config/cli-options.ts
@@ -6,7 +6,11 @@
  * Modified by Opera Software AS.
  */
 
-// NOTE: do not edit manually. Auto-generated by 'npm run cli:generate'.
+/**
+ * @fileoverview
+ * WARNING: This file is auto-generated by 'npm run cli:generate'.
+ * Do not edit this file manually.
+ */
 
 export interface ArgDef {
   name: string;
@@ -29,6 +33,12 @@ export const commands: Commands = {
     description: 'Clicks on the provided element',
     category: 'Input automation',
     args: {
+      pageId: {
+        name: 'pageId',
+        type: 'number',
+        description: 'Targets a specific page by ID.',
+        required: true,
+      },
       uid: {
         name: 'uid',
         type: 'string',
@@ -56,6 +66,12 @@ export const commands: Commands = {
       'Clicks at the provided coordinates (requires flag: --experimentalVision=true)',
     category: 'Input automation',
     args: {
+      pageId: {
+        name: 'pageId',
+        type: 'number',
+        description: 'Targets a specific page by ID.',
+        required: true,
+      },
       x: {
         name: 'x',
         type: 'number',
@@ -142,6 +158,12 @@ export const commands: Commands = {
     description: 'Drag an element onto another element',
     category: 'Input automation',
     args: {
+      pageId: {
+        name: 'pageId',
+        type: 'number',
+        description: 'Targets a specific page by ID.',
+        required: true,
+      },
       from_uid: {
         name: 'from_uid',
         type: 'string',
@@ -164,9 +186,15 @@ export const commands: Commands = {
     },
   },
   emulate: {
-    description: 'Emulates various features on the selected page.',
+    description: 'Emulates various features on the target page.',
     category: 'Emulation',
     args: {
+      pageId: {
+        name: 'pageId',
+        type: 'number',
+        description: 'Targets a specific page by ID.',
+        required: true,
+      },
       networkConditions: {
         name: 'networkConditions',
         type: 'string',
@@ -221,14 +249,21 @@ export const commands: Commands = {
   },
   evaluate_script: {
     description:
-      'Evaluate a JavaScript function inside the currently selected page. Returns the response as JSON, so returned values have to be JSON-serializable.',
+      'Evaluate a JavaScript function inside the target page or service worker. Returns the response as JSON, so returned values have to be JSON-serializable.',
     category: 'Debugging',
     args: {
+      pageId: {
+        name: 'pageId',
+        type: 'number',
+        description:
+          'Targets a specific page by ID. Required when not evaluating in a service worker.',
+        required: false,
+      },
       function: {
         name: 'function',
         type: 'string',
         description:
-          'A JavaScript function declaration to be executed by the tool in the currently selected page.\nExample without arguments: `() => document.title` or `async () => await fetch("example.com")`.\nExample with arguments: `(el) => el.innerText`\n',
+          'A JavaScript function declaration to be executed by the tool in the target page.\nExample without arguments: `() => document.title` or `async () => await fetch("example.com")`.\nExample with arguments: `(el) => el.innerText`\n',
         required: true,
       },
       args: {
@@ -258,6 +293,13 @@ export const commands: Commands = {
           'Whether to wait for the DOM to settle. Pass false if the script only reads data. Defaults to true.',
         required: false,
       },
+      serviceWorkerId: {
+        name: 'serviceWorkerId',
+        type: 'string',
+        description:
+          "The optional service worker id to evaluate the script in. If provided, 'pageId' should be omitted. Note: 'args' (element UIDs) cannot be used when evaluating in a service worker.",
+        required: false,
+      },
     },
   },
   execute_3p_developer_tool: {
@@ -265,6 +307,12 @@ export const commands: Commands = {
       'Executes a tool exposed by the page. (requires flag: --categoryExperimentalThirdParty=true)',
     category: 'Third-party',
     args: {
+      pageId: {
+        name: 'pageId',
+        type: 'number',
+        description: 'Targets a specific page by ID.',
+        required: true,
+      },
       toolName: {
         name: 'toolName',
         type: 'string',
@@ -284,6 +332,12 @@ export const commands: Commands = {
       'Executes a WebMCP tool exposed by the page. (requires flag: --categoryExperimentalWebmcp=true)',
     category: 'WebMCP',
     args: {
+      pageId: {
+        name: 'pageId',
+        type: 'number',
+        description: 'Targets a specific page by ID.',
+        required: true,
+      },
       toolName: {
         name: 'toolName',
         type: 'string',
@@ -304,6 +358,12 @@ export const commands: Commands = {
       'Type text into an input, text area or select an option from a <select> element.',
     category: 'Input automation',
     args: {
+      pageId: {
+        name: 'pageId',
+        type: 'number',
+        description: 'Targets a specific page by ID.',
+        required: true,
+      },
       uid: {
         name: 'uid',
         type: 'string',
@@ -332,6 +392,12 @@ export const commands: Commands = {
       'Gets a console message by its ID. You can get all messages by calling list_console_messages.',
     category: 'Debugging',
     args: {
+      pageId: {
+        name: 'pageId',
+        type: 'number',
+        description: 'Targets a specific page by ID.',
+        required: true,
+      },
       msgid: {
         name: 'msgid',
         type: 'number',
@@ -509,10 +575,11 @@ export const commands: Commands = {
         required: false,
         enum: ['retainedSize', 'selfSize', 'name'],
       },
-      minRetainedSize: {
-        name: 'minRetainedSize',
-        type: 'number',
-        description: 'Minimum retained size in bytes for target nodes.',
+      retainedSize: {
+        name: 'retainedSize',
+        type: 'string',
+        description:
+          'Inclusive retained size range (e.g. "1MB-2MB", "-1MB", or "1MB-") for target nodes. A single value is treated as a minimum. Currently, only the lower bound is applied.',
         required: false,
       },
       excludePrimitives: {
@@ -638,9 +705,15 @@ export const commands: Commands = {
   },
   get_network_request: {
     description:
-      'Gets a network request by an optional reqid, if omitted returns the currently selected request in the DevTools Network panel.',
+      "Gets a network request by an optional reqid, if omitted returns the currently selected request in the DevTools Network panel. Useful for inspecting request headers (including 'Cookie') and response headers (including 'Set-Cookie' and directives).",
     category: 'Network',
     args: {
+      pageId: {
+        name: 'pageId',
+        type: 'number',
+        description: 'Targets a specific page by ID.',
+        required: true,
+      },
       reqid: {
         name: 'reqid',
         type: 'number',
@@ -683,6 +756,12 @@ export const commands: Commands = {
       'If a browser dialog was opened, use this command to handle it',
     category: 'Input automation',
     args: {
+      pageId: {
+        name: 'pageId',
+        type: 'number',
+        description: 'Targets a specific page by ID.',
+        required: true,
+      },
       action: {
         name: 'action',
         type: 'string',
@@ -702,6 +781,12 @@ export const commands: Commands = {
     description: 'Hover over the provided element',
     category: 'Input automation',
     args: {
+      pageId: {
+        name: 'pageId',
+        type: 'number',
+        description: 'Targets a specific page by ID.',
+        required: true,
+      },
       uid: {
         name: 'uid',
         type: 'string',
@@ -786,6 +871,12 @@ export const commands: Commands = {
       'Get Lighthouse score and reports for accessibility, SEO, best practices, and agentic browsing. This excludes performance. For performance audits, run performance_start_trace',
     category: 'Debugging',
     args: {
+      pageId: {
+        name: 'pageId',
+        type: 'number',
+        description: 'Targets a specific page by ID.',
+        required: true,
+      },
       mode: {
         name: 'mode',
         type: 'string',
@@ -815,13 +906,26 @@ export const commands: Commands = {
     description:
       "Lists all third-party developer tools the page exposes for providing runtime information.\nThird-party developer tools can be called via the 'execute_3p_developer_tool()' MCP tool.\nAlternatively, third-party developer tools can be executed by calling 'evaluate_script' and adding the\nfollowing command to the script:\n`window.__dtmcp.executeTool(toolName, params)`\nThis might be helpful when the third-party developer tools return non-serializable values or when composing\nthird-party developer tools with additional functionality. (requires flag: --categoryExperimentalThirdParty=true)",
     category: 'Third-party',
-    args: {},
+    args: {
+      pageId: {
+        name: 'pageId',
+        type: 'number',
+        description: 'Targets a specific page by ID.',
+        required: true,
+      },
+    },
   },
   list_console_messages: {
     description:
-      'List all console messages for the currently selected page since the last navigation.',
+      'List all console messages for the target page since the last navigation. This includes console messages originating from extensions content scripts.',
     category: 'Debugging',
     args: {
+      pageId: {
+        name: 'pageId',
+        type: 'number',
+        description: 'Targets a specific page by ID.',
+        required: true,
+      },
       pageSize: {
         name: 'pageSize',
         type: 'integer',
@@ -876,9 +980,15 @@ export const commands: Commands = {
   },
   list_network_requests: {
     description:
-      'Lists the most recent requests for the currently selected page since the last navigation.',
+      'Lists the most recent requests for the target page since the last navigation.',
     category: 'Network',
     args: {
+      pageId: {
+        name: 'pageId',
+        type: 'number',
+        description: 'Targets a specific page by ID.',
+        required: true,
+      },
       pageSize: {
         name: 'pageSize',
         type: 'integer',
@@ -911,7 +1021,8 @@ export const commands: Commands = {
     },
   },
   list_pages: {
-    description: 'Get a list of pages open in the browser.',
+    description:
+      'Get a list of pages including extension service workers open in the browser.',
     category: 'Navigation automation',
     args: {},
   },
@@ -919,13 +1030,26 @@ export const commands: Commands = {
     description:
       'Lists all WebMCP tools the page exposes. (requires flag: --categoryExperimentalWebmcp=true)',
     category: 'WebMCP',
-    args: {},
+    args: {
+      pageId: {
+        name: 'pageId',
+        type: 'number',
+        description: 'Targets a specific page by ID.',
+        required: true,
+      },
+    },
   },
   navigate_page: {
     description:
       'Go to a URL, or back, forward, or reload. Use project URL if not specified otherwise.',
     category: 'Navigation automation',
     args: {
+      pageId: {
+        name: 'pageId',
+        type: 'number',
+        description: 'Targets a specific page by ID.',
+        required: true,
+      },
       type: {
         name: 'type',
         type: 'string',
@@ -992,7 +1116,7 @@ export const commands: Commands = {
         name: 'isolatedContext',
         type: 'string',
         description:
-          'If specified, the page is created in an isolated browser context with the given name. Pages in the same browser context share cookies and storage. Pages in different browser contexts are fully isolated.',
+          'If specified, the page is created in an isolated browser context with the given name. Pages in the same browser context share cookies and storage. Pages in different browser contexts are fully isolated (useful for clean-slate testing of cookies and authentication).',
         required: false,
       },
       timeout: {
@@ -1009,6 +1133,12 @@ export const commands: Commands = {
       'Complete OAuth sign-in for an MCP server that requires authentication. Opens a browser popup for the OAuth flow; requires a headed (visible) browser. Only available when connected to Opera Neon.',
     category: 'Opera',
     args: {
+      pageId: {
+        name: 'pageId',
+        type: 'number',
+        description: 'Targets a specific page by ID.',
+        required: true,
+      },
       server: {
         name: 'server',
         type: 'string',
@@ -1022,6 +1152,12 @@ export const commands: Commands = {
       'Execute a tool on a specific MCP server registered in the browser. Use opera_list_mcp_servers to discover available servers and tools. Only available when connected to Opera Neon.',
     category: 'Opera',
     args: {
+      pageId: {
+        name: 'pageId',
+        type: 'number',
+        description: 'Targets a specific page by ID.',
+        required: true,
+      },
       server: {
         name: 'server',
         type: 'string',
@@ -1048,6 +1184,12 @@ export const commands: Commands = {
       "Send a chat prompt to Opera's built-in AI and return the response. Only available when connected to Opera Neon.",
     category: 'Opera',
     args: {
+      pageId: {
+        name: 'pageId',
+        type: 'number',
+        description: 'Targets a specific page by ID.',
+        required: true,
+      },
       prompt: {
         name: 'prompt',
         type: 'string',
@@ -1082,6 +1224,12 @@ export const commands: Commands = {
       'Connect to a registered MCP server. If the server requires OAuth, the response includes requiresAuth: "needed" — follow with opera_authenticate_mcp_server. Only available when connected to Opera Neon.',
     category: 'Opera',
     args: {
+      pageId: {
+        name: 'pageId',
+        type: 'number',
+        description: 'Targets a specific page by ID.',
+        required: true,
+      },
       server: {
         name: 'server',
         type: 'string',
@@ -1095,6 +1243,12 @@ export const commands: Commands = {
       'Disable an MCP server without unregistering it. Only available when connected to Opera Neon.',
     category: 'Opera',
     args: {
+      pageId: {
+        name: 'pageId',
+        type: 'number',
+        description: 'Targets a specific page by ID.',
+        required: true,
+      },
       server: {
         name: 'server',
         type: 'string',
@@ -1108,6 +1262,12 @@ export const commands: Commands = {
       "Instruct Opera's built-in AI to perform an action on the current page and return the result. Only available when connected to Opera Neon.",
     category: 'Opera',
     args: {
+      pageId: {
+        name: 'pageId',
+        type: 'number',
+        description: 'Targets a specific page by ID.',
+        required: true,
+      },
       prompt: {
         name: 'prompt',
         type: 'string',
@@ -1128,6 +1288,12 @@ export const commands: Commands = {
       'Enable a disabled MCP server. Only available when connected to Opera Neon.',
     category: 'Opera',
     args: {
+      pageId: {
+        name: 'pageId',
+        type: 'number',
+        description: 'Targets a specific page by ID.',
+        required: true,
+      },
       server: {
         name: 'server',
         type: 'string',
@@ -1140,13 +1306,26 @@ export const commands: Commands = {
     description:
       'List MCP servers registered in the browser, including their connection status. Only available when connected to Opera Neon.',
     category: 'Opera',
-    args: {},
+    args: {
+      pageId: {
+        name: 'pageId',
+        type: 'number',
+        description: 'Targets a specific page by ID.',
+        required: true,
+      },
+    },
   },
   opera_list_mcp_tools: {
     description:
       'List the tools exposed by a single MCP server. Prefer opera_list_mcp_servers when discovering everything at once; use this for a targeted refresh of one server. Only available when connected to Opera Neon.',
     category: 'Opera',
     args: {
+      pageId: {
+        name: 'pageId',
+        type: 'number',
+        description: 'Targets a specific page by ID.',
+        required: true,
+      },
       server: {
         name: 'server',
         type: 'string',
@@ -1159,13 +1338,26 @@ export const commands: Commands = {
     description:
       'List available AI models for Opera chat. Returns model IDs, display names, and which is the default. Only available when connected to Opera Neon.',
     category: 'Opera',
-    args: {},
+    args: {
+      pageId: {
+        name: 'pageId',
+        type: 'number',
+        description: 'Targets a specific page by ID.',
+        required: true,
+      },
+    },
   },
   opera_make: {
     description:
       "Ask Opera's built-in AI to create or generate content and return the result. Only available when connected to Opera Neon.",
     category: 'Opera',
     args: {
+      pageId: {
+        name: 'pageId',
+        type: 'number',
+        description: 'Targets a specific page by ID.',
+        required: true,
+      },
       prompt: {
         name: 'prompt',
         type: 'string',
@@ -1193,6 +1385,12 @@ export const commands: Commands = {
       'Register an MCP server in the browser. Does not connect or authenticate — follow with opera_connect_mcp_server. Only available when connected to Opera Neon.',
     category: 'Opera',
     args: {
+      pageId: {
+        name: 'pageId',
+        type: 'number',
+        description: 'Targets a specific page by ID.',
+        required: true,
+      },
       server: {
         name: 'server',
         type: 'string',
@@ -1212,6 +1410,12 @@ export const commands: Commands = {
       "Ask Opera's built-in AI to research a topic and return a summary. Only available when connected to Opera Neon.",
     category: 'Opera',
     args: {
+      pageId: {
+        name: 'pageId',
+        type: 'number',
+        description: 'Targets a specific page by ID.',
+        required: true,
+      },
       prompt: {
         name: 'prompt',
         type: 'string',
@@ -1240,6 +1444,12 @@ export const commands: Commands = {
       'Remove a registered MCP server and its stored auth tokens. Only available when connected to Opera Neon.',
     category: 'Opera',
     args: {
+      pageId: {
+        name: 'pageId',
+        type: 'number',
+        description: 'Targets a specific page by ID.',
+        required: true,
+      },
       server: {
         name: 'server',
         type: 'string',
@@ -1253,6 +1463,12 @@ export const commands: Commands = {
       'Provides more detailed information on a specific Performance Insight of an insight set that was highlighted in the results of a trace recording.',
     category: 'Performance',
     args: {
+      pageId: {
+        name: 'pageId',
+        type: 'number',
+        description: 'Targets a specific page by ID.',
+        required: true,
+      },
       insightSetId: {
         name: 'insightSetId',
         type: 'string',
@@ -1271,14 +1487,20 @@ export const commands: Commands = {
   },
   performance_start_trace: {
     description:
-      'Start a performance trace on the selected webpage. Use to find frontend performance issues, Core Web Vitals (LCP, INP, CLS), and improve page load speed.',
+      'Start a performance trace on the target webpage. Use to find frontend performance issues, Core Web Vitals (LCP, INP, CLS), and improve page load speed.',
     category: 'Performance',
     args: {
+      pageId: {
+        name: 'pageId',
+        type: 'number',
+        description: 'Targets a specific page by ID.',
+        required: true,
+      },
       reload: {
         name: 'reload',
         type: 'boolean',
         description:
-          'Determines if, once tracing has started, the current selected page should be automatically reloaded. Navigate the page to the right URL using the navigate_page tool BEFORE starting the trace if reload or autoStop is set to true.',
+          'Determines if, once tracing has started, the target page should be automatically reloaded. Navigate the page to the right URL using the navigate_page tool BEFORE starting the trace if reload or autoStop is set to true.',
         required: false,
         default: true,
       },
@@ -1301,9 +1523,15 @@ export const commands: Commands = {
   },
   performance_stop_trace: {
     description:
-      'Stop the active performance trace recording on the selected webpage.',
+      'Stop the active performance trace recording on the target webpage.',
     category: 'Performance',
     args: {
+      pageId: {
+        name: 'pageId',
+        type: 'number',
+        description: 'Targets a specific page by ID.',
+        required: true,
+      },
       filePath: {
         name: 'filePath',
         type: 'string',
@@ -1318,6 +1546,12 @@ export const commands: Commands = {
       'Press a key or key combination. Use this when other input methods like fill() cannot be used (e.g., keyboard shortcuts, navigation keys, or special key combinations).',
     category: 'Input automation',
     args: {
+      pageId: {
+        name: 'pageId',
+        type: 'number',
+        description: 'Targets a specific page by ID.',
+        required: true,
+      },
       key: {
         name: 'key',
         type: 'string',
@@ -1334,6 +1568,78 @@ export const commands: Commands = {
       },
     },
   },
+  query_heapsnapshot_objects: {
+    description:
+      'Loads a memory heapsnapshot and queries objects matching specific filters (className, propertyName, nodeType, retainedSize, selfSize, isDetached, sortBy). (requires flag: --memoryDebugging=true)',
+    category: 'Memory',
+    args: {
+      filePath: {
+        name: 'filePath',
+        type: 'string',
+        description: 'A path to a .heapsnapshot file to read.',
+        required: true,
+      },
+      className: {
+        name: 'className',
+        type: 'string',
+        description: 'Optional regex or text matching object class name.',
+        required: false,
+      },
+      propertyName: {
+        name: 'propertyName',
+        type: 'string',
+        description:
+          'Optional property name filter for outgoing reference edges.',
+        required: false,
+      },
+      nodeType: {
+        name: 'nodeType',
+        type: 'string',
+        description:
+          'Optional V8 node type filter (e.g. object, closure, string, array, code).',
+        required: false,
+      },
+      retainedSize: {
+        name: 'retainedSize',
+        type: 'string',
+        description:
+          'Inclusive retained size range (e.g. "1MB-2MB", "-1MB", or "1MB-"). A single value is treated as a minimum.',
+        required: false,
+      },
+      selfSize: {
+        name: 'selfSize',
+        type: 'string',
+        description:
+          'Inclusive self size range (e.g. "1MB-2MB", "-1MB", or "1MB-"). A single value is treated as a minimum.',
+        required: false,
+      },
+      isDetached: {
+        name: 'isDetached',
+        type: 'boolean',
+        description: 'Whether to filter for detached DOM nodes.',
+        required: false,
+      },
+      sortBy: {
+        name: 'sortBy',
+        type: 'string',
+        description: 'Sort order for results. Default is retainedSize.',
+        required: false,
+        enum: ['retainedSize', 'selfSize', 'id'],
+      },
+      pageIdx: {
+        name: 'pageIdx',
+        type: 'number',
+        description: 'The page index for pagination.',
+        required: false,
+      },
+      pageSize: {
+        name: 'pageSize',
+        type: 'number',
+        description: 'The page size for pagination.',
+        required: false,
+      },
+    },
+  },
   reload_extension: {
     description:
       'Reloads an unpacked Chrome extension by its ID. (requires flag: --categoryExtensions=true)',
@@ -1349,9 +1655,15 @@ export const commands: Commands = {
   },
   resize_page: {
     description:
-      "Resizes the selected page's window so that the page has specified dimension",
+      "Resizes the page's window so that the page has specified dimension",
     category: 'Emulation',
     args: {
+      pageId: {
+        name: 'pageId',
+        type: 'number',
+        description: 'Targets a specific page by ID.',
+        required: true,
+      },
       width: {
         name: 'width',
         type: 'number',
@@ -1368,9 +1680,15 @@ export const commands: Commands = {
   },
   screencast_start: {
     description:
-      'Starts recording a screencast (video) of the selected page in specified format. (requires flag: --experimentalScreencast=true)',
+      'Starts recording a screencast (video) of the target page in specified format. (requires flag: --experimentalScreencast=true)',
     category: 'Debugging',
     args: {
+      pageId: {
+        name: 'pageId',
+        type: 'number',
+        description: 'Targets a specific page by ID.',
+        required: true,
+      },
       filePath: {
         name: 'filePath',
         type: 'string',
@@ -1382,9 +1700,16 @@ export const commands: Commands = {
   },
   screencast_stop: {
     description:
-      'Stops the active screencast recording on the selected page. (requires flag: --experimentalScreencast=true)',
+      'Stops the active screencast recording on the target page. (requires flag: --experimentalScreencast=true)',
     category: 'Debugging',
-    args: {},
+    args: {
+      pageId: {
+        name: 'pageId',
+        type: 'number',
+        description: 'Targets a specific page by ID.',
+        required: true,
+      },
+    },
   },
   select_page: {
     description: 'Select a page as a context for future tool calls.',
@@ -1407,9 +1732,15 @@ export const commands: Commands = {
   },
   take_heapsnapshot: {
     description:
-      'Capture a heap snapshot of the currently selected page. Use to analyze the memory distribution of JavaScript objects and debug memory leaks.',
+      'Capture a heap snapshot of the target page. Use to analyze the memory distribution of JavaScript objects and debug memory leaks.',
     category: 'Memory',
     args: {
+      pageId: {
+        name: 'pageId',
+        type: 'number',
+        description: 'Targets a specific page by ID.',
+        required: true,
+      },
       filePath: {
         name: 'filePath',
         type: 'string',
@@ -1423,6 +1754,12 @@ export const commands: Commands = {
     description: 'Take a screenshot of the page or element.',
     category: 'Debugging',
     args: {
+      pageId: {
+        name: 'pageId',
+        type: 'number',
+        description: 'Targets a specific page by ID.',
+        required: true,
+      },
       format: {
         name: 'format',
         type: 'string',
@@ -1464,9 +1801,15 @@ export const commands: Commands = {
   },
   take_snapshot: {
     description:
-      'Take a text snapshot of the currently selected page based on the a11y tree. The snapshot lists page elements along with a unique\nidentifier (uid). Always use the latest snapshot. Prefer taking a snapshot over taking a screenshot. The snapshot indicates the element selected\nin the DevTools Elements panel (if any).',
+      'Take a text snapshot of the target page based on the a11y tree. The snapshot lists page elements along with a unique\nidentifier (uid). Always use the latest snapshot. Prefer taking a snapshot over taking a screenshot. The snapshot indicates the element selected\nin the DevTools Elements panel (if any).',
     category: 'Debugging',
     args: {
+      pageId: {
+        name: 'pageId',
+        type: 'number',
+        description: 'Targets a specific page by ID.',
+        required: true,
+      },
       verbose: {
         name: 'verbose',
         type: 'boolean',
@@ -1500,6 +1843,12 @@ export const commands: Commands = {
     description: 'Type text using keyboard into a previously focused input',
     category: 'Input automation',
     args: {
+      pageId: {
+        name: 'pageId',
+        type: 'number',
+        description: 'Targets a specific page by ID.',
+        required: true,
+      },
       text: {
         name: 'text',
         type: 'string',
@@ -1546,6 +1895,12 @@ export const commands: Commands = {
     description: 'Upload a file through a provided element.',
     category: 'Input automation',
     args: {
+      pageId: {
+        name: 'pageId',
+        type: 'number',
+        description: 'Targets a specific page by ID.',
+        required: true,
+      },
       uid: {
         name: 'uid',
         type: 'string',
diff --git a/src/bin/chrome-devtools-mcp-cli-options.ts b/src/config/mcp-options.ts
similarity index 66%
rename from src/bin/chrome-devtools-mcp-cli-options.ts
rename to src/config/mcp-options.ts
index 9d87ad47..e7c558b3 100644
--- a/src/bin/chrome-devtools-mcp-cli-options.ts
+++ b/src/config/mcp-options.ts
@@ -7,9 +7,7 @@
  */
 
 import {
-  CACHE_DIR_NAME,
   ENV_NO_USAGE_STATISTICS,
-  MCP_BIN_NAME,
   PACKAGE_NAME,
   REPO_URL,
 } from '../opera/branding.js';
@@ -19,116 +17,20 @@ import {
   USAGE_STATISTICS_DEFAULT,
   USAGE_STATISTICS_DESCRIPTION,
 } from '../opera/policy.js';
+
 import type {YargsOptions} from '../third_party/index.js';
 import {yargs, hideBin} from '../third_party/index.js';
+import os from 'node:os';
+import {readFileSync} from 'node:fs';
 
-export const cliOptions = {
-  autoConnect: {
-    type: 'boolean',
-    description:
-      'If specified, automatically connects to a browser (Chrome 144+) running locally from the user data directory identified by the channel param (default channel is stable). Requires the remote debugging server to be started in the Chrome instance via chrome://inspect/#remote-debugging.',
-    conflicts: ['isolated', 'executablePath'],
-    default: false,
-    coerce: (value: boolean | undefined) => {
-      if (!value) {
-        return;
-      }
-      return value;
-    },
-  },
-  browserUrl: {
-    type: 'string',
-    description: `Connect to a running, debuggable Chrome instance (e.g. \`http://127.0.0.1:9222\`). For more details see: ${REPO_URL}#connecting-to-a-running-chrome-instance.`,
-    alias: 'u',
-    conflicts: ['wsEndpoint'],
-    coerce: (url: string | undefined) => {
-      if (!url) {
-        return;
-      }
-      try {
-        new URL(url);
-      } catch {
-        throw new Error(`Provided browserUrl ${url} is not valid URL.`);
-      }
-      return url;
-    },
-  },
-  wsEndpoint: {
-    type: 'string',
-    description:
-      'WebSocket endpoint to connect to a running Chrome instance (e.g., ws://127.0.0.1:9222/devtools/browser/<id>). Alternative to --browserUrl.',
-    alias: 'w',
-    conflicts: ['browserUrl'],
-    coerce: (url: string | undefined) => {
-      if (!url) {
-        return;
-      }
-      try {
-        const parsed = new URL(url);
-        if (parsed.protocol !== 'ws:' && parsed.protocol !== 'wss:') {
-          throw new Error(
-            `Provided wsEndpoint ${url} must use ws:// or wss:// protocol.`,
-          );
-        }
-        return url;
-      } catch (error) {
-        if ((error as Error).message.includes('ws://')) {
-          throw error;
-        }
-        throw new Error(`Provided wsEndpoint ${url} is not valid URL.`);
-      }
-    },
-  },
-  wsHeaders: {
-    type: 'string',
-    description:
-      'Custom headers for WebSocket connection in JSON format (e.g., \'{"Authorization":"Bearer token"}\'). Only works with --wsEndpoint.',
-    implies: 'wsEndpoint',
-    coerce: (val: string | undefined) => {
-      if (!val) {
-        return;
-      }
-      try {
-        const parsed = JSON.parse(val);
-        if (typeof parsed !== 'object' || Array.isArray(parsed)) {
-          throw new Error('Headers must be a JSON object');
-        }
-        return parsed as Record<string, string>;
-      } catch (error) {
-        throw new Error(
-          `Invalid JSON for wsHeaders: ${(error as Error).message}`,
-        );
-      }
-    },
-  },
-  headless: {
-    type: 'boolean',
-    description: 'Whether to run in headless (no UI) mode.',
-    default: false,
-  },
-  executablePath: {
-    type: 'string',
-    description: 'Path to custom Chrome executable.',
-    conflicts: ['browserUrl', 'wsEndpoint'],
-    alias: 'e',
-  },
-  isolated: {
-    type: 'boolean',
-    description:
-      'If specified, creates a temporary user-data-dir that is automatically cleaned up after the browser is closed. Defaults to false.',
-  },
-  userDataDir: {
-    type: 'string',
-    description: `Path to the user data directory for Chrome. Default is $HOME/.cache/${CACHE_DIR_NAME}/chrome-profile$CHANNEL_SUFFIX_IF_NON_STABLE`,
-    conflicts: ['browserUrl', 'wsEndpoint', 'isolated'],
-  },
-  channel: {
-    type: 'string',
-    description:
-      'Specify a different Chrome channel that should be used. The default is the stable channel version.',
-    choices: ['canary', 'dev', 'beta', 'stable'] as const,
-    conflicts: ['browserUrl', 'wsEndpoint', 'executablePath'],
-  },
+export const DEFAULT_FILESYSTEM_ROOT = [os.tmpdir()];
+
+import {getCategoryOptions} from './category-options.js';
+import {getBrowserOptions} from './browser-options.js';
+
+export const mcpOptions = {
+  ...getCategoryOptions(),
+  ...getBrowserOptions(),
   logFile: {
     type: 'string',
     describe:
@@ -152,18 +54,22 @@ export const cliOptions = {
       };
     },
   },
-  proxyServer: {
-    type: 'string',
-    description: `Proxy server configuration for Chrome passed as --proxy-server when launching the browser. See https://www.chromium.org/developers/design-documents/network-settings/ for details.`,
-  },
   acceptInsecureCerts: {
     type: 'boolean',
     description: `If enabled, ignores errors relative to self-signed and expired certificates. Use with caution.`,
   },
-  experimentalPageIdRouting: {
+  pageIdRouting: {
     type: 'boolean',
     describe:
-      'Whether to expose pageId on page-scoped tools and route requests by page ID (useful for concurrent agent sessions).',
+      'Require pageId on page-scoped tools and route requests by page ID (useful for concurrent agent sessions). Use --no-page-id-routing to disable.',
+    default: true,
+  },
+  devtoolsComments: {
+    type: 'boolean',
+    describe:
+      'Whether to enable DevTools comments tools. Internal WIP feature.',
+    hidden: true,
+    default: false,
   },
   experimentalDevtools: {
     type: 'boolean',
@@ -176,11 +82,13 @@ export const cliOptions = {
   },
   memoryDebugging: {
     type: 'boolean',
+    default: false,
     describe: 'Whether to enable memory debugging tools.',
     alias: 'experimentalMemory',
   },
   experimentalStructuredContent: {
     type: 'boolean',
+    default: false,
     describe: 'Whether to output structured formatted content.',
   },
   experimentalToonFormat: {
@@ -216,14 +124,22 @@ export const cliOptions = {
     describe: 'Path to ffmpeg executable for screencast recording.',
     implies: 'experimentalScreencast',
   },
-  categoryExperimentalWebmcp: {
-    type: 'boolean',
+  experimentalScreencastFps: {
+    type: 'number',
     describe:
-      'Set to true to enable debugging WebMCP tools. Requires Chrome 150+ with the following flag: `--enable-features=WebMCP`',
-  },
-  chromeArg: {
-    type: 'array',
-    describe: `Additional arguments for Chrome. Only applies when Chrome is launched by ${MCP_BIN_NAME}.`,
+      'Frames per second to use for screencast recording. Lower values can reduce memory pressure on pages that produce frames faster than ffmpeg can encode them.',
+    implies: 'experimentalScreencast',
+    coerce: (value: number | undefined) => {
+      if (value === undefined) {
+        return;
+      }
+      if (!Number.isInteger(value) || value <= 0) {
+        throw new Error(
+          `Invalid experimentalScreencastFps ${value}. Expected a positive integer.`,
+        );
+      }
+      return value;
+    },
   },
   blockedUrlPattern: {
     type: 'array',
@@ -237,54 +153,27 @@ export const cliOptions = {
       "Restricts browser's network access by allowing only specified URL patterns (uses https://urlpattern.spec.whatwg.org/). Requires Chrome 149+. Silently detaches from targets with unallowed URLs upon connection, and blocks runtime requests (including navigations and subresources). Accepts an array of patterns.",
     conflicts: ['blockedUrlPattern'],
   },
-  ignoreDefaultChromeArg: {
-    type: 'array',
-    describe: `Explicitly disable default arguments for Chrome. Only applies when Chrome is launched by ${MCP_BIN_NAME}.`,
-  },
-  categoryEmulation: {
+  performanceCrux: {
     type: 'boolean',
-    default: true,
-    describe: 'Set to false to exclude tools related to emulation.',
+    default: PERFORMANCE_CRUX_DEFAULT,
+    describe: PERFORMANCE_CRUX_DESCRIPTION,
   },
-  categoryPerformance: {
+  usageStatistics: {
     type: 'boolean',
-    default: true,
-    describe: 'Set to false to exclude tools related to performance.',
+    default: USAGE_STATISTICS_DEFAULT,
+    describe: USAGE_STATISTICS_DESCRIPTION,
   },
-  categoryNetwork: {
+  javascriptEvaluation: {
     type: 'boolean',
     default: true,
-    describe: 'Set to false to exclude tools related to network.',
-  },
-  categoryExtensions: {
-    type: 'boolean',
-    hidden: false,
-    default: false,
     describe:
-      'Set to true to include tools related to extensions. Note: This feature is currently only supported with a pipe connection. autoConnect, browserUrl, and wsEndpoint are not supported with this feature until 149 will be released.',
+      'Set to false to disable JavaScript execution. When disabled, evaluation tools (evaluate_script and slim evaluate) are disabled, the initScript parameter in navigate_page is turned off, and navigating to javascript:, data:, or vbscript: URLs is disallowed.',
   },
-  categoryExperimentalThirdParty: {
+  sourceMaps: {
     type: 'boolean',
-    default: false,
-    describe:
-      'Set to true to enable third-party developer tools exposed by the inspected page itself',
-  },
-  categoryPwa: {
-    type: 'boolean',
-    hidden: false,
-    conflicts: ['autoConnect', 'browserUrl', 'wsEndpoint'],
+    default: true,
     describe:
-      'Set to true to include tools for automating Progressive Web Apps (install, launch, uninstall, and OS state). This feature is only supported with a pipe connection; autoConnect, browserUrl, and wsEndpoint are not supported.',
-  },
-  performanceCrux: {
-    type: 'boolean',
-    default: PERFORMANCE_CRUX_DEFAULT,
-    describe: PERFORMANCE_CRUX_DESCRIPTION,
-  },
-  usageStatistics: {
-    type: 'boolean',
-    default: USAGE_STATISTICS_DEFAULT,
-    describe: USAGE_STATISTICS_DESCRIPTION,
+      'Whether to enable source maps in DevTools. Use --no-source-maps to disable.',
   },
   clearcutEndpoint: {
     type: 'string',
@@ -304,7 +193,7 @@ export const cliOptions = {
   screenshotFormat: {
     type: 'string',
     description:
-      'Override the default output format used by take_screenshot when the caller does not specify one. JPEG and WebP are ~3-5x smaller than PNG, which helps reduce context size in AI conversations. Unset preserves the existing default ("png").',
+      'Override the default output format used by take_screenshot when the caller does not specify one. JPEG and WebP are ~3-5x smaller than PNG, which reduces transfer and storage size. To reduce context size use --screenshotMaxWidth / --screenshotMaxHeight, since image tokens scale with dimensions rather than encoded bytes. Unset preserves the existing default ("png").',
     choices: ['jpeg', 'png', 'webp'] as const,
   },
   screenshotQuality: {
@@ -375,16 +264,68 @@ export const cliOptions = {
   allowUnrestrictedPaths: {
     type: 'boolean',
     default: false,
+    deprecated: 'Use --workspace=/ instead.',
     describe:
       'If set, disables the default path restriction that applies when the MCP client does not negotiate ' +
       'the roots capability. By default, file-writing tools are restricted to the OS temp directory when ' +
       'no roots are configured. Use this only when connecting a trusted local client that does not implement ' +
       'MCP roots and requires access to paths outside the temp directory.',
   },
+  filesystemRoot: {
+    type: 'array',
+    alias: 'workspace',
+    default: DEFAULT_FILESYSTEM_ROOT,
+    defaultDescription: 'OS temp directory',
+    describe:
+      'A directory that filesystem tools are allowed to access. May be specified more than once.',
+  },
+  config: {
+    type: 'string',
+    describe: 'Path to JSON configuration file.',
+  },
 } satisfies Record<string, YargsOptions>;
 
 export type ParsedArguments = ReturnType<typeof parseArguments>;
 
+export function getMcpOptionsForViaCli(): typeof mcpOptions {
+  if (!('default' in mcpOptions.headless)) {
+    throw new Error('headless cli option unexpectedly does not have a default');
+  }
+  if (!('default' in mcpOptions.experimentalStructuredContent)) {
+    throw new Error(
+      'experimentalStructuredContent cli option unexpectedly does not have a default',
+    );
+  }
+  if ('default' in mcpOptions.isolated) {
+    throw new Error('isolated cli option unexpectedly has a default');
+  }
+
+  return {
+    ...mcpOptions,
+    headless: {
+      ...mcpOptions.headless,
+      default: true,
+    },
+    memoryDebugging: {
+      ...mcpOptions.memoryDebugging,
+      default: true,
+    },
+    categoryExtensions: {
+      ...mcpOptions.categoryExtensions,
+      default: true,
+    },
+    experimentalStructuredContent: {
+      ...mcpOptions.experimentalStructuredContent,
+      default: true,
+    },
+    isolated: {
+      ...mcpOptions.isolated,
+      description:
+        'If specified, creates a temporary user-data-dir that is automatically cleaned up after the browser is closed. Defaults to true unless userDataDir is provided.',
+    },
+  };
+}
+
 /**
  * Exported only for testing to not trigger process exit.
  */
@@ -393,24 +334,26 @@ export function parser(
   argv = process.argv,
   env = process.env,
 ) {
-  // Preserve yargs' mixed camel/kebab-case expansion under strict validation.
-  const kebabCaseAliases: Record<string, string> = {};
-  for (const option of Object.keys(cliOptions)) {
-    const alias = option.replace(
-      /[A-Z]/g,
-      letter => `-${letter.toLowerCase()}`,
-    );
-    if (alias !== option) {
-      kebabCaseAliases[option] = alias;
-    }
-  }
+  const isViaCli = argv.includes('--viaCli') || argv.includes('--via-cli');
+  const options = isViaCli ? getMcpOptionsForViaCli() : mcpOptions;
 
   const yargsInstance = yargs(hideBin(argv))
     .scriptName(`npx ${PACKAGE_NAME}@latest`)
-    .options(cliOptions)
-    .alias(kebabCaseAliases)
-    .strictOptions()
+    .parserConfiguration({
+      'strip-aliased': true,
+      'strip-dashed': true,
+    })
+    .options(options)
+    .showHelpOnFail(false, 'Specify --help for available options')
     .middleware(args => {
+      if (isViaCli && args.filesystemRoot === DEFAULT_FILESYSTEM_ROOT) {
+        const cliFilesystemArgs: {
+          allowUnrestrictedPaths?: boolean;
+          filesystemRoot?: unknown;
+        } = args;
+        cliFilesystemArgs.allowUnrestrictedPaths = true;
+        cliFilesystemArgs.filesystemRoot = undefined;
+      }
       // We can't set default in the options else
       // Yargs will complain
       if (
@@ -427,6 +370,23 @@ export function parser(
         );
         args.usageStatistics = false;
       }
+
+      const cliOptionsAllowedArgs = [
+        ...Object.keys(options),
+        // Yargs populated with positional args
+        '_',
+        '$0',
+      ];
+
+      const unknownArgs = Object.keys(args).filter(
+        arg => !cliOptionsAllowedArgs.includes(arg),
+      );
+
+      if (unknownArgs.length > 0) {
+        console.error(
+          `Unknown arguments: ${unknownArgs.map(arg => `--${arg}`)}`,
+        );
+      }
     })
     .example([
       [
@@ -485,6 +445,11 @@ export function parser(
         '$0 --no-performance-crux',
         'Disable CrUX (field data) integration in performance tools.',
       ],
+      ['$0 --no-source-maps', 'Disable source maps in DevTools.'],
+      [
+        '$0 --no-javascript-evaluation',
+        'Disable JavaScript execution (disables evaluation tools, initScript in navigate_page, and navigating to javascript:, data:, or vbscript: URLs).',
+      ],
       [
         '$0 --slim',
         'Only 3 tools: navigation, JavaScript execution and screenshot',
@@ -492,6 +457,32 @@ export function parser(
     ]);
 
   return yargsInstance
+    .config('config', 'Path to JSON configuration file', configPath => {
+      try {
+        const parsed = JSON.parse(readFileSync(configPath, 'utf-8'));
+        if (
+          typeof parsed !== 'object' ||
+          parsed === null ||
+          Array.isArray(parsed)
+        ) {
+          throw new Error('Config must be a JSON object');
+        }
+
+        return yargs()
+          .parserConfiguration({
+            'strip-aliased': true,
+            'camel-case-expansion': false,
+          })
+          .options(options)
+          .config(parsed)
+          .strict()
+          .fail(false)
+          .exitProcess(false)
+          .parseSync([]);
+      } catch (err) {
+        throw new Error(`Invalid JSON config file: ${(err as Error).message}`);
+      }
+    })
     .wrap(Math.min(120, yargsInstance.terminalWidth()))
     .help()
     .version(version);
diff --git a/src/daemon/client.ts b/src/daemon/client.ts
index 62624b0c..146e1fd5 100644
--- a/src/daemon/client.ts
+++ b/src/daemon/client.ts
@@ -224,6 +224,15 @@ export async function handleResponse(
   format: 'json' | 'md',
 ): Promise<string> {
   if (response.isError) {
+    if (format === 'md') {
+      const chunks = [];
+      for (const content of response.content) {
+        if (content.type === 'text') {
+          chunks.push(content.text);
+        }
+      }
+      return chunks.join(' ');
+    }
     return JSON.stringify(response.content);
   }
   const chunks = [];
diff --git a/src/daemon/utils.ts b/src/daemon/utils.ts
index bcf878d9..2a914b8a 100644
--- a/src/daemon/utils.ts
+++ b/src/daemon/utils.ts
@@ -135,6 +135,12 @@ export function serializeArgs(
       continue;
     }
     const value = argv[key];
+    const option = options[key];
+    // Yargs reuses the option `default` object; skip it so the daemon parser
+    // still sees the original default (needed for filesystemRoot identity).
+    if (option !== undefined && value === option.default) {
+      continue;
+    }
     const kebabKey = key.replace(/[A-Z]/g, m => `-${m.toLowerCase()}`);
 
     if (typeof value === 'boolean') {
diff --git a/src/devtools/DevtoolsUtils.ts b/src/devtools/DevtoolsUtils.ts
index 5b4ac445..4195b3e3 100644
--- a/src/devtools/DevtoolsUtils.ts
+++ b/src/devtools/DevtoolsUtils.ts
@@ -36,6 +36,12 @@ export function overrideDevToolsGlobals({
   // DevTools CDP errors can get noisy.
   DevTools.ProtocolClient.InspectorBackend.test.suppressRequestErrors = true;
 
+  const noopAgentCommand = () => {
+    return Promise.resolve({
+      getError: () => undefined,
+    });
+  };
+
   // Stub out Network emulation commands on the DevTools Agent prototype globally.
   // This prevents the DevTools Frontend from ever resetting/clearing Puppeteer's
   // active network blocking/throttling rules during target setup or session lifetime.
@@ -63,42 +69,42 @@ export function overrideDevToolsGlobals({
       networkAgentPrototype,
       'invoke_overrideNetworkState',
       {
-        value: () => {
-          return Promise.resolve({
-            getError: () => undefined,
-          });
-        },
+        value: noopAgentCommand,
         writable: true,
         configurable: true,
         enumerable: true,
       },
     );
     Object.defineProperty(networkAgentPrototype, 'invoke_enable', {
-      value: () => {
-        return Promise.resolve({
-          getError: () => undefined,
-        });
-      },
+      value: noopAgentCommand,
       writable: true,
       configurable: true,
       enumerable: true,
     });
     Object.defineProperty(networkAgentPrototype, 'invoke_disable', {
-      value: () => {
-        return Promise.resolve({
-          getError: () => undefined,
-        });
-      },
+      value: noopAgentCommand,
       writable: true,
       configurable: true,
       enumerable: true,
     });
     Object.defineProperty(networkAgentPrototype, 'invoke_setBlockedURLs', {
-      value: () => {
-        return Promise.resolve({
-          getError: () => undefined,
-        });
-      },
+      value: noopAgentCommand,
+      writable: true,
+      configurable: true,
+      enumerable: true,
+    });
+  }
+
+  // Puppeteer already collects issues from its own Audits subscription. Avoid
+  // enabling the DevTools Frontend's redundant subscription, which can replay
+  // a large retained issue backlog and delay unrelated page work.
+  const auditsAgentPrototype =
+    DevTools.ProtocolClient.InspectorBackend.inspectorBackend.agentPrototypes.get(
+      'Audits',
+    );
+  if (auditsAgentPrototype) {
+    Object.defineProperty(auditsAgentPrototype, 'invoke_enable', {
+      value: noopAgentCommand,
       writable: true,
       configurable: true,
       enumerable: true,
@@ -131,8 +137,13 @@ export interface TargetUniverse {
   session: CDPSession;
 }
 
+export interface CreateTargetUniverseOptions {
+  sourceMaps?: boolean;
+}
+
 export async function createTargetUniverse(
   session: CDPSession,
+  options?: CreateTargetUniverseOptions,
 ): Promise<TargetUniverse> {
   const settingStorage = new DevTools.Common.Settings.SettingsStorage({});
   const universe = new DevTools.Foundation.Universe.Universe({
@@ -150,6 +161,17 @@ export async function createTargetUniverse(
     supportsEmulation: false,
   });
 
+  const sourceMaps = options?.sourceMaps ?? true;
+  const jsSourceMapsSetting = universe.settings.resolve(
+    DevTools.SDKSettings.jsSourceMapsEnabledSettingDescriptor,
+  );
+  jsSourceMapsSetting.set(sourceMaps);
+
+  const cssSourceMapsSetting = universe.settings.resolve(
+    DevTools.SDKSettings.cssSourceMapsEnabledSettingDescriptor,
+  );
+  cssSourceMapsSetting.set(sourceMaps);
+
   const setting = universe.settings.resolve(
     DevTools.SourceMapManager.lazyLoadingSettingDescriptor,
   );
diff --git a/src/formatters/NetworkFormatter.ts b/src/formatters/NetworkFormatter.ts
index a7647d22..3b751074 100644
--- a/src/formatters/NetworkFormatter.ts
+++ b/src/formatters/NetworkFormatter.ts
@@ -13,6 +13,7 @@ import {
 } from '../third_party/index.js';
 
 const BODY_CONTEXT_SIZE_LIMIT = 10000;
+const URL_CONTEXT_SIZE_LIMIT = 255;
 
 export interface NetworkFormatterOptions {
   requestId?: number | string;
@@ -263,8 +264,10 @@ function getSizeLimitedString(text: string, sizeLimit: number) {
 function convertNetworkRequestConciseToString(
   data: NetworkRequestConcise,
 ): string {
-  // TODO truncate the URL
-  return `reqid=${data.requestId} ${data.method} ${data.url} [${data.status}]${data.selectedInDevToolsUI ? ` [selected in the DevTools Network panel]` : ''}`;
+  // Long URLs (e.g., data: URLs) bloat the concise list output. The full URL
+  // remains available via the detailed view and the structured content.
+  const url = getSizeLimitedString(data.url, URL_CONTEXT_SIZE_LIMIT);
+  return `reqid=${data.requestId} ${data.method} ${url} [${data.status}]${data.selectedInDevToolsUI ? ` [selected in the DevTools Network panel]` : ''}`;
 }
 
 function formatHeaders(headers: Record<string, string>): string[] {
diff --git a/src/index.ts b/src/index.ts
index 30a2a5f1..311e8f9d 100644
--- a/src/index.ts
+++ b/src/index.ts
@@ -7,36 +7,43 @@
  */
 
 import type fs from 'node:fs';
+import path from 'node:path';
+import {pathToFileURL} from 'node:url';
 
-import type {parseArguments} from './bin/chrome-devtools-mcp-cli-options.js';
 import type {Channel} from './browser.js';
 import {ensureBrowserConnected, ensureBrowserLaunched} from './browser.js';
+import {type ParsedArguments} from './config/mcp-options.js';
 import {loadIssueDescriptions} from './devtools/issueDescriptions.js';
 import {McpContext} from './McpContext.js';
 import {
   BROWSER_EXPOSURE_DISCLAIMER,
   showUsageStatisticsDisclaimer,
 } from './opera/policy.js';
-import {createOperaToolHooks} from './opera/toolHandlerHooks.js';
 import {buildLaunchOptions} from './opera/browserLaunch.js';
+import {
+  createOperaToolHooks,
+  type OperaToolHooks,
+} from './opera/toolHandlerHooks.js';
 import {ClearcutLogger} from './telemetry/ClearcutLogger.js';
 import {FilePersistence} from './telemetry/persistence.js';
 import {
-  McpServer,
+  McpServer as SdkMcpServer,
   type CallToolResult,
   type Root,
+  type Transport,
   SetLevelRequestSchema,
   ListRootsResultSchema,
   RootsListChangedNotificationSchema,
+  Mutex,
+  puppeteer,
 } from './third_party/index.js';
 import {ToolHandler} from './ToolHandler.js';
 import type {DefinedPageTool, ToolDefinition} from './tools/ToolDefinition.js';
 import {createTools} from './tools/tools.js';
 import {logger} from './utils/logger.js';
-import {Mutex} from './third_party/index.js';
 import {VERSION} from './version.js';
 
-export {buildFlag} from './ToolHandler.js';
+puppeteer.setFollowSymlinks(false);
 
 /**
  * Timeout for a `roots/list` that a tool call is waiting on, matching the 5s
@@ -48,106 +55,194 @@ export {buildFlag} from './ToolHandler.js';
  */
 const ROOTS_REQUEST_TIMEOUT = 5_000;
 
-export async function createMcpServer(
-  serverArgs: ReturnType<typeof parseArguments>,
-  options: {
-    logFile?: fs.WriteStream;
-  },
-) {
-  // Opera forces `usageStatistics` off in ./opera/policy.ts, so this stays
-  // dormant. Kept identical to upstream so the seam is the policy, not this file.
-  if (serverArgs.usageStatistics) {
-    ClearcutLogger.initialize({
-      persistence: new FilePersistence(),
-      logFile: serverArgs.logFile,
-      appVersion: VERSION,
-      clearcutEndpoint: serverArgs.clearcutEndpoint,
-      clearcutForceFlushIntervalMs: serverArgs.clearcutForceFlushIntervalMs,
-      clearcutIncludePidHeader: serverArgs.clearcutIncludePidHeader,
+export interface McpServerOptions {
+  logFile?: fs.WriteStream;
+}
+
+export class McpServer {
+  readonly server: SdkMcpServer;
+  #serverArgs: ParsedArguments;
+  #options: McpServerOptions;
+  #context?: McpContext;
+
+  /**
+   * Client roots stay valid across browser reconnects and only the client can
+   * invalidate them through a `roots/list_changed` notification. CLI-configured
+   * roots are read from `#serverArgs` when combining roots.
+   */
+  #lastClientRoots?: Root[];
+  #toolMutex = new Mutex();
+  #operaHooks: OperaToolHooks;
+
+  private constructor(
+    serverArgs: ParsedArguments,
+    options: McpServerOptions = {},
+  ) {
+    this.#serverArgs = serverArgs;
+    this.#options = options;
+    this.#operaHooks = createOperaToolHooks({
+      serverArgs: this.#serverArgs,
+      logFile: this.#options.logFile,
+      resetContext: () => {
+        this.#context?.dispose();
+        this.#context = undefined;
+      },
+    });
+
+    if (this.#serverArgs.usageStatistics) {
+      ClearcutLogger.initialize({
+        persistence: new FilePersistence(),
+        logFile: this.#serverArgs.logFile,
+        appVersion: VERSION,
+        clearcutEndpoint: this.#serverArgs.clearcutEndpoint,
+        clearcutForceFlushIntervalMs:
+          this.#serverArgs.clearcutForceFlushIntervalMs,
+        clearcutIncludePidHeader: this.#serverArgs.clearcutIncludePidHeader,
+      });
+    }
+
+    this.server = new SdkMcpServer(
+      {
+        name: 'chrome_devtools',
+        title: 'Chrome DevTools MCP server',
+        version: VERSION,
+      },
+      {capabilities: {logging: {}}},
+    );
+
+    this.server.server.setRequestHandler(SetLevelRequestSchema, () => {
+      return {};
+    });
+
+    this.server.server.oninitialized = () => {
+      const clientName = this.server.server.getClientVersion()?.name;
+      if (clientName) {
+        ClearcutLogger.get()?.setClientName(clientName);
+      }
+      if (this.server.server.getClientCapabilities()?.roots) {
+        void this.#updateRoots();
+        this.server.server.setNotificationHandler(
+          RootsListChangedNotificationSchema,
+          () => {
+            void this.#updateRoots();
+          },
+        );
+      } else if (
+        !this.#serverArgs.allowUnrestrictedPaths &&
+        (this.#serverArgs.filesystemRoot ?? []).length === 0
+      ) {
+        console.warn(
+          '[chrome-devtools-mcp] The connecting client did not negotiate the MCP roots ' +
+            'capability. File-writing tools will be restricted to the OS temp directory. ' +
+            'To restore the previous unrestricted behavior, start the server with ' +
+            '--allow-unrestricted-paths.',
+        );
+      }
+    };
+  }
+
+  async connect(transport: Transport): Promise<void> {
+    return await this.server.connect(transport);
+  }
+
+  /**
+   * Closes the MCP connection and disposes internal context/listeners.
+   */
+  async close(): Promise<void> {
+    this.#context?.dispose();
+    this.#context = undefined;
+    await this.server.close();
+  }
+
+  [Symbol.dispose](): void {
+    this.close().catch(() => {
+      // TODO: wire up the logger
+    });
+  }
+
+  async [Symbol.asyncDispose](): Promise<void> {
+    await this.close();
+  }
+
+  static async from(
+    serverArgs: ParsedArguments,
+    options: McpServerOptions = {},
+  ): Promise<McpServer> {
+    const server = new McpServer(serverArgs, options);
+    await server.#init();
+    return server;
+  }
+
+  async #init(): Promise<void> {
+    const tools = createTools(this.#serverArgs);
+    for (const tool of tools) {
+      this.#registerTool(tool);
+    }
+    await loadIssueDescriptions();
+  }
+
+  #combinedRoots(): Root[] | undefined {
+    const configuredRoots = (
+      this.#serverArgs.allowUnrestrictedPaths
+        ? []
+        : (this.#serverArgs.filesystemRoot ?? [])
+    ).map(root => {
+      const rootPath = path.resolve(String(root));
+      return {
+        uri: pathToFileURL(rootPath).href,
+        name: path.basename(rootPath) || rootPath,
+      };
     });
+    if (configuredRoots.length === 0 && this.#lastClientRoots === undefined) {
+      return undefined;
+    }
+    return [...configuredRoots, ...(this.#lastClientRoots ?? [])];
   }
 
-  const server = new McpServer(
-    {
-      name: 'chrome_devtools',
-      title: 'Chrome DevTools MCP server',
-      version: VERSION,
-    },
-    {capabilities: {logging: {}}},
-  );
-  server.server.setRequestHandler(SetLevelRequestSchema, () => {
-    return {};
-  });
-
-  // Roots are client state rather than browser state, so the last listing stays
-  // valid across browser reconnects and only the client can invalidate it, via
-  // the `roots/list_changed` notification handled below
-  let lastRoots: Root[] | undefined;
-
-  // `timeout` is only passed where a tool call is waiting on the result – the
-  // background refreshes below block nobody, so bounding them would just discard
-  // roots a slow client was about to send
-  const updateRoots = async (timeout?: number) => {
-    if (!server.server.getClientCapabilities()?.roots) {
+  /**
+   * `timeout` is only passed where a tool call is waiting on the result – the
+   * background refreshes below block nobody, so bounding them would just discard
+   * roots a slow client was about to send
+   */
+  async #updateRoots(timeout?: number): Promise<void> {
+    if (!this.server.server.getClientCapabilities()?.roots) {
       return;
     }
     try {
-      const roots = await server.server.request(
+      const roots = await this.server.server.request(
         {method: 'roots/list'},
         ListRootsResultSchema,
         timeout === undefined ? undefined : {timeout},
       );
-      lastRoots = roots.roots;
-      context?.setRoots(lastRoots);
+      this.#lastClientRoots = roots.roots;
+      this.#context?.setRoots(this.#combinedRoots());
     } catch (e) {
       logger?.('Failed to list roots', e);
     }
-  };
-
-  server.server.oninitialized = () => {
-    const clientName = server.server.getClientVersion()?.name;
-    if (clientName) {
-      ClearcutLogger.get()?.setClientName(clientName);
-    }
-    if (server.server.getClientCapabilities()?.roots) {
-      void updateRoots();
-      server.server.setNotificationHandler(
-        RootsListChangedNotificationSchema,
-        () => {
-          void updateRoots();
-        },
-      );
-    } else if (!serverArgs.allowUnrestrictedPaths) {
-      console.warn(
-        '[chrome-devtools-mcp] The connecting client did not negotiate the MCP roots ' +
-          'capability. File-writing tools will be restricted to the OS temp directory. ' +
-          'To restore the previous unrestricted behavior, start the server with ' +
-          '--allow-unrestricted-paths.',
-      );
-    }
-  };
+  }
 
-  let context: McpContext | undefined;
-  async function getContext(): Promise<McpContext> {
-    const devtools = serverArgs.experimentalDevtools ?? false;
-    const blocklist = serverArgs.blockedUrlPattern
-      ? serverArgs.blockedUrlPattern.map(String)
+  async #getContext(): Promise<McpContext> {
+    const devtools = this.#serverArgs.experimentalDevtools ?? false;
+    const blocklist = this.#serverArgs.blockedUrlPattern
+      ? this.#serverArgs.blockedUrlPattern.map(String)
       : undefined;
-    const allowlist = serverArgs.allowedUrlPattern
-      ? serverArgs.allowedUrlPattern.map(String)
+    const allowlist = this.#serverArgs.allowedUrlPattern
+      ? this.#serverArgs.allowedUrlPattern.map(String)
       : undefined;
 
+    const channel = this.#serverArgs.channel as Channel | undefined;
+
     const browser =
-      serverArgs.browserUrl || serverArgs.wsEndpoint || serverArgs.autoConnect
+      this.#serverArgs.browserUrl ||
+      this.#serverArgs.wsEndpoint ||
+      this.#serverArgs.autoConnect
         ? await ensureBrowserConnected({
-            browserURL: serverArgs.browserUrl,
-            wsEndpoint: serverArgs.wsEndpoint,
-            wsHeaders: serverArgs.wsHeaders,
+            browserURL: this.#serverArgs.browserUrl,
+            wsEndpoint: this.#serverArgs.wsEndpoint,
+            wsHeaders: this.#serverArgs.wsHeaders,
             // Important: only pass channel, if autoConnect is true.
-            channel: serverArgs.autoConnect
-              ? (serverArgs.channel as Channel)
-              : undefined,
-            userDataDir: serverArgs.userDataDir,
+            channel: this.#serverArgs.autoConnect ? channel : undefined,
+            userDataDir: this.#serverArgs.userDataDir,
             devtools,
             blocklist,
             allowlist,
@@ -155,64 +250,56 @@ export async function createMcpServer(
         : await ensureBrowserLaunched(
             // Pass the already-derived values so the launched browser uses the
             // exact same flags as the connected branch and `McpContext`.
-            buildLaunchOptions(serverArgs, options.logFile, {
+            buildLaunchOptions(this.#serverArgs, this.#options.logFile, {
               devtools,
               blocklist,
               allowlist,
             }),
           );
 
-    if (context?.browser !== browser) {
-      context?.dispose();
-      context = await McpContext.from(browser, logger, {
+    if (this.#context?.browser !== browser) {
+      this.#context?.dispose();
+      this.#context = await McpContext.from(browser, logger, {
         experimentalDevToolsDebugging: devtools,
-        experimentalIncludeAllPages: serverArgs.experimentalIncludeAllPages,
-        performanceCrux: serverArgs.performanceCrux,
+        experimentalIncludeAllPages:
+          this.#serverArgs.experimentalIncludeAllPages,
+        performanceCrux: this.#serverArgs.performanceCrux,
+        sourceMaps: this.#serverArgs.sourceMaps,
         allowList: allowlist,
         blocklist: blocklist,
-        allowUnrestrictedPaths: serverArgs.allowUnrestrictedPaths,
+        allowUnrestrictedPaths: this.#serverArgs.allowUnrestrictedPaths,
         // Surfaces a one-time note in the next response after a reconnect.
-        reconnected: context !== undefined,
+        reconnected: this.#context !== undefined,
+        categoryExtensions: this.#serverArgs.categoryExtensions,
       });
-      if (lastRoots === undefined) {
+      this.#context.setRoots(this.#combinedRoots());
+      if (this.#lastClientRoots === undefined) {
         // Nothing listed yet, so this call has to wait – bounded, since it is
         // holding the tool mutex, and a later background refresh still lands
-        await updateRoots(ROOTS_REQUEST_TIMEOUT);
+        await this.#updateRoots(ROOTS_REQUEST_TIMEOUT);
       } else {
         // Carry the known roots over and refresh out of band, so a reconnect
         // never pays for a client round-trip
-        context.setRoots(lastRoots);
-        void updateRoots();
+        void this.#updateRoots();
       }
     }
-    return context;
+    return this.#context;
   }
 
-  const operaHooks = createOperaToolHooks({
-    serverArgs,
-    logFile: options.logFile,
-    resetContext: () => {
-      context?.dispose();
-      context = undefined;
-    },
-  });
-
-  const toolMutex = new Mutex();
-
-  function registerTool(tool: ToolDefinition | DefinedPageTool): void {
+  #registerTool(tool: ToolDefinition | DefinedPageTool): void {
     const toolHandler = new ToolHandler(
       tool,
-      serverArgs,
-      getContext,
-      toolMutex,
-      operaHooks,
+      this.#serverArgs,
+      () => this.#getContext(),
+      this.#toolMutex,
+      this.#operaHooks,
     );
 
     if (!toolHandler.shouldRegister) {
       return;
     }
 
-    server.registerTool(
+    this.server.registerTool(
       tool.name,
       {
         description: tool.description,
@@ -224,18 +311,24 @@ export async function createMcpServer(
       },
     );
   }
+}
 
-  const tools = createTools(serverArgs);
-  for (const tool of tools) {
-    registerTool(tool);
-  }
-
-  await loadIssueDescriptions();
-
-  return {server};
+/**
+ * Creates and initializes a Chrome DevTools MCP server instance.
+ *
+ * Maintained as a public API for backwards compatibility because external
+ * consumers and integrations rely on `createMcpServer()`. For new code,
+ * prefer using `McpServer.from(serverArgs, options)`.
+ */
+export async function createMcpServer(
+  serverArgs: ParsedArguments,
+  options: McpServerOptions = {},
+): Promise<{server: SdkMcpServer}> {
+  const server = await McpServer.from(serverArgs, options);
+  return {server: server.server};
 }
 
-export const logDisclaimers = (args: ReturnType<typeof parseArguments>) => {
+export const logDisclaimers = (args: ParsedArguments) => {
   console.error(BROWSER_EXPOSURE_DISCLAIMER);
 
   if (!args.slim && args.performanceCrux) {
diff --git a/src/opera/browserFlags.ts b/src/opera/browserFlags.ts
index 963face6..2db788ae 100644
--- a/src/opera/browserFlags.ts
+++ b/src/opera/browserFlags.ts
@@ -7,7 +7,7 @@
 
 import type fs from 'node:fs';
 
-import type {parseArguments} from '../bin/chrome-devtools-mcp-cli-options.js';
+import type {parseArguments} from '../config/mcp-options.js';
 import {
   closeBrowserIfOpen,
   ensureBrowserLaunched,
diff --git a/src/opera/browserLaunch.ts b/src/opera/browserLaunch.ts
index 9eeda992..376f5b68 100644
--- a/src/opera/browserLaunch.ts
+++ b/src/opera/browserLaunch.ts
@@ -7,7 +7,7 @@
 
 import type fs from 'node:fs';
 
-import type {parseArguments} from '../bin/chrome-devtools-mcp-cli-options.js';
+import type {parseArguments} from '../config/mcp-options.js';
 import type {Channel, ensureBrowserLaunched} from '../browser.js';
 
 type ServerArgs = ReturnType<typeof parseArguments>;
diff --git a/src/opera/toolHandlerHooks.ts b/src/opera/toolHandlerHooks.ts
index 96d9f52e..e53296cc 100644
--- a/src/opera/toolHandlerHooks.ts
+++ b/src/opera/toolHandlerHooks.ts
@@ -7,7 +7,7 @@
 
 import type fs from 'node:fs';
 
-import type {parseArguments} from '../bin/chrome-devtools-mcp-cli-options.js';
+import type {parseArguments} from '../config/mcp-options.js';
 import {ToolCategory} from '../tools/categories.js';
 import type {DefinedPageTool, ToolDefinition} from '../tools/ToolDefinition.js';
 
diff --git a/src/processors/HeapSnapshotManager.ts b/src/processors/HeapSnapshotManager.ts
index 02f0a20d..170d66c4 100644
--- a/src/processors/HeapSnapshotManager.ts
+++ b/src/processors/HeapSnapshotManager.ts
@@ -48,6 +48,11 @@ export type HeapQueryOptions =
 
 export type HeapEdgesQueryOptions =
   DevTools.HeapSnapshotModel.HeapSnapshotModel.HeapEdgesQueryOptions;
+const VALID_EXTENSIONS: readonly string[] = ['.heapsnapshot', '.heaptimeline'];
+
+function hasValidHeapSnapshotExtension(filePath: string): boolean {
+  return VALID_EXTENSIONS.some(ext => filePath.endsWith(ext));
+}
 
 export class HeapSnapshotManager {
   #snapshotIdGenerator = createIdGenerator();
@@ -65,6 +70,11 @@ export class HeapSnapshotManager {
   async getSnapshot(
     filePath: string,
   ): Promise<DevTools.HeapSnapshotModel.HeapSnapshotProxy.HeapSnapshotProxy> {
+    if (!hasValidHeapSnapshotExtension(filePath)) {
+      throw new Error(
+        `File ${filePath} must have a .heapsnapshot or .heaptimeline extension.`,
+      );
+    }
     const absolutePath = path.resolve(filePath);
     const cached = this.#snapshots.get(absolutePath);
     if (cached) {
@@ -412,6 +422,15 @@ export class HeapSnapshotManager {
     return await snapshot.getDuplicateStrings();
   }
 
+  async queryObjects(
+    filePath: string,
+    options: HeapQueryOptions,
+  ): Promise<DevTools.HeapSnapshotModel.HeapSnapshotModel.ItemsRange> {
+    const snapshot = await this.getSnapshot(filePath);
+    const provider = snapshot.queryObjects(options);
+    return await provider.serializeItemsRange(0, Infinity);
+  }
+
   hasSnapshots(): boolean {
     return this.#snapshots.size > 0;
   }
diff --git a/src/telemetry/ClearcutLogger.ts b/src/telemetry/ClearcutLogger.ts
index 35f711ef..2f20f4f7 100644
--- a/src/telemetry/ClearcutLogger.ts
+++ b/src/telemetry/ClearcutLogger.ts
@@ -12,16 +12,22 @@ import {logger} from '../utils/logger.js';
 
 import type {ErrorCode} from './errors.js';
 import type {LocalState, Persistence} from './persistence.js';
-import {sanitizeParams, stripUnderscoreBeforeNumber} from './transformation.js';
+import {
+  bucketizeDaysSince,
+  bucketizeLatency,
+  buildContext,
+  sanitizeParams,
+  stripUnderscoreBeforeNumber,
+} from './transformation.js';
 import {
   McpClient,
   type FlagUsage,
   WatchdogMessageType,
   OsType,
   type ToolInvocation,
-  type ToolInvocationContext,
 } from './types.js';
 import {WatchdogClient} from './WatchdogClient.js';
+import type {DevToolsData} from '../tools/ToolDefinition.js';
 
 const MS_PER_DAY = 24 * 60 * 60 * 1000;
 
@@ -90,7 +96,9 @@ export class ClearcutLogger {
 
   setClientName(clientName: string): void {
     const lowerName = clientName.toLowerCase();
-    if (lowerName.includes('claude')) {
+    if (lowerName.includes('claude-desktop')) {
+      this.#mcpClient = McpClient.MCP_CLIENT_CLAUDE_DESKTOP;
+    } else if (lowerName.includes('claude')) {
       this.#mcpClient = McpClient.MCP_CLIENT_CLAUDE_CODE;
     } else if (lowerName.includes('gemini')) {
       this.#mcpClient = McpClient.MCP_CLIENT_GEMINI_CLI;
@@ -98,10 +106,16 @@ export class ClearcutLogger {
       this.#mcpClient = McpClient.MCP_CLIENT_DT_MCP_CLI;
     } else if (lowerName.includes('openclaw')) {
       this.#mcpClient = McpClient.MCP_CLIENT_OPENCLAW;
+    } else if (lowerName.includes('opencode')) {
+      this.#mcpClient = McpClient.MCP_CLIENT_OPENCODE;
     } else if (lowerName.includes('codex')) {
       this.#mcpClient = McpClient.MCP_CLIENT_CODEX;
     } else if (lowerName.includes('antigravity')) {
       this.#mcpClient = McpClient.MCP_CLIENT_ANTIGRAVITY;
+    } else if (lowerName.includes('grok') || lowerName.includes('xai')) {
+      this.#mcpClient = McpClient.MCP_CLIENT_GROK;
+    } else if (lowerName.includes('copilot')) {
+      this.#mcpClient = McpClient.MCP_CLIENT_GITHUB_COPILOT;
     } else {
       this.#mcpClient = McpClient.MCP_CLIENT_OTHER;
     }
@@ -113,16 +127,18 @@ export class ClearcutLogger {
     schema: zod.ZodRawShape;
     success: boolean;
     latencyMs: number;
-    context: ToolInvocationContext;
+    devToolsData?: DevToolsData;
+    pageUrl?: string;
   }): Promise<void> {
+    const context = buildContext(args.devToolsData, args.pageUrl);
     const sanitizedToolName = stripUnderscoreBeforeNumber(args.toolName);
     const tool_invocation: ToolInvocation = {
       tool_name: sanitizedToolName,
       success: args.success,
-      latency_ms: args.latencyMs,
+      latency_ms: bucketizeLatency(args.latencyMs),
     };
-    if (Object.keys(args.context).length > 0) {
-      tool_invocation.context = args.context;
+    if (Object.keys(context).length > 0) {
+      tool_invocation.context = context;
     }
     if (Object.keys(args.params).length > 0) {
       tool_invocation.tool_params = {
@@ -172,7 +188,7 @@ export class ClearcutLogger {
           payload: {
             mcp_client: this.#mcpClient,
             daily_active: {
-              days_since_last_active: daysSince,
+              days_since_last_active: bucketizeDaysSince(daysSince),
             },
           },
         });
diff --git a/src/telemetry/flagUtils.ts b/src/telemetry/flagUtils.ts
index b4adb94e..39b641c4 100644
--- a/src/telemetry/flagUtils.ts
+++ b/src/telemetry/flagUtils.ts
@@ -4,7 +4,7 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 
-import type {cliOptions} from '../bin/chrome-devtools-mcp-cli-options.js';
+import type {mcpOptions} from '../config/mcp-options.js';
 import {DevTools} from '../third_party/index.js';
 
 import {stripUnderscoreBeforeNumber} from './transformation.js';
@@ -12,7 +12,7 @@ import type {FlagUsage} from './types.js';
 
 const {StringUtilities} = DevTools.Platform;
 
-type CliOptions = typeof cliOptions;
+type CliOptions = typeof mcpOptions;
 
 /**
  * For enums, log the value as uppercase.
diff --git a/src/telemetry/flag_usage_metrics.json b/src/telemetry/flag_usage_metrics.json
index 4e5826ea..5fdb70ef 100644
--- a/src/telemetry/flag_usage_metrics.json
+++ b/src/telemetry/flag_usage_metrics.json
@@ -242,11 +242,13 @@
   },
   {
     "name": "experimental_page_id_routing",
-    "flagType": "boolean"
+    "flagType": "boolean",
+    "isDeprecated": true
   },
   {
     "name": "experimental_page_id_routing_present",
-    "flagType": "boolean"
+    "flagType": "boolean",
+    "isDeprecated": true
   },
   {
     "name": "experimental_webmcp",
@@ -379,5 +381,89 @@
   {
     "name": "category_pwa",
     "flagType": "boolean"
+  },
+  {
+    "name": "page_id_routing_present",
+    "flagType": "boolean"
+  },
+  {
+    "name": "page_id_routing",
+    "flagType": "boolean"
+  },
+  {
+    "name": "javascript_evaluation_present",
+    "flagType": "boolean"
+  },
+  {
+    "name": "javascript_evaluation",
+    "flagType": "boolean"
+  },
+  {
+    "name": "experimental_screencast_fps_present",
+    "flagType": "boolean"
+  },
+  {
+    "name": "filesystem_root_present",
+    "flagType": "boolean"
+  },
+  {
+    "name": "category_input_present",
+    "flagType": "boolean"
+  },
+  {
+    "name": "category_input",
+    "flagType": "boolean"
+  },
+  {
+    "name": "category_navigation_present",
+    "flagType": "boolean"
+  },
+  {
+    "name": "category_navigation",
+    "flagType": "boolean"
+  },
+  {
+    "name": "category_debugging_present",
+    "flagType": "boolean"
+  },
+  {
+    "name": "category_debugging",
+    "flagType": "boolean"
+  },
+  {
+    "name": "category_memory_present",
+    "flagType": "boolean"
+  },
+  {
+    "name": "category_memory",
+    "flagType": "boolean"
+  },
+  {
+    "name": "source_maps_present",
+    "flagType": "boolean"
+  },
+  {
+    "name": "source_maps",
+    "flagType": "boolean"
+  },
+  {
+    "name": "config_present",
+    "flagType": "boolean"
+  },
+  {
+    "name": "devtools_comments_present",
+    "flagType": "boolean"
+  },
+  {
+    "name": "devtools_comments",
+    "flagType": "boolean"
+  },
+  {
+    "name": "category_opera_present",
+    "flagType": "boolean"
+  },
+  {
+    "name": "category_opera",
+    "flagType": "boolean"
   }
 ]
diff --git a/src/telemetry/tool_call_metrics.json b/src/telemetry/tool_call_metrics.json
index be7a52be..df3de619 100644
--- a/src/telemetry/tool_call_metrics.json
+++ b/src/telemetry/tool_call_metrics.json
@@ -123,6 +123,10 @@
       {
         "name": "wait_for_stable_dom",
         "argType": "boolean"
+      },
+      {
+        "name": "page_id",
+        "argType": "number"
       }
     ]
   },
@@ -188,7 +192,8 @@
     "args": [
       {
         "name": "page_id",
-        "argType": "number"
+        "argType": "number",
+        "isDeprecated": true
       }
     ]
   },
@@ -871,7 +876,8 @@
       },
       {
         "name": "min_retained_size",
-        "argType": "number"
+        "argType": "number",
+        "isDeprecated": true
       },
       {
         "name": "exclude_primitives",
@@ -884,6 +890,10 @@
       {
         "name": "page_size",
         "argType": "number"
+      },
+      {
+        "name": "retained_size_length",
+        "argType": "number"
       }
     ]
   },
@@ -1103,5 +1113,50 @@
         "argType": "number"
       }
     ]
+  },
+  {
+    "name": "query_heapsnapshot_objects",
+    "args": [
+      {
+        "name": "file_path_length",
+        "argType": "number"
+      },
+      {
+        "name": "class_name_length",
+        "argType": "number"
+      },
+      {
+        "name": "property_name_length",
+        "argType": "number"
+      },
+      {
+        "name": "node_type_length",
+        "argType": "number"
+      },
+      {
+        "name": "retained_size_length",
+        "argType": "number"
+      },
+      {
+        "name": "self_size_length",
+        "argType": "number"
+      },
+      {
+        "name": "is_detached",
+        "argType": "boolean"
+      },
+      {
+        "name": "sort_by",
+        "argType": "string"
+      },
+      {
+        "name": "page_idx",
+        "argType": "number"
+      },
+      {
+        "name": "page_size",
+        "argType": "number"
+      }
+    ]
   }
 ]
diff --git a/src/telemetry/transformation.ts b/src/telemetry/transformation.ts
index 2441e398..ad827c61 100644
--- a/src/telemetry/transformation.ts
+++ b/src/telemetry/transformation.ts
@@ -21,6 +21,12 @@ export function bucketizeLatency(latencyMs: number): number {
   return LATENCY_BUCKETS[LATENCY_BUCKETS.length - 1];
 }
 
+export const MAX_ACTIVE_DAYS = 31;
+
+export function bucketizeDaysSince(days: number): number {
+  return Math.min(days, MAX_ACTIVE_DAYS);
+}
+
 export const PARAM_BLOCKLIST = new Set(['uid', 'reqid', 'msgid']);
 
 const SUPPORTED_ZOD_TYPES = [
diff --git a/src/telemetry/types.ts b/src/telemetry/types.ts
index cac3f242..b4b3a8b8 100644
--- a/src/telemetry/types.ts
+++ b/src/telemetry/types.ts
@@ -92,6 +92,10 @@ export enum McpClient {
   MCP_CLIENT_OPENCLAW = 5,
   MCP_CLIENT_CODEX = 6,
   MCP_CLIENT_ANTIGRAVITY = 7,
+  MCP_CLIENT_GROK = 8,
+  MCP_CLIENT_OPENCODE = 9,
+  MCP_CLIENT_CLAUDE_DESKTOP = 10,
+  MCP_CLIENT_GITHUB_COPILOT = 11,
   MCP_CLIENT_OTHER = 3,
 }
 
diff --git a/src/third_party/index.ts b/src/third_party/index.ts
index b7597df2..157d3df8 100644
--- a/src/third_party/index.ts
+++ b/src/third_party/index.ts
@@ -22,6 +22,7 @@ export {type ShapeOutput} from '@modelcontextprotocol/sdk/server/zod-compat.js';
 export {StdioServerTransport} from '@modelcontextprotocol/sdk/server/stdio.js';
 export {StdioClientTransport} from '@modelcontextprotocol/sdk/client/stdio.js';
 export {Client} from '@modelcontextprotocol/sdk/client/index.js';
+export type {Transport} from '@modelcontextprotocol/sdk/shared/transport.js';
 export {
   type CallToolResult,
   SetLevelRequestSchema,
@@ -39,11 +40,12 @@ export {
   PredefinedNetworkConditions,
   KnownDevices,
   CDPSessionEvent,
+  ScreenRecorder,
 } from 'puppeteer-core';
 export {default as puppeteer} from 'puppeteer-core';
 export type * from 'puppeteer-core';
 export {PipeTransport} from 'puppeteer-core/internal/node/PipeTransport.js';
-export type {CdpPage} from 'puppeteer-core/internal/cdp/Page.js';
+export {CdpPage} from 'puppeteer-core/internal/cdp/Page.js';
 export type {CdpWebWorker} from 'puppeteer-core/internal/cdp/WebWorker.js';
 export type {Realm} from 'puppeteer-core/internal/api/Realm.js';
 export type {JSONSchema7, JSONSchema7Definition} from 'json-schema';
diff --git a/src/tools/ToolDefinition.ts b/src/tools/ToolDefinition.ts
index deb0e41a..0d511917 100644
--- a/src/tools/ToolDefinition.ts
+++ b/src/tools/ToolDefinition.ts
@@ -6,13 +6,14 @@
  * Modified by Opera Software AS.
  */
 
-import type {ParsedArguments} from '../bin/chrome-devtools-mcp-cli-options.js';
+import type {ParsedArguments} from '../config/mcp-options.js';
 import type {
   HeapSnapshotAggregateData,
   HeapSnapshotClassDiff,
   HeapSnapshotDetailedClassDiff,
   DuplicateStringGroup,
   HeapEdgesQueryOptions,
+  HeapQueryOptions,
 } from '../processors/HeapSnapshotManager.js';
 import type {McpPage} from '../McpPage.js';
 import {zod} from '../third_party/index.js';
@@ -319,6 +320,10 @@ export type Context = Readonly<{
     currentFilePath: string,
     classIndex: number,
   ): Promise<HeapSnapshotDetailedClassDiff>;
+  queryHeapSnapshotObjects(
+    filePath: string,
+    options: HeapQueryOptions,
+  ): Promise<DevTools.HeapSnapshotModel.HeapSnapshotModel.ItemsRange>;
 }>;
 
 /**
@@ -491,6 +496,21 @@ export function viewportTransform(arg: string | undefined):
     number,
     number | undefined,
   ];
+  if (!Number.isFinite(width) || width <= 0) {
+    throw new Error(
+      `Invalid viewport width "${width}". Expected format '<width>x<height>x<devicePixelRatio>[,mobile][,touch][,landscape]' with a positive width.`,
+    );
+  }
+  if (!Number.isFinite(height) || height <= 0) {
+    throw new Error(
+      `Invalid viewport height "${height}". Expected format '<width>x<height>x<devicePixelRatio>[,mobile][,touch][,landscape]' with a positive height.`,
+    );
+  }
+  if (dpr !== undefined && (!Number.isFinite(dpr) || dpr <= 0)) {
+    throw new Error(
+      `Invalid devicePixelRatio "${dpr}". Expected a positive number.`,
+    );
+  }
   return {
     width,
     height,
@@ -506,6 +526,16 @@ export function geolocationTransform(arg: string | undefined) {
     return undefined;
   }
   const [latitude, longitude] = arg.split(',').map(Number) as [number, number];
+  if (!Number.isFinite(latitude) || latitude < -90 || latitude > 90) {
+    throw new Error(
+      `Invalid latitude "${latitude}". Latitude must be a number between -90 and 90.`,
+    );
+  }
+  if (!Number.isFinite(longitude) || longitude < -180 || longitude > 180) {
+    throw new Error(
+      `Invalid longitude "${longitude}". Longitude must be a number between -180 and 180.`,
+    );
+  }
   return {
     latitude,
     longitude,
diff --git a/src/tools/categories.ts b/src/tools/categories.ts
index 16442931..6d9b466e 100644
--- a/src/tools/categories.ts
+++ b/src/tools/categories.ts
@@ -33,10 +33,3 @@ export const labels = {
   [ToolCategory.OPERA]: 'Opera',
   [ToolCategory.PWA]: 'Progressive Web Apps',
 };
-
-export const OFF_BY_DEFAULT_CATEGORIES = [
-  ToolCategory.EXTENSIONS,
-  ToolCategory.THIRD_PARTY,
-  ToolCategory.WEBMCP,
-  ToolCategory.PWA,
-];
diff --git a/src/tools/comments.ts b/src/tools/comments.ts
new file mode 100644
index 00000000..477db738
--- /dev/null
+++ b/src/tools/comments.ts
@@ -0,0 +1,105 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import {zod} from '../third_party/index.js';
+
+import {ToolCategory} from './categories.js';
+import {definePageTool} from './ToolDefinition.js';
+
+export const openDevtools = definePageTool({
+  name: 'open_devtools',
+  description: 'Open a DevTools window for the selected page.',
+  annotations: {
+    category: ToolCategory.DEBUGGING,
+    readOnlyHint: true,
+    conditions: ['devtoolsComments'],
+  },
+  schema: {},
+  blockedByDialog: false,
+  verifyFilesSchema: [],
+  handler: async () => {
+    throw new Error('Not implemented');
+  },
+});
+
+export const getDevtoolsComments = definePageTool({
+  name: 'get_devtools_comments',
+  description: 'Retrieve user comments from the DevTools window for the page.',
+  annotations: {
+    category: ToolCategory.DEBUGGING,
+    readOnlyHint: true,
+    conditions: ['devtoolsComments'],
+  },
+  schema: {},
+  blockedByDialog: false,
+  verifyFilesSchema: {},
+  handler: async () => {
+    throw new Error('Not implemented');
+  },
+});
+
+export const resolveDevtoolsComment = definePageTool({
+  name: 'resolve_devtools_comment',
+  description:
+    'Append an agent reply to a DevTools comment thread and mark it as resolved.',
+  annotations: {
+    category: ToolCategory.DEBUGGING,
+    readOnlyHint: false,
+    conditions: ['devtoolsComments'],
+  },
+  schema: {
+    threadId: zod
+      .string()
+      .describe(
+        'The unique identifier of the comment thread to resolve (e.g. "comment-1").',
+      ),
+    replyText: zod
+      .string()
+      .optional()
+      .describe(
+        'Optional reply explanation from the AI agent to append to the resolved comment thread.',
+      ),
+  },
+  blockedByDialog: false,
+  verifyFilesSchema: {},
+  handler: async () => {
+    throw new Error('Not implemented');
+  },
+});
+
+export const revealInDevtools = definePageTool({
+  name: 'reveal_in_devtools',
+  description:
+    'Navigate DevTools to a specified panel and highlight a target DOM node or network request. The parameters uid and reqid are mutually exclusive.',
+  annotations: {
+    category: ToolCategory.DEBUGGING,
+    readOnlyHint: true,
+    conditions: ['devtoolsComments'],
+  },
+  schema: {
+    panelName: zod
+      .string()
+      .optional()
+      .describe(
+        'The target DevTools panel (e.g. "elements", "network", "sources", "console").',
+      ),
+    uid: zod
+      .string()
+      .optional()
+      .describe(
+        'Optional snapshot element UID to reveal in the Elements panel.',
+      ),
+    reqid: zod
+      .number()
+      .optional()
+      .describe('Optional network request ID to reveal in the Network panel.'),
+  },
+  blockedByDialog: false,
+  verifyFilesSchema: {},
+  handler: async () => {
+    throw new Error('Not implemented');
+  },
+});
diff --git a/src/tools/console.ts b/src/tools/console.ts
index feb4083d..53d11a97 100644
--- a/src/tools/console.ts
+++ b/src/tools/console.ts
@@ -42,7 +42,7 @@ const LIST_CONSOLE_MESSAGES_TOOL_NAME = 'list_console_messages';
 export const listConsoleMessages = definePageTool(cliArgs => {
   return {
     name: LIST_CONSOLE_MESSAGES_TOOL_NAME,
-    description: `List all console messages for the currently selected page since the last navigation.${cliArgs?.categoryExtensions ? ' This includes console messages originating from extensions content scripts.' : ''}`,
+    description: `List all console messages for the target page since the last navigation.${cliArgs?.categoryExtensions ? ' This includes console messages originating from extensions content scripts.' : ''}`,
     annotations: {
       category: ToolCategory.DEBUGGING,
       readOnlyHint: true,
diff --git a/src/tools/emulation.ts b/src/tools/emulation.ts
index 22408287..2abd6051 100644
--- a/src/tools/emulation.ts
+++ b/src/tools/emulation.ts
@@ -47,7 +47,7 @@ const throttlingOptions: [string, ...string[]] = [
 
 export const emulate = definePageTool({
   name: 'emulate',
-  description: `Emulates various features on the selected page.`,
+  description: `Emulates various features on the target page.`,
   annotations: {
     category: ToolCategory.EMULATION,
     readOnlyHint: false,
diff --git a/src/tools/extensions.ts b/src/tools/extensions.ts
index ffef1a03..e9489274 100644
--- a/src/tools/extensions.ts
+++ b/src/tools/extensions.ts
@@ -23,7 +23,7 @@ export const installExtension = defineTool({
   },
   blockedByDialog: false,
   verifyFilesSchema: {
-    path: true,
+    path: {local: true},
   },
   handler: async (request, response, context) => {
     const {path} = request.params;
diff --git a/src/tools/memory.ts b/src/tools/memory.ts
index 8747b1c6..db25dfdf 100644
--- a/src/tools/memory.ts
+++ b/src/tools/memory.ts
@@ -5,6 +5,7 @@
  */
 
 import {zod} from '../third_party/index.js';
+import {byteSizeRangeSchema} from '../utils/bytes.js';
 
 import {ToolCategory} from './categories.js';
 import {definePageTool, defineTool} from './ToolDefinition.js';
@@ -21,7 +22,7 @@ const HEAP_SNAPSHOT_FILTERS: readonly [string, ...string[]] = [
 
 export const takeHeapSnapshot = definePageTool({
   name: 'take_heapsnapshot',
-  description: `Capture a heap snapshot of the currently selected page. Use to analyze the memory distribution of JavaScript objects and debug memory leaks.`,
+  description: `Capture a heap snapshot of the target page. Use to analyze the memory distribution of JavaScript objects and debug memory leaks.`,
   annotations: {
     category: ToolCategory.MEMORY,
     readOnlyHint: false,
@@ -305,10 +306,9 @@ export const getHeapSnapshotEdges = defineTool({
       .enum(['retainedSize', 'selfSize', 'name'])
       .optional()
       .describe('Sort order for edges. Default is retainedSize.'),
-    minRetainedSize: zod
-      .number()
-      .optional()
-      .describe('Minimum retained size in bytes for target nodes.'),
+    retainedSize: byteSizeRangeSchema(
+      'Inclusive retained size range (e.g. "1MB-2MB", "-1MB", or "1MB-") for target nodes. A single value is treated as a minimum. Currently, only the lower bound is applied.',
+    ).optional(),
     excludePrimitives: zod
       .boolean()
       .optional()
@@ -322,7 +322,8 @@ export const getHeapSnapshotEdges = defineTool({
       request.params.nodeId,
       {
         sortBy: request.params.sortBy ?? 'retainedSize',
-        minRetainedSize: request.params.minRetainedSize,
+        // DevTools currently only supports a lower retained-size bound here.
+        minRetainedSize: request.params.retainedSize?.min,
         excludePrimitives: request.params.excludePrimitives ?? true,
       },
     );
@@ -465,3 +466,70 @@ export const getHeapSnapshotObjectDetails = defineTool({
     response.setHeapSnapshotObjectDetails(objectInfo);
   },
 });
+
+export const queryHeapSnapshotObjects = defineTool({
+  name: 'query_heapsnapshot_objects',
+  description:
+    'Loads a memory heapsnapshot and queries objects matching specific filters (className, propertyName, nodeType, retainedSize, selfSize, isDetached, sortBy).',
+  annotations: {
+    category: ToolCategory.MEMORY,
+    readOnlyHint: true,
+    conditions: ['memoryDebugging'],
+  },
+  blockedByDialog: false,
+  verifyFilesSchema: {filePath: true},
+  schema: {
+    filePath: zod.string().describe('A path to a .heapsnapshot file to read.'),
+    className: zod
+      .string()
+      .optional()
+      .describe('Optional regex or text matching object class name.'),
+    propertyName: zod
+      .string()
+      .optional()
+      .describe('Optional property name filter for outgoing reference edges.'),
+    nodeType: zod
+      .string()
+      .optional()
+      .describe(
+        'Optional V8 node type filter (e.g. object, closure, string, array, code).',
+      ),
+    retainedSize: byteSizeRangeSchema(
+      'Inclusive retained size range (e.g. "1MB-2MB", "-1MB", or "1MB-"). A single value is treated as a minimum.',
+    ).optional(),
+    selfSize: byteSizeRangeSchema(
+      'Inclusive self size range (e.g. "1MB-2MB", "-1MB", or "1MB-"). A single value is treated as a minimum.',
+    ).optional(),
+    isDetached: zod
+      .boolean()
+      .optional()
+      .describe('Whether to filter for detached DOM nodes.'),
+    sortBy: zod
+      .enum(['retainedSize', 'selfSize', 'id'])
+      .optional()
+      .describe('Sort order for results. Default is retainedSize.'),
+    pageIdx: zod.number().optional().describe('The page index for pagination.'),
+    pageSize: zod.number().optional().describe('The page size for pagination.'),
+  },
+  handler: async (request, response, context) => {
+    const range = await context.queryHeapSnapshotObjects(
+      request.params.filePath,
+      {
+        className: request.params.className,
+        propertyName: request.params.propertyName,
+        nodeType: request.params.nodeType,
+        minRetainedSize: request.params.retainedSize?.min,
+        maxRetainedSize: request.params.retainedSize?.max,
+        minSelfSize: request.params.selfSize?.min,
+        maxSelfSize: request.params.selfSize?.max,
+        isDetached: request.params.isDetached,
+        sortBy: request.params.sortBy,
+      },
+    );
+
+    response.setHeapSnapshotNodes(range, {
+      pageIdx: request.params.pageIdx,
+      pageSize: request.params.pageSize,
+    });
+  },
+});
diff --git a/src/tools/network.ts b/src/tools/network.ts
index cb85ba30..20412555 100644
--- a/src/tools/network.ts
+++ b/src/tools/network.ts
@@ -34,7 +34,7 @@ const FILTERABLE_RESOURCE_TYPES: readonly [ResourceType, ...ResourceType[]] = [
 
 export const listNetworkRequests = definePageTool({
   name: 'list_network_requests',
-  description: `Lists the most recent requests for the currently selected page since the last navigation.`,
+  description: `Lists the most recent requests for the target page since the last navigation.`,
   annotations: {
     category: ToolCategory.NETWORK,
     readOnlyHint: true,
@@ -90,7 +90,7 @@ export const listNetworkRequests = definePageTool({
 
 export const getNetworkRequest = definePageTool({
   name: 'get_network_request',
-  description: `Gets a network request by an optional reqid, if omitted returns the currently selected request in the DevTools Network panel.`,
+  description: `Gets a network request by an optional reqid, if omitted returns the currently selected request in the DevTools Network panel. Useful for inspecting request headers (including 'Cookie') and response headers (including 'Set-Cookie' and directives).`,
   annotations: {
     category: ToolCategory.NETWORK,
     readOnlyHint: false,
diff --git a/src/tools/pages.ts b/src/tools/pages.ts
index aa767e1c..ea06ee26 100644
--- a/src/tools/pages.ts
+++ b/src/tools/pages.ts
@@ -7,6 +7,7 @@
 import type {CdpPage} from '../third_party/index.js';
 import {zod} from '../third_party/index.js';
 import {logger} from '../utils/logger.js';
+import {validateUrl} from '../utils/url.js';
 
 import {ToolCategory} from './categories.js';
 import {
@@ -96,7 +97,7 @@ export const closePage = defineTool({
   },
 });
 
-export const newPage = defineTool(() => {
+export const newPage = defineTool(args => {
   return {
     name: 'new_page',
     description: `Open a new tab and load a URL. Use project URL if not specified otherwise.`,
@@ -118,13 +119,18 @@ export const newPage = defineTool(() => {
         .describe(
           'If specified, the page is created in an isolated browser context with the given name. ' +
             'Pages in the same browser context share cookies and storage. ' +
-            'Pages in different browser contexts are fully isolated.',
+            'Pages in different browser contexts are fully isolated (useful for clean-slate testing of cookies and authentication).',
         ),
       ...timeoutSchema,
     },
     blockedByDialog: false,
     verifyFilesSchema: {},
     handler: async (request, response, context) => {
+      validateUrl(request.params.url, {
+        javascriptEvaluation: args?.javascriptEvaluation,
+        categoryExtensions: args?.categoryExtensions,
+      });
+
       const page = await context.newPage(
         request.params.background,
         request.params.isolatedContext,
@@ -145,7 +151,7 @@ export const newPage = defineTool(() => {
   };
 });
 
-export const navigatePage = definePageTool(() => {
+export const navigatePage = definePageTool(args => {
   return {
     name: 'navigate_page',
     description: `Go to a URL, or back, forward, or reload. Use project URL if not specified otherwise.`,
@@ -171,12 +177,16 @@ export const navigatePage = definePageTool(() => {
         .describe(
           'Whether to auto accept or beforeunload dialogs triggered by this navigation. Default is accept.',
         ),
-      initScript: zod
-        .string()
-        .optional()
-        .describe(
-          'A JavaScript script to be executed on each new document before any other scripts for the next navigation.',
-        ),
+      ...(args?.javascriptEvaluation !== false
+        ? {
+            initScript: zod
+              .string()
+              .optional()
+              .describe(
+                'A JavaScript script to be executed on each new document before any other scripts for the next navigation.',
+              ),
+          }
+        : {}),
       ...timeoutSchema,
     },
     blockedByDialog: false,
@@ -195,6 +205,13 @@ export const navigatePage = definePageTool(() => {
         request.params.type = 'url';
       }
 
+      if (request.params.url) {
+        validateUrl(request.params.url, {
+          javascriptEvaluation: args?.javascriptEvaluation,
+          categoryExtensions: args?.categoryExtensions,
+        });
+      }
+
       let initScriptId: string | undefined;
       if (request.params.initScript) {
         const {identifier} = await page.pptrPage.evaluateOnNewDocument(
@@ -296,7 +313,7 @@ export const navigatePage = definePageTool(() => {
 
 export const resizePage = definePageTool({
   name: 'resize_page',
-  description: `Resizes the selected page's window so that the page has specified dimension`,
+  description: `Resizes the page's window so that the page has specified dimension`,
   annotations: {
     category: ToolCategory.EMULATION,
     readOnlyHint: false,
@@ -396,17 +413,11 @@ export const getTabId = definePageTool({
     readOnlyHint: true,
     conditions: ['experimentalInteropTools'],
   },
-  schema: {
-    pageId: zod
-      .number()
-      .describe(
-        `The ID of the page to get the tab ID for. Call ${listPages().name} to get available pages.`,
-      ),
-  },
+  schema: {},
   blockedByDialog: false,
   verifyFilesSchema: {},
-  handler: async (request, response, context) => {
-    const page = context.getPageById(request.params.pageId);
+  handler: async (request, response) => {
+    const page = request.page;
     const tabId = (page.pptrPage as unknown as CdpPage)._tabId;
     response.setTabId(tabId);
     response.appendResponseLine(`Tab ID: ${tabId}`);
diff --git a/src/tools/performance.ts b/src/tools/performance.ts
index d146ee03..32127756 100644
--- a/src/tools/performance.ts
+++ b/src/tools/performance.ts
@@ -27,7 +27,7 @@ const filePathSchema = zod
 
 export const startTrace = definePageTool({
   name: 'performance_start_trace',
-  description: `Start a performance trace on the selected webpage. Use to find frontend performance issues, Core Web Vitals (LCP, INP, CLS), and improve page load speed.`,
+  description: `Start a performance trace on the target webpage. Use to find frontend performance issues, Core Web Vitals (LCP, INP, CLS), and improve page load speed.`,
   annotations: {
     category: ToolCategory.PERFORMANCE,
     readOnlyHint: false,
@@ -37,7 +37,7 @@ export const startTrace = definePageTool({
       .boolean()
       .default(true)
       .describe(
-        'Determines if, once tracing has started, the current selected page should be automatically reloaded. Navigate the page to the right URL using the navigate_page tool BEFORE starting the trace if reload or autoStop is set to true.',
+        'Determines if, once tracing has started, the target page should be automatically reloaded. Navigate the page to the right URL using the navigate_page tool BEFORE starting the trace if reload or autoStop is set to true.',
       ),
     autoStop: zod
       .boolean()
@@ -81,6 +81,7 @@ export const startTrace = definePageTool({
       ];
       await page.pptrPage.tracing.start({
         categories,
+        bufferSize: 1200 * 1000,
       });
 
       if (request.params.reload) {
@@ -125,7 +126,7 @@ export const startTrace = definePageTool({
 export const stopTrace = definePageTool({
   name: 'performance_stop_trace',
   description:
-    'Stop the active performance trace recording on the selected webpage.',
+    'Stop the active performance trace recording on the target webpage.',
   annotations: {
     category: ToolCategory.PERFORMANCE,
     readOnlyHint: false,
diff --git a/src/tools/screencast.ts b/src/tools/screencast.ts
index c4daa7c2..ee8cc6a2 100644
--- a/src/tools/screencast.ts
+++ b/src/tools/screencast.ts
@@ -25,7 +25,7 @@ const supportedExtensions: SupportedVideoExtension[] = ['.webm', '.mp4'];
 
 export const startScreencast = definePageTool(args => ({
   name: 'screencast_start',
-  description: `Starts recording a screencast (video) of the selected page in specified format.`,
+  description: `Starts recording a screencast (video) of the target page in specified format.`,
   annotations: {
     category: ToolCategory.DEBUGGING,
     readOnlyHint: false,
@@ -89,6 +89,7 @@ export const startScreencast = definePageTool(args => ({
         path: resolvedPath,
         format: format,
         ffmpegPath: args?.experimentalFfmpegPath,
+        fps: args?.experimentalScreencastFps,
       });
     } catch (err) {
       // If we generated a temporary directory for this recording, remove it so
@@ -123,7 +124,7 @@ export const startScreencast = definePageTool(args => ({
 
 export const stopScreencast = definePageTool({
   name: 'screencast_stop',
-  description: 'Stops the active screencast recording on the selected page.',
+  description: 'Stops the active screencast recording on the target page.',
   annotations: {
     category: ToolCategory.DEBUGGING,
     readOnlyHint: false,
diff --git a/src/tools/screenshot.ts b/src/tools/screenshot.ts
index 33202658..6465cd2a 100644
--- a/src/tools/screenshot.ts
+++ b/src/tools/screenshot.ts
@@ -17,14 +17,24 @@ import {definePageTool} from './ToolDefinition.js';
 
 type ScreenshotFormat = 'png' | 'jpeg' | 'webp';
 
+type SourceBox = BoundingBox & {
+  devicePixelRatio: number;
+};
+
 async function getSourceBox(
   page: Page,
   element: ElementHandle | undefined,
   fullPage: boolean,
-): Promise<BoundingBox | undefined> {
+): Promise<SourceBox | undefined> {
   if (element) {
-    const box = await element.boundingBox();
-    return box ?? undefined;
+    const viewport = page.viewport();
+    const [box, devicePixelRatio] = await Promise.all([
+      element.boundingBox(),
+      viewport
+        ? (viewport.deviceScaleFactor ?? 1)
+        : page.evaluate(() => window.devicePixelRatio),
+    ]);
+    return box ? {...box, devicePixelRatio} : undefined;
   }
   if (fullPage) {
     const dims = await page.evaluate(() => ({
@@ -36,15 +46,28 @@ async function getSourceBox(
         document.documentElement.scrollHeight,
         document.body?.scrollHeight ?? 0,
       ),
+      devicePixelRatio: window.devicePixelRatio,
     }));
     if (dims.width <= 0 || dims.height <= 0) {
       return undefined;
     }
-    return {x: 0, y: 0, width: dims.width, height: dims.height};
+    return {
+      x: 0,
+      y: 0,
+      width: dims.width,
+      height: dims.height,
+      devicePixelRatio: dims.devicePixelRatio,
+    };
   }
   const viewport = page.viewport();
   if (viewport) {
-    return {x: 0, y: 0, width: viewport.width, height: viewport.height};
+    return {
+      x: 0,
+      y: 0,
+      width: viewport.width,
+      height: viewport.height,
+      devicePixelRatio: viewport.deviceScaleFactor ?? 1,
+    };
   }
   // The browser is launched and connected with `defaultViewport: null`, so
   // `page.viewport()` stays null until something emulates one. Fall back to the
@@ -52,28 +75,42 @@ async function getSourceBox(
   const dims = await page.evaluate(() => ({
     width: window.innerWidth,
     height: window.innerHeight,
+    devicePixelRatio: window.devicePixelRatio,
   }));
   if (dims.width <= 0 || dims.height <= 0) {
     return undefined;
   }
-  return {x: 0, y: 0, width: dims.width, height: dims.height};
+  return {
+    x: 0,
+    y: 0,
+    width: dims.width,
+    height: dims.height,
+    devicePixelRatio: dims.devicePixelRatio,
+  };
 }
 
 function computeDownscaleClip(
-  box: BoundingBox,
+  box: SourceBox,
   maxWidth: number | undefined,
   maxHeight: number | undefined,
 ): ScreenshotClip | undefined {
   const widthScale =
-    maxWidth !== undefined ? Math.min(1, maxWidth / box.width) : 1;
+    maxWidth !== undefined
+      ? Math.min(1, maxWidth / (box.width * box.devicePixelRatio))
+      : 1;
   const heightScale =
-    maxHeight !== undefined ? Math.min(1, maxHeight / box.height) : 1;
+    maxHeight !== undefined
+      ? Math.min(1, maxHeight / (box.height * box.devicePixelRatio))
+      : 1;
   const scale = Math.min(widthScale, heightScale);
   if (scale >= 1) {
     return undefined;
   }
   // Skip degenerate sub-pixel results.
-  if (Math.round(box.width * scale) < 1 || Math.round(box.height * scale) < 1) {
+  if (
+    Math.round(box.width * box.devicePixelRatio * scale) < 1 ||
+    Math.round(box.height * box.devicePixelRatio * scale) < 1
+  ) {
     return undefined;
   }
   return {
diff --git a/src/tools/script.ts b/src/tools/script.ts
index 41d37061..d0631126 100644
--- a/src/tools/script.ts
+++ b/src/tools/script.ts
@@ -17,15 +17,27 @@ export type Evaluatable = Page | Frame | WebWorker;
 export const evaluateScript = defineTool(cliArgs => {
   return {
     name: 'evaluate_script',
-    description: `Evaluate a JavaScript function inside the currently selected page${cliArgs?.categoryExtensions ? ' or service worker' : ''}. Returns the response as JSON, so returned values have to be JSON-serializable.`,
+    description: `Evaluate a JavaScript function inside the target page${cliArgs?.categoryExtensions ? ' or service worker' : ''}. Returns the response as JSON, so returned values have to be JSON-serializable.`,
     annotations: {
       category: ToolCategory.DEBUGGING,
       readOnlyHint: false,
+      conditions: ['javascriptEvaluation'],
     },
     schema: {
-      ...(cliArgs?.experimentalPageIdRouting ? pageIdSchema : {}),
+      ...(cliArgs?.pageIdRouting
+        ? cliArgs.categoryExtensions
+          ? {
+              pageId: zod
+                .number()
+                .optional()
+                .describe(
+                  'Targets a specific page by ID. Required when not evaluating in a service worker.',
+                ),
+            }
+          : pageIdSchema
+        : {}),
       function: zod.string().describe(
-        `A JavaScript function declaration to be executed by the tool in the currently selected page.
+        `A JavaScript function declaration to be executed by the tool in the target page.
 Example without arguments: \`() => document.title\` or \`async () => await fetch("example.com")\`.
 Example with arguments: \`(el) => el.innerText\`
 `,
@@ -114,9 +126,14 @@ Example with arguments: \`(el) => el.innerText\`
         return;
       }
 
-      const mcpPage = cliArgs?.experimentalPageIdRouting
-        ? context.getPageById(request.params.pageId)
-        : context.getSelectedMcpPage();
+      if (cliArgs?.categoryExtensions && cliArgs?.pageIdRouting && !pageId) {
+        throw new Error('specify either a pageId or a serviceWorkerId.');
+      }
+
+      const mcpPage =
+        cliArgs?.pageIdRouting && request.params.pageId
+          ? context.getPageById(request.params.pageId)
+          : context.getSelectedMcpPage();
       const page: Page = mcpPage.pptrPage;
 
       const args: Array<JSHandle<unknown>> = [];
diff --git a/src/tools/slim/tools.ts b/src/tools/slim/tools.ts
index 898433e5..c0bc9660 100644
--- a/src/tools/slim/tools.ts
+++ b/src/tools/slim/tools.ts
@@ -8,6 +8,7 @@ import type {Dialog} from '../../third_party/index.js';
 import {zod} from '../../third_party/index.js';
 import {ToolCategory} from '../categories.js';
 import {definePageTool} from '../ToolDefinition.js';
+import {validateUrl} from '../../utils/url.js';
 
 export const screenshot = definePageTool({
   name: 'screenshot',
@@ -34,43 +35,50 @@ export const screenshot = definePageTool({
   },
 });
 
-export const navigate = definePageTool({
-  name: 'navigate',
-  description: `Loads a URL`,
-  annotations: {
-    category: ToolCategory.NAVIGATION,
-    readOnlyHint: false,
-  },
-  schema: {
-    url: zod.string().describe('URL to navigate to'),
-  },
-  blockedByDialog: false,
-  verifyFilesSchema: {},
-  handler: async (request, response) => {
-    const page = request.page;
+export const navigate = definePageTool(args => {
+  return {
+    name: 'navigate',
+    description: `Loads a URL`,
+    annotations: {
+      category: ToolCategory.NAVIGATION,
+      readOnlyHint: false,
+    },
+    schema: {
+      url: zod.string().describe('URL to navigate to'),
+    },
+    blockedByDialog: false,
+    verifyFilesSchema: {},
+    handler: async (request, response) => {
+      validateUrl(request.params.url, {
+        javascriptEvaluation: args?.javascriptEvaluation,
+        categoryExtensions: args?.categoryExtensions,
+      });
 
-    const options = {
-      timeout: 30_000,
-    };
+      const page = request.page;
 
-    const dialogHandler = (dialog: Dialog) => {
-      if (dialog.type() === 'beforeunload') {
-        response.appendResponseLine(`Accepted a beforeunload dialog.`);
-        void dialog.accept();
-        // We are not going to report the dialog like regular dialogs.
-        page.clearDialog();
-      }
-    };
+      const options = {
+        timeout: 30_000,
+      };
 
-    page.pptrPage.on('dialog', dialogHandler);
+      const dialogHandler = (dialog: Dialog) => {
+        if (dialog.type() === 'beforeunload') {
+          response.appendResponseLine(`Accepted a beforeunload dialog.`);
+          void dialog.accept();
+          // We are not going to report the dialog like regular dialogs.
+          page.clearDialog();
+        }
+      };
 
-    try {
-      await page.pptrPage.goto(request.params.url, options);
-      response.appendResponseLine(`Navigated to ${page.pptrPage.url()}.`);
-    } finally {
-      page.pptrPage.off('dialog', dialogHandler);
-    }
-  },
+      page.pptrPage.on('dialog', dialogHandler);
+
+      try {
+        await page.pptrPage.goto(request.params.url, options);
+        response.appendResponseLine(`Navigated to ${page.pptrPage.url()}.`);
+      } finally {
+        page.pptrPage.off('dialog', dialogHandler);
+      }
+    },
+  };
 });
 
 export const evaluate = definePageTool({
@@ -79,6 +87,7 @@ export const evaluate = definePageTool({
   annotations: {
     category: ToolCategory.DEBUGGING,
     readOnlyHint: false,
+    conditions: ['javascriptEvaluation'],
   },
   schema: {
     script: zod.string().describe(`JS script to run on the page`),
diff --git a/src/tools/snapshot.ts b/src/tools/snapshot.ts
index 5121f5d0..8724de7b 100644
--- a/src/tools/snapshot.ts
+++ b/src/tools/snapshot.ts
@@ -11,7 +11,7 @@ import {definePageTool, timeoutSchema} from './ToolDefinition.js';
 
 export const takeSnapshot = definePageTool({
   name: 'take_snapshot',
-  description: `Take a text snapshot of the currently selected page based on the a11y tree. The snapshot lists page elements along with a unique
+  description: `Take a text snapshot of the target page based on the a11y tree. The snapshot lists page elements along with a unique
 identifier (uid). Always use the latest snapshot. Prefer taking a snapshot over taking a screenshot. The snapshot indicates the element selected
 in the DevTools Elements panel (if any).`,
   annotations: {
diff --git a/src/tools/tools.ts b/src/tools/tools.ts
index a78a8b7d..1814648c 100644
--- a/src/tools/tools.ts
+++ b/src/tools/tools.ts
@@ -6,9 +6,10 @@
  * Modified by Opera Software AS.
  */
 
-import type {ParsedArguments} from '../bin/chrome-devtools-mcp-cli-options.js';
+import type {ParsedArguments} from '../config/mcp-options.js';
 import * as operaTools from '../opera/tools/opera.js';
 
+import * as commentsTools from './comments.js';
 import * as consoleTools from './console.js';
 import * as emulationTools from './emulation.js';
 import * as extensionTools from './extensions.js';
@@ -32,6 +33,7 @@ export const createTools = (args: ParsedArguments) => {
   const rawTools = args.slim
     ? Object.values(slimTools)
     : [
+        ...(args.devtoolsComments ? Object.values(commentsTools) : []),
         ...Object.values(consoleTools),
         ...Object.values(emulationTools),
         ...Object.values(extensionTools),
diff --git a/src/utils/WaitForHelper.ts b/src/utils/WaitForHelper.ts
index 0289bfa5..3fb830a6 100644
--- a/src/utils/WaitForHelper.ts
+++ b/src/utils/WaitForHelper.ts
@@ -157,7 +157,7 @@ export class WaitForHelper {
 
     // A scoped AbortController used to clean up navigation probe listeners.
     // When aborted (either after navigation detection finishes or if this.#abortController
-    // aborts), it removes the CDP Page.frameStartedNavigating listener and automatically
+    // aborts), it removes CDP navigation probe listeners and automatically
     // detaches the abort listener from this.#abortController.signal.
     const navigationAbortController = new AbortController();
     const navigationStartedResolvers = Promise.withResolvers<boolean>();
@@ -177,12 +177,25 @@ export class WaitForHelper {
 
       navigationStartedResolvers.resolve(true);
     };
+    const requestedNavigationListener = (
+      event: Protocol.Page.FrameRequestedNavigationEvent,
+    ) => {
+      if (event.frameId === this.#page.mainFrame()._id) {
+        navigationStartedResolvers.resolve(true);
+      }
+    };
 
     this.#page._client().on('Page.frameStartedNavigating', navigationListener);
+    this.#page
+      ._client()
+      .on('Page.frameRequestedNavigation', requestedNavigationListener);
     navigationAbortController.signal.addEventListener('abort', () => {
       this.#page
         ._client()
         .off('Page.frameStartedNavigating', navigationListener);
+      this.#page
+        ._client()
+        .off('Page.frameRequestedNavigation', requestedNavigationListener);
     });
     this.#abortController.signal.addEventListener(
       'abort',
diff --git a/src/utils/bytes.ts b/src/utils/bytes.ts
new file mode 100644
index 00000000..4e5ad415
--- /dev/null
+++ b/src/utils/bytes.ts
@@ -0,0 +1,134 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import {zod} from '../third_party/index.js';
+
+const BYTE_UNITS: Readonly<Record<string, number>> = {
+  b: 1,
+  byte: 1,
+  bytes: 1,
+  k: 1000,
+  kb: 1000,
+  kib: 1024,
+  m: 1000 * 1000,
+  mb: 1000 * 1000,
+  mib: 1024 * 1024,
+  g: 1000 * 1000 * 1000,
+  gb: 1000 * 1000 * 1000,
+  gib: 1024 * 1024 * 1024,
+  t: 1000 * 1000 * 1000 * 1000,
+  tb: 1000 * 1000 * 1000 * 1000,
+  tib: 1024 * 1024 * 1024 * 1024,
+};
+
+/**
+ * Parses a byte size string (e.g. "1M", "1MB", "500KB", "1.5GB", "1024") into bytes.
+ */
+export function parseByteSize(value: string): number {
+  const trimmed = value.trim();
+  if (trimmed === '') {
+    throw new Error(`Invalid byte size: "${value}"`);
+  }
+
+  const match = trimmed.match(/^(\d+(?:\.\d+)?)\s*([a-zA-Z]+)?$/);
+  if (!match) {
+    throw new Error(
+      `Invalid byte size format: "${value}". Expected a number or format like "1024", "1M", "1MB", "1G", "1GB".`,
+    );
+  }
+
+  const numMatch = match[1];
+  if (numMatch === undefined) {
+    throw new Error(`Invalid byte size: "${value}"`);
+  }
+  const num = Number(numMatch);
+  if (!Number.isFinite(num) || num < 0) {
+    throw new Error(`Invalid byte size: "${value}"`);
+  }
+
+  const unitMatch = match[2];
+  if (unitMatch === undefined) {
+    return Math.round(num);
+  }
+
+  const unit = unitMatch.toLowerCase();
+  const multiplier = BYTE_UNITS[unit];
+  if (multiplier === undefined) {
+    throw new Error(
+      `Unknown unit "${unitMatch}" in "${value}". Supported units: B, KB, KiB, MB, MiB, GB, GiB, TB, TiB.`,
+    );
+  }
+
+  const bytes = Math.round(num * multiplier);
+  if (!Number.isFinite(bytes)) {
+    throw new Error(`Invalid byte size: "${value}"`);
+  }
+  return bytes;
+}
+
+export interface ByteSizeRange {
+  min: number;
+  max?: number;
+}
+
+/**
+ * Parses an inclusive byte-size range (e.g. "1MB", "1MB-2MB", "-1MB", "1MB-").
+ */
+export function parseByteSizeRange(value: string): ByteSizeRange {
+  const trimmed = value.trim();
+  if (!trimmed.includes('-')) {
+    return {min: parseByteSize(trimmed), max: undefined};
+  }
+
+  const parts = trimmed.split('-');
+  if (parts.length !== 2) {
+    throw new Error(
+      `Invalid byte size range: "${value}". Expected a size or range like "1MB", "1MB-2MB", "-1MB", or "1MB-".`,
+    );
+  }
+
+  const minValue = parts[0];
+  const maxValue = parts[1];
+  if (minValue === undefined || maxValue === undefined) {
+    throw new Error(`Invalid byte size range: "${value}"`);
+  }
+
+  const minText = minValue.trim();
+  const maxText = maxValue.trim();
+  if (minText === '' && maxText === '') {
+    throw new Error(
+      `Invalid byte size range: "${value}". At least one bound is required.`,
+    );
+  }
+
+  const min = minText === '' ? 0 : parseByteSize(minText);
+  const max = maxText === '' ? undefined : parseByteSize(maxText);
+  if (max !== undefined && min > max) {
+    throw new Error(
+      `Invalid byte size range: "${value}". The lower bound must not exceed the upper bound.`,
+    );
+  }
+
+  return {min, max};
+}
+
+export function byteSizeRangeSchema(description: string) {
+  return zod
+    .string()
+    .transform((value, context) => {
+      try {
+        return parseByteSizeRange(value);
+      } catch (error) {
+        context.addIssue({
+          code: zod.ZodIssueCode.custom,
+          message:
+            error instanceof Error ? error.message : 'Invalid byte size range',
+        });
+        return zod.NEVER;
+      }
+    })
+    .describe(description);
+}
diff --git a/src/utils/url.ts b/src/utils/url.ts
index 073316f6..f9056439 100644
--- a/src/utils/url.ts
+++ b/src/utils/url.ts
@@ -48,3 +48,108 @@ export function isLocalhost(url?: string): boolean {
 
   return false;
 }
+
+export interface ValidateUrlOptions {
+  javascriptEvaluation: boolean | undefined;
+  categoryExtensions: boolean | undefined;
+}
+
+export interface IsAllowedUrlOptions {
+  categoryExtensions: boolean | undefined;
+}
+
+/**
+ * Determines whether a URL is allowed for navigation and page tracking.
+ *
+ * Disallowed schemes:
+ * - chrome: (except chrome://newtab/ and chrome://inspect*)
+ * - chrome-untrusted:
+ * - chrome-extension: (unless categoryExtensions is true)
+ *
+ * @param url The URL string to test.
+ * @param options Configuration specifying whether extensions are enabled.
+ * @returns true if the URL is allowed.
+ */
+export function isAllowedUrl(
+  url: string,
+  options: IsAllowedUrlOptions,
+): boolean {
+  let parsed: URL;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return false;
+  }
+
+  if (parsed.protocol === 'chrome:') {
+    const host = parsed.hostname.toLowerCase();
+    const path = parsed.pathname.toLowerCase();
+    if (host === 'newtab' || host === 'new-tab-page' || host === 'inspect') {
+      return true;
+    }
+    if (
+      host === '' &&
+      (path === 'newtab' ||
+        path === 'new-tab-page' ||
+        path.startsWith('inspect'))
+    ) {
+      return true;
+    }
+  }
+
+  if (
+    parsed.protocol === 'chrome:' ||
+    parsed.protocol === 'chrome-untrusted:'
+  ) {
+    return false;
+  }
+  if (!options.categoryExtensions && parsed.protocol === 'chrome-extension:') {
+    return false;
+  }
+
+  return true;
+}
+
+const DISALLOWED_PROTOCOLS = new Set(['javascript:', 'data:', 'vbscript:']);
+
+/**
+ * Validates a URL string by parsing it with `new URL` and checking for disallowed protocols and restricted schemes.
+ *
+ * @param url The URL string to validate.
+ * @param options Options object containing javascriptEvaluation and categoryExtensions.
+ * @returns The parsed URL.
+ * @throws Error if the URL does not parse with `new URL`, or if JavaScript evaluation is disabled and a disallowed URL is passed,
+ * or if navigating to a restricted scheme.
+ */
+export function validateUrl(url: string, options: ValidateUrlOptions): URL {
+  const {javascriptEvaluation, categoryExtensions} = options;
+
+  let parsed: URL;
+  try {
+    parsed = new URL(url);
+  } catch {
+    throw new Error(
+      `Invalid URL: "${url}". URLs must be valid according to the URL standard.`,
+    );
+  }
+
+  if (
+    javascriptEvaluation === false &&
+    DISALLOWED_PROTOCOLS.has(parsed.protocol)
+  ) {
+    throw new Error(
+      `Navigating to ${parsed.protocol} URLs is not allowed when JavaScript evaluation is disabled.`,
+    );
+  }
+
+  if (!isAllowedUrl(url, {categoryExtensions})) {
+    if (parsed.protocol === 'chrome-extension:') {
+      throw new Error(
+        `Navigating to chrome-extension: URLs is not allowed without --categoryExtensions.`,
+      );
+    }
+    throw new Error(`Navigating to ${parsed.protocol} URLs is not allowed.`);
+  }
+
+  return parsed;
+}
diff --git a/tests/McpContext.test.ts b/tests/McpContext.test.ts
index 249b7d11..83a3688a 100644
--- a/tests/McpContext.test.ts
+++ b/tests/McpContext.test.ts
@@ -20,6 +20,7 @@ import {McpPage} from '../src/McpPage.js';
 import {TextSnapshot} from '../src/TextSnapshot.js';
 import {type HTTPResponse} from '../src/third_party/index.js';
 import type {TraceResult} from '../src/processors/PerformanceTrace.js';
+import {resolveCanonicalPath} from '../src/utils/files.js';
 
 import {
   getMockRequest,
@@ -133,6 +134,89 @@ describe('McpContext', () => {
       },
     );
   });
+
+  it('drops pages reaching internal chrome or chrome-untrusted schemes by any route', async () => {
+    await withMcpContext(async (_response, context) => {
+      const page = await context.newPage();
+      const pageId = page.id;
+      assert.strictEqual(context.getPageById(pageId), page);
+
+      const urlStub = sinon
+        .stub(page.pptrPage, 'url')
+        .returns('chrome://settings');
+      try {
+        await context.createPagesSnapshot();
+        const listed = context.getPages();
+        assert.ok(
+          !listed.some(p => p.id === pageId),
+          'page reaching chrome://settings should be dropped from listing',
+        );
+        assert.throws(() => context.getPageById(pageId), /No page found/);
+      } finally {
+        urlStub.restore();
+      }
+    });
+  });
+
+  it('drops pages with chrome-extension schemes unless categoryExtensions is enabled', async () => {
+    await withMcpContext(async (_response, context) => {
+      const page = await context.newPage();
+      const pageId = page.id;
+
+      const urlStub = sinon
+        .stub(page.pptrPage, 'url')
+        .returns('chrome-extension://some-ext-id/popup.html');
+      try {
+        await context.createPagesSnapshot();
+        const listed = context.getPages();
+        assert.ok(
+          !listed.some(p => p.id === pageId),
+          'extension page should be dropped from listing when categoryExtensions is disabled',
+        );
+        assert.throws(() => context.getPageById(pageId), /No page found/);
+      } finally {
+        urlStub.restore();
+      }
+    });
+  });
+
+  it('keeps pages with chrome://newtab/ and chrome://inspect', async () => {
+    await withMcpContext(async (_response, context) => {
+      const page = await context.newPage();
+      const pageId = page.id;
+
+      const newtabStub = sinon
+        .stub(page.pptrPage, 'url')
+        .returns('chrome://newtab/');
+      try {
+        await context.createPagesSnapshot();
+        const listed = context.getPages();
+        assert.ok(
+          listed.some(p => p.id === pageId),
+          'chrome://newtab/ should be kept in listing',
+        );
+        assert.strictEqual(context.getPageById(pageId), page);
+      } finally {
+        newtabStub.restore();
+      }
+
+      const inspectStub = sinon
+        .stub(page.pptrPage, 'url')
+        .returns('chrome://inspect/#devices');
+      try {
+        await context.createPagesSnapshot();
+        const listed = context.getPages();
+        assert.ok(
+          listed.some(p => p.id === pageId),
+          'chrome://inspect should be kept in listing',
+        );
+        assert.strictEqual(context.getPageById(pageId), page);
+      } finally {
+        inspectStub.restore();
+      }
+    });
+  });
+
   it('resolves uid from a non-selected page snapshot', async () => {
     await withMcpContext(async (_response, context) => {
       // Page 1: set content and snapshot
@@ -418,8 +502,14 @@ describe('McpContext', () => {
         ];
         context.setRoots(roots);
         // Valid path within root
-        await context.validatePath(path.join(workspacePath, 'test.txt'));
-        await context.validatePath(workspacePath);
+        const targetPath = path.join(workspacePath, 'test.txt');
+        const resolved = await context.validatePath(targetPath);
+        assert.strictEqual(resolved, await resolveCanonicalPath(targetPath));
+        const resolvedWorkspace = await context.validatePath(workspacePath);
+        assert.strictEqual(
+          resolvedWorkspace,
+          await resolveCanonicalPath(workspacePath),
+        );
 
         // Invalid path outside root and outside temp dir
         const outsidePath = path.resolve(os.homedir(), 'outside-test.txt');
@@ -443,9 +533,9 @@ describe('McpContext', () => {
         ];
         context.setRoots(roots);
         // Valid path within root with non-existent intermediate directories
-        await context.validatePath(
-          path.join(workspacePath, 'dir1', 'dir2', 'test.txt'),
-        );
+        const targetPath = path.join(workspacePath, 'dir1', 'dir2', 'test.txt');
+        const resolved = await context.validatePath(targetPath);
+        assert.strictEqual(resolved, await resolveCanonicalPath(targetPath));
       } finally {
         await fs.rm(workspacePath, {recursive: true, force: true});
       }
@@ -456,19 +546,42 @@ describe('McpContext', () => {
     await withMcpContext(
       async (_response, context) => {
         context.setRoots(undefined);
-        await context.validatePath(path.resolve(os.homedir(), 'anywhere.txt'));
+        const targetPath = path.resolve(os.homedir(), 'anywhere.txt');
+        const resolved = await context.validatePath(targetPath);
+        assert.strictEqual(resolved, await resolveCanonicalPath(targetPath));
       },
       {allowUnrestrictedPaths: true},
     );
   });
 
+  it('validatePath returns undefined if filePath is undefined', async () => {
+    await withMcpContext(async (_response, context) => {
+      const resolved = await context.validatePath(undefined);
+      assert.strictEqual(resolved, undefined);
+    });
+  });
+
+  it('validatePath returns resolved absolute path for relative paths', async () => {
+    await withMcpContext(async (_response, context) => {
+      const tmpDir = os.tmpdir();
+      const relativeTmpPath = path.relative(
+        process.cwd(),
+        path.join(tmpDir, 'test.txt'),
+      );
+      const resolved = await context.validatePath(relativeTmpPath);
+      assert.strictEqual(resolved, await resolveCanonicalPath(relativeTmpPath));
+    });
+  });
+
   it('validatePath denies paths outside tmpdir if roots are undefined and allowUnrestrictedPaths is not set', async () => {
     await withMcpContext(async (_response, context) => {
       // setRoots() never called — simulates a client that skips roots capability.
       const outsidePath = path.resolve(os.homedir(), 'anywhere.txt');
       await assert.rejects(context.validatePath(outsidePath), /Access denied/);
       // Temp dir must still be reachable.
-      await context.validatePath(path.join(os.tmpdir(), 'test.txt'));
+      const tmpPath = path.join(os.tmpdir(), 'test.txt');
+      const resolved = await context.validatePath(tmpPath);
+      assert.strictEqual(resolved, await resolveCanonicalPath(tmpPath));
     });
   });
 
@@ -476,7 +589,9 @@ describe('McpContext', () => {
     await withMcpContext(async (_response, context) => {
       context.setRoots([]);
       // Should allow temp dir
-      await context.validatePath(path.join(os.tmpdir(), 'test.txt'));
+      const tmpPath = path.join(os.tmpdir(), 'test.txt');
+      const resolved = await context.validatePath(tmpPath);
+      assert.strictEqual(resolved, await resolveCanonicalPath(tmpPath));
 
       // Should deny outside temp dir
       await assert.rejects(
@@ -492,7 +607,35 @@ describe('McpContext', () => {
       return;
     }
 
-    it('saveFile refuses to write through a symlink to an existing file', async () => {
+    it('validatePath resolves symlinks and returns the canonical path', async () => {
+      await withMcpContext(async (_response, context) => {
+        const tmpDir = await fs.mkdtemp(
+          path.join(os.tmpdir(), 'validate-symlink-test-'),
+        );
+        try {
+          const targetDir = path.join(tmpDir, 'target');
+          await fs.mkdir(targetDir);
+          const targetFile = path.join(targetDir, 'file.txt');
+          await fs.writeFile(targetFile, 'hello');
+
+          const symlinkDir = path.join(tmpDir, 'symlink_dir');
+          await fs.symlink(targetDir, symlinkDir, 'dir');
+
+          const canonicalTarget = await fs.realpath(targetDir);
+          context.setRoots([
+            {uri: pathToFileURL(canonicalTarget).href, name: 'target'},
+          ]);
+
+          const filePathWithSymlink = path.join(symlinkDir, 'file.txt');
+          const resolved = await context.validatePath(filePathWithSymlink);
+          assert.strictEqual(resolved, path.join(canonicalTarget, 'file.txt'));
+        } finally {
+          await fs.rm(tmpDir, {recursive: true, force: true});
+        }
+      });
+    });
+
+    it('saveFile allows writing to a symlinked file if it resolves to an allowed path', async () => {
       await withMcpContext(async (_response, context) => {
         const tmpDir = await fs.mkdtemp(
           path.join(os.tmpdir(), 'mcp-symlink-test-'),
@@ -506,14 +649,12 @@ describe('McpContext', () => {
           const symlinkPath = path.join(tmpDir, 'symlink.txt');
           await fs.symlink(targetPath, symlinkPath);
 
-          const data = new TextEncoder().encode('malicious content');
-          await assert.rejects(
-            context.saveFile(data, symlinkPath, '.txt'),
-            /Could not write/,
-          );
+          const data = new TextEncoder().encode('content');
+          await context.saveFile(data, symlinkPath, '.txt');
+          await context.saveFile(data, targetPath, '.txt');
 
           const content = await fs.readFile(targetPath, 'utf-8');
-          assert.strictEqual(content, 'original content');
+          assert.strictEqual(content, 'content');
         } finally {
           await fs.rm(tmpDir, {recursive: true, force: true});
         }
@@ -567,8 +708,10 @@ describe('McpContext', () => {
           const data = new TextEncoder().encode('allowed content');
 
           const result = await context.saveFile(data, targetFilePath, '.txt');
-          assert.strictEqual(result.filename, targetFilePath);
-
+          assert.strictEqual(
+            result.filename,
+            await resolveCanonicalPath(targetFilePath),
+          );
           const content = await fs.readFile(
             path.join(realDir, 'test.txt'),
             'utf-8',
@@ -718,5 +861,52 @@ describe('McpContext', () => {
         });
       });
     });
+
+    describe('getSelectedMcpPageUrl', () => {
+      it('returns url from passed page when open', async () => {
+        await withMcpContext(async (_response, context) => {
+          const page = await context.newPage();
+          const result = context.getSelectedMcpPageUrl(page);
+          assert.strictEqual(result, page.pptrPage.url());
+        });
+      });
+
+      it('returns undefined from passed page when closed', async () => {
+        await withMcpContext(async (_response, context) => {
+          const page = await context.newPage();
+          await page.pptrPage.close();
+          const result = context.getSelectedMcpPageUrl(page);
+          assert.strictEqual(result, undefined);
+        });
+      });
+
+      it('returns url from selected page when no page passed', async () => {
+        await withMcpContext(async (_response, context) => {
+          const page = context.getSelectedMcpPage();
+          const result = context.getSelectedMcpPageUrl();
+          assert.strictEqual(result, page.pptrPage.url());
+        });
+      });
+
+      it('returns undefined when getSelectedMcpPage throws', async () => {
+        await withMcpContext(async (_response, context) => {
+          sinon
+            .stub(context, 'getSelectedMcpPage')
+            .throws(new Error('No page selected'));
+          const result = context.getSelectedMcpPageUrl();
+          assert.strictEqual(result, undefined);
+        });
+      });
+
+      it('returns undefined when selected page is closed and getSelectedMcpPage throws', async () => {
+        await withMcpContext(async (_response, context) => {
+          const page = context.getSelectedMcpPage();
+          await page.pptrPage.close();
+          assert.throws(() => context.getSelectedMcpPage());
+          const result = context.getSelectedMcpPageUrl();
+          assert.strictEqual(result, undefined);
+        });
+      });
+    });
   });
 });
diff --git a/tests/McpPage.test.ts b/tests/McpPage.test.ts
index 6afae508..954e484d 100644
--- a/tests/McpPage.test.ts
+++ b/tests/McpPage.test.ts
@@ -5,14 +5,22 @@
  */
 
 import assert from 'node:assert';
-import {describe, it} from 'node:test';
+import {afterEach, describe, it} from 'node:test';
 
-import type {McpPage} from '../src/McpPage.js';
-import {replaceHtmlElementsWithUids} from '../src/McpPage.js';
-import type {JSONSchema7Definition} from '../src/third_party/index.js';
+import sinon from 'sinon';
+
+import type {TargetUniverse} from '../src/devtools/DevtoolsUtils.js';
+import {McpPage, replaceHtmlElementsWithUids} from '../src/McpPage.js';
+import {
+  Locator,
+  type JSONSchema7Definition,
+  type Page,
+} from '../src/third_party/index.js';
 import {TextSnapshot} from '../src/TextSnapshot.js';
 import type {TextSnapshotNode} from '../src/types.js';
-import {withMcpContext} from './utils.js';
+import {createMockPuppeteerPage} from './mocks.js';
+
+import {html, withMcpContext} from './utils.js';
 
 function installFakeSnapshotNode(
   page: McpPage,
@@ -329,4 +337,344 @@ describe('McpPage', () => {
       );
     });
   });
+  describe('emulate()', () => {
+    afterEach(() => {
+      sinon.restore();
+    });
+
+    function createMcpPage(
+      options: {hasNetworkBlockOrAllowlist?: boolean} = {},
+    ) {
+      const pptrPage = createMockPuppeteerPage();
+      const mcpPage = new McpPage(pptrPage as unknown as Page, 1, {
+        hasNetworkBlockOrAllowlist: options.hasNetworkBlockOrAllowlist ?? false,
+        locatorClass: Locator,
+      });
+      const mockSession = {
+        send: sinon.stub().resolves(),
+      };
+      sinon
+        .stub(mcpPage, 'devtoolsUniverse')
+        .get(() => ({session: mockSession}) as unknown as TargetUniverse);
+      return {mcpPage, pptrPage, mockSession};
+    }
+
+    it('calls emulateNetworkConditions with offline settings', async () => {
+      const {mcpPage, pptrPage} = createMcpPage();
+      await mcpPage.emulate({networkConditions: 'Offline'});
+      assert.strictEqual(mcpPage.networkConditions, 'Offline');
+      sinon.assert.calledOnceWithExactly(pptrPage.emulateNetworkConditions, {
+        offline: true,
+        download: 0,
+        upload: 0,
+        latency: 0,
+      });
+    });
+
+    it('calls emulateNetworkConditions with the predefined condition', async () => {
+      const {mcpPage, pptrPage} = createMcpPage();
+      await mcpPage.emulate({networkConditions: 'Slow 3G'});
+      assert.strictEqual(mcpPage.networkConditions, 'Slow 3G');
+      sinon.assert.calledOnceWithExactly(pptrPage.emulateNetworkConditions, {
+        download: 50000,
+        upload: 50000,
+        latency: 2000,
+      });
+    });
+
+    it('calls emulateNetworkConditions(null) when networkConditions is omitted', async () => {
+      const {mcpPage, pptrPage} = createMcpPage();
+      await mcpPage.emulate({networkConditions: 'Slow 3G'});
+      await mcpPage.emulate({});
+      assert.strictEqual(mcpPage.networkConditions, null);
+      sinon.assert.calledTwice(pptrPage.emulateNetworkConditions);
+      sinon.assert.calledWithExactly(
+        pptrPage.emulateNetworkConditions.secondCall,
+        null,
+      );
+    });
+
+    it('does not call emulateNetworkConditions for unknown values', async () => {
+      const {mcpPage, pptrPage} = createMcpPage();
+      await mcpPage.emulate({networkConditions: 'Slow 11G'});
+      assert.strictEqual(mcpPage.networkConditions, null);
+      sinon.assert.notCalled(pptrPage.emulateNetworkConditions);
+    });
+
+    it('throws when networkConditions is set with network blocking enabled', async () => {
+      const {mcpPage, pptrPage} = createMcpPage({
+        hasNetworkBlockOrAllowlist: true,
+      });
+      await assert.rejects(
+        () => mcpPage.emulate({networkConditions: 'Slow 3G'}),
+        /Network throttling is not supported when network blocking/,
+      );
+      sinon.assert.notCalled(pptrPage.emulateNetworkConditions);
+    });
+
+    it('calls emulateCPUThrottling with the given rate', async () => {
+      const {mcpPage, pptrPage} = createMcpPage();
+      await mcpPage.emulate({cpuThrottlingRate: 4});
+      assert.strictEqual(mcpPage.cpuThrottlingRate, 4);
+      sinon.assert.calledOnceWithExactly(pptrPage.emulateCPUThrottling, 4);
+    });
+
+    it('calls emulateCPUThrottling(1) to reset throttling', async () => {
+      const {mcpPage, pptrPage} = createMcpPage();
+      await mcpPage.emulate({cpuThrottlingRate: 4});
+      await mcpPage.emulate({cpuThrottlingRate: 1});
+      assert.strictEqual(mcpPage.cpuThrottlingRate, 1);
+      sinon.assert.calledTwice(pptrPage.emulateCPUThrottling);
+      sinon.assert.calledWithExactly(
+        pptrPage.emulateCPUThrottling.secondCall,
+        1,
+      );
+    });
+
+    it('sends Emulation.setCPUThrottlingRate to secondary session if present', async () => {
+      const {mcpPage, pptrPage, mockSession} = createMcpPage();
+      await mcpPage.emulate({cpuThrottlingRate: 4});
+      sinon.assert.calledOnceWithExactly(pptrPage.emulateCPUThrottling, 4);
+      sinon.assert.calledOnceWithExactly(
+        mockSession.send,
+        'Emulation.setCPUThrottlingRate',
+        {rate: 4},
+      );
+    });
+
+    it('sends Emulation.setCPUThrottlingRate with rate 1 to secondary session when cpuThrottlingRate is omitted', async () => {
+      const {mcpPage, pptrPage, mockSession} = createMcpPage();
+      await mcpPage.emulate({});
+      sinon.assert.calledOnceWithExactly(pptrPage.emulateCPUThrottling, 1);
+      sinon.assert.calledOnceWithExactly(
+        mockSession.send,
+        'Emulation.setCPUThrottlingRate',
+        {rate: 1},
+      );
+    });
+
+    it('calls setGeolocation with the given coordinates', async () => {
+      const {mcpPage, pptrPage} = createMcpPage();
+      await mcpPage.emulate({
+        geolocation: {latitude: 48.137154, longitude: 11.576124},
+      });
+      assert.deepStrictEqual(mcpPage.geolocation, {
+        latitude: 48.137154,
+        longitude: 11.576124,
+      });
+      sinon.assert.calledOnceWithExactly(pptrPage.setGeolocation, {
+        latitude: 48.137154,
+        longitude: 11.576124,
+      });
+    });
+
+    it('calls setGeolocation with (0, 0) when geolocation is omitted', async () => {
+      const {mcpPage, pptrPage} = createMcpPage();
+      await mcpPage.emulate({
+        geolocation: {latitude: 48.137154, longitude: 11.576124},
+      });
+      await mcpPage.emulate({});
+      assert.strictEqual(mcpPage.geolocation, null);
+      sinon.assert.calledTwice(pptrPage.setGeolocation);
+      sinon.assert.calledWithExactly(pptrPage.setGeolocation.secondCall, {
+        latitude: 0,
+        longitude: 0,
+      });
+    });
+
+    it('calls setUserAgent with the given user agent', async () => {
+      const {mcpPage, pptrPage} = createMcpPage();
+      await mcpPage.emulate({userAgent: 'TestUA/1.0'});
+      assert.strictEqual(mcpPage.userAgent, 'TestUA/1.0');
+      sinon.assert.calledOnceWithExactly(pptrPage.setUserAgent, {
+        userAgent: 'TestUA/1.0',
+      });
+    });
+
+    it('calls setUserAgent with undefined to clear the user agent', async () => {
+      const {mcpPage, pptrPage} = createMcpPage();
+      await mcpPage.emulate({userAgent: 'TestUA/1.0'});
+      await mcpPage.emulate({userAgent: ''});
+      assert.strictEqual(mcpPage.userAgent, null);
+      sinon.assert.calledTwice(pptrPage.setUserAgent);
+      sinon.assert.calledWithExactly(pptrPage.setUserAgent.secondCall, {
+        userAgent: undefined,
+      });
+    });
+
+    it('calls emulateMediaFeatures with dark color scheme', async () => {
+      const {mcpPage, pptrPage} = createMcpPage();
+      await mcpPage.emulate({colorScheme: 'dark'});
+      assert.strictEqual(mcpPage.colorScheme, 'dark');
+      sinon.assert.calledOnceWithExactly(pptrPage.emulateMediaFeatures, [
+        {name: 'prefers-color-scheme', value: 'dark'},
+      ]);
+    });
+
+    it('calls emulateMediaFeatures with empty string to reset color scheme', async () => {
+      const {mcpPage, pptrPage} = createMcpPage();
+      await mcpPage.emulate({colorScheme: 'dark'});
+      await mcpPage.emulate({colorScheme: 'auto'});
+      assert.strictEqual(mcpPage.colorScheme, null);
+      sinon.assert.calledTwice(pptrPage.emulateMediaFeatures);
+      sinon.assert.calledWithExactly(pptrPage.emulateMediaFeatures.secondCall, [
+        {name: 'prefers-color-scheme', value: ''},
+      ]);
+    });
+
+    it('calls setViewport with the given dimensions merged with defaults', async () => {
+      const {mcpPage, pptrPage} = createMcpPage();
+      await mcpPage.emulate({
+        viewport: {
+          width: 400,
+          height: 400,
+        },
+      });
+      assert.deepStrictEqual(mcpPage.viewport, {
+        width: 400,
+        height: 400,
+        deviceScaleFactor: 1,
+        isMobile: false,
+        hasTouch: false,
+        isLandscape: false,
+      });
+      sinon.assert.calledOnceWithExactly(pptrPage.setViewport, {
+        width: 400,
+        height: 400,
+        deviceScaleFactor: 1,
+        isMobile: false,
+        hasTouch: false,
+        isLandscape: false,
+      });
+    });
+
+    it('calls setViewport(null) when viewport is omitted', async () => {
+      const {mcpPage, pptrPage} = createMcpPage();
+      await mcpPage.emulate({viewport: {width: 400, height: 400}});
+      await mcpPage.emulate({});
+      assert.strictEqual(mcpPage.viewport, null);
+      sinon.assert.calledTwice(pptrPage.setViewport);
+      sinon.assert.calledWithExactly(pptrPage.setViewport.secondCall, null);
+    });
+
+    it('calls setExtraHTTPHeaders with the given headers', async () => {
+      const {mcpPage, pptrPage} = createMcpPage();
+      await mcpPage.emulate({
+        extraHttpHeaders: {'X-Custom-Header': 'test-value'},
+      });
+      assert.deepStrictEqual(mcpPage.emulationSettings.extraHttpHeaders, {
+        'X-Custom-Header': 'test-value',
+      });
+      sinon.assert.calledOnceWithExactly(pptrPage.setExtraHTTPHeaders, {
+        'X-Custom-Header': 'test-value',
+      });
+    });
+
+    it('clears extraHttpHeaders when empty object is passed', async () => {
+      const {mcpPage, pptrPage} = createMcpPage();
+      await mcpPage.emulate({
+        extraHttpHeaders: {'X-Custom-Header': 'test-value'},
+      });
+      await mcpPage.emulate({extraHttpHeaders: {}});
+      assert.strictEqual(mcpPage.emulationSettings.extraHttpHeaders, undefined);
+      sinon.assert.calledTwice(pptrPage.setExtraHTTPHeaders);
+      sinon.assert.calledWithExactly(
+        pptrPage.setExtraHTTPHeaders.secondCall,
+        {},
+      );
+    });
+  });
+
+  describe('waitForTextOnPage()', () => {
+    it('finds text on the page', async () => {
+      await withMcpContext(async (_response, context) => {
+        const mcpPage = context.getSelectedMcpPage();
+        const page = mcpPage.pptrPage;
+
+        await page.setContent(
+          html`<main><span>Hello</span><span> </span><div>World</div></main>`,
+        );
+
+        const element = await mcpPage.waitForTextOnPage(['Hello']);
+        assert.ok(element);
+      });
+    });
+
+    it('works with any-match array', async () => {
+      await withMcpContext(async (_response, context) => {
+        const mcpPage = context.getSelectedMcpPage();
+        const page = mcpPage.pptrPage;
+
+        await page.setContent(
+          html`<main><span>Status</span><div>Error</div></main>`,
+        );
+
+        const element = await mcpPage.waitForTextOnPage(['Complete', 'Error']);
+        assert.ok(element);
+      });
+    });
+
+    it('works with any-match array when element shows up later', async () => {
+      await withMcpContext(async (_response, context) => {
+        const mcpPage = context.getSelectedMcpPage();
+        const page = mcpPage.pptrPage;
+
+        const waitPromise = mcpPage.waitForTextOnPage(['Complete', 'Error']);
+
+        await page.setContent(
+          html`<main
+            ><span>Hello</span><span> </span><div>Complete</div></main
+          >`,
+        );
+
+        const element = await waitPromise;
+        assert.ok(element);
+      });
+    });
+
+    it('works with element that shows up later', async () => {
+      await withMcpContext(async (_response, context) => {
+        const mcpPage = context.getSelectedMcpPage();
+        const page = mcpPage.pptrPage;
+
+        const waitPromise = mcpPage.waitForTextOnPage(['Hello World']);
+
+        await page.setContent(
+          html`<main><span>Hello</span><span> </span><div>World</div></main>`,
+        );
+
+        const element = await waitPromise;
+        assert.ok(element);
+      });
+    });
+
+    it('works with aria elements', async () => {
+      await withMcpContext(async (_response, context) => {
+        const mcpPage = context.getSelectedMcpPage();
+        const page = mcpPage.pptrPage;
+
+        await page.setContent(
+          html`<main><h1>Header</h1><div>Text</div></main>`,
+        );
+
+        const element = await mcpPage.waitForTextOnPage(['Header']);
+        assert.ok(element);
+      });
+    });
+
+    it('works with iframe content', async () => {
+      await withMcpContext(async (_response, context) => {
+        const mcpPage = context.getSelectedMcpPage();
+        const page = mcpPage.pptrPage;
+
+        await page.setContent(
+          html`<h1>Top level</h1>
+            <iframe srcdoc="<p>Hello iframe</p>"></iframe>`,
+        );
+
+        const element = await mcpPage.waitForTextOnPage(['Hello iframe']);
+        assert.ok(element);
+      });
+    });
+  });
 });
diff --git a/tests/McpResponse.test.js.snapshot b/tests/McpResponse.test.js.snapshot
index c98dc5e2..93b94832 100644
--- a/tests/McpResponse.test.js.snapshot
+++ b/tests/McpResponse.test.js.snapshot
@@ -814,7 +814,7 @@ Available insights:
     example question: Which LCP subpart was most problematic?
     example question: What can I do to reduce the LCP time for this page load?
   - insight name: LCPDiscovery
-    description: [Optimize LCP](https://developer.chrome.com/docs/performance/insights/lcp-discovery) by making the LCP image discoverable from the HTML immediately, and avoiding lazy-loading
+    description: [Optimize LCP](https://developer.chrome.com/docs/performance/insights/lcp-discovery) by making the LCP image discoverable from the HTML immediately, and avoiding lazy-loading.
     relevant trace bounds: {min: 122411004828µs, max: 122411055039µs}
     example question: Suggest fixes to reduce my LCP
     example question: What can I do to reduce my LCP discovery time?
@@ -900,7 +900,120 @@ The order of headers corresponds to an internal fixed list. If a header is not p
 `;
 
 exports[`McpResponse network pagination > trace summaries > includes the trace summary text and structured data 2`] = `
-"## Summary of Performance trace findings:\\nURL: https://web.dev/\\nTrace bounds: {min: 122410994891µs, max: 122416385853µs}\\nCPU throttling: none\\nNetwork throttling: none\\n\\n# Available insight sets\\n\\nThe following is a list of insight sets. An insight set covers a specific part of the trace, split by navigations. The insights within each insight set are specific to that part of the trace. Be sure to consider the insight set id and bounds when calling functions. If no specific insight set or navigation is mentioned, assume the user is referring to the first one.\\n\\n## insight set id: NAVIGATION_0\\n\\nURL: https://web.dev/\\nBounds: {min: 122410996889µs, max: 122416385853µs}\\nMetrics (lab / observed):\\n  - LCP: 129 ms, event: (eventKey: r-6063, ts: 122411126100), nodeId: 7\\n  - LCP breakdown:\\n    - TTFB: 8 ms, bounds: {min: 122410996889µs, max: 122411004828µs}\\n    - Load delay: 33 ms, bounds: {min: 122411004828µs, max: 122411037986µs}\\n    - Load duration: 15 ms, bounds: {min: 122411037986µs, max: 122411052690µs}\\n    - Render delay: 73 ms, bounds: {min: 122411052690µs, max: 122411126100µs}\\n  - CLS: 0.00\\nMetrics (field / real users): n/a – no data for this page in CrUX\\nAvailable insights:\\n  - insight name: LCPBreakdown\\n    description: Each [subpart has specific improvement strategies](https://developer.chrome.com/docs/performance/insights/lcp-breakdown). Ideally, most of the LCP time should be spent on loading the resources, not within delays.\\n    relevant trace bounds: {min: 122410996889µs, max: 122411126100µs}\\n    example question: Help me optimize my LCP score\\n    example question: Which LCP subpart was most problematic?\\n    example question: What can I do to reduce the LCP time for this page load?\\n  - insight name: LCPDiscovery\\n    description: [Optimize LCP](https://developer.chrome.com/docs/performance/insights/lcp-discovery) by making the LCP image discoverable from the HTML immediately, and avoiding lazy-loading\\n    relevant trace bounds: {min: 122411004828µs, max: 122411055039µs}\\n    example question: Suggest fixes to reduce my LCP\\n    example question: What can I do to reduce my LCP discovery time?\\n    example question: Why is LCP discovery time important?\\n  - insight name: RenderBlocking\\n    description: Requests are blocking the page’s initial render, which may delay LCP. [Deferring or inlining](https://developer.chrome.com/docs/performance/insights/render-blocking) can move these network requests out of the critical path.\\n    relevant trace bounds: {min: 122411037528µs, max: 122411053852µs}\\n    example question: Show me the most impactful render-blocking requests that I should focus on\\n    example question: How can I reduce the number of render-blocking requests?\\n  - insight name: DocumentLatency\\n    description: Your first network request is the most important. [Reduce its latency](https://developer.chrome.com/docs/performance/insights/document-latency) by avoiding redirects, ensuring a fast server response, and enabling text compression.\\n    relevant trace bounds: {min: 122410998910µs, max: 122411043781µs}\\n    estimated metric savings: FCP 0 ms, LCP 0 ms\\n    estimated wasted bytes: 77.1 kB\\n    example question: How do I decrease the initial loading time of my page?\\n    example question: Did anything slow down the request for this document?\\n  - insight name: ThirdParties\\n    description: 3rd party code can significantly impact load performance. [Reduce and defer loading of 3rd party code](https://developer.chrome.com/docs/performance/insights/third-parties) to prioritize your page’s content.\\n    relevant trace bounds: {min: 122411037881µs, max: 122416229595µs}\\n    example question: Which third parties are having the largest impact on my page performance?\\n  - insight name: CharacterSet\\n    description: A character encoding declaration is required. It can be done with a meta charset tag in the first 1024 bytes of the HTML or in the Content-Type HTTP response header. [Learn more about declaring the character encoding](https://developer.chrome.com/docs/insights/charset/).\\n    relevant trace bounds: {min: 122410998910µs, max: 122411043781µs}\\n    example question: How do I declare a character encoding for my page?\\n\\n## Details on call tree & network request formats:\\nInformation on performance traces may contain main thread activity represented as call frames and network requests.\\n\\nEach call frame is presented in the following format:\\n\\n'id;eventKey;name;duration;selfTime;urlIndex;childRange;[line];[column];[S]'\\n\\nKey definitions:\\n\\n* id: A unique numerical identifier for the call frame. Never mention this id in the output to the user.\\n* eventKey: String that uniquely identifies this event in the flame chart.\\n* name: A concise string describing the call frame (e.g., 'Evaluate Script', 'render', 'fetchData').\\n* duration: The total execution time of the call frame, including its children.\\n* selfTime: The time spent directly within the call frame, excluding its children's execution.\\n* urlIndex: Index referencing the \\"All URLs\\" list. Empty if no specific script URL is associated.\\n* childRange: Specifies the direct children of this node using their IDs. If empty ('' or 'S' at the end), the node has no children. If a single number (e.g., '4'), the node has one child with that ID. If in the format 'firstId-lastId' (e.g., '4-5'), it indicates a consecutive range of child IDs from 'firstId' to 'lastId', inclusive.\\n* line: An optional field for a call frame's line number. This is where the function is defined.\\n* column: An optional field for a call frame's column number. This is where the function is defined.\\n* S: _Optional_. The letter 'S' terminates the line if that call frame was selected by the user.\\n\\nExample Call Tree:\\n\\n1;r-123;main;500;100;0;1;;\\n2;r-124;update;200;50;;3;0;1;\\n3;p-49575-15428179-2834-374;animate;150;20;0;4-5;0;1;S\\n4;p-49575-15428179-3505-1162;calculatePosition;80;80;0;1;;\\n5;p-49575-15428179-5391-2767;applyStyles;50;50;0;1;;\\n\\n\\nNetwork requests are formatted like this:\\n\`urlIndex;eventKey;queuedTime;requestSentTime;downloadCompleteTime;processingCompleteTime;totalDuration;downloadDuration;mainThreadProcessingDuration;statusCode;mimeType;priority;initialPriority;finalPriority;renderBlocking;protocol;fromServiceWorker;initiators;redirects:[[redirectUrlIndex|startTime|duration]];responseHeaders:[header1Value|header2Value|...]\`\\n\\n- \`urlIndex\`: Numerical index for the request's URL, referencing the \\"All URLs\\" list.\\n- \`eventKey\`: String that uniquely identifies this request's trace event.\\nTimings (all in milliseconds, relative to navigation start):\\n- \`queuedTime\`: When the request was queued.\\n- \`requestSentTime\`: When the request was sent.\\n- \`downloadCompleteTime\`: When the download completed.\\n- \`processingCompleteTime\`: When main thread processing finished.\\nDurations (all in milliseconds):\\n- \`totalDuration\`: Total time from the request being queued until its main thread processing completed.\\n- \`downloadDuration\`: Time spent actively downloading the resource.\\n- \`mainThreadProcessingDuration\`: Time spent on the main thread after the download completed.\\n- \`statusCode\`: The HTTP status code of the response (e.g., 200, 404).\\n- \`mimeType\`: The MIME type of the resource (e.g., \\"text/html\\", \\"application/javascript\\").\\n- \`priority\`: The final network request priority (e.g., \\"VeryHigh\\", \\"Low\\").\\n- \`initialPriority\`: The initial network request priority.\\n- \`finalPriority\`: The final network request priority (redundant if \`priority\` is always final, but kept for clarity if \`initialPriority\` and \`priority\` differ).\\n- \`renderBlocking\`: 't' if the request was render-blocking, 'f' otherwise.\\n- \`protocol\`: The network protocol used (e.g., \\"h2\\", \\"http/1.1\\").\\n- \`fromServiceWorker\`: 't' if the request was served from a service worker, 'f' otherwise.\\n- \`initiators\`: A list (separated by ,) of URL indices for the initiator chain of this request. Listed in order starting from the root request to the request that directly loaded this one. This represents the network dependencies necessary to load this request. If there is no initiator, this is empty.\\n- \`redirects\`: A comma-separated list of redirects, enclosed in square brackets. Each redirect is formatted as\\n\`[redirectUrlIndex|startTime|duration]\`, where: \`redirectUrlIndex\`: Numerical index for the redirect's URL. \`startTime\`: The start time of the redirect in milliseconds, relative to navigation start. \`duration\`: The duration of the redirect in milliseconds.\\n- \`responseHeaders\`: A list (separated by '|') of values for specific, pre-defined response headers, enclosed in square brackets.\\nThe order of headers corresponds to an internal fixed list. If a header is not present, its value will be empty.\\n"
+## Summary of Performance trace findings:
+URL: https://web.dev/
+Trace bounds: {min: 122410994891µs, max: 122416385853µs}
+CPU throttling: none
+Network throttling: none
+
+# Available insight sets
+
+The following is a list of insight sets. An insight set covers a specific part of the trace, split by navigations. The insights within each insight set are specific to that part of the trace. Be sure to consider the insight set id and bounds when calling functions. If no specific insight set or navigation is mentioned, assume the user is referring to the first one.
+
+## insight set id: NAVIGATION_0
+
+URL: https://web.dev/
+Bounds: {min: 122410996889µs, max: 122416385853µs}
+Metrics (lab / observed):
+  - LCP: 129 ms, event: (eventKey: r-6063, ts: 122411126100), nodeId: 7
+  - LCP breakdown:
+    - TTFB: 8 ms, bounds: {min: 122410996889µs, max: 122411004828µs}
+    - Load delay: 33 ms, bounds: {min: 122411004828µs, max: 122411037986µs}
+    - Load duration: 15 ms, bounds: {min: 122411037986µs, max: 122411052690µs}
+    - Render delay: 73 ms, bounds: {min: 122411052690µs, max: 122411126100µs}
+  - CLS: 0.00
+Metrics (field / real users): n/a – no data for this page in CrUX
+Available insights:
+  - insight name: LCPBreakdown
+    description: Each [subpart has specific improvement strategies](https://developer.chrome.com/docs/performance/insights/lcp-breakdown). Ideally, most of the LCP time should be spent on loading the resources, not within delays.
+    relevant trace bounds: {min: 122410996889µs, max: 122411126100µs}
+    example question: Help me optimize my LCP score
+    example question: Which LCP subpart was most problematic?
+    example question: What can I do to reduce the LCP time for this page load?
+  - insight name: LCPDiscovery
+    description: [Optimize LCP](https://developer.chrome.com/docs/performance/insights/lcp-discovery) by making the LCP image discoverable from the HTML immediately, and avoiding lazy-loading.
+    relevant trace bounds: {min: 122411004828µs, max: 122411055039µs}
+    example question: Suggest fixes to reduce my LCP
+    example question: What can I do to reduce my LCP discovery time?
+    example question: Why is LCP discovery time important?
+  - insight name: RenderBlocking
+    description: Requests are blocking the page’s initial render, which may delay LCP. [Deferring or inlining](https://developer.chrome.com/docs/performance/insights/render-blocking) can move these network requests out of the critical path.
+    relevant trace bounds: {min: 122411037528µs, max: 122411053852µs}
+    example question: Show me the most impactful render-blocking requests that I should focus on
+    example question: How can I reduce the number of render-blocking requests?
+  - insight name: DocumentLatency
+    description: Your first network request is the most important. [Reduce its latency](https://developer.chrome.com/docs/performance/insights/document-latency) by avoiding redirects, ensuring a fast server response, and enabling text compression.
+    relevant trace bounds: {min: 122410998910µs, max: 122411043781µs}
+    estimated metric savings: FCP 0 ms, LCP 0 ms
+    estimated wasted bytes: 77.1 kB
+    example question: How do I decrease the initial loading time of my page?
+    example question: Did anything slow down the request for this document?
+  - insight name: ThirdParties
+    description: 3rd party code can significantly impact load performance. [Reduce and defer loading of 3rd party code](https://developer.chrome.com/docs/performance/insights/third-parties) to prioritize your page’s content.
+    relevant trace bounds: {min: 122411037881µs, max: 122416229595µs}
+    example question: Which third parties are having the largest impact on my page performance?
+  - insight name: CharacterSet
+    description: A character encoding declaration is required. It can be done with a meta charset tag in the first 1024 bytes of the HTML or in the Content-Type HTTP response header. [Learn more about declaring the character encoding](https://developer.chrome.com/docs/insights/charset/).
+    relevant trace bounds: {min: 122410998910µs, max: 122411043781µs}
+    example question: How do I declare a character encoding for my page?
+
+## Details on call tree & network request formats:
+Information on performance traces may contain main thread activity represented as call frames and network requests.
+
+Each call frame is presented in the following format:
+
+'id;eventKey;name;duration;selfTime;urlIndex;childRange;[line];[column];[S]'
+
+Key definitions:
+
+* id: A unique numerical identifier for the call frame. Never mention this id in the output to the user.
+* eventKey: String that uniquely identifies this event in the flame chart.
+* name: A concise string describing the call frame (e.g., 'Evaluate Script', 'render', 'fetchData').
+* duration: The total execution time of the call frame, including its children.
+* selfTime: The time spent directly within the call frame, excluding its children's execution.
+* urlIndex: Index referencing the "All URLs" list. Empty if no specific script URL is associated.
+* childRange: Specifies the direct children of this node using their IDs. If empty ('' or 'S' at the end), the node has no children. If a single number (e.g., '4'), the node has one child with that ID. If in the format 'firstId-lastId' (e.g., '4-5'), it indicates a consecutive range of child IDs from 'firstId' to 'lastId', inclusive.
+* line: An optional field for a call frame's line number. This is where the function is defined.
+* column: An optional field for a call frame's column number. This is where the function is defined.
+* S: _Optional_. The letter 'S' terminates the line if that call frame was selected by the user.
+
+Example Call Tree:
+
+1;r-123;main;500;100;0;1;;
+2;r-124;update;200;50;;3;0;1;
+3;p-49575-15428179-2834-374;animate;150;20;0;4-5;0;1;S
+4;p-49575-15428179-3505-1162;calculatePosition;80;80;0;1;;
+5;p-49575-15428179-5391-2767;applyStyles;50;50;0;1;;
+
+
+Network requests are formatted like this:
+\`urlIndex;eventKey;queuedTime;requestSentTime;downloadCompleteTime;processingCompleteTime;totalDuration;downloadDuration;mainThreadProcessingDuration;statusCode;mimeType;priority;initialPriority;finalPriority;renderBlocking;protocol;fromServiceWorker;initiators;redirects:[[redirectUrlIndex|startTime|duration]];responseHeaders:[header1Value|header2Value|...]\`
+
+- \`urlIndex\`: Numerical index for the request's URL, referencing the "All URLs" list.
+- \`eventKey\`: String that uniquely identifies this request's trace event.
+Timings (all in milliseconds, relative to navigation start):
+- \`queuedTime\`: When the request was queued.
+- \`requestSentTime\`: When the request was sent.
+- \`downloadCompleteTime\`: When the download completed.
+- \`processingCompleteTime\`: When main thread processing finished.
+Durations (all in milliseconds):
+- \`totalDuration\`: Total time from the request being queued until its main thread processing completed.
+- \`downloadDuration\`: Time spent actively downloading the resource.
+- \`mainThreadProcessingDuration\`: Time spent on the main thread after the download completed.
+- \`statusCode\`: The HTTP status code of the response (e.g., 200, 404).
+- \`mimeType\`: The MIME type of the resource (e.g., "text/html", "application/javascript").
+- \`priority\`: The final network request priority (e.g., "VeryHigh", "Low").
+- \`initialPriority\`: The initial network request priority.
+- \`finalPriority\`: The final network request priority (redundant if \`priority\` is always final, but kept for clarity if \`initialPriority\` and \`priority\` differ).
+- \`renderBlocking\`: 't' if the request was render-blocking, 'f' otherwise.
+- \`protocol\`: The network protocol used (e.g., "h2", "http/1.1").
+- \`fromServiceWorker\`: 't' if the request was served from a service worker, 'f' otherwise.
+- \`initiators\`: A list (separated by ,) of URL indices for the initiator chain of this request. Listed in order starting from the root request to the request that directly loaded this one. This represents the network dependencies necessary to load this request. If there is no initiator, this is empty.
+- \`redirects\`: A comma-separated list of redirects, enclosed in square brackets. Each redirect is formatted as
+\`[redirectUrlIndex|startTime|duration]\`, where: \`redirectUrlIndex\`: Numerical index for the redirect's URL. \`startTime\`: The start time of the redirect in milliseconds, relative to navigation start. \`duration\`: The duration of the redirect in milliseconds.
+- \`responseHeaders\`: A list (separated by '|') of values for specific, pre-defined response headers, enclosed in square brackets.
+The order of headers corresponds to an internal fixed list. If a header is not present, its value will be empty.
+
 `;
 
 exports[`McpResponse network pagination > trace summaries > includes the trace summary text and structured data 3`] = `
diff --git a/tests/McpResponse.test.ts b/tests/McpResponse.test.ts
index 119af73c..2d2d04c1 100644
--- a/tests/McpResponse.test.ts
+++ b/tests/McpResponse.test.ts
@@ -12,7 +12,7 @@ import {describe, it} from 'node:test';
 
 import sinon from 'sinon';
 
-import type {ParsedArguments} from '../src/bin/chrome-devtools-mcp-cli-options.js';
+import type {ParsedArguments} from '../src/config/mcp-options.js';
 import type {McpContext} from '../src/McpContext.js';
 import type {McpResponse} from '../src/McpResponse.js';
 import type {Extension} from '../src/third_party/index.js';
diff --git a/tests/ToolHandler.test.ts b/tests/ToolHandler.test.ts
index 2feafba7..08277c68 100644
--- a/tests/ToolHandler.test.ts
+++ b/tests/ToolHandler.test.ts
@@ -12,7 +12,7 @@ import {pathToFileURL} from 'node:url';
 
 import sinon from 'sinon';
 
-import {parseArguments} from '../src/bin/chrome-devtools-mcp-cli-options.js';
+import {parseArguments} from '../src/config/mcp-options.js';
 import {McpContext} from '../src/McpContext.js';
 import {McpPage} from '../src/McpPage.js';
 import {McpResponse} from '../src/McpResponse.js';
@@ -23,8 +23,10 @@ import {ToolHandler} from '../src/ToolHandler.js';
 import {ToolCategory} from '../src/tools/categories.js';
 import type {
   DefinedPageTool,
+  DevToolsData,
   ToolDefinition,
 } from '../src/tools/ToolDefinition.js';
+import {createTools} from '../src/tools/tools.js';
 import {getMockBrowser} from './utils.js';
 import {Mutex} from '../src/third_party/index.js';
 
@@ -34,7 +36,7 @@ describe('ToolHandler', () => {
     ClearcutLogger.resetForTesting();
   });
 
-  it('calls page getter for page scoped tools', async () => {
+  it('calls getPageById for page scoped tools when pageId is provided', async () => {
     let handlerCalled = false;
     const tool: DefinedPageTool = {
       name: 'page_tool',
@@ -56,7 +58,7 @@ describe('ToolHandler', () => {
     const mockProcess = sinon.createStubInstance(ChildProcess);
     mockContext.browser = getMockBrowser({process: mockProcess});
     const mockPage = sinon.createStubInstance(McpPage);
-    mockContext.getSelectedMcpPage.returns(mockPage);
+    mockContext.getPageById.returns(mockPage);
 
     const toolMutex = new Mutex();
     const serverArgs = parseArguments('1.0.0', ['node', 'script.js'], {
@@ -70,6 +72,52 @@ describe('ToolHandler', () => {
       toolMutex,
     );
 
+    assert.strictEqual(toolHandler.shouldRegister, true);
+    await toolHandler.handle({pageId: 1});
+
+    assert.strictEqual(mockContext.getPageById.calledOnce, true);
+    assert.strictEqual(mockContext.getPageById.calledWith(1), true);
+    assert.strictEqual(handlerCalled, true);
+  });
+
+  it('calls getSelectedMcpPage for page scoped tools when pageIdRouting is disabled', async () => {
+    let handlerCalled = false;
+    const tool: DefinedPageTool = {
+      name: 'page_tool',
+      description: 'A page scoped tool',
+      annotations: {
+        category: ToolCategory.INPUT,
+        readOnlyHint: false,
+      },
+      schema: {},
+      blockedByDialog: false,
+      verifyFilesSchema: {},
+      pageScoped: true,
+      handler: async () => {
+        handlerCalled = true;
+      },
+    };
+
+    const mockContext = sinon.createStubInstance(McpContext);
+    const mockProcess = sinon.createStubInstance(ChildProcess);
+    mockContext.browser = getMockBrowser({process: mockProcess});
+    const mockPage = sinon.createStubInstance(McpPage);
+    mockContext.getSelectedMcpPage.returns(mockPage);
+
+    const toolMutex = new Mutex();
+    const serverArgs = parseArguments(
+      '1.0.0',
+      ['node', 'script.js', '--no-page-id-routing'],
+      {CHROME_DEVTOOLS_MCP_NO_USAGE_STATISTICS: 'true'},
+    );
+
+    const toolHandler = new ToolHandler(
+      tool,
+      serverArgs,
+      async () => mockContext,
+      toolMutex,
+    );
+
     assert.strictEqual(toolHandler.shouldRegister, true);
     await toolHandler.handle({});
 
@@ -114,13 +162,13 @@ describe('ToolHandler', () => {
     const result = await toolHandler.handle({});
 
     assert.strictEqual(mockContext.getDevToolsData.calledOnce, true);
-    assert.strictEqual(mockContext.getSelectedMcpPage.calledOnce, true);
+    assert.strictEqual(mockContext.getSelectedMcpPageUrl.calledOnce, true);
     assert.strictEqual(mockContext.getPageById.called, false);
     assert.strictEqual(handlerCalled, true);
     assert.strictEqual(result.isError, undefined);
   });
 
-  it('appends correct context to tool call logs', async () => {
+  it('passes devToolsData and pageUrl to logger', async () => {
     const baseTool: ToolDefinition = {
       name: 'test_tool',
       description: 'A test tool',
@@ -138,9 +186,8 @@ describe('ToolHandler', () => {
 
     const testCases: Array<{
       tool: ToolDefinition | DefinedPageTool;
-      devToolsData: Record<string, unknown>;
+      devToolsData: DevToolsData;
       pageUrl?: string;
-      expectedContext: Record<string, unknown>;
     }> = [
       {
         tool: {
@@ -150,13 +197,6 @@ describe('ToolHandler', () => {
         },
         devToolsData: {cdpBackendNodeId: 1},
         pageUrl: 'http://localhost:9222/',
-        expectedContext: {
-          is_devtools_open: true,
-          is_localhost: true,
-          devtools_data: {
-            is_dom_element_selected: true,
-          },
-        },
       },
       {
         tool: {
@@ -165,9 +205,6 @@ describe('ToolHandler', () => {
         },
         devToolsData: {},
         pageUrl: undefined,
-        expectedContext: {
-          is_devtools_open: false,
-        },
       },
     ];
 
@@ -182,13 +219,7 @@ describe('ToolHandler', () => {
       mockContext.browser = getMockBrowser({process: mockProcess});
       mockContext.getDevToolsData.resolves(testCase.devToolsData);
       if (testCase.pageUrl) {
-        const mockPage = {
-          pptrPage: {
-            isClosed: () => false,
-            url: () => testCase.pageUrl,
-          },
-        } as unknown as McpPage;
-        mockContext.getSelectedMcpPage.returns(mockPage);
+        mockContext.getSelectedMcpPageUrl.returns(testCase.pageUrl);
       }
 
       const logSpy = sinon.spy();
@@ -212,9 +243,10 @@ describe('ToolHandler', () => {
 
       assert.strictEqual(logSpy.calledOnce, true);
       assert.deepStrictEqual(
-        logSpy.firstCall.args[0].context,
-        testCase.expectedContext,
+        logSpy.firstCall.args[0].devToolsData,
+        testCase.devToolsData,
       );
+      assert.strictEqual(logSpy.firstCall.args[0].pageUrl, testCase.pageUrl);
       assert.strictEqual(handlerCalled, true);
 
       sinon.restore();
@@ -314,6 +346,124 @@ describe('ToolHandler', () => {
     assert.strictEqual(handlerCalled, false);
   });
 
+  it('registers evaluate_script by default and disables it when javascriptEvaluation is false', async () => {
+    const mockContext = sinon.createStubInstance(McpContext);
+    const toolMutex = new Mutex();
+
+    const defaultServerArgs = parseArguments('1.0.0', ['node', 'script.js'], {
+      CHROME_DEVTOOLS_MCP_NO_USAGE_STATISTICS: 'true',
+    });
+    const defaultTool = createTools(defaultServerArgs).find(
+      t => t.name === 'evaluate_script',
+    );
+    if (!defaultTool) {
+      assert.fail('evaluate_script not found');
+    }
+    const defaultHandler = new ToolHandler(
+      defaultTool,
+      defaultServerArgs,
+      async () => mockContext,
+      toolMutex,
+    );
+    assert.strictEqual(defaultHandler.shouldRegister, true);
+
+    const disabledServerArgs = parseArguments(
+      '1.0.0',
+      ['node', 'script.js', '--no-javascript-evaluation'],
+      {CHROME_DEVTOOLS_MCP_NO_USAGE_STATISTICS: 'true'},
+    );
+    const disabledTool = createTools(disabledServerArgs).find(
+      t => t.name === 'evaluate_script',
+    );
+    if (!disabledTool) {
+      assert.fail('evaluate_script not found');
+    }
+    const disabledHandler = new ToolHandler(
+      disabledTool,
+      disabledServerArgs,
+      async () => mockContext,
+      toolMutex,
+    );
+    assert.strictEqual(disabledHandler.shouldRegister, false);
+
+    const disabledResult = await disabledHandler.handle({function: '() => 1'});
+    assert.strictEqual(disabledResult.isError, true);
+    assert.match(
+      disabledResult.content[0].type === 'text'
+        ? disabledResult.content[0].text
+        : '',
+      /Tool evaluate_script requires flag --javascriptEvaluation and is currently disabled/,
+    );
+
+    const cliServerArgs = parseArguments(
+      '1.0.0',
+      ['node', 'script.js', '--no-javascript-evaluation', '--viaCli'],
+      {CHROME_DEVTOOLS_MCP_NO_USAGE_STATISTICS: 'true'},
+    );
+    const cliTool = createTools(cliServerArgs).find(
+      t => t.name === 'evaluate_script',
+    );
+    if (!cliTool) {
+      assert.fail('evaluate_script not found');
+    }
+    const cliHandler = new ToolHandler(
+      cliTool,
+      cliServerArgs,
+      async () => mockContext,
+      toolMutex,
+    );
+    assert.strictEqual(cliHandler.shouldRegister, true);
+    const cliResult = await cliHandler.handle({function: '() => 1'});
+    assert.strictEqual(cliResult.isError, true);
+    assert.match(
+      cliResult.content[0].type === 'text' ? cliResult.content[0].text : '',
+      /Tool evaluate_script requires flag --javascriptEvaluation and is currently disabled/,
+    );
+  });
+
+  it('disables slim evaluate tool when javascriptEvaluation is false', async () => {
+    const mockContext = sinon.createStubInstance(McpContext);
+    const toolMutex = new Mutex();
+
+    const defaultServerArgs = parseArguments(
+      '1.0.0',
+      ['node', 'script.js', '--slim'],
+      {CHROME_DEVTOOLS_MCP_NO_USAGE_STATISTICS: 'true'},
+    );
+    const defaultTool = createTools(defaultServerArgs).find(
+      t => t.name === 'evaluate',
+    );
+    if (!defaultTool) {
+      assert.fail('evaluate not found');
+    }
+    const defaultHandler = new ToolHandler(
+      defaultTool,
+      defaultServerArgs,
+      async () => mockContext,
+      toolMutex,
+    );
+    assert.strictEqual(defaultHandler.shouldRegister, true);
+
+    const disabledServerArgs = parseArguments(
+      '1.0.0',
+      ['node', 'script.js', '--slim', '--javascriptEvaluation=false'],
+      {CHROME_DEVTOOLS_MCP_NO_USAGE_STATISTICS: 'true'},
+    );
+    const disabledTool = createTools(disabledServerArgs).find(
+      t => t.name === 'evaluate',
+    );
+    if (!disabledTool) {
+      assert.fail('evaluate not found');
+    }
+    const disabledHandler = new ToolHandler(
+      disabledTool,
+      disabledServerArgs,
+      async () => mockContext,
+      toolMutex,
+    );
+    assert.strictEqual(disabledHandler.shouldRegister, false);
+  });
+
   it('applies the redactNetworkHeaders flag to the response', async () => {
     const tool: ToolDefinition = {
       name: 'global_tool',
@@ -506,8 +656,9 @@ describe('ToolHandler', () => {
     });
   });
 
-  it('validates files specified in verifyFilesSchema', async () => {
+  it('validates files specified in verifyFilesSchema and rewrites input with validated paths/URLs', async () => {
     let handlerCalled = false;
+    let receivedParams: Record<string, unknown> | undefined;
     const tool: ToolDefinition = {
       name: 'file_tool',
       description: 'A tool requiring file validation',
@@ -524,15 +675,24 @@ describe('ToolHandler', () => {
         filePath: true,
         fileList: true,
       },
-      handler: async () => {
+      handler: async request => {
         handlerCalled = true;
+        receivedParams = request.params;
       },
     };
 
     const mockContext = sinon.createStubInstance(McpContext);
     const mockProcess = sinon.createStubInstance(ChildProcess);
     mockContext.browser = getMockBrowser({process: mockProcess});
-    mockContext.validatePath.resolves();
+    mockContext.validatePath.callsFake(async p => {
+      if (!p) {
+        return undefined;
+      }
+      return path.resolve(
+        '/canonical',
+        path.relative(path.resolve('/workspace'), p),
+      );
+    });
 
     const toolMutex = new Mutex();
     const serverArgs = parseArguments('1.0.0', ['node', 'script.js'], {
@@ -572,6 +732,14 @@ describe('ToolHandler', () => {
       mockContext.validatePath.calledWith(testListFile2),
       true,
     );
+    assert.deepStrictEqual(receivedParams, {
+      filePath: pathToFileURL(path.resolve('/canonical/url-file.txt')).href,
+      fileList: [
+        path.resolve('/canonical/list1.txt'),
+        path.resolve('/canonical/list2.txt'),
+        'https://example.com/remote.txt',
+      ],
+    });
   });
 
   it('returns error when file validation fails for verifyFilesSchema', async () => {
@@ -628,6 +796,7 @@ describe('ToolHandler', () => {
 
   it('validates verifyFilesSchema when local: true and browser is running locally via process', async () => {
     let handlerCalled = false;
+    let receivedParams: Record<string, unknown> | undefined;
     const tool: ToolDefinition = {
       name: 'upload_tool',
       description: 'A tool with local-only file verification',
@@ -645,15 +814,17 @@ describe('ToolHandler', () => {
           remote: false,
         },
       },
-      handler: async () => {
+      handler: async request => {
         handlerCalled = true;
+        receivedParams = request.params;
       },
     };
 
     const mockContext = sinon.createStubInstance(McpContext);
     const mockProcess = sinon.createStubInstance(ChildProcess);
     mockContext.browser = getMockBrowser({process: mockProcess});
-    mockContext.validatePath.resolves();
+    const canonicalPath = path.resolve('/canonical/workspace/upload.png');
+    mockContext.validatePath.resolves(canonicalPath);
 
     const toolMutex = new Mutex();
     const serverArgs = parseArguments('1.0.0', ['node', 'script.js'], {
@@ -675,10 +846,14 @@ describe('ToolHandler', () => {
     assert.strictEqual(result.isError, undefined);
     assert.strictEqual(handlerCalled, true);
     assert.strictEqual(mockContext.validatePath.calledOnceWith(testPath), true);
+    assert.deepStrictEqual(receivedParams, {
+      filePaths: [canonicalPath],
+    });
   });
 
   it('validates verifyFilesSchema when local: true and browser is connected to localhost wsEndpoint', async () => {
     let handlerCalled = false;
+    let receivedParams: Record<string, unknown> | undefined;
     const tool: ToolDefinition = {
       name: 'install_pwa_tool',
       description: 'PWA tool with local-only file verification',
@@ -695,8 +870,9 @@ describe('ToolHandler', () => {
           local: true,
         },
       },
-      handler: async () => {
+      handler: async request => {
         handlerCalled = true;
+        receivedParams = request.params;
       },
     };
 
@@ -704,7 +880,8 @@ describe('ToolHandler', () => {
     mockContext.browser = getMockBrowser({
       wsEndpoint: 'ws://127.0.0.1:9222/devtools/browser/test',
     });
-    mockContext.validatePath.resolves();
+    const canonicalBundlePath = path.resolve('/canonical/workspace/app.swbn');
+    mockContext.validatePath.resolves(canonicalBundlePath);
 
     const toolMutex = new Mutex();
     const serverArgs = parseArguments('1.0.0', ['node', 'script.js'], {
@@ -730,10 +907,14 @@ describe('ToolHandler', () => {
       mockContext.validatePath.calledOnceWith(bundlePath),
       true,
     );
+    assert.deepStrictEqual(receivedParams, {
+      installUrlOrBundleUrl: pathToFileURL(canonicalBundlePath).href,
+    });
   });
 
   it('skips local-only verifyFilesSchema when browser is remote', async () => {
     let handlerCalled = false;
+    let receivedParams: Record<string, unknown> | undefined;
     const tool: ToolDefinition = {
       name: 'upload_tool',
       description: 'A tool with local-only file verification',
@@ -751,8 +932,9 @@ describe('ToolHandler', () => {
           remote: false,
         },
       },
-      handler: async () => {
+      handler: async request => {
         handlerCalled = true;
+        receivedParams = request.params;
       },
     };
 
@@ -780,6 +962,9 @@ describe('ToolHandler', () => {
     assert.strictEqual(result.isError, undefined);
     assert.strictEqual(handlerCalled, true);
     assert.strictEqual(mockContext.validatePath.called, false);
+    assert.deepStrictEqual(receivedParams, {
+      filePaths: ['/remote/server/path.txt'],
+    });
   });
 
   it('skips local-only verifyFilesSchema when browser has no process', async () => {
@@ -879,6 +1064,7 @@ describe('ToolHandler', () => {
 
   it('validates verifyFilesSchema with true but skips local: true on remote browser', async () => {
     let handlerCalled = false;
+    let receivedParams: Record<string, unknown> | undefined;
     const tool: ToolDefinition = {
       name: 'hybrid_tool',
       description: 'A tool with both schema file verifications',
@@ -898,8 +1084,9 @@ describe('ToolHandler', () => {
           remote: false,
         },
       },
-      handler: async () => {
+      handler: async request => {
         handlerCalled = true;
+        receivedParams = request.params;
       },
     };
 
@@ -907,7 +1094,8 @@ describe('ToolHandler', () => {
     mockContext.browser = getMockBrowser({
       wsEndpoint: 'ws://remote-host.com:9222/devtools/browser/test',
     });
-    mockContext.validatePath.resolves();
+    const canonicalOutputPath = path.resolve('/canonical/output.json');
+    mockContext.validatePath.resolves(canonicalOutputPath);
 
     const toolMutex = new Mutex();
     const serverArgs = parseArguments('1.0.0', ['node', 'script.js'], {
@@ -933,6 +1121,10 @@ describe('ToolHandler', () => {
       mockContext.validatePath.calledOnceWith(outputPath),
       true,
     );
+    assert.deepStrictEqual(receivedParams, {
+      outputFile: canonicalOutputPath,
+      inputFile: '/remote/input.json',
+    });
   });
 
   it('returns error when file validation fails for local: true on local browser', async () => {
@@ -1054,4 +1246,69 @@ describe('ToolHandler', () => {
     await localToolHandler.handle({remoteFile: remotePath});
     assert.strictEqual(mockLocalContext.validatePath.called, false);
   });
+
+  it('rewrites file paths in params for page scoped tools', async () => {
+    let receivedParams: Record<string, unknown> | undefined;
+    const tool: DefinedPageTool = {
+      name: 'page_file_tool',
+      description: 'A page scoped tool with file verification',
+      annotations: {
+        category: ToolCategory.DEBUGGING,
+        readOnlyHint: false,
+      },
+      schema: {
+        filePath: zod.string(),
+      },
+      blockedByDialog: false,
+      verifyFilesSchema: {
+        filePath: true,
+      },
+      pageScoped: true,
+      handler: async request => {
+        receivedParams = request.params;
+      },
+    };
+
+    const mockContext = sinon.createStubInstance(McpContext);
+    const mockProcess = sinon.createStubInstance(ChildProcess);
+    mockContext.browser = getMockBrowser({process: mockProcess});
+    mockContext.getDevToolsData.resolves({});
+    const mockPage = sinon.createStubInstance(McpPage);
+    mockPage.getDialog.returns(undefined);
+    sinon.stub(mockPage, 'networkConditions').get(() => undefined);
+    sinon.stub(mockPage, 'geolocation').get(() => undefined);
+    sinon.stub(mockPage, 'viewport').get(() => undefined);
+    sinon.stub(mockPage, 'userAgent').get(() => undefined);
+    sinon.stub(mockPage, 'colorScheme').get(() => undefined);
+    sinon.stub(mockPage, 'cpuThrottlingRate').get(() => 1);
+    mockContext.getSelectedMcpPage.returns(mockPage);
+    const canonicalFilePath = path.resolve('/canonical/output.png');
+    mockContext.validatePath.resolves(canonicalFilePath);
+
+    const toolMutex = new Mutex();
+    const serverArgs = parseArguments('1.0.0', ['node', 'script.js'], {
+      CHROME_DEVTOOLS_MCP_NO_USAGE_STATISTICS: 'true',
+    });
+
+    const toolHandler = new ToolHandler(
+      tool,
+      serverArgs,
+      async () => mockContext,
+      toolMutex,
+    );
+
+    const inputPath = path.resolve('/workspace/output.png');
+    const result = await toolHandler.handle({
+      filePath: inputPath,
+    });
+
+    assert.strictEqual(result.isError, undefined);
+    assert.strictEqual(
+      mockContext.validatePath.calledOnceWith(inputPath),
+      true,
+    );
+    assert.deepStrictEqual(receivedParams, {
+      filePath: canonicalFilePath,
+    });
+  });
 });
diff --git a/tests/browser.test.ts b/tests/browser.test.ts
index 69245781..191c2ffa 100644
--- a/tests/browser.test.ts
+++ b/tests/browser.test.ts
@@ -11,7 +11,12 @@ import {describe, it} from 'node:test';
 
 import {executablePath} from 'puppeteer';
 
-import {detectDisplay, ensureBrowserConnected, launch} from '../src/browser.js';
+import {
+  detectDisplay,
+  ensureBrowserConnected,
+  launch,
+  makeTargetFilter,
+} from '../src/browser.js';
 import type {Browser} from '../src/third_party/index.js';
 
 import {serverHooks} from './server.js';
@@ -244,4 +249,67 @@ describe('browser', () => {
       });
     });
   });
+
+  describe('makeTargetFilter', () => {
+    it('filters internal chrome and extension targets', () => {
+      const filterWithoutExtensions = makeTargetFilter(false);
+      const filterWithExtensions = makeTargetFilter(true);
+
+      const mockTarget = (url: string) => ({
+        url: () => url,
+      });
+
+      // Newtab and inspect allowances
+      assert.strictEqual(
+        filterWithoutExtensions(mockTarget('chrome://newtab/')),
+        true,
+      );
+      assert.strictEqual(
+        filterWithoutExtensions(mockTarget('chrome://inspect')),
+        true,
+      );
+      assert.strictEqual(
+        filterWithoutExtensions(mockTarget('chrome://inspect/#devices')),
+        true,
+      );
+
+      // Disallowed internal schemes
+      assert.strictEqual(
+        filterWithoutExtensions(mockTarget('chrome://settings')),
+        false,
+      );
+      assert.strictEqual(
+        filterWithoutExtensions(mockTarget('chrome://version')),
+        false,
+      );
+      assert.strictEqual(
+        filterWithoutExtensions(mockTarget('chrome-untrusted://terminal')),
+        false,
+      );
+
+      // Extensions toggle
+      assert.strictEqual(
+        filterWithoutExtensions(
+          mockTarget('chrome-extension://abcdef/popup.html'),
+        ),
+        false,
+      );
+      assert.strictEqual(
+        filterWithExtensions(
+          mockTarget('chrome-extension://abcdef/popup.html'),
+        ),
+        true,
+      );
+
+      // Web URLs
+      assert.strictEqual(
+        filterWithoutExtensions(mockTarget('https://example.com')),
+        true,
+      );
+      assert.strictEqual(
+        filterWithoutExtensions(mockTarget('about:blank')),
+        true,
+      );
+    });
+  });
 });
diff --git a/tests/cli.test.ts b/tests/cli.test.ts
index e453cda9..1e3fa55e 100644
--- a/tests/cli.test.ts
+++ b/tests/cli.test.ts
@@ -8,8 +8,15 @@
 
 import assert from 'node:assert';
 import {describe, it} from 'node:test';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
 
-import {parser} from '../src/bin/chrome-devtools-mcp-cli-options.js';
+import {
+  DEFAULT_FILESYSTEM_ROOT,
+  mcpOptions,
+  parser,
+} from '../src/config/mcp-options.js';
 
 function parseArguments(argv: string[], env: NodeJS.ProcessEnv = {}) {
   return parser('0.0.0', ['node', 'main.js', ...argv], env)
@@ -17,28 +24,43 @@ function parseArguments(argv: string[], env: NodeJS.ProcessEnv = {}) {
     .parseSync();
 }
 
+function createTempFile(content: string, fileName: string) {
+  const filePath = path.join(os.tmpdir(), fileName);
+  fs.writeFileSync(filePath, content);
+  return {
+    path: filePath,
+    [Symbol.dispose]() {
+      try {
+        fs.unlinkSync(filePath);
+      } catch {
+        // ignore
+      }
+    },
+  };
+}
+
 describe('cli args parsing', () => {
   const defaultArgs = {
-    'category-emulation': true,
+    categoryInput: true,
+    categoryNavigation: true,
     categoryEmulation: true,
-    'category-performance': true,
     categoryPerformance: true,
-    'category-network': true,
     categoryNetwork: true,
-    'category-extensions': false,
-    categoryExtensions: false,
-    'category-experimental-third-party': false,
-    categoryExperimentalThirdParty: false,
-    'auto-connect': undefined,
+    categoryDebugging: true,
+    categoryMemory: true,
+    categoryOpera: true,
     autoConnect: undefined,
-    'performance-crux': false,
     performanceCrux: false,
-    'usage-statistics': false,
     usageStatistics: false,
-    'redact-network-headers': false,
+    javascriptEvaluation: true,
     redactNetworkHeaders: false,
-    'allow-unrestricted-paths': false,
     allowUnrestrictedPaths: false,
+    filesystemRoot: DEFAULT_FILESYSTEM_ROOT,
+    memoryDebugging: false,
+    experimentalStructuredContent: false,
+    pageIdRouting: true,
+    sourceMaps: true,
+    devtoolsComments: false,
   };
 
   it('parses with default args', async () => {
@@ -52,6 +74,16 @@ describe('cli args parsing', () => {
     });
   });
 
+  it('parses with viaCli args', async () => {
+    const args = parseArguments(['--viaCli']);
+    assert.strictEqual(args.allowUnrestrictedPaths, true);
+    assert.strictEqual(args.headless, true);
+    assert.strictEqual(args.memoryDebugging, true);
+    assert.strictEqual(args.categoryExtensions, true);
+    assert.strictEqual(args.experimentalStructuredContent, true);
+    assert.strictEqual(args.viaCli, true);
+  });
+
   it('parses with browser url', async () => {
     const args = parseArguments(['--browserUrl', 'http://localhost:3000']);
     assert.deepStrictEqual(args, {
@@ -59,17 +91,22 @@ describe('cli args parsing', () => {
       _: [],
       headless: false,
       $0: 'npx opera-devtools-mcp@latest',
-      'browser-url': 'http://localhost:3000',
       browserUrl: 'http://localhost:3000',
-      u: 'http://localhost:3000',
     });
   });
 
   it('rejects unknown options', async () => {
-    assert.throws(
-      () => parseArguments(['--browserURL', 'http://localhost:3000']),
-      /Unknown argument: browserURL/,
-    );
+    let output = '';
+    const originalError = console.error;
+    console.error = (msg: string) => {
+      output += msg;
+    };
+    try {
+      parseArguments(['--browserURL', 'http://localhost:3000']);
+      assert.match(output, /Unknown arguments: --browserURL/);
+    } finally {
+      console.error = originalError;
+    }
   });
 
   it('parses mixed-form option names', async () => {
@@ -86,7 +123,6 @@ describe('cli args parsing', () => {
       headless: false,
       $0: 'npx opera-devtools-mcp@latest',
       channel: 'stable',
-      'user-data-dir': '/tmp/chrome-profile',
       userDataDir: '/tmp/chrome-profile',
     });
   });
@@ -98,9 +134,7 @@ describe('cli args parsing', () => {
       _: [],
       headless: false,
       $0: 'npx opera-devtools-mcp@latest',
-      'browser-url': undefined,
       browserUrl: undefined,
-      u: undefined,
       channel: 'stable',
     });
   });
@@ -112,8 +146,6 @@ describe('cli args parsing', () => {
       _: [],
       headless: false,
       $0: 'npx opera-devtools-mcp@latest',
-      'executable-path': '/tmp/test 123/chrome',
-      e: '/tmp/test 123/chrome',
       executablePath: '/tmp/test 123/chrome',
     });
   });
@@ -144,11 +176,50 @@ describe('cli args parsing', () => {
       headless: false,
       $0: 'npx opera-devtools-mcp@latest',
       channel: 'stable',
-      'chrome-arg': ['--no-sandbox', '--disable-setuid-sandbox'],
       chromeArg: ['--no-sandbox', '--disable-setuid-sandbox'],
     });
   });
 
+  describe('filesystem roots', () => {
+    it('parses filesystem roots', async () => {
+      const args = parseArguments([
+        '--filesystem-root=/tmp/one',
+        '--filesystem-root=/tmp/two',
+      ]);
+      assert.deepStrictEqual(args.filesystemRoot, ['/tmp/one', '/tmp/two']);
+    });
+
+    it('parses workspace as an alias for filesystem roots', async () => {
+      const args = parseArguments([
+        '--workspace=/tmp/one',
+        '--workspace=/tmp/two',
+      ]);
+      assert.deepStrictEqual(args.filesystemRoot, ['/tmp/one', '/tmp/two']);
+    });
+
+    it('still accepts unrestricted paths without an explicit root', async () => {
+      const args = parseArguments(['--allow-unrestricted-paths']);
+      assert.strictEqual(args.allowUnrestrictedPaths, true);
+    });
+
+    it('lets an explicit workspace override the CLI unrestricted default', async () => {
+      const args = parseArguments(['--viaCli', '--workspace=/tmp/one']);
+      assert.strictEqual(args.allowUnrestrictedPaths, false);
+      assert.deepStrictEqual(args.filesystemRoot, ['/tmp/one']);
+    });
+
+    it('keeps the CLI unrestricted default when no workspace is set', async () => {
+      const args = parseArguments(['--viaCli']);
+      assert.strictEqual(args.allowUnrestrictedPaths, true);
+      assert.strictEqual(args.filesystemRoot, undefined);
+    });
+
+    it('uses yargs default identity to detect an unset CLI workspace', async () => {
+      const args = parseArguments([]);
+      assert.strictEqual(args.filesystemRoot, DEFAULT_FILESYSTEM_ROOT);
+    });
+  });
+
   it('parses ignore chrome args', async () => {
     const args = parseArguments([
       `--ignore-default-chrome-arg='--disable-extensions'`,
@@ -160,10 +231,6 @@ describe('cli args parsing', () => {
       headless: false,
       $0: 'npx opera-devtools-mcp@latest',
       channel: 'stable',
-      'ignore-default-chrome-arg': [
-        '--disable-extensions',
-        '--disable-cancel-all-touches',
-      ],
       ignoreDefaultChromeArg: [
         '--disable-extensions',
         '--disable-cancel-all-touches',
@@ -181,9 +248,7 @@ describe('cli args parsing', () => {
       _: [],
       headless: false,
       $0: 'npx opera-devtools-mcp@latest',
-      'ws-endpoint': 'ws://127.0.0.1:9222/devtools/browser/abc123',
       wsEndpoint: 'ws://127.0.0.1:9222/devtools/browser/abc123',
-      w: 'ws://127.0.0.1:9222/devtools/browser/abc123',
     });
   });
 
@@ -197,9 +262,7 @@ describe('cli args parsing', () => {
       _: [],
       headless: false,
       $0: 'npx opera-devtools-mcp@latest',
-      'ws-endpoint': 'wss://example.com:9222/devtools/browser/abc123',
       wsEndpoint: 'wss://example.com:9222/devtools/browser/abc123',
-      w: 'wss://example.com:9222/devtools/browser/abc123',
     });
   });
 
@@ -224,7 +287,6 @@ describe('cli args parsing', () => {
       headless: false,
       $0: 'npx opera-devtools-mcp@latest',
       channel: 'stable',
-      'category-emulation': false,
       categoryEmulation: false,
     });
   });
@@ -236,11 +298,25 @@ describe('cli args parsing', () => {
       headless: false,
       $0: 'npx opera-devtools-mcp@latest',
       channel: 'stable',
-      'auto-connect': true,
       autoConnect: true,
     });
   });
 
+  it('rejects invalid screencast fps values', async () => {
+    const coerce = mcpOptions.experimentalScreencastFps.coerce;
+    assert.ok(coerce);
+
+    assert.strictEqual(coerce(undefined), undefined);
+    assert.strictEqual(coerce(10), 10);
+
+    for (const value of [0, -1, 10.5, Number.NaN]) {
+      assert.throws(
+        () => coerce(value),
+        /Invalid experimentalScreencastFps .* Expected a positive integer\./,
+      );
+    }
+  });
+
   it('parses usage statistics flag', async () => {
     // Default is false (opera opts out of telemetry by default).
     const defaultArgs = parseArguments([]);
@@ -255,6 +331,20 @@ describe('cli args parsing', () => {
     assert.strictEqual(disabledArgs.usageStatistics, false);
   });
 
+  it('parses javascript evaluation flag', async () => {
+    // Test default (should be true).
+    const defaultArgs = parseArguments(['main.js'], {});
+    assert.strictEqual(defaultArgs.javascriptEvaluation, true);
+
+    // Test enabling it
+    const enabledArgs = parseArguments(['--javascript-evaluation']);
+    assert.strictEqual(enabledArgs.javascriptEvaluation, true);
+
+    // Test disabling it
+    const disabledArgs = parseArguments(['--no-javascript-evaluation']);
+    assert.strictEqual(disabledArgs.javascriptEvaluation, false);
+  });
+
   it('respects env variable', async () => {
     // Test default (should be true).
     // Test default (should be true).
@@ -349,4 +439,88 @@ describe('cli args parsing', () => {
       'https://b.com/*',
     ]);
   });
+
+  it('parses source-maps flag', async () => {
+    const defaultParsed = parseArguments(['main.js']);
+    assert.strictEqual(defaultParsed.sourceMaps, true);
+
+    const disabledArgs = parseArguments(['--no-source-maps']);
+    assert.strictEqual(disabledArgs.sourceMaps, false);
+
+    const explicitFalseArgs = parseArguments(['--source-maps=false']);
+    assert.strictEqual(explicitFalseArgs.sourceMaps, false);
+
+    const explicitTrueArgs = parseArguments(['--source-maps=true']);
+    assert.strictEqual(explicitTrueArgs.sourceMaps, true);
+  });
+
+  it('parses config option', async () => {
+    using testConfig = createTempFile(
+      JSON.stringify({
+        headless: true,
+        categoryInput: false,
+        blockedUrlPattern: ['https://example.com/*'],
+      }),
+      'cd4a.test.config.json',
+    );
+    const args = parseArguments(['--config', testConfig.path]);
+    assert.strictEqual(args.config, testConfig.path);
+    assert.strictEqual(args.headless, true);
+    assert.strictEqual(args.categoryInput, false);
+    assert.deepStrictEqual(args.blockedUrlPattern, ['https://example.com/*']);
+  });
+
+  it('parses config option mixed with cli arguments', async () => {
+    using testConfig = createTempFile(
+      JSON.stringify({
+        headless: true,
+        categoryInput: false,
+      }),
+      'cd4a.test.config.mixed.json',
+    );
+    const args = parseArguments([
+      '--config',
+      testConfig.path,
+      '--headless=false',
+      '--category-network=false',
+    ]);
+    assert.strictEqual(args.config, testConfig.path);
+    assert.strictEqual(args.headless, false);
+    assert.strictEqual(args.categoryInput, false);
+    assert.strictEqual(args.categoryNetwork, false);
+    assert.strictEqual(args.categoryMemory, true);
+  });
+
+  it('parses config should not allow no prefix', async () => {
+    using testConfig = createTempFile(
+      JSON.stringify({
+        headless: true,
+        'no-category-memory': true,
+      }),
+      'cd4a.test.config.mixed.json',
+    );
+    assert.throws(
+      () => parseArguments(['--config', testConfig.path]),
+      /Invalid JSON config file: Unknown argument: no-category-memory/,
+    );
+  });
+
+  it('parses config should not allow dashed property', async () => {
+    using testConfig = createTempFile(
+      JSON.stringify({
+        headless: true,
+        'category-memory': false,
+      }),
+      'cd4a.test.config.mixed.json',
+    );
+    assert.throws(
+      () => parseArguments(['--config', testConfig.path]),
+      /Invalid JSON config file: Unknown argument: category-memory/,
+    );
+  });
+
+  it('parses with devtoolsComments enabled', async () => {
+    const args = parseArguments(['--devtoolsComments']);
+    assert.strictEqual(args.devtoolsComments, true);
+  });
 });
diff --git a/tests/daemon/client.test.ts b/tests/daemon/client.test.ts
index c995c9de..89461b92 100644
--- a/tests/daemon/client.test.ts
+++ b/tests/daemon/client.test.ts
@@ -126,13 +126,24 @@ describe('daemon client', () => {
       );
     });
 
-    it('handles error response when isError is true', async () => {
+    it('handles error response when isError is true with md format', async () => {
       const errorResponse = {
         isError: true,
         content: [{type: 'text' as const, text: 'Something went wrong'}],
       };
       assert.strictEqual(
         await handleResponse(errorResponse, 'md'),
+        'Something went wrong',
+      );
+    });
+
+    it('handles error response when isError is true with json format', async () => {
+      const errorResponse = {
+        isError: true,
+        content: [{type: 'text' as const, text: 'Something went wrong'}],
+      };
+      assert.strictEqual(
+        await handleResponse(errorResponse, 'json'),
         JSON.stringify(errorResponse.content),
       );
     });
diff --git a/tests/daemon/utils.test.ts b/tests/daemon/utils.test.ts
index 7a8e5101..07cf6003 100644
--- a/tests/daemon/utils.test.ts
+++ b/tests/daemon/utils.test.ts
@@ -13,7 +13,7 @@ import path from 'node:path';
 import process from 'node:process';
 import {afterEach, beforeEach, describe, it} from 'node:test';
 
-import type {ParsedArguments} from '../../src/bin/chrome-devtools-mcp-cli-options.js';
+import type {ParsedArguments} from '../../src/config/mcp-options.js';
 import {
   serializeArgs,
   assertValidSessionId,
diff --git a/tests/devtools/DevtoolsUtils.test.ts b/tests/devtools/DevtoolsUtils.test.ts
index 4be3f42e..f225cebb 100644
--- a/tests/devtools/DevtoolsUtils.test.ts
+++ b/tests/devtools/DevtoolsUtils.test.ts
@@ -100,6 +100,103 @@ describe('createTargetUniverse', () => {
       sinon.assert.notCalled(requestStartedSpy);
     });
   });
+
+  it('does not replay retained Audits issues', async () => {
+    server.addHtmlRoute('/audits', html`<div>Audits</div>`);
+
+    await withBrowser(async (browser, page) => {
+      await page.goto(server.getRoute('/audits'));
+
+      const auditsSession = await page.createCDPSession();
+      await auditsSession.send('Audits.enable');
+
+      const backlogCreated = Promise.withResolvers<void>();
+      let performanceIssueCount = 0;
+      auditsSession.on('Audits.issueAdded', event => {
+        if (
+          event.issue.code === 'PerformanceIssue' &&
+          event.issue.details.performanceIssueDetails?.performanceIssueType ===
+            'DocumentCookie'
+        ) {
+          performanceIssueCount++;
+          if (performanceIssueCount === 500) {
+            backlogCreated.resolve();
+          }
+        }
+      });
+
+      await page.evaluate(() => {
+        document.cookie = 'test=value';
+        for (let i = 0; i < 500; i++) {
+          void document.cookie;
+        }
+      });
+
+      await backlogCreated.promise;
+      assert.strictEqual(performanceIssueCount, 500);
+      await auditsSession.detach();
+
+      const warnStub = sinon.stub(console, 'warn');
+      const targetUniverse = await createTargetUniverse(
+        await page.createCDPSession(),
+      );
+
+      assert.ok(targetUniverse.target.model(DevTools.DebuggerModel));
+      assert.strictEqual(await page.evaluate('1 + 1'), 2);
+      await targetUniverse.session.send('Runtime.evaluate', {
+        expression: '1 + 1',
+      });
+      sinon.assert.neverCalledWithMatch(
+        warnStub,
+        'No handler registered for issue code PerformanceIssue',
+      );
+    });
+  });
+
+  it('enables source maps by default', async () => {
+    await withBrowser(async (browser, page) => {
+      const targetUniverse = await createTargetUniverse(
+        await page.createCDPSession(),
+      );
+      assert.ok(targetUniverse);
+
+      assert.strictEqual(
+        targetUniverse.universe.settings
+          .resolve(DevTools.SDKSettings.jsSourceMapsEnabledSettingDescriptor)
+          .get(),
+        true,
+      );
+      assert.strictEqual(
+        targetUniverse.universe.settings
+          .resolve(DevTools.SDKSettings.cssSourceMapsEnabledSettingDescriptor)
+          .get(),
+        true,
+      );
+    });
+  });
+
+  it('disables source maps when sourceMaps is false', async () => {
+    await withBrowser(async (browser, page) => {
+      const targetUniverse = await createTargetUniverse(
+        await page.createCDPSession(),
+        {sourceMaps: false},
+      );
+      assert.ok(targetUniverse);
+
+      assert.strictEqual(
+        targetUniverse.universe.settings
+          .resolve(DevTools.SDKSettings.jsSourceMapsEnabledSettingDescriptor)
+          .get(),
+        false,
+      );
+      assert.strictEqual(
+        targetUniverse.universe.settings
+          .resolve(DevTools.SDKSettings.cssSourceMapsEnabledSettingDescriptor)
+          .get(),
+        false,
+      );
+    });
+  });
 });
 
 describe('SymbolizedError', () => {
diff --git a/tests/e2e/opera-devtools-commands.test.ts b/tests/e2e/opera-devtools-commands.test.ts
index 04fb8501..4ea2cef9 100644
--- a/tests/e2e/opera-devtools-commands.test.ts
+++ b/tests/e2e/opera-devtools-commands.test.ts
@@ -60,7 +60,7 @@ describe('opera-devtools', () => {
       `start command failed: ${startResult.stderr}`,
     );
 
-    const result = await runCli(['take_screenshot'], sessionId);
+    const result = await runCli(['take_screenshot', '1'], sessionId);
     assert.strictEqual(
       result.status,
       0,
@@ -75,7 +75,7 @@ describe('opera-devtools', () => {
   it('fails to invoke list_network_requests when categoryNetwork is disabled', async () => {
     await runCli(['start', '--categoryNetwork=false'], sessionId);
 
-    const result = await runCli(['list_network_requests'], sessionId);
+    const result = await runCli(['list_network_requests', '1'], sessionId);
     assert.strictEqual(result.status, 0);
 
     assert(
@@ -93,7 +93,7 @@ describe('opera-devtools', () => {
   it('fails to invoke click_at when experimentalVision is disabled (default)', async () => {
     await runCli(['start'], sessionId);
 
-    const result = await runCli(['click_at', '100', '100'], sessionId);
+    const result = await runCli(['click_at', '1', '100', '100'], sessionId);
     assert.strictEqual(result.status, 0);
     assert(
       result.stdout.includes(
@@ -107,6 +107,49 @@ describe('opera-devtools', () => {
     );
   });
 
+  it('fails to invoke evaluate_script when javascriptEvaluation is disabled', async () => {
+    await runCli(['start', '--no-javascript-evaluation'], sessionId);
+
+    const result = await runCli(['evaluate_script', '() => 1'], sessionId);
+    assert.strictEqual(result.status, 0);
+    assert(
+      result.stdout.includes(
+        'Tool evaluate_script requires flag --javascriptEvaluation and is currently disabled',
+      ),
+      'error message is unexpected: ' + result.stdout,
+    );
+    assert(
+      result.stdout.includes(
+        'opera-devtools start --javascriptEvaluation=true',
+      ),
+      'restart command suggestion is missing: ' + result.stdout,
+    );
+
+    const navResult = await runCli(
+      ['navigate_page', '1', '--url', 'javascript:alert(1)'],
+      sessionId,
+    );
+    assert.strictEqual(navResult.status, 0);
+    assert(
+      navResult.stdout.includes(
+        'Navigating to javascript: URLs is not allowed when JavaScript evaluation is disabled.',
+      ),
+      'error message is unexpected: ' + navResult.stdout,
+    );
+
+    const initScriptResult = await runCli(
+      ['navigate_page', '1', '--initScript', 'alert(1)'],
+      sessionId,
+    );
+    assert.strictEqual(initScriptResult.status, 0);
+    assert(
+      initScriptResult.stdout.includes(
+        'Unknown argument for tool "navigate_page": "initScript"',
+      ),
+      'error message is unexpected: ' + initScriptResult.stdout,
+    );
+  });
+
   it('can record a performance trace', async () => {
     const startResult = await runCli(
       ['start', '--performanceCrux=false'],
@@ -119,7 +162,7 @@ describe('opera-devtools', () => {
     );
 
     const emulateResult = await runCli(
-      ['emulate', '--cpuThrottlingRate', '2'],
+      ['emulate', '1', '--cpuThrottlingRate', '2'],
       sessionId,
     );
     assert.strictEqual(
@@ -128,7 +171,7 @@ describe('opera-devtools', () => {
       `emulate command failed: ${emulateResult.stderr}`,
     );
 
-    const result = await runCli(['performance_start_trace'], sessionId);
+    const result = await runCli(['performance_start_trace', '1'], sessionId);
     assert.strictEqual(
       result.status,
       0,
diff --git a/tests/e2e/opera-devtools-start-stop.test.ts b/tests/e2e/opera-devtools-start-stop.test.ts
index 7a4b3349..84f7724b 100644
--- a/tests/e2e/opera-devtools-start-stop.test.ts
+++ b/tests/e2e/opera-devtools-start-stop.test.ts
@@ -78,4 +78,32 @@ describe('opera-devtools', () => {
 
     await assertDaemonIsRunning(sessionId);
   });
+
+  it('can start the daemon with a workspace', async () => {
+    const workspace = fs.mkdtempSync(
+      path.join(os.tmpdir(), 'chrome-devtools-workspace-'),
+    );
+
+    try {
+      const startResult = await runCli(
+        ['start', '--workspace', workspace],
+        sessionId,
+      );
+      assert.strictEqual(
+        startResult.status,
+        0,
+        `start command failed: ${startResult.stderr}`,
+      );
+
+      const statusResult = await runCli(['status'], sessionId);
+      assert.strictEqual(statusResult.status, 0);
+      assert.ok(
+        statusResult.stdout.includes('--filesystem-root=') &&
+          statusResult.stdout.includes(path.basename(workspace)),
+        `workspace was not forwarded: ${statusResult.stdout}`,
+      );
+    } finally {
+      fs.rmSync(workspace, {recursive: true, force: true});
+    }
+  });
 });
diff --git a/tests/formatters/NetworkFormatter.test.ts b/tests/formatters/NetworkFormatter.test.ts
index 7a75fd35..364b6aa6 100644
--- a/tests/formatters/NetworkFormatter.test.ts
+++ b/tests/formatters/NetworkFormatter.test.ts
@@ -132,6 +132,51 @@ describe('NetworkFormatter', () => {
         'reqid=1 GET http://example.com [pending] [selected in the DevTools Network panel]',
       );
     });
+
+    it('truncates long urls', async () => {
+      const longUrl = `http://example.com/${'a'.repeat(500)}`;
+      const request = getMockRequest({url: longUrl});
+      const formatter = await NetworkFormatter.from(request, {
+        requestId: 1,
+        saveFile: async () => ({filename: ''}),
+        redactNetworkHeaders: false,
+      });
+
+      assert.equal(
+        formatter.toString(),
+        `reqid=1 GET ${longUrl.substring(0, 255)}... <truncated> [pending]`,
+      );
+      // The structured data keeps the full URL.
+      assert.equal(formatter.toJSON().url, longUrl);
+    });
+
+    it('truncates data: urls', async () => {
+      const dataUrl = `data:image/png;base64,${'A'.repeat(5000)}`;
+      const request = getMockRequest({url: dataUrl});
+      const formatter = await NetworkFormatter.from(request, {
+        requestId: 1,
+        saveFile: async () => ({filename: ''}),
+        redactNetworkHeaders: false,
+      });
+
+      assert.equal(
+        formatter.toString(),
+        `reqid=1 GET ${dataUrl.substring(0, 255)}... <truncated> [pending]`,
+      );
+    });
+
+    it('does not truncate urls within the size limit', async () => {
+      // Exactly at the 150 character limit.
+      const url = `http://example.com/${'a'.repeat(131)}`;
+      const request = getMockRequest({url});
+      const formatter = await NetworkFormatter.from(request, {
+        requestId: 1,
+        saveFile: async () => ({filename: ''}),
+        redactNetworkHeaders: false,
+      });
+
+      assert.equal(formatter.toString(), `reqid=1 GET ${url} [pending]`);
+    });
   });
 
   describe('toStringDetailed', () => {
diff --git a/tests/index.test.ts b/tests/index.test.ts
index 8049efc3..cfcd2b47 100644
--- a/tests/index.test.ts
+++ b/tests/index.test.ts
@@ -21,8 +21,9 @@ import {
 } from '@modelcontextprotocol/sdk/types.js';
 import {executablePath} from 'puppeteer';
 
+import {mcpOptions} from '../src/config/mcp-options.js';
+import {getOffByDefaultCategories} from '../src/config/category-options.js';
 import type {ToolCategory} from '../src/tools/categories.js';
-import {OFF_BY_DEFAULT_CATEGORIES} from '../src/tools/categories.js';
 import type {ToolDefinition} from '../src/tools/ToolDefinition.js';
 
 describe('e2e', () => {
@@ -112,7 +113,7 @@ describe('e2e', () => {
         definedNames.sort();
         assert.deepStrictEqual(exposedNames, definedNames);
       },
-      OFF_BY_DEFAULT_CATEGORIES.map(category => `--category-${category}`),
+      getOffByDefaultCategories().map(category => `--category-${category}`),
     );
   });
 
@@ -121,7 +122,7 @@ describe('e2e', () => {
       const {tools} = await client.listTools();
       const exposedNames = tools.map(t => t.name).sort();
       const definedNames = await getToolsWithFilteredCategories(
-        OFF_BY_DEFAULT_CATEGORIES,
+        getOffByDefaultCategories(),
       );
       definedNames.sort();
       assert.deepStrictEqual(exposedNames, definedNames);
@@ -204,6 +205,17 @@ describe('e2e', () => {
     );
   });
 
+  it('can disable javascript evaluation tools', async () => {
+    await withClient(
+      async client => {
+        const {tools} = await client.listTools();
+        const evaluateScript = tools.find(t => t.name === 'evaluate_script');
+        assert.strictEqual(evaluateScript, undefined);
+      },
+      ['--no-javascript-evaluation'],
+    );
+  });
+
   it('updates roots when client notifies', async () => {
     const roots = [{uri: 'file:///test-root', name: 'test-root'}];
     let resolvePromise: () => void;
@@ -234,6 +246,51 @@ describe('e2e', () => {
     );
   });
 
+  it('combines configured filesystem roots with client roots', async () => {
+    const configuredRoot = await fs.promises.mkdtemp(
+      path.join(os.homedir(), '.configured-root-'),
+    );
+    const clientRoot = await fs.promises.mkdtemp(
+      path.join(os.homedir(), '.client-root-'),
+    );
+
+    try {
+      await withClient(
+        async client => {
+          client.setRequestHandler(ListRootsRequestSchema, () => {
+            return {
+              roots: [
+                {uri: pathToFileURL(clientRoot).href, name: 'client-root'},
+              ],
+            };
+          });
+
+          for (const outputPath of [
+            path.join(configuredRoot, 'configured.png'),
+            path.join(clientRoot, 'client.png'),
+          ]) {
+            const result = await client.callTool({
+              name: 'take_screenshot',
+              arguments: {pageId: 1, filePath: outputPath},
+            });
+            assert.strictEqual(result.isError, undefined);
+            const content = result.content as TextContent[];
+            assert.match(content[0].text, /Saved screenshot to/);
+          }
+        },
+        [`--filesystem-root=${configuredRoot}`],
+        {
+          capabilities: {
+            roots: {listChanged: true},
+          },
+        },
+      );
+    } finally {
+      await fs.promises.rm(configuredRoot, {recursive: true, force: true});
+      await fs.promises.rm(clientRoot, {recursive: true, force: true});
+    }
+  });
+
   it('denies file access if roots list is empty', async () => {
     await withClient(
       async client => {
@@ -244,6 +301,7 @@ describe('e2e', () => {
         const result = await client.callTool({
           name: 'take_screenshot',
           arguments: {
+            pageId: 1,
             filePath: path.resolve(os.homedir(), 'test.png'),
           },
         });
@@ -271,6 +329,7 @@ describe('e2e', () => {
         const result = await client.callTool({
           name: 'take_screenshot',
           arguments: {
+            pageId: 1,
             filePath: path.join(os.tmpdir(), 'test.png'),
           },
         });
@@ -349,7 +408,10 @@ describe('e2e', () => {
 
           const result = await client.callTool({
             name: 'take_screenshot',
-            arguments: {filePath: path.join(workspace, 'shot.png')},
+            arguments: {
+              pageId: 1,
+              filePath: path.join(workspace, 'shot.png'),
+            },
           });
 
           // Asserted before isError so a denial reports the path it rejected
@@ -381,7 +443,9 @@ describe('e2e', () => {
 
       const snapshotResult = await client.callTool({
         name: 'take_snapshot',
-        arguments: {},
+        arguments: {
+          pageId: 2,
+        },
       });
 
       const snapshotText = (snapshotResult.content as TextContent[])[0].text;
@@ -392,6 +456,7 @@ describe('e2e', () => {
       const result = await client.callTool({
         name: 'click',
         arguments: {
+          pageId: 2,
           uid,
         },
       });
@@ -412,6 +477,7 @@ describe('e2e', () => {
         const result = await client.callTool({
           name: 'take_screenshot',
           arguments: {
+            pageId: 2,
             // Use os.tmpdir() so validatePath passes on macOS/Windows before
             // reaching the dialog-blocked check.
             filePath: path.join(os.tmpdir(), 'test.png'),
@@ -489,7 +555,12 @@ function toolShouldBeSkipped(
   filteredOutCategories: ToolCategory[],
 ) {
   if (tool.annotations?.conditions) {
-    return true;
+    for (const condition of tool.annotations.conditions) {
+      const option = mcpOptions[condition as keyof typeof mcpOptions];
+      if (!option || !('default' in option) || option.default !== true) {
+        return true;
+      }
+    }
   }
   if (
     tool.annotations?.category &&
diff --git a/tests/mocks.ts b/tests/mocks.ts
new file mode 100644
index 00000000..e34ce93f
--- /dev/null
+++ b/tests/mocks.ts
@@ -0,0 +1,137 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * Sinon-based mock factories for McpPage, McpContext, McpResponse and
+ * the underlying Puppeteer Page.
+ *
+ * Uses sinon.createStubInstance() so all methods are automatically stubbed
+ * from the real class prototype — no hand-rolled interface definitions needed.
+ *
+ * Usage example:
+ *
+ *   const page = createMockMcpPage();
+ *   const context = createMockMcpContext({selectedPage: page});
+ *   const response = createMockMcpResponse();
+ *
+ *   await myTool.handler({params: {networkConditions: 'Slow 3G'}, page}, response, context);
+ *
+ *   sinon.assert.calledOnceWithExactly(page.emulate, {networkConditions: 'Slow 3G'});
+ */
+
+import type {Frame} from 'puppeteer-core';
+import sinon from 'sinon';
+
+import {McpContext} from '../src/McpContext.js';
+import {McpPage} from '../src/McpPage.js';
+import {McpResponse} from '../src/McpResponse.js';
+import {CdpPage} from '../src/third_party/index.js';
+import type {Page} from '../src/third_party/index.js';
+
+export type MockMcpPage = sinon.SinonStubbedInstance<McpPage> & {
+  pptrPage: sinon.SinonStubbedInstance<Page>;
+};
+export type MockMcpContext = sinon.SinonStubbedInstance<McpContext>;
+export type MockMcpResponse = sinon.SinonStubbedInstance<McpResponse>;
+
+/**
+ * A minimal event emitter used to back mocked `on`/`off`/`emit` methods on
+ * Puppeteer objects (Page, CDPSession, Browser) so tests can trigger events
+ * synchronously without a real browser.
+ */
+export function mockListener() {
+  const listeners: Record<
+    string | symbol | number,
+    Array<(data: unknown) => void>
+  > = {};
+  return {
+    on(eventName: string | symbol | number, listener: (data: unknown) => void) {
+      const arr = listeners[eventName];
+      if (arr) {
+        arr.push(listener);
+      } else {
+        listeners[eventName] = [listener];
+      }
+    },
+    off(
+      _eventName: string | symbol | number,
+      _listener?: (data: unknown) => void,
+    ) {
+      // no-op
+    },
+    emit(eventName: string | symbol | number, data?: unknown) {
+      for (const listener of listeners[eventName] ?? []) {
+        listener(data);
+      }
+    },
+  };
+}
+
+export function createMockPuppeteerPage(): sinon.SinonStubbedInstance<Page> {
+  const page = sinon.createStubInstance(
+    CdpPage,
+  ) as unknown as sinon.SinonStubbedInstance<Page>;
+
+  // mainFrame() must return a stable object so tests can pass it back into
+  // page.emit('framenavigated', mainFrame) and have it recognized as the
+  // same frame instance across calls.
+  page.mainFrame.returns({} as Frame);
+
+  // _client() is a private internal Puppeteer API used by ConsoleCollector
+  // in the McpPage constructor. Not on the CdpPage prototype, so added
+  // explicitly. It needs real on/off/emit behavior so tests can trigger CDP
+  // events directly via cdpSession.emit(...).
+  const cdpListener = mockListener();
+  const cdpSession = {
+    on: sinon.stub().callsFake(cdpListener.on),
+    off: sinon.stub().callsFake(cdpListener.off),
+    send: sinon.stub().resolves({}),
+    target: sinon.stub().returns({_targetId: '<mock>'}),
+    emit: cdpListener.emit,
+  };
+  // @ts-expect-error internal API
+  page._client = sinon.stub().returns(cdpSession);
+
+  return page;
+}
+
+export function createMockMcpPage(
+  options: {pptrPage?: sinon.SinonStubbedInstance<Page>} = {},
+): MockMcpPage {
+  const page = sinon.createStubInstance(McpPage);
+  const pptrPage = options.pptrPage ?? createMockPuppeteerPage();
+  return Object.assign(page, {pptrPage});
+}
+
+export function createMockMcpContext(
+  options: {selectedPage?: MockMcpPage} = {},
+): MockMcpContext {
+  const context = sinon.createStubInstance(McpContext);
+  const page = options.selectedPage ?? createMockMcpPage();
+  context.getSelectedMcpPage.returns(page satisfies McpPage);
+
+  return context;
+}
+
+export function createMockMcpResponse(): MockMcpResponse {
+  return sinon.createStubInstance(McpResponse);
+}
+
+/**
+ * Convenience helper — creates a mock page, context and response in one call.
+ *
+ *   const {page, context, response} = createHandlerMocks();
+ */
+export function createHandlerMocks(): {
+  page: MockMcpPage;
+  context: MockMcpContext;
+  response: MockMcpResponse;
+} {
+  const page = createMockMcpPage();
+  const context = createMockMcpContext({selectedPage: page});
+  const response = createMockMcpResponse();
+  return {page, context, response};
+}
diff --git a/tests/opera/browserLaunch.test.ts b/tests/opera/browserLaunch.test.ts
index cf4b24b3..5db6416c 100644
--- a/tests/opera/browserLaunch.test.ts
+++ b/tests/opera/browserLaunch.test.ts
@@ -8,7 +8,7 @@
 import assert from 'node:assert';
 import {describe, it} from 'node:test';
 
-import type {parseArguments} from '../../src/bin/chrome-devtools-mcp-cli-options.js';
+import type {parseArguments} from '../../src/config/mcp-options.js';
 import {buildLaunchOptions} from '../../src/opera/browserLaunch.js';
 
 type ServerArgs = ReturnType<typeof parseArguments>;
diff --git a/tests/processors/HeapSnapshotManager.test.ts b/tests/processors/HeapSnapshotManager.test.ts
index 65a2ffee..f86e76a4 100644
--- a/tests/processors/HeapSnapshotManager.test.ts
+++ b/tests/processors/HeapSnapshotManager.test.ts
@@ -17,6 +17,15 @@ describe('HeapSnapshotManager', () => {
     sinon.restore();
   });
 
+  it('rejects when a file without .heapsnapshot or .heaptimeline extension is passed', async () => {
+    const manager = new HeapSnapshotManager();
+
+    await assert.rejects(
+      manager.getSnapshot('tests/fixtures/snapshot_diffs.js'),
+      /must have a \.heapsnapshot or \.heaptimeline extension/,
+    );
+  });
+
   it('disposes the worker when snapshot loading fails', async () => {
     const disposeSpy = sinon.spy(
       DevTools.HeapSnapshotModel.HeapSnapshotProxy.HeapSnapshotWorkerProxy
diff --git a/tests/roots.test.ts b/tests/roots.test.ts
index 0732d5a5..582fc603 100644
--- a/tests/roots.test.ts
+++ b/tests/roots.test.ts
@@ -11,6 +11,8 @@ import path from 'node:path';
 import {describe, it} from 'node:test';
 import {pathToFileURL} from 'node:url';
 
+import {resolveCanonicalPath} from '../src/utils/files.js';
+
 import {withMcpContext} from './utils.js';
 
 describe('McpContext Roots', () => {
@@ -18,8 +20,8 @@ describe('McpContext Roots', () => {
     await withMcpContext(async (_response, context) => {
       context.setRoots([]);
       const tmpPath = path.join(os.tmpdir(), 'test-file.txt');
-      // This should not throw
-      await context.validatePath(tmpPath);
+      const resolved = await context.validatePath(tmpPath);
+      assert.strictEqual(resolved, await resolveCanonicalPath(tmpPath));
     });
   });
 
@@ -36,7 +38,8 @@ describe('McpContext Roots', () => {
       const tmpPath = path.join(os.tmpdir(), 'test-file.txt');
       // The temp directory must remain reachable even with no negotiated
       // roots, matching the existing "empty roots" behavior above.
-      await context.validatePath(tmpPath);
+      const resolved = await context.validatePath(tmpPath);
+      assert.strictEqual(resolved, await resolveCanonicalPath(tmpPath));
     });
   });
 
@@ -51,11 +54,16 @@ describe('McpContext Roots', () => {
         context.setRoots([{uri: pathToFileURL(otherRoot).href, name: 'other'}]);
 
         const tmpPath = path.join(os.tmpdir(), 'test-file.txt');
-        // This should not throw.
-        await context.validatePath(tmpPath);
+        const resolvedTmp = await context.validatePath(tmpPath);
+        assert.strictEqual(resolvedTmp, await resolveCanonicalPath(tmpPath));
 
         // Other root should also be allowed.
-        await context.validatePath(path.join(otherRoot, 'file.txt'));
+        const otherFile = path.join(otherRoot, 'file.txt');
+        const resolvedOther = await context.validatePath(otherFile);
+        assert.strictEqual(
+          resolvedOther,
+          await resolveCanonicalPath(otherFile),
+        );
 
         // Outside should still be denied. Use a path that is definitely not a root or temp dir.
         const outsidePath = path.resolve(
@@ -122,7 +130,9 @@ describe('McpContext Roots', () => {
 
           assert.strictEqual(
             resolvedPath,
-            path.join(workspacePath, testCase.expected),
+            await resolveCanonicalPath(
+              path.join(workspacePath, testCase.expected),
+            ),
           );
         }
       } finally {
diff --git a/tests/telemetry/ClearcutLogger.test.ts b/tests/telemetry/ClearcutLogger.test.ts
index 90196e8e..6000cdf5 100644
--- a/tests/telemetry/ClearcutLogger.test.ts
+++ b/tests/telemetry/ClearcutLogger.test.ts
@@ -50,7 +50,6 @@ describe('ClearcutLogger', () => {
         schema: {},
         success: true,
         latencyMs: 123,
-        context: {},
       });
 
       assert(mockWatchdogClient.send.calledOnce);
@@ -58,7 +57,7 @@ describe('ClearcutLogger', () => {
       assert.strictEqual(msg.type, WatchdogMessageType.LOG_EVENT);
       assert.strictEqual(msg.payload.tool_invocation?.tool_name, 'test_tool');
       assert.strictEqual(msg.payload.tool_invocation?.success, true);
-      assert.strictEqual(msg.payload.tool_invocation?.latency_ms, 123);
+      assert.strictEqual(msg.payload.tool_invocation?.latency_ms, 250);
     });
     it('sends context when provided', async () => {
       const logger = ClearcutLogger.initialize({
@@ -72,10 +71,10 @@ describe('ClearcutLogger', () => {
         schema: {},
         success: true,
         latencyMs: 123,
-        context: {
-          is_devtools_open: true,
-          is_localhost: false,
+        devToolsData: {
+          cdpBackendNodeId: 1,
         },
+        pageUrl: 'https://example.com',
       });
 
       assert(mockWatchdogClient.send.calledOnce);
@@ -84,6 +83,9 @@ describe('ClearcutLogger', () => {
       assert.deepStrictEqual(msg.payload.tool_invocation?.context, {
         is_devtools_open: true,
         is_localhost: false,
+        devtools_data: {
+          is_dom_element_selected: true,
+        },
       });
     });
     it('sends sanitized params', async () => {
@@ -109,7 +111,6 @@ describe('ClearcutLogger', () => {
         schema,
         success: true,
         latencyMs: 123,
-        context: {},
       });
 
       assert(mockWatchdogClient.send.calledOnce);
@@ -125,12 +126,20 @@ describe('ClearcutLogger', () => {
 
   describe('setClientName', () => {
     const clients = [
+      {name: 'claude-desktop', expected: 10}, // MCP_CLIENT_CLAUDE_DESKTOP
       {name: 'claude-code', expected: 1}, // MCP_CLIENT_CLAUDE_CODE
+      {name: 'claude', expected: 1}, // MCP_CLIENT_CLAUDE_CODE
       {name: 'gemini-cli', expected: 2}, // MCP_CLIENT_GEMINI_CLI
       {name: DAEMON_CLIENT_NAME, expected: 4}, // MCP_CLIENT_DT_MCP_CLI
       {name: 'openclaw-browser', expected: 5}, // MCP_CLIENT_OPENCLAW
+      {name: 'opencode', expected: 9}, // MCP_CLIENT_OPENCODE
       {name: 'codex-mcp-client', expected: 6}, // MCP_CLIENT_CODEX
       {name: 'antigravity-client', expected: 7}, // MCP_CLIENT_ANTIGRAVITY
+      {name: 'grok-build', expected: 8}, // MCP_CLIENT_GROK
+      {name: 'xai-sdk', expected: 8}, // MCP_CLIENT_GROK
+      {name: 'github-copilot-developer', expected: 11}, // MCP_CLIENT_GITHUB_COPILOT
+      {name: 'copilot-intellij', expected: 11}, // MCP_CLIENT_GITHUB_COPILOT
+      {name: 'unknown-client', expected: 3}, // MCP_CLIENT_OTHER
     ];
 
     for (const {name, expected} of clients) {
@@ -243,7 +252,30 @@ describe('ClearcutLogger', () => {
       const msg = mockWatchdogClient.send.firstCall.args[0];
       assert.strictEqual(msg.type, WatchdogMessageType.LOG_EVENT);
       assert.ok(msg.payload.daily_active);
+      assert.ok(msg.payload.daily_active.days_since_last_active !== undefined);
+
+      assert(mockPersistence.saveState.called);
+    });
+
+    it('caps days_since_last_active at 31 if lastActive was > 30 days ago', async () => {
+      const longAgo = new Date();
+      longAgo.setDate(longAgo.getDate() - 45);
+      mockPersistence.loadState.resolves({
+        lastActive: longAgo.toISOString(),
+      });
+
+      const logger = ClearcutLogger.initialize({
+        persistence: mockPersistence,
+        appVersion: '1.0.0',
+        watchdogClient: mockWatchdogClient,
+      });
 
+      await logger.logDailyActiveIfNeeded();
+
+      assert(mockWatchdogClient.send.calledOnce);
+      const msg = mockWatchdogClient.send.firstCall.args[0];
+      assert.strictEqual(msg.type, WatchdogMessageType.LOG_EVENT);
+      assert.strictEqual(msg.payload.daily_active?.days_since_last_active, 31);
       assert(mockPersistence.saveState.called);
     });
 
diff --git a/tests/telemetry/flagUtils.test.ts b/tests/telemetry/flagUtils.test.ts
index 603259d9..4e6af00b 100644
--- a/tests/telemetry/flagUtils.test.ts
+++ b/tests/telemetry/flagUtils.test.ts
@@ -7,7 +7,7 @@
 import assert from 'node:assert/strict';
 import {describe, it} from 'node:test';
 
-import type {cliOptions} from '../../src/bin/chrome-devtools-mcp-cli-options.js';
+import type {mcpOptions} from '../../src/config/mcp-options.js';
 import {
   computeFlagUsage,
   getPossibleFlagMetrics,
@@ -33,7 +33,7 @@ describe('computeFlagUsage', () => {
       description: 'A flag with a default value',
       default: false,
     },
-  } as unknown as typeof cliOptions;
+  } as unknown as typeof mcpOptions;
 
   it('logs boolean flags directly with snake_case keys', () => {
     const args = {boolFlag: true};
@@ -113,7 +113,7 @@ describe('computeFlagUsage', () => {
           type: 'boolean' as const,
           description: 'A 3p flag',
         },
-      } as unknown as typeof cliOptions;
+      } as unknown as typeof mcpOptions;
       const args = {experimental3pTool: true};
       const usage = computeFlagUsage(args, mock3pOptions);
       assert.equal(usage.experimental3p_tool, true);
@@ -136,7 +136,7 @@ describe('getPossibleFlagMetrics', () => {
       description: 'An enum flag',
       choices: ['a', 'b'],
     },
-  } as unknown as typeof cliOptions;
+  } as unknown as typeof mcpOptions;
 
   it('returns all possible metrics for given options', () => {
     const metrics = getPossibleFlagMetrics(mockOptions);
@@ -160,7 +160,7 @@ describe('getPossibleFlagMetrics', () => {
         type: 'boolean' as const,
         description: 'A 3p flag',
       },
-    } as unknown as typeof cliOptions;
+    } as unknown as typeof mcpOptions;
     const metrics = getPossibleFlagMetrics(mock3pOptions);
 
     assert.deepEqual(metrics, [
diff --git a/tests/telemetry/transformation.test.ts b/tests/telemetry/transformation.test.ts
index e6e6e413..56d6db8f 100644
--- a/tests/telemetry/transformation.test.ts
+++ b/tests/telemetry/transformation.test.ts
@@ -8,9 +8,11 @@ import assert from 'node:assert';
 import {describe, it} from 'node:test';
 
 import {
+  bucketizeDaysSince,
   bucketizeLatency,
   buildContext,
   getEnumValues,
+  MAX_ACTIVE_DAYS,
   sanitizeParams,
   stripUnderscoreBeforeNumber,
   transformArgName,
@@ -81,6 +83,28 @@ describe('bucketizeLatency', () => {
   });
 });
 
+describe('bucketizeDaysSince', () => {
+  it('should bucketize days correctly', () => {
+    const testCases = [
+      {input: -1, expected: -1},
+      {input: 0, expected: 0},
+      {input: 1, expected: 1},
+      {input: 7, expected: 7},
+      {input: 14, expected: 14},
+      {input: 30, expected: 30},
+      {input: 31, expected: 31},
+      {input: MAX_ACTIVE_DAYS, expected: 31},
+      {input: 32, expected: 31},
+      {input: 45, expected: 31},
+      {input: 100, expected: 31},
+    ];
+
+    for (const {input, expected} of testCases) {
+      assert.strictEqual(bucketizeDaysSince(input), expected);
+    }
+  });
+});
+
 describe('sanitizeParams', () => {
   it('filters out uid and transforms strings and arrays', () => {
     const schema = {
diff --git a/tests/tools/console.test.js.snapshot b/tests/tools/console.test.js.snapshot
index 0677097b..cc7232b0 100644
--- a/tests/tools/console.test.js.snapshot
+++ b/tests/tools/console.test.js.snapshot
@@ -141,7 +141,7 @@ exports[`console > get_console_message > when dialog is open 1`] = `
     "args": [
       "This is an error"
     ],
-    "stackTrace": "at  (VM7:1:9)\\nat  (pptr:;CdpFrame.%3Canonymous%3E%20(<file-path>)\\n--- PendingScript ----------------------\\nat  (pptr:;CdpFrame.%3Canonymous%3E%20(<file-path>)\\nNote: line and column numbers use 1-based indexing"
+    "stackTrace": "at  (about:blank:1:17)\\nNote: line and column numbers use 1-based indexing"
   },
   "pagination": {
     "currentPage": 0,
diff --git a/tests/tools/console.test.ts b/tests/tools/console.test.ts
index 21220ebf..1376ebf2 100644
--- a/tests/tools/console.test.ts
+++ b/tests/tools/console.test.ts
@@ -10,7 +10,7 @@ import {before, describe, it} from 'node:test';
 
 import type {Dialog} from 'puppeteer-core';
 
-import type {ParsedArguments} from '../../src/bin/chrome-devtools-mcp-cli-options.js';
+import type {ParsedArguments} from '../../src/config/mcp-options.js';
 import {loadIssueDescriptions} from '../../src/devtools/issueDescriptions.js';
 import {McpResponse} from '../../src/McpResponse.js';
 import {TextSnapshot} from '../../src/TextSnapshot.js';
@@ -347,20 +347,28 @@ describe('console', () => {
             page.on('dialog', dialog => resolve(dialog));
           });
 
-          page.evaluate(() => {
-            alert('test dialog');
-          });
+          const evalPromise = page
+            .evaluate(() => {
+              alert('test dialog');
+            })
+            .catch(() => {
+              // Ignore TargetCloseError when page is closed with open dialog
+            });
           const dialog = await dialogPromise;
 
-          await listConsoleMessages().handler(
-            {params: {}, page: context.getSelectedMcpPage()},
-            response,
-            context,
-          );
+          try {
+            await listConsoleMessages().handler(
+              {params: {}, page: context.getSelectedMcpPage()},
+              response,
+              context,
+            );
 
-          const result = await response.handle(context);
-          t.assert.snapshot(JSON.stringify(result));
-          await dialog.dismiss();
+            const result = await response.handle(context);
+            t.assert.snapshot(JSON.stringify(result));
+          } finally {
+            await dialog.dismiss();
+            await evalPromise;
+          }
         });
       });
     });
@@ -635,6 +643,39 @@ describe('console', () => {
       });
     });
 
+    it('does not apply source maps when sourceMaps is false', async () => {
+      server.addRoute('/main.min.js', (_req, res) => {
+        res.setHeader('Content-Type', 'text/javascript');
+        res.statusCode = 200;
+        res.end(`function n(){throw new Error("b00m!")}function o(){n()}(function n(){o()})();
+          //# sourceMappingURL=data:application/json;charset=utf-8;base64,eyJ2ZXJzaW9uIjozLCJuYW1lcyI6WyJiYXIiLCJFcnJvciIsImZvbyIsIklpZmUiXSwic291cmNlcyI6WyIuL21haW4uanMiXSwic291cmNlc0NvbnRlbnQiOlsiXG5mdW5jdGlvbiBiYXIoKSB7XG4gIHRocm93IG5ldyBFcnJvcignYjAwbSEnKTtcbn1cblxuZnVuY3Rpb24gZm9vKCkge1xuICBiYXIoKTtcbn1cblxuKGZ1bmN0aW9uIElpZmUoKSB7XG4gIGZvbygpO1xufSkoKTtcblxuIl0sIm1hcHBpbmdzIjoiQUFDQSxTQUFTQSxJQUNQLE1BQU0sSUFBSUMsTUFBTSxRQUNsQixDQUVBLFNBQVNDLElBQ1BGLEdBQ0YsRUFFQSxTQUFVRyxJQUNSRCxHQUNELEVBRkQiLCJpZ25vcmVMaXN0IjpbXX0=
+        `);
+      });
+      server.addHtmlRoute(
+        '/index.html',
+        `<script src="${server.getRoute('/main.min.js')}"></script>`,
+      );
+
+      await withMcpContext(
+        async (response, context) => {
+          const page = context.getSelectedMcpPage();
+          await page.pptrPage.goto(server.getRoute('/index.html'));
+
+          await getConsoleMessage.handler(
+            {params: {msgid: 1}, page: context.getSelectedMcpPage()},
+            response,
+            context,
+          );
+          const formattedResponse = await response.handle(context);
+          const rawText = getTextContent(formattedResponse.content[0]);
+
+          assert.ok(rawText.includes('main.min.js'));
+          assert.ok(!rawText.includes('main.js'));
+        },
+        {sourceMaps: false},
+      );
+    });
+
     it('ignores frames from ignore listed URLs', async t => {
       server.addHtmlRoute(
         '/index.html',
@@ -694,20 +735,30 @@ describe('console', () => {
         const dialogPromise = new Promise<Dialog>(resolve => {
           page.on('dialog', dialog => resolve(dialog));
         });
-        page.evaluate(() => {
-          alert('test dialog');
-        });
+        const evalPromise = page
+          .evaluate(() => {
+            alert('test dialog');
+          })
+          .catch(() => {
+            // Ignore TargetCloseError when page is closed with open dialog
+          });
         const dialog = await dialogPromise;
 
-        await getConsoleMessage.handler(
-          {params: {msgid: 1}, page: context.getSelectedMcpPage()},
-          response,
-          context,
-        );
+        try {
+          await getConsoleMessage.handler(
+            {params: {msgid: 1}, page: context.getSelectedMcpPage()},
+            response,
+            context,
+          );
 
-        const result = await response.handle(context);
-        t.assert.snapshot(stabilizeStructuredContent(result.structuredContent));
-        await dialog.dismiss();
+          const result = await response.handle(context);
+          t.assert.snapshot(
+            stabilizeStructuredContent(result.structuredContent),
+          );
+        } finally {
+          await dialog.dismiss();
+          await evalPromise;
+        }
       });
     });
   });
diff --git a/tests/tools/emulation.test.ts b/tests/tools/emulation.test.ts
index cba1fb21..d9002242 100644
--- a/tests/tools/emulation.test.ts
+++ b/tests/tools/emulation.test.ts
@@ -5,19 +5,21 @@
  */
 
 import assert from 'node:assert';
-import type {IncomingHttpHeaders} from 'node:http';
-import {beforeEach, describe, it, mock} from 'node:test';
+import {afterEach, describe, it} from 'node:test';
+
+import sinon from 'sinon';
 
 import {emulate} from '../../src/tools/emulation.js';
 import {
   geolocationTransform,
   viewportTransform,
 } from '../../src/tools/ToolDefinition.js';
-import {serverHooks} from '../server.js';
-import {html, withMcpContext} from '../utils.js';
+import {createHandlerMocks} from '../mocks.js';
 
 describe('emulation', () => {
-  const server = serverHooks();
+  afterEach(() => {
+    sinon.restore();
+  });
 
   describe('transforms', () => {
     describe('viewportTransform', () => {
@@ -68,6 +70,26 @@ describe('emulation', () => {
           isLandscape: true,
         });
       });
+
+      it('throws on non-numeric dimensions', () => {
+        assert.throws(() => viewportTransform('abc'));
+      });
+
+      it('throws when width is not positive', () => {
+        assert.throws(() => viewportTransform('0x600'));
+      });
+
+      it('throws when height is not positive', () => {
+        assert.throws(() => viewportTransform('800x0'));
+      });
+
+      it('throws when devicePixelRatio is not positive', () => {
+        assert.throws(() => viewportTransform('1024x768x0'));
+      });
+
+      it('throws when height is missing', () => {
+        assert.throws(() => viewportTransform('800'));
+      });
     });
 
     describe('geolocationTransform', () => {
@@ -81,799 +103,457 @@ describe('emulation', () => {
           longitude: 11.576124,
         });
       });
-    });
-  });
-
-  describe('network', () => {
-    it('emulates offline network conditions', async () => {
-      await withMcpContext(async (response, context) => {
-        await emulate.handler(
-          {
-            params: {
-              networkConditions: 'Offline',
-            },
-            page: context.getSelectedMcpPage(),
-          },
-          response,
-          context,
-        );
 
-        assert.strictEqual(
-          context.getSelectedMcpPage().networkConditions,
-          'Offline',
-        );
+      it('throws when latitude is out of range', () => {
+        assert.throws(() => geolocationTransform('999,999'));
       });
-    });
-    it('emulates network throttling when the throttling option is valid', async () => {
-      await withMcpContext(async (response, context) => {
-        await emulate.handler(
-          {
-            params: {
-              networkConditions: 'Slow 3G',
-            },
-            page: context.getSelectedMcpPage(),
-          },
-          response,
-          context,
-        );
 
-        assert.strictEqual(
-          context.getSelectedMcpPage().networkConditions,
-          'Slow 3G',
-        );
+      it('throws when longitude is out of range', () => {
+        assert.throws(() => geolocationTransform('48.1,999'));
       });
-    });
 
-    it('disables network emulation', async () => {
-      await withMcpContext(async (response, context) => {
-        await emulate.handler(
-          {
-            params: {},
-            page: context.getSelectedMcpPage(),
-          },
-          response,
-          context,
-        );
+      it('throws on non-numeric input', () => {
+        assert.throws(() => geolocationTransform('abc,def'));
+      });
 
-        assert.strictEqual(
-          context.getSelectedMcpPage().networkConditions,
-          null,
-        );
+      it('throws when longitude is missing', () => {
+        assert.throws(() => geolocationTransform('48.1'));
       });
     });
+  });
 
-    it('does not set throttling when the network throttling is not one of the predefined options', async () => {
-      await withMcpContext(async (response, context) => {
-        await emulate.handler(
-          {
-            params: {
-              networkConditions: 'Slow 11G',
-            },
-            page: context.getSelectedMcpPage(),
-          },
-          response,
-          context,
-        );
+  describe('network', () => {
+    it('emulates offline network conditions', async () => {
+      const {page, context, response} = createHandlerMocks();
+      await emulate.handler(
+        {params: {networkConditions: 'Offline'}, page},
+        response,
+        context,
+      );
+      sinon.assert.calledOnceWithExactly(page.emulate, {
+        networkConditions: 'Offline',
+      });
+      sinon.assert.calledOnceWithExactly(
+        response.appendResponseLine,
+        'Emulation configured successfully',
+      );
+    });
 
-        assert.strictEqual(
-          context.getSelectedMcpPage().networkConditions,
-          null,
-        );
+    it('emulates network throttling when the throttling option is valid', async () => {
+      const {page, context, response} = createHandlerMocks();
+      await emulate.handler(
+        {params: {networkConditions: 'Slow 3G'}, page},
+        response,
+        context,
+      );
+      sinon.assert.calledOnceWithExactly(page.emulate, {
+        networkConditions: 'Slow 3G',
       });
     });
 
-    it('report correctly for the currently selected page', async () => {
-      await withMcpContext(async (response, context) => {
-        await emulate.handler(
-          {
-            params: {
-              networkConditions: 'Slow 3G',
-            },
-            page: context.getSelectedMcpPage(),
-          },
-          response,
-          context,
-        );
-
-        assert.strictEqual(
-          context.getSelectedMcpPage().networkConditions,
-          'Slow 3G',
-        );
-
-        const page = await context.newPage();
-        context.selectPage(page);
+    it('disables network emulation when networkConditions is omitted', async () => {
+      const {page, context, response} = createHandlerMocks();
+      await emulate.handler({params: {}, page}, response, context);
+      sinon.assert.calledOnceWithExactly(page.emulate, {});
+    });
 
-        assert.strictEqual(
-          context.getSelectedMcpPage().networkConditions,
-          null,
-        );
+    it('report correctly for the currently selected page', async () => {
+      const {page, context, response} = createHandlerMocks();
+      await emulate.handler(
+        {params: {networkConditions: 'Slow 3G'}, page},
+        response,
+        context,
+      );
+      sinon.assert.calledOnceWithExactly(page.emulate, {
+        networkConditions: 'Slow 3G',
       });
     });
   });
 
   describe('cpu', () => {
     it('emulates cpu throttling when the rate is valid (1-20x)', async () => {
-      await withMcpContext(async (response, context) => {
-        await emulate.handler(
-          {
-            params: {
-              cpuThrottlingRate: 4,
-            },
-            page: context.getSelectedMcpPage(),
-          },
-          response,
-          context,
-        );
-
-        assert.strictEqual(context.getSelectedMcpPage().cpuThrottlingRate, 4);
-      });
+      const {page, context, response} = createHandlerMocks();
+      await emulate.handler(
+        {params: {cpuThrottlingRate: 4}, page},
+        response,
+        context,
+      );
+      sinon.assert.calledOnceWithExactly(page.emulate, {cpuThrottlingRate: 4});
+      sinon.assert.calledOnceWithExactly(
+        response.appendResponseLine,
+        'Emulation configured successfully',
+      );
     });
 
-    it('applies cpu throttling to secondary session', async () => {
-      await withMcpContext(async (response, context) => {
-        const mcpPage = context.getSelectedMcpPage();
-        const universe = mcpPage.devtoolsUniverse;
-        assert.ok(universe);
-
-        const sendSpy = mock.method(universe.session, 'send');
-
-        await emulate.handler(
-          {
-            params: {
-              cpuThrottlingRate: 4,
-            },
-            page: mcpPage,
-          },
-          response,
-          context,
-        );
-
-        assert.ok(sendSpy.mock.calls.length > 0);
-        const cpuCall = sendSpy.mock.calls.find(
-          call => call.arguments[0] === 'Emulation.setCPUThrottlingRate',
-        );
-        assert.ok(cpuCall);
-        assert.deepStrictEqual(cpuCall.arguments[1], {rate: 4});
-
-        sendSpy.mock.restore();
-      });
-    });
-
-    it('disables cpu throttling', async () => {
-      await withMcpContext(async (response, context) => {
-        await context.getSelectedMcpPage().emulate({
-          cpuThrottlingRate: 4,
-        });
-        await emulate.handler(
-          {
-            params: {
-              cpuThrottlingRate: 1,
-            },
-            page: context.getSelectedMcpPage(),
-          },
-          response,
-          context,
-        );
-
-        assert.strictEqual(context.getSelectedMcpPage().cpuThrottlingRate, 1);
-      });
+    it('disables cpu throttling when rate is 1', async () => {
+      const {page, context, response} = createHandlerMocks();
+      await emulate.handler(
+        {params: {cpuThrottlingRate: 1}, page},
+        response,
+        context,
+      );
+      sinon.assert.calledOnceWithExactly(page.emulate, {cpuThrottlingRate: 1});
     });
 
     it('report correctly for the currently selected page', async () => {
-      await withMcpContext(async (response, context) => {
-        await emulate.handler(
-          {
-            params: {
-              cpuThrottlingRate: 4,
-            },
-            page: context.getSelectedMcpPage(),
-          },
-          response,
-          context,
-        );
-
-        assert.strictEqual(context.getSelectedMcpPage().cpuThrottlingRate, 4);
-
-        const page = await context.newPage();
-        context.selectPage(page);
-
-        assert.strictEqual(context.getSelectedMcpPage().cpuThrottlingRate, 1);
-      });
+      const {page, context, response} = createHandlerMocks();
+      await emulate.handler(
+        {params: {cpuThrottlingRate: 4}, page},
+        response,
+        context,
+      );
+      sinon.assert.calledOnceWithExactly(page.emulate, {cpuThrottlingRate: 4});
     });
   });
 
   describe('geolocation', () => {
     it('emulates geolocation with latitude and longitude', async () => {
-      await withMcpContext(async (response, context) => {
-        await emulate.handler(
-          {
-            params: {
-              geolocation: {
-                latitude: 48.137154,
-                longitude: 11.576124,
-              },
+      const {page, context, response} = createHandlerMocks();
+      await emulate.handler(
+        {
+          params: {
+            geolocation: {
+              latitude: 48.137154,
+              longitude: 11.576124,
             },
-            page: context.getSelectedMcpPage(),
           },
-          response,
-          context,
-        );
-
-        const geolocation = context.getSelectedMcpPage().geolocation;
-        assert.strictEqual(geolocation?.latitude, 48.137154);
-        assert.strictEqual(geolocation?.longitude, 11.576124);
+          page,
+        },
+        response,
+        context,
+      );
+      sinon.assert.calledOnceWithExactly(page.emulate, {
+        geolocation: {
+          latitude: 48.137154,
+          longitude: 11.576124,
+        },
       });
+      sinon.assert.calledOnceWithExactly(
+        response.appendResponseLine,
+        'Emulation configured successfully',
+      );
     });
 
-    it('clears geolocation override when geolocation is set to null', async () => {
-      await withMcpContext(async (response, context) => {
-        // First set a geolocation
-        await emulate.handler(
-          {
-            params: {
-              geolocation: {
-                latitude: 48.137154,
-                longitude: 11.576124,
-              },
-            },
-            page: context.getSelectedMcpPage(),
-          },
-          response,
-          context,
-        );
-
-        assert.notStrictEqual(context.getSelectedMcpPage().geolocation, null);
-
-        // Then clear it by setting geolocation to null
-        await emulate.handler(
-          {
-            params: {},
-            page: context.getSelectedMcpPage(),
-          },
-          response,
-          context,
-        );
-
-        assert.strictEqual(context.getSelectedMcpPage().geolocation, null);
-      });
+    it('clears geolocation override when geolocation is omitted', async () => {
+      const {page, context, response} = createHandlerMocks();
+      await emulate.handler(
+        {
+          params: {},
+          page,
+        },
+        response,
+        context,
+      );
+      sinon.assert.calledOnceWithExactly(page.emulate, {});
     });
 
     it('reports correctly for the currently selected page', async () => {
-      await withMcpContext(async (response, context) => {
-        await emulate.handler(
-          {
-            params: {
-              geolocation: {
-                latitude: 48.137154,
-                longitude: 11.576124,
-              },
+      const {page, context, response} = createHandlerMocks();
+      await emulate.handler(
+        {
+          params: {
+            geolocation: {
+              latitude: 48.137154,
+              longitude: 11.576124,
             },
-            page: context.getSelectedMcpPage(),
           },
-          response,
-          context,
-        );
-
-        const geolocation = context.getSelectedMcpPage().geolocation;
-        assert.strictEqual(geolocation?.latitude, 48.137154);
-        assert.strictEqual(geolocation?.longitude, 11.576124);
-
-        const page = await context.newPage();
-        context.selectPage(page);
-
-        assert.strictEqual(context.getSelectedMcpPage().geolocation, null);
+          page,
+        },
+        response,
+        context,
+      );
+      sinon.assert.calledOnceWithExactly(page.emulate, {
+        geolocation: {
+          latitude: 48.137154,
+          longitude: 11.576124,
+        },
       });
     });
   });
-  describe('viewport', () => {
-    beforeEach(() => {
-      server.addHtmlRoute('/viewport', html`Test page`);
-    });
 
+  describe('viewport', () => {
     it('emulates viewport', async () => {
-      await withMcpContext(async (response, context) => {
-        const page = context.getSelectedMcpPage().pptrPage;
-        await page.goto(server.baseUrl + '/viewport');
-        await emulate.handler(
-          {
-            params: {
-              viewport: {
-                width: 400,
-                height: 400,
-                deviceScaleFactor: 2,
-                isMobile: true,
-                hasTouch: true,
-                isLandscape: false,
-              },
+      const {page, context, response} = createHandlerMocks();
+      await emulate.handler(
+        {
+          params: {
+            viewport: {
+              width: 400,
+              height: 400,
+              deviceScaleFactor: 2,
+              isMobile: true,
+              hasTouch: true,
+              isLandscape: false,
             },
-            page: context.getSelectedMcpPage(),
           },
-          response,
-          context,
-        );
-
-        const viewportData = await page.evaluate(() => {
-          return {
-            width: window.innerWidth,
-            height: window.innerHeight,
-            deviceScaleFactor: window.devicePixelRatio,
-            hasTouch: navigator.maxTouchPoints > 0,
-          };
-        });
-
-        assert.deepStrictEqual(viewportData, {
+          page,
+        },
+        response,
+        context,
+      );
+      sinon.assert.calledOnceWithExactly(page.emulate, {
+        viewport: {
           width: 400,
           height: 400,
           deviceScaleFactor: 2,
+          isMobile: true,
           hasTouch: true,
-        });
+          isLandscape: false,
+        },
       });
+      sinon.assert.calledOnceWithExactly(
+        response.appendResponseLine,
+        'Emulation configured successfully',
+      );
     });
 
-    it('clears viewport override when viewport is set to null', async () => {
-      await withMcpContext(async (response, context) => {
-        const page = context.getSelectedMcpPage().pptrPage;
-        // First set a viewport
-        await emulate.handler(
-          {
-            params: {
-              viewport: {
-                width: 400,
-                height: 400,
-              },
-            },
-            page: context.getSelectedMcpPage(),
-          },
-          response,
-          context,
-        );
-
-        const viewportData = await page.evaluate(() => {
-          return {
-            width: window.innerWidth,
-            height: window.innerHeight,
-          };
-        });
-
-        assert.deepStrictEqual(viewportData, {
-          width: 400,
-          height: 400,
-        });
-
-        // Then clear it by setting viewport to null
-        await emulate.handler(
-          {
-            params: {},
-            page: context.getSelectedMcpPage(),
-          },
-          response,
-          context,
-        );
-
-        assert.strictEqual(context.getSelectedMcpPage().viewport, null);
-
-        // Somehow reset of the viewport seems to be async.
-        await context.getSelectedMcpPage().pptrPage.waitForFunction(() => {
-          return window.innerWidth !== 400 && window.innerHeight !== 400;
-        });
-      });
+    it('clears viewport override when viewport is omitted', async () => {
+      const {page, context, response} = createHandlerMocks();
+      await emulate.handler(
+        {
+          params: {},
+          page,
+        },
+        response,
+        context,
+      );
+      sinon.assert.calledOnceWithExactly(page.emulate, {});
     });
 
     it('reports correctly for the currently selected page', async () => {
-      await withMcpContext(async (response, context) => {
-        await emulate.handler(
-          {
-            params: {
-              viewport: {
-                width: 400,
-                height: 400,
-              },
+      const {page, context, response} = createHandlerMocks();
+      await emulate.handler(
+        {
+          params: {
+            viewport: {
+              width: 400,
+              height: 400,
             },
-            page: context.getSelectedMcpPage(),
           },
-          response,
-          context,
-        );
-
-        assert.ok(context.getSelectedMcpPage().viewport);
-
-        const page = await context.newPage();
-        context.selectPage(page);
-
-        assert.strictEqual(context.getSelectedMcpPage().viewport, null);
-        assert.ok(
-          await context.getSelectedMcpPage().pptrPage.evaluate(() => {
-            return window.innerWidth !== 400 && window.innerHeight !== 400;
-          }),
-        );
+          page,
+        },
+        response,
+        context,
+      );
+      sinon.assert.calledOnceWithExactly(page.emulate, {
+        viewport: {
+          width: 400,
+          height: 400,
+        },
       });
     });
   });
 
   describe('userAgent', () => {
     it('emulates userAgent', async () => {
-      await withMcpContext(async (response, context) => {
-        await emulate.handler(
-          {
-            params: {
-              userAgent: 'MyUA',
-            },
-            page: context.getSelectedMcpPage(),
-          },
-          response,
-          context,
-        );
-
-        assert.strictEqual(context.getSelectedMcpPage().userAgent, 'MyUA');
-        const page = context.getSelectedMcpPage().pptrPage;
-        const ua = await page.evaluate(() => navigator.userAgent);
-        assert.strictEqual(ua, 'MyUA');
-      });
+      const {page, context, response} = createHandlerMocks();
+      await emulate.handler(
+        {
+          params: {
+            userAgent: 'MyUA',
+          },
+          page,
+        },
+        response,
+        context,
+      );
+      sinon.assert.calledOnceWithExactly(page.emulate, {
+        userAgent: 'MyUA',
+      });
+      sinon.assert.calledOnceWithExactly(
+        response.appendResponseLine,
+        'Emulation configured successfully',
+      );
     });
 
     it('updates userAgent', async () => {
-      await withMcpContext(async (response, context) => {
-        await emulate.handler(
-          {
-            params: {
-              userAgent: 'UA1',
-            },
-            page: context.getSelectedMcpPage(),
-          },
-          response,
-          context,
-        );
-        assert.strictEqual(context.getSelectedMcpPage().userAgent, 'UA1');
-
-        await emulate.handler(
-          {
-            params: {
-              userAgent: 'UA2',
-            },
-            page: context.getSelectedMcpPage(),
-          },
-          response,
-          context,
-        );
-        assert.strictEqual(context.getSelectedMcpPage().userAgent, 'UA2');
-        const page = context.getSelectedMcpPage().pptrPage;
-        const ua = await page.evaluate(() => navigator.userAgent);
-        assert.strictEqual(ua, 'UA2');
+      const {page, context, response} = createHandlerMocks();
+      await emulate.handler(
+        {
+          params: {
+            userAgent: 'UA1',
+          },
+          page,
+        },
+        response,
+        context,
+      );
+      sinon.assert.calledOnceWithExactly(page.emulate, {
+        userAgent: 'UA1',
+      });
+
+      await emulate.handler(
+        {
+          params: {
+            userAgent: 'UA2',
+          },
+          page,
+        },
+        response,
+        context,
+      );
+      sinon.assert.calledTwice(page.emulate);
+      sinon.assert.calledWithExactly(page.emulate.secondCall, {
+        userAgent: 'UA2',
       });
     });
 
-    it('clears userAgent override when userAgent is set to null', async () => {
-      await withMcpContext(async (response, context) => {
-        await emulate.handler(
-          {
-            params: {
-              userAgent: 'MyUA',
-            },
-            page: context.getSelectedMcpPage(),
-          },
-          response,
-          context,
-        );
-
-        assert.strictEqual(context.getSelectedMcpPage().userAgent, 'MyUA');
-
-        await emulate.handler(
-          {
-            params: {},
-            page: context.getSelectedMcpPage(),
-          },
-          response,
-          context,
-        );
-
-        assert.strictEqual(context.getSelectedMcpPage().userAgent, null);
-        const page = context.getSelectedMcpPage().pptrPage;
-        const ua = await page.evaluate(() => navigator.userAgent);
-        assert.notStrictEqual(ua, 'MyUA');
-        assert.ok(ua.length > 0);
-      });
+    it('clears userAgent override when userAgent is omitted', async () => {
+      const {page, context, response} = createHandlerMocks();
+      await emulate.handler(
+        {
+          params: {},
+          page,
+        },
+        response,
+        context,
+      );
+      sinon.assert.calledOnceWithExactly(page.emulate, {});
     });
 
     it('reports correctly for the currently selected page', async () => {
-      await withMcpContext(async (response, context) => {
-        await emulate.handler(
-          {
-            params: {
-              userAgent: 'MyUA',
-            },
-            page: context.getSelectedMcpPage(),
-          },
-          response,
-          context,
-        );
-
-        assert.strictEqual(context.getSelectedMcpPage().userAgent, 'MyUA');
-
-        const page = await context.newPage();
-        context.selectPage(page);
-
-        assert.strictEqual(context.getSelectedMcpPage().userAgent, null);
-        assert.ok(
-          await context.getSelectedMcpPage().pptrPage.evaluate(() => {
-            return navigator.userAgent !== 'MyUA';
-          }),
-        );
+      const {page, context, response} = createHandlerMocks();
+      await emulate.handler(
+        {
+          params: {
+            userAgent: 'MyUA',
+          },
+          page,
+        },
+        response,
+        context,
+      );
+      sinon.assert.calledOnceWithExactly(page.emulate, {
+        userAgent: 'MyUA',
       });
     });
   });
 
   describe('extraHttpHeaders', () => {
-    it('sets extra headers on requests', async () => {
-      let receivedHeaders: IncomingHttpHeaders = {};
-      server.addRoute('/headers-test', async (req, res) => {
-        receivedHeaders = req.headers;
-        res.writeHead(200, {'Content-Type': 'text/html'});
-        res.end('<main>Headers Test</main>');
-      });
-
-      await withMcpContext(async (response, context) => {
-        const page = context.getSelectedMcpPage().pptrPage;
-        await emulate.handler(
-          {
-            params: {
-              extraHttpHeaders: {'X-Custom-Header': 'test-value'},
-            },
-            page: context.getSelectedMcpPage(),
-          },
-          response,
-          context,
-        );
-
-        await page.goto(server.getRoute('/headers-test'));
-        assert.strictEqual(receivedHeaders['x-custom-header'], 'test-value');
-      });
-    });
-
-    it('clears extra headers when null is passed', async () => {
-      let receivedHeaders: IncomingHttpHeaders = {};
-      server.addRoute('/headers-clear', async (req, res) => {
-        receivedHeaders = req.headers;
-        res.writeHead(200, {'Content-Type': 'text/html'});
-        res.end('<main>Headers Clear</main>');
-      });
-
-      await withMcpContext(async (response, context) => {
-        const page = context.getSelectedMcpPage().pptrPage;
-        // Set headers first
-        await emulate.handler(
-          {
-            params: {
-              extraHttpHeaders: {'X-To-Clear': 'value'},
-            },
-            page: context.getSelectedMcpPage(),
-          },
-          response,
-          context,
-        );
-
-        // Clear headers
-        await emulate.handler(
-          {
-            params: {
-              extraHttpHeaders: {},
-            },
-            page: context.getSelectedMcpPage(),
-          },
-          response,
-          context,
-        );
-
-        await page.goto(server.getRoute('/headers-clear'));
-        assert.strictEqual(receivedHeaders['x-to-clear'], undefined);
-        assert.strictEqual(
-          context.getSelectedMcpPage().emulationSettings.extraHttpHeaders,
-          undefined,
-        );
-      });
+    it('emulates extraHttpHeaders', async () => {
+      const {page, context, response} = createHandlerMocks();
+      await emulate.handler(
+        {
+          params: {
+            extraHttpHeaders: {'X-Custom-Header': 'test-value'},
+          },
+          page,
+        },
+        response,
+        context,
+      );
+      sinon.assert.calledOnceWithExactly(page.emulate, {
+        extraHttpHeaders: {'X-Custom-Header': 'test-value'},
+      });
+      sinon.assert.calledOnceWithExactly(
+        response.appendResponseLine,
+        'Emulation configured successfully',
+      );
     });
 
-    it('headers persist across navigations', async () => {
-      const receivedHeaders: IncomingHttpHeaders[] = [];
-      server.addRoute('/persist-one', async (req, res) => {
-        receivedHeaders.push({...req.headers});
-        res.writeHead(200, {'Content-Type': 'text/html'});
-        res.end('<main>Page One</main>');
-      });
-      server.addRoute('/persist-two', async (req, res) => {
-        receivedHeaders.push({...req.headers});
-        res.writeHead(200, {'Content-Type': 'text/html'});
-        res.end('<main>Page Two</main>');
-      });
-
-      await withMcpContext(async (response, context) => {
-        const page = context.getSelectedMcpPage().pptrPage;
-        await emulate.handler(
-          {
-            params: {
-              extraHttpHeaders: {'X-Persist': 'yes'},
-            },
-            page: context.getSelectedMcpPage(),
-          },
-          response,
-          context,
-        );
-
-        await page.goto(server.getRoute('/persist-one'));
-        await page.goto(server.getRoute('/persist-two'));
-
-        assert.strictEqual(receivedHeaders[0]?.['x-persist'], 'yes');
-        assert.strictEqual(receivedHeaders[1]?.['x-persist'], 'yes');
-      });
-    });
-
-    it('does not affect other emulation settings', async () => {
-      await withMcpContext(async (response, context) => {
-        // Set userAgent first
-        await emulate.handler(
-          {
-            params: {
-              userAgent: 'MyUA',
-            },
-            page: context.getSelectedMcpPage(),
-          },
-          response,
-          context,
-        );
-
-        // Set extraHTTPHeaders separately
-        await emulate.handler(
-          {
-            params: {
-              extraHttpHeaders: {'X-Test': 'value'},
-            },
-            page: context.getSelectedMcpPage(),
-          },
-          response,
-          context,
-        );
-
-        const settings = context.getSelectedMcpPage().emulationSettings;
-        assert.deepStrictEqual(settings.extraHttpHeaders, {
-          'X-Test': 'value',
-        });
+    it('clears extra headers when empty object is passed', async () => {
+      const {page, context, response} = createHandlerMocks();
+      await emulate.handler(
+        {
+          params: {
+            extraHttpHeaders: {},
+          },
+          page,
+        },
+        response,
+        context,
+      );
+      sinon.assert.calledOnceWithExactly(page.emulate, {
+        extraHttpHeaders: {},
       });
     });
 
     it('reports correctly for the currently selected page', async () => {
-      await withMcpContext(async (response, context) => {
-        await emulate.handler(
-          {
-            params: {
-              extraHttpHeaders: {'X-Page': 'one'},
-            },
-            page: context.getSelectedMcpPage(),
-          },
-          response,
-          context,
-        );
-
-        assert.deepStrictEqual(
-          context.getSelectedMcpPage().emulationSettings.extraHttpHeaders,
-          {'X-Page': 'one'},
-        );
-
-        const page = await context.newPage();
-        context.selectPage(page);
-
-        assert.strictEqual(
-          context.getSelectedMcpPage().emulationSettings.extraHttpHeaders,
-          undefined,
-        );
+      const {page, context, response} = createHandlerMocks();
+      await emulate.handler(
+        {
+          params: {
+            extraHttpHeaders: {'X-Page': 'one'},
+          },
+          page,
+        },
+        response,
+        context,
+      );
+      sinon.assert.calledOnceWithExactly(page.emulate, {
+        extraHttpHeaders: {'X-Page': 'one'},
       });
     });
   });
 
   describe('colorScheme', () => {
     it('emulates color scheme', async () => {
-      await withMcpContext(async (response, context) => {
-        await emulate.handler(
-          {
-            params: {
-              colorScheme: 'dark',
-            },
-            page: context.getSelectedMcpPage(),
-          },
-          response,
-          context,
-        );
-
-        assert.strictEqual(context.getSelectedMcpPage().colorScheme, 'dark');
-        const page = context.getSelectedMcpPage().pptrPage;
-        const scheme = await page.evaluate(() =>
-          window.matchMedia('(prefers-color-scheme: dark)').matches
-            ? 'dark'
-            : 'light',
-        );
-        assert.strictEqual(scheme, 'dark');
-      });
+      const {page, context, response} = createHandlerMocks();
+      await emulate.handler(
+        {
+          params: {
+            colorScheme: 'dark',
+          },
+          page,
+        },
+        response,
+        context,
+      );
+      sinon.assert.calledOnceWithExactly(page.emulate, {
+        colorScheme: 'dark',
+      });
+      sinon.assert.calledOnceWithExactly(
+        response.appendResponseLine,
+        'Emulation configured successfully',
+      );
     });
 
     it('updates color scheme', async () => {
-      await withMcpContext(async (response, context) => {
-        await emulate.handler(
-          {
-            params: {
-              colorScheme: 'dark',
-            },
-            page: context.getSelectedMcpPage(),
-          },
-          response,
-          context,
-        );
-        assert.strictEqual(context.getSelectedMcpPage().colorScheme, 'dark');
-
-        await emulate.handler(
-          {
-            params: {
-              colorScheme: 'light',
-            },
-            page: context.getSelectedMcpPage(),
-          },
-          response,
-          context,
-        );
-        assert.strictEqual(context.getSelectedMcpPage().colorScheme, 'light');
-        const page = context.getSelectedMcpPage().pptrPage;
-        const scheme = await page.evaluate(() =>
-          window.matchMedia('(prefers-color-scheme: light)').matches
-            ? 'light'
-            : 'dark',
-        );
-        assert.strictEqual(scheme, 'light');
+      const {page, context, response} = createHandlerMocks();
+      await emulate.handler(
+        {
+          params: {
+            colorScheme: 'dark',
+          },
+          page,
+        },
+        response,
+        context,
+      );
+      sinon.assert.calledOnceWithExactly(page.emulate, {
+        colorScheme: 'dark',
+      });
+
+      await emulate.handler(
+        {
+          params: {
+            colorScheme: 'light',
+          },
+          page,
+        },
+        response,
+        context,
+      );
+      sinon.assert.calledTwice(page.emulate);
+      sinon.assert.calledWithExactly(page.emulate.secondCall, {
+        colorScheme: 'light',
       });
     });
 
     it('resets color scheme when set to auto', async () => {
-      await withMcpContext(async (response, context) => {
-        const page = context.getSelectedMcpPage().pptrPage;
-
-        const initial = await page.evaluate(
-          () => window.matchMedia('(prefers-color-scheme: dark)').matches,
-        );
-
-        await emulate.handler(
-          {
-            params: {
-              colorScheme: 'dark',
-            },
-            page: context.getSelectedMcpPage(),
-          },
-          response,
-          context,
-        );
-        assert.strictEqual(context.getSelectedMcpPage().colorScheme, 'dark');
-        // Check manually that it is dark
-
-        assert.strictEqual(
-          await page.evaluate(
-            () => window.matchMedia('(prefers-color-scheme: dark)').matches,
-          ),
-          true,
-        );
-
-        await emulate.handler(
-          {
-            params: {
-              colorScheme: 'auto',
-            },
-            page: context.getSelectedMcpPage(),
-          },
-          response,
-          context,
-        );
-
-        assert.strictEqual(context.getSelectedMcpPage().colorScheme, null);
-        assert.strictEqual(
-          await page.evaluate(
-            () => window.matchMedia('(prefers-color-scheme: dark)').matches,
-          ),
-          initial,
-        );
+      const {page, context, response} = createHandlerMocks();
+      await emulate.handler(
+        {
+          params: {
+            colorScheme: 'auto',
+          },
+          page,
+        },
+        response,
+        context,
+      );
+      sinon.assert.calledOnceWithExactly(page.emulate, {
+        colorScheme: 'auto',
       });
     });
   });
diff --git a/tests/tools/extensions.test.ts b/tests/tools/extensions.test.ts
index 6f57d8ad..d8769ee3 100644
--- a/tests/tools/extensions.test.ts
+++ b/tests/tools/extensions.test.ts
@@ -10,7 +10,7 @@ import {afterEach, describe, it} from 'node:test';
 
 import sinon from 'sinon';
 
-import type {ParsedArguments} from '../../src/bin/chrome-devtools-mcp-cli-options.js';
+import type {ParsedArguments} from '../../src/config/mcp-options.js';
 import {listConsoleMessages} from '../../src/tools/console.js';
 import {
   installExtension,
diff --git a/tests/tools/input.test.ts b/tests/tools/input.test.ts
index 1c480cdc..7e46cd62 100644
--- a/tests/tools/input.test.ts
+++ b/tests/tools/input.test.ts
@@ -11,7 +11,7 @@ import {describe, it} from 'node:test';
 
 import sinon from 'sinon';
 
-import type {ParsedArguments} from '../../src/bin/chrome-devtools-mcp-cli-options.js';
+import type {ParsedArguments} from '../../src/config/mcp-options.js';
 import {McpResponse} from '../../src/McpResponse.js';
 import {TextSnapshot} from '../../src/TextSnapshot.js';
 import {
diff --git a/tests/tools/lighthouse.test.ts b/tests/tools/lighthouse.test.ts
index 305ba63b..272d6ec4 100644
--- a/tests/tools/lighthouse.test.ts
+++ b/tests/tools/lighthouse.test.ts
@@ -11,6 +11,7 @@ import path from 'node:path';
 import {describe, it} from 'node:test';
 
 import {lighthouseAudit} from '../../src/tools/lighthouse.js';
+import {resolveCanonicalPath} from '../../src/utils/files.js';
 import {serverHooks} from '../server.js';
 import {html, withMcpContext} from '../utils.js';
 
@@ -177,8 +178,9 @@ describe('lighthouse', () => {
           assert.equal(data.summary.mode, 'snapshot');
           assert.equal(data.summary.device, 'mobile');
           assert.ok(data.reports.length === 2);
+          const canonicalFolderPath = await resolveCanonicalPath(folderPath);
           for (const report of data.reports) {
-            assert.ok(report.startsWith(folderPath));
+            assert.ok(report.startsWith(canonicalFolderPath));
           }
         });
       } finally {
diff --git a/tests/tools/memory.test.js.snapshot b/tests/tools/memory.test.js.snapshot
index 34169e01..dd9295e4 100644
--- a/tests/tools/memory.test.js.snapshot
+++ b/tests/tools/memory.test.js.snapshot
@@ -302,6 +302,15 @@ Showing 1-2 of 56 (Page 1 of 28).
 Next page: 1
 `;
 
+exports[`memory > get_heapsnapshot_edges > with retainedSize range 1`] = `
+## Heap Snapshot Data
+name,type,nodeId,nodeName,selfSize,retainedSize
+map,internal,25577,system / Map,0.0 kB,0.7 kB
+constructor,property,25575,String,0.1 kB,0.4 kB
+__proto__,property,25329,{constructor, __defineGetter__, __defineSetter__, …, get __proto__, set __proto__, toLocaleString},0.1 kB,0.3 kB
+Showing 1-3 of 3 (Page 1 of 1).
+`;
+
 exports[`memory > get_heapsnapshot_edges > with valid nodeId 1`] = `
 ## Heap Snapshot Data
 name,type,nodeId,nodeName,selfSize,retainedSize
@@ -449,3 +458,66 @@ Retained by context size: 3.5 kB (148 objects)
 Not retained by context size: 798 kB (11792 objects)
 Total size: 802 kB
 `;
+
+exports[`memory > query_heapsnapshot_objects > with an unbounded retainedSize filter 1`] = `
+## Heap Snapshot Data
+nodeId,nodeName,type,distance,selfSize,retainedSize
+1,,synthetic,100000000,0.0 kB,802 kB
+7249,system / NativeContext / https://example.com,hidden,1,1.2 kB,350 kB
+7199,system / NativeContext,hidden,1,1.2 kB,84.4 kB
+7307,system / NativeContext,hidden,1,1.2 kB,84.4 kB
+7195,system / NativeContext / https://example.com,hidden,1,1.2 kB,60.1 kB
+27635,Window (global*) / https://example.com,object,2,40.5 kB,51.0 kB
+30887,Window (global*) / https://example.com,object,2,40.5 kB,50.9 kB
+3,(GC roots),synthetic,100000001,0.0 kB,45.6 kB
+49547,,array,2,4.1 kB,41.0 kB
+36241,,array,2,4.1 kB,41.0 kB
+Showing 1-10 of 148 (Page 1 of 15).
+Next page: 1
+`;
+
+exports[`memory > query_heapsnapshot_objects > with className filter 1`] = `
+## Heap Snapshot Data
+nodeId,nodeName,type,distance,selfSize,retainedSize
+27635,Window (global*) / https://example.com,object,2,40.5 kB,51.0 kB
+30887,Window (global*) / https://example.com,object,2,40.5 kB,50.9 kB
+30967,Window (prototype) / https://example.com,object,4,26.6 kB,26.7 kB
+42085,Window (prototype) / https://example.com,object,4,26.6 kB,26.7 kB
+32995,Window (internal cache) / https://example.com,object,3,0.2 kB,10.1 kB
+41995,Window (internal cache) / https://example.com,object,3,0.2 kB,10.1 kB
+16321,Window / https://example.com,native,2,0.9 kB,1.9 kB
+16329,Window,closure,3,0.1 kB,0.4 kB
+16341,Window,closure,3,0.1 kB,0.4 kB
+30975,Window (prototype) / https://example.com,object,3,0.0 kB,0.2 kB
+Showing 1-10 of 34 (Page 1 of 4).
+Next page: 1
+`;
+
+exports[`memory > query_heapsnapshot_objects > with default options 1`] = `
+## Heap Snapshot Data
+nodeId,nodeName,type,distance,selfSize,retainedSize
+1,,synthetic,100000000,0.0 kB,802 kB
+7249,system / NativeContext / https://example.com,hidden,1,1.2 kB,350 kB
+7199,system / NativeContext,hidden,1,1.2 kB,84.4 kB
+7307,system / NativeContext,hidden,1,1.2 kB,84.4 kB
+7195,system / NativeContext / https://example.com,hidden,1,1.2 kB,60.1 kB
+27635,Window (global*) / https://example.com,object,2,40.5 kB,51.0 kB
+30887,Window (global*) / https://example.com,object,2,40.5 kB,50.9 kB
+3,(GC roots),synthetic,100000001,0.0 kB,45.6 kB
+49547,,array,2,4.1 kB,41.0 kB
+36241,,array,2,4.1 kB,41.0 kB
+Showing 1-10 of 27466 (Page 1 of 2747).
+Next page: 1
+`;
+
+exports[`memory > query_heapsnapshot_objects > with sortBy selfSize and pagination 1`] = `
+## Heap Snapshot Data
+nodeId,nodeName,type,distance,selfSize,retainedSize
+1,,synthetic,100000000,0.0 kB,802 kB
+7249,system / NativeContext / https://example.com,hidden,1,1.2 kB,350 kB
+7199,system / NativeContext,hidden,1,1.2 kB,84.4 kB
+7307,system / NativeContext,hidden,1,1.2 kB,84.4 kB
+7195,system / NativeContext / https://example.com,hidden,1,1.2 kB,60.1 kB
+Showing 1-5 of 27466 (Page 1 of 5494).
+Next page: 1
+`;
diff --git a/tests/tools/memory.test.ts b/tests/tools/memory.test.ts
index 4da915ad..0c226f77 100644
--- a/tests/tools/memory.test.ts
+++ b/tests/tools/memory.test.ts
@@ -24,8 +24,11 @@ import {
   compareHeapSnapshots,
   getHeapSnapshotDuplicateStrings,
   getHeapSnapshotObjectDetails,
+  queryHeapSnapshotObjects,
 } from '../../src/tools/memory.js';
+import {parseByteSizeRange} from '../../src/utils/bytes.js';
 import {stableIdSymbol} from '../../src/utils/id.js';
+import {resolveCanonicalPath} from '../../src/utils/files.js';
 import {withMcpContext} from '../utils.js';
 
 describe('memory', () => {
@@ -39,9 +42,10 @@ describe('memory', () => {
             response,
             context,
           );
+          const canonicalFilePath = await resolveCanonicalPath(filePath);
           assert.equal(
             response.responseLines.at(0),
-            `Heap snapshot saved to ${filePath}`,
+            `Heap snapshot saved to ${canonicalFilePath}`,
           );
           assert.ok(existsSync(filePath));
         } finally {
@@ -444,6 +448,34 @@ describe('memory', () => {
         t.assert.snapshot(output);
       });
     });
+
+    it('with retainedSize range', async t => {
+      await withMcpContext(async (response, context) => {
+        const filePath = join(
+          process.cwd(),
+          'tests/fixtures/example.heapsnapshot',
+        );
+
+        await getHeapSnapshotEdges.handler(
+          {
+            params: {
+              filePath,
+              nodeId: 25341,
+              retainedSize: parseByteSizeRange('100B-100B'),
+            },
+          },
+          response,
+          context,
+        );
+
+        const responseData = await response.handle(context);
+        const output = responseData.content
+          .map(c => (c.type === 'text' ? c.text : ''))
+          .join('\n');
+
+        t.assert.snapshot(output);
+      });
+    });
   });
 
   describe('get_heapsnapshot_dominators', () => {
@@ -648,4 +680,100 @@ describe('memory', () => {
       });
     });
   });
+
+  describe('query_heapsnapshot_objects', () => {
+    it('with default options', async t => {
+      await withMcpContext(async (response, context) => {
+        const filePath = join(
+          process.cwd(),
+          'tests/fixtures/example.heapsnapshot',
+        );
+
+        await queryHeapSnapshotObjects.handler(
+          {params: {filePath, pageSize: 10}},
+          response,
+          context,
+        );
+
+        const responseData = await response.handle(context);
+        const output = responseData.content
+          .map(c => (c.type === 'text' ? c.text : ''))
+          .join('\n');
+
+        t.assert.snapshot(output);
+      });
+    });
+
+    it('with className filter', async t => {
+      await withMcpContext(async (response, context) => {
+        const filePath = join(
+          process.cwd(),
+          'tests/fixtures/example.heapsnapshot',
+        );
+
+        await queryHeapSnapshotObjects.handler(
+          {params: {filePath, className: 'Window', pageSize: 10}},
+          response,
+          context,
+        );
+
+        const responseData = await response.handle(context);
+        const output = responseData.content
+          .map(c => (c.type === 'text' ? c.text : ''))
+          .join('\n');
+
+        t.assert.snapshot(output);
+      });
+    });
+
+    it('with an unbounded retainedSize filter', async t => {
+      await withMcpContext(async (response, context) => {
+        const filePath = join(
+          process.cwd(),
+          'tests/fixtures/example.heapsnapshot',
+        );
+
+        await queryHeapSnapshotObjects.handler(
+          {
+            params: {
+              filePath,
+              retainedSize: parseByteSizeRange('1KB'),
+              pageSize: 10,
+            },
+          },
+          response,
+          context,
+        );
+
+        const responseData = await response.handle(context);
+        const output = responseData.content
+          .map(c => (c.type === 'text' ? c.text : ''))
+          .join('\n');
+
+        t.assert.snapshot(output);
+      });
+    });
+
+    it('with sortBy selfSize and pagination', async t => {
+      await withMcpContext(async (response, context) => {
+        const filePath = join(
+          process.cwd(),
+          'tests/fixtures/example.heapsnapshot',
+        );
+
+        await queryHeapSnapshotObjects.handler(
+          {params: {filePath, sortBy: 'selfSize', pageSize: 5, pageIdx: 0}},
+          response,
+          context,
+        );
+
+        const responseData = await response.handle(context);
+        const output = responseData.content
+          .map(c => (c.type === 'text' ? c.text : ''))
+          .join('\n');
+
+        t.assert.snapshot(output);
+      });
+    });
+  });
 });
diff --git a/tests/tools/pages.test.ts b/tests/tools/pages.test.ts
index b8ba3ef2..b03b349b 100644
--- a/tests/tools/pages.test.ts
+++ b/tests/tools/pages.test.ts
@@ -11,7 +11,10 @@ import {afterEach, describe, it} from 'node:test';
 import type {Dialog} from 'puppeteer-core';
 import sinon from 'sinon';
 
-import type {ParsedArguments} from '../../src/bin/chrome-devtools-mcp-cli-options.js';
+import {
+  parseArguments,
+  type ParsedArguments,
+} from '../../src/config/mcp-options.js';
 import {
   listPages,
   newPage,
@@ -249,6 +252,137 @@ describe('pages', () => {
         assert.ok(response.includePages);
       });
     });
+    it('throws when navigating to a javascript URL and javascriptEvaluation is false', async () => {
+      await withMcpContext(async (response, context) => {
+        const disabledArgs = parseArguments(
+          '1.0.0',
+          ['node', 'script.js', '--no-javascript-evaluation'],
+          {CHROME_DEVTOOLS_MCP_NO_USAGE_STATISTICS: 'true'},
+        );
+        const tool = newPage(disabledArgs);
+        await assert.rejects(
+          async () => {
+            await tool.handler(
+              {params: {url: 'javascript:alert(1)'}},
+              response,
+              context,
+            );
+          },
+          {
+            message:
+              'Navigating to javascript: URLs is not allowed when JavaScript evaluation is disabled.',
+          },
+        );
+        await assert.rejects(
+          async () => {
+            await tool.handler(
+              {params: {url: 'data:text/html,<div>test</div>'}},
+              response,
+              context,
+            );
+          },
+          {
+            message:
+              'Navigating to data: URLs is not allowed when JavaScript evaluation is disabled.',
+          },
+        );
+        await assert.rejects(
+          async () => {
+            await tool.handler(
+              {params: {url: 'vbscript:msgbox(1)'}},
+              response,
+              context,
+            );
+          },
+          {
+            message:
+              'Navigating to vbscript: URLs is not allowed when JavaScript evaluation is disabled.',
+          },
+        );
+      });
+    });
+    it('throws when URL does not parse with new URL', async () => {
+      await withMcpContext(async (response, context) => {
+        const tool = newPage();
+        await assert.rejects(
+          async () => {
+            await tool.handler(
+              {params: {url: 'not a valid url'}},
+              response,
+              context,
+            );
+          },
+          {
+            message:
+              'Invalid URL: "not a valid url". URLs must be valid according to the URL standard.',
+          },
+        );
+      });
+    });
+    it('rejects chrome: and chrome-untrusted: URLs', async () => {
+      await withMcpContext(async (response, context) => {
+        const tool = newPage();
+        await assert.rejects(
+          async () => {
+            await tool.handler(
+              {params: {url: 'chrome://settings'}},
+              response,
+              context,
+            );
+          },
+          {
+            message: 'Navigating to chrome: URLs is not allowed.',
+          },
+        );
+        await assert.rejects(
+          async () => {
+            await tool.handler(
+              {params: {url: 'chrome-untrusted://terminal'}},
+              response,
+              context,
+            );
+          },
+          {
+            message: 'Navigating to chrome-untrusted: URLs is not allowed.',
+          },
+        );
+        assert.strictEqual(context.getPages().length, 1);
+      });
+    });
+    it('rejects chrome-extension: URLs unless categoryExtensions is enabled', async () => {
+      await withMcpContext(async (response, context) => {
+        const tool = newPage();
+        await assert.rejects(
+          async () => {
+            await tool.handler(
+              {params: {url: 'chrome-extension://abcdef/popup.html'}},
+              response,
+              context,
+            );
+          },
+          {
+            message:
+              'Navigating to chrome-extension: URLs is not allowed without --categoryExtensions.',
+          },
+        );
+      });
+    });
+    it('allows chrome://newtab/', async () => {
+      await withMcpContext(async (response, context) => {
+        const tool = newPage();
+        await tool.handler(
+          {params: {url: 'chrome://newtab/'}},
+          response,
+          context,
+        );
+        assert.ok(
+          context
+            .getSelectedMcpPage()
+            .pptrPage.url()
+            .startsWith('chrome://new'),
+        );
+      });
+    });
     it('create a page in the background', async () => {
       await withMcpContext(async (response, context) => {
         const originalPage = context.getPageById(1);
@@ -296,6 +430,38 @@ describe('pages', () => {
       });
     });
 
+    it('keeps focus when background is true with isolatedContext', async () => {
+      await withMcpContext(async (response, context) => {
+        const originalPage = context.getPageById(1);
+        assert.strictEqual(originalPage, context.getSelectedMcpPage());
+        // Ensure original page has focus
+        await originalPage.pptrPage.bringToFront();
+        assert.strictEqual(
+          await originalPage.pptrPage.evaluate(() => document.hasFocus()),
+          true,
+        );
+        await newPage().handler(
+          {
+            params: {
+              url: 'data:text/html,<html></html>',
+              background: true,
+              isolatedContext: 'session-a',
+            },
+          },
+          response,
+          context,
+        );
+        // New page should be selected but original should retain focus
+        const mcpPage = context.getSelectedMcpPage();
+        assert.strictEqual(mcpPage.isolatedContextName, 'session-a');
+        assert.strictEqual(
+          await originalPage.pptrPage.evaluate(() => document.hasFocus()),
+          true,
+        );
+        assert.ok(response.includePages);
+      });
+    });
+
     it('reuses the same context for the same isolatedContext name', async () => {
       await withMcpContext(async (response, context) => {
         await newPage().handler(
@@ -811,6 +977,8 @@ describe('pages', () => {
             });
           </script>`,
         );
+        // Grant user activation so Chrome permits the beforeunload dialog
+        await page.mouse.click(10, 10);
 
         await navigatePage().handler(
           {params: {type: 'reload'}, page: context.getSelectedMcpPage()},
@@ -838,6 +1006,8 @@ describe('pages', () => {
             });
           </script>`,
         );
+        // Grant user activation so Chrome permits the beforeunload dialog
+        await page.mouse.click(10, 10);
 
         await navigatePage().handler(
           {
@@ -917,6 +1087,186 @@ describe('pages', () => {
       });
     });
 
+    it('omits initScript from schema when javascriptEvaluation is false', () => {
+      const defaultTool = navigatePage();
+      assert.strictEqual('initScript' in defaultTool.schema, true);
+
+      const disabledArgs = parseArguments(
+        '1.0.0',
+        ['node', 'script.js', '--no-javascript-evaluation'],
+        {CHROME_DEVTOOLS_MCP_NO_USAGE_STATISTICS: 'true'},
+      );
+      const disabledTool = navigatePage(disabledArgs);
+      assert.strictEqual('initScript' in disabledTool.schema, false);
+    });
+
+    it('throws when navigating to a javascript, data, or vbscript URL and javascriptEvaluation is false', async () => {
+      await withMcpContext(async (response, context) => {
+        const disabledArgs = parseArguments(
+          '1.0.0',
+          ['node', 'script.js', '--no-javascript-evaluation'],
+          {CHROME_DEVTOOLS_MCP_NO_USAGE_STATISTICS: 'true'},
+        );
+        const tool = navigatePage(disabledArgs);
+        await assert.rejects(
+          async () => {
+            await tool.handler(
+              {
+                params: {
+                  url: 'javascript:alert(1)',
+                },
+                page: context.getSelectedMcpPage(),
+              },
+              response,
+              context,
+            );
+          },
+          {
+            message:
+              'Navigating to javascript: URLs is not allowed when JavaScript evaluation is disabled.',
+          },
+        );
+        await assert.rejects(
+          async () => {
+            await tool.handler(
+              {
+                params: {
+                  url: 'data:text/html,<div>test</div>',
+                },
+                page: context.getSelectedMcpPage(),
+              },
+              response,
+              context,
+            );
+          },
+          {
+            message:
+              'Navigating to data: URLs is not allowed when JavaScript evaluation is disabled.',
+          },
+        );
+        await assert.rejects(
+          async () => {
+            await tool.handler(
+              {
+                params: {
+                  url: 'vbscript:msgbox(1)',
+                },
+                page: context.getSelectedMcpPage(),
+              },
+              response,
+              context,
+            );
+          },
+          {
+            message:
+              'Navigating to vbscript: URLs is not allowed when JavaScript evaluation is disabled.',
+          },
+        );
+      });
+    });
+
+    it('throws when URL does not parse with new URL', async () => {
+      await withMcpContext(async (response, context) => {
+        const tool = navigatePage();
+        await assert.rejects(
+          async () => {
+            await tool.handler(
+              {
+                params: {
+                  url: 'not a valid url',
+                },
+                page: context.getSelectedMcpPage(),
+              },
+              response,
+              context,
+            );
+          },
+          {
+            message:
+              'Invalid URL: "not a valid url". URLs must be valid according to the URL standard.',
+          },
+        );
+      });
+    });
+
+    it('rejects chrome: and chrome-untrusted: URLs', async () => {
+      await withMcpContext(async (response, context) => {
+        const tool = navigatePage();
+        await assert.rejects(
+          async () => {
+            await tool.handler(
+              {
+                params: {url: 'chrome://settings'},
+                page: context.getSelectedMcpPage(),
+              },
+              response,
+              context,
+            );
+          },
+          {
+            message: 'Navigating to chrome: URLs is not allowed.',
+          },
+        );
+        await assert.rejects(
+          async () => {
+            await tool.handler(
+              {
+                params: {url: 'chrome-untrusted://terminal'},
+                page: context.getSelectedMcpPage(),
+              },
+              response,
+              context,
+            );
+          },
+          {
+            message: 'Navigating to chrome-untrusted: URLs is not allowed.',
+          },
+        );
+      });
+    });
+
+    it('rejects chrome-extension: URLs unless categoryExtensions is enabled', async () => {
+      await withMcpContext(async (response, context) => {
+        const tool = navigatePage();
+        await assert.rejects(
+          async () => {
+            await tool.handler(
+              {
+                params: {url: 'chrome-extension://abcdef/popup.html'},
+                page: context.getSelectedMcpPage(),
+              },
+              response,
+              context,
+            );
+          },
+          {
+            message:
+              'Navigating to chrome-extension: URLs is not allowed without --categoryExtensions.',
+          },
+        );
+      });
+    });
+
+    it('allows chrome://newtab/', async () => {
+      await withMcpContext(async (response, context) => {
+        const tool = navigatePage();
+        await tool.handler(
+          {
+            params: {url: 'chrome://newtab/'},
+            page: context.getSelectedMcpPage(),
+          },
+          response,
+          context,
+        );
+        assert.ok(
+          context
+            .getSelectedMcpPage()
+            .pptrPage.url()
+            .startsWith('chrome://new'),
+        );
+      });
+    });
+
     it('when dialog is open', async t => {
       await withMcpContext(async (response, context) => {
         const page = context.getSelectedMcpPage().pptrPage;
@@ -1077,39 +1427,46 @@ describe('pages', () => {
       });
     });
 
-    it('resize when window state is fullscreen', async () => {
-      await withMcpContext(async (response, context) => {
-        const page = context.getSelectedMcpPage().pptrPage;
-        const browser = page.browser();
-        const windowId = await page.windowId();
-        await browser.setWindowBounds(windowId, {windowState: 'fullscreen'});
-
-        const {windowState} = await browser.getWindowBounds(windowId);
-        assert.strictEqual(windowState, 'fullscreen');
-
-        const resizePromise = page.evaluate(() => {
-          return new Promise(resolve => {
-            window.addEventListener('resize', resolve, {once: true});
+    /*
+     * The following test fails after the release of chrome 152.
+     * */
+    it(
+      'resize when window state is fullscreen',
+      {skip: process.platform === 'darwin'},
+      async () => {
+        await withMcpContext(async (response, context) => {
+          const page = context.getSelectedMcpPage().pptrPage;
+          const browser = page.browser();
+          const windowId = await page.windowId();
+          await browser.setWindowBounds(windowId, {windowState: 'fullscreen'});
+
+          const {windowState} = await browser.getWindowBounds(windowId);
+          assert.strictEqual(windowState, 'fullscreen');
+
+          const resizePromise = page.evaluate(() => {
+            return new Promise(resolve => {
+              window.addEventListener('resize', resolve, {once: true});
+            });
           });
+          await resizePage.handler(
+            {
+              params: {width: 850, height: 650},
+              page: context.getSelectedMcpPage(),
+            },
+            response,
+            context,
+          );
+          await resizePromise;
+          await page.waitForFunction(
+            () => window.innerWidth === 850 && window.innerHeight === 650,
+          );
+          const dimensions = await page.evaluate(() => {
+            return [window.innerWidth, window.innerHeight];
+          });
+          assert.deepStrictEqual(dimensions, [850, 650]);
         });
-        await resizePage.handler(
-          {
-            params: {width: 850, height: 650},
-            page: context.getSelectedMcpPage(),
-          },
-          response,
-          context,
-        );
-        await resizePromise;
-        await page.waitForFunction(
-          () => window.innerWidth === 850 && window.innerHeight === 650,
-        );
-        const dimensions = await page.evaluate(() => {
-          return [window.innerWidth, window.innerHeight];
-        });
-        assert.deepStrictEqual(dimensions, [850, 650]);
-      });
-    });
+      },
+    );
 
     it('when dialog is open', async t => {
       await withMcpContext(async (response, context) => {
@@ -1331,7 +1688,7 @@ describe('pages', () => {
         // @ts-expect-error _tabId is internal.
         page._tabId = 'test-tab-id';
         await getTabId.handler(
-          {params: {pageId: 1}, page: context.getSelectedMcpPage()},
+          {params: {}, page: context.getSelectedMcpPage()},
           response,
           context,
         );
diff --git a/tests/tools/performance.test.ts b/tests/tools/performance.test.ts
index 506ef810..72f5bd6c 100644
--- a/tests/tools/performance.test.ts
+++ b/tests/tools/performance.test.ts
@@ -67,6 +67,7 @@ describe('performance', () => {
             ...DevTools.TracingOptionalCategories.JsSampling,
             ...DevTools.TracingOptionalCategories.Screenshot,
           ],
+          bufferSize: 1200 * 1000,
         });
         assert.ok(context.isRunningPerformanceTrace());
         assert.ok(
diff --git a/tests/tools/screencast.test.ts b/tests/tools/screencast.test.ts
index adf0ff2f..a5a7e4af 100644
--- a/tests/tools/screencast.test.ts
+++ b/tests/tools/screencast.test.ts
@@ -8,18 +8,25 @@ import assert from 'node:assert';
 import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
-import {describe, it, afterEach} from 'node:test';
+import {afterEach, describe, it} from 'node:test';
 
 import sinon from 'sinon';
 
-import type {ParsedArguments} from '../../src/bin/chrome-devtools-mcp-cli-options.js';
+import {parseArguments} from '../../src/config/mcp-options.js';
+import {ScreenRecorder} from '../../src/third_party/index.js';
 import {startScreencast, stopScreencast} from '../../src/tools/screencast.js';
-import {withMcpContext} from '../utils.js';
+import {createHandlerMocks} from '../mocks.js';
 
-function createMockRecorder() {
-  return {
-    stop: sinon.stub().resolves(),
-  };
+function createMockScreenRecorder(): sinon.SinonStubbedInstance<ScreenRecorder> {
+  return sinon.createStubInstance(ScreenRecorder);
+}
+
+function createScreencastMocks() {
+  const {page, context, response} = createHandlerMocks();
+  const mockRecorder = createMockScreenRecorder();
+  page.pptrPage.screencast.resolves(mockRecorder);
+  context.getScreenRecorder.returns(null);
+  return {page, context, response, mockRecorder};
 }
 
 describe('screencast', () => {
@@ -29,263 +36,301 @@ describe('screencast', () => {
 
   describe('screencast_start', () => {
     it('starts a screencast recording with filePath', async () => {
-      await withMcpContext(async (response, context) => {
-        const mockRecorder = createMockRecorder();
-        const selectedPage = context.getSelectedMcpPage().pptrPage;
-        const screencastStub = sinon
-          .stub(selectedPage, 'screencast')
-          .resolves(mockRecorder as never);
-
-        await startScreencast().handler(
-          {
-            params: {filePath: path.join(os.tmpdir(), 'test-recording.mp4')},
-            page: context.getSelectedMcpPage(),
-          },
-          response,
-          context,
-        );
-
-        sinon.assert.calledOnce(screencastStub);
-        const callArgs = screencastStub.firstCall.args[0];
-        assert.ok(callArgs);
-        assert.ok(callArgs.path?.endsWith('test-recording.mp4'));
-
-        assert.ok(context.getScreenRecorder() !== null);
-        assert.ok(
-          response.responseLines
-            .join('\n')
-            .includes('Screencast recording started'),
-        );
+      const {page, context, response, mockRecorder} = createScreencastMocks();
+
+      const filePath: `${string}.mp4` = `${path.join(
+        os.tmpdir(),
+        'test-recording',
+      )}.mp4`;
+      context.ensureExtension.resolves(filePath);
+
+      await startScreencast().handler(
+        {
+          params: {filePath},
+          page,
+        },
+        response,
+        context,
+      );
+
+      sinon.assert.calledOnceWithExactly(
+        context.ensureExtension,
+        filePath,
+        '.mp4',
+      );
+      sinon.assert.calledOnceWithExactly(page.pptrPage.screencast, {
+        path: filePath,
+        format: 'mp4',
+        ffmpegPath: undefined,
+        fps: undefined,
       });
+      sinon.assert.calledOnceWithExactly(context.setScreenRecorder, {
+        recorder: mockRecorder,
+        filePath,
+      });
+      sinon.assert.calledOnceWithExactly(
+        response.appendResponseLine,
+        `Screencast recording started. The recording will be saved to ${filePath}. Use screencast_stop to stop recording.`,
+      );
     });
 
     it('records WebM for an uppercase extension (case-insensitive)', async () => {
-      await withMcpContext(async (response, context) => {
-        const mockRecorder = createMockRecorder();
-        const selectedPage = context.getSelectedMcpPage().pptrPage;
-        const screencastStub = sinon
-          .stub(selectedPage, 'screencast')
-          .resolves(mockRecorder as never);
-
-        await startScreencast().handler(
-          {
-            params: {filePath: path.join(os.tmpdir(), 'test-recording.WEBM')},
-            page: context.getSelectedMcpPage(),
-          },
-          response,
-          context,
-        );
-
-        sinon.assert.calledOnce(screencastStub);
-        const callArgs = screencastStub.firstCall.args[0];
-        assert.ok(callArgs);
-        assert.strictEqual(callArgs.format, 'webm');
-        assert.ok(callArgs.path?.endsWith('.webm'));
+      const {page, context, response, mockRecorder} = createScreencastMocks();
+
+      const requestedPath = `${path.join(os.tmpdir(), 'test-recording')}.WEBM`;
+      const expectedPath: `${string}.webm` = `${path.join(
+        os.tmpdir(),
+        'test-recording',
+      )}.webm`;
+      context.ensureExtension.resolves(expectedPath);
+
+      await startScreencast().handler(
+        {
+          params: {filePath: requestedPath},
+          page,
+        },
+        response,
+        context,
+      );
+
+      sinon.assert.calledOnceWithExactly(
+        context.ensureExtension,
+        requestedPath,
+        '.webm',
+      );
+      sinon.assert.calledOnceWithExactly(page.pptrPage.screencast, {
+        path: expectedPath,
+        format: 'webm',
+        ffmpegPath: undefined,
+        fps: undefined,
+      });
+      sinon.assert.calledOnceWithExactly(context.setScreenRecorder, {
+        recorder: mockRecorder,
+        filePath: expectedPath,
       });
     });
 
     it('rejects an unsupported extension instead of silently using mp4', async () => {
-      await withMcpContext(async (response, context) => {
-        const selectedPage = context.getSelectedMcpPage().pptrPage;
-        const screencastStub = sinon.stub(selectedPage, 'screencast');
-
-        await assert.rejects(
-          startScreencast().handler(
-            {
-              params: {filePath: path.join(os.tmpdir(), 'recording.avi')},
-              page: context.getSelectedMcpPage(),
-            },
-            response,
-            context,
-          ),
-          /Unsupported screencast file extension/,
-        );
-
-        sinon.assert.notCalled(screencastStub);
-        assert.strictEqual(context.getScreenRecorder(), null);
-      });
-    });
+      const {page, context, response} = createScreencastMocks();
+      const filePath = `${path.join(os.tmpdir(), 'recording')}.avi`;
 
-    it('starts a screencast recording with temp file when no filePath', async () => {
-      await withMcpContext(async (response, context) => {
-        const mockRecorder = createMockRecorder();
-        const selectedPage = context.getSelectedMcpPage().pptrPage;
-        const screencastStub = sinon
-          .stub(selectedPage, 'screencast')
-          .resolves(mockRecorder as never);
-
-        await startScreencast().handler(
-          {params: {}, page: context.getSelectedMcpPage()},
+      await assert.rejects(
+        startScreencast().handler(
+          {
+            params: {filePath},
+            page,
+          },
           response,
           context,
-        );
+        ),
+        /Unsupported screencast file extension/,
+      );
 
-        sinon.assert.calledOnce(screencastStub);
-        const callArgs = screencastStub.firstCall.args[0];
-        assert.ok(callArgs);
-        assert.ok(callArgs.path?.endsWith('.mp4'));
-        assert.ok(context.getScreenRecorder() !== null);
+      sinon.assert.notCalled(context.ensureExtension);
+      sinon.assert.notCalled(page.pptrPage.screencast);
+      sinon.assert.notCalled(context.setScreenRecorder);
+    });
+
+    it('starts a screencast recording with temp file when no filePath', async () => {
+      const {page, context, response, mockRecorder} = createScreencastMocks();
+      const expectedPath: `${string}.mp4` = `${path.join(
+        os.tmpdir(),
+        'temp-screencast',
+      )}.mp4`;
+      context.ensureExtension.resolves(expectedPath);
+
+      await startScreencast().handler({params: {}, page}, response, context);
+
+      sinon.assert.calledOnce(context.ensureExtension);
+      assert.ok(context.ensureExtension.firstCall.args[0].endsWith('.mp4'));
+      assert.strictEqual(context.ensureExtension.firstCall.args[1], '.mp4');
+      sinon.assert.calledOnceWithExactly(page.pptrPage.screencast, {
+        path: expectedPath,
+        format: 'mp4',
+        ffmpegPath: undefined,
+        fps: undefined,
+      });
+      sinon.assert.calledOnceWithExactly(context.setScreenRecorder, {
+        recorder: mockRecorder,
+        filePath: expectedPath,
       });
     });
 
     it('errors if a recording is already active', async () => {
-      await withMcpContext(async (response, context) => {
-        const mockRecorder = createMockRecorder();
-        context.setScreenRecorder({
-          recorder: mockRecorder as never,
-          filePath: path.join(os.tmpdir(), 'existing.mp4'),
-        });
-
-        const selectedPage = context.getSelectedMcpPage().pptrPage;
-        const screencastStub = sinon.stub(selectedPage, 'screencast');
-
-        await startScreencast().handler(
-          {params: {}, page: context.getSelectedMcpPage()},
-          response,
-          context,
-        );
-
-        sinon.assert.notCalled(screencastStub);
-        assert.ok(
-          response.responseLines
-            .join('\n')
-            .includes('a screencast recording is already in progress'),
-        );
+      const {page, context, response, mockRecorder} = createScreencastMocks();
+      context.getScreenRecorder.returns({
+        recorder: mockRecorder,
+        filePath: `${path.join(os.tmpdir(), 'existing')}.mp4`,
       });
+
+      await startScreencast().handler({params: {}, page}, response, context);
+
+      sinon.assert.notCalled(context.ensureExtension);
+      sinon.assert.notCalled(page.pptrPage.screencast);
+      sinon.assert.notCalled(context.setScreenRecorder);
+      sinon.assert.calledOnceWithExactly(
+        response.appendResponseLine,
+        'Error: a screencast recording is already in progress. Use screencast_stop to stop it before starting a new one.',
+      );
     });
 
     it('provides a clear error when ffmpeg is not found', async () => {
-      await withMcpContext(async (response, context) => {
-        const selectedPage = context.getSelectedMcpPage().pptrPage;
-        const error = new Error('spawn ffmpeg ENOENT');
-        sinon.stub(selectedPage, 'screencast').rejects(error);
-
-        await assert.rejects(
-          startScreencast().handler(
-            {
-              params: {filePath: path.join(os.tmpdir(), 'test.mp4')},
-              page: context.getSelectedMcpPage(),
-            },
-            response,
-            context,
-          ),
-          /ffmpeg is required for screencast recording/,
-        );
-
-        assert.strictEqual(context.getScreenRecorder(), null);
-      });
+      const {page, context, response} = createScreencastMocks();
+      const filePath: `${string}.mp4` = `${path.join(os.tmpdir(), 'test')}.mp4`;
+      context.ensureExtension.resolves(filePath);
+      page.pptrPage.screencast.rejects(new Error('spawn ffmpeg ENOENT'));
+
+      await assert.rejects(
+        startScreencast().handler(
+          {
+            params: {filePath},
+            page,
+          },
+          response,
+          context,
+        ),
+        /ffmpeg is required for screencast recording/,
+      );
+
+      sinon.assert.calledOnceWithExactly(
+        context.ensureExtension,
+        filePath,
+        '.mp4',
+      );
+      sinon.assert.notCalled(context.setScreenRecorder);
     });
 
     it('cleans up the generated temp directory if recording fails to start', async () => {
-      await withMcpContext(async (response, context) => {
-        const selectedPage = context.getSelectedMcpPage().pptrPage;
-        const screencastStub = sinon
-          .stub(selectedPage, 'screencast')
-          .rejects(new Error('spawn ffmpeg ENOENT'));
-
-        await assert.rejects(
-          startScreencast().handler(
-            {params: {}, page: context.getSelectedMcpPage()},
-            response,
-            context,
-          ),
-          /ffmpeg is required for screencast recording/,
-        );
-
-        // The temp directory generateTempFilePath() created must be removed.
-        const tempPath = screencastStub.firstCall.args[0]?.path as string;
-        assert.ok(tempPath);
-        await assert.rejects(fs.access(path.dirname(tempPath)));
-        assert.strictEqual(context.getScreenRecorder(), null);
-      });
+      const {page, context, response} = createScreencastMocks();
+      context.ensureExtension.callsFake(async filePath => `${filePath}.mp4`);
+      page.pptrPage.screencast.rejects(new Error('spawn ffmpeg ENOENT'));
+
+      await assert.rejects(
+        startScreencast().handler({params: {}, page}, response, context),
+        /ffmpeg is required for screencast recording/,
+      );
+
+      const tempPath = page.pptrPage.screencast.firstCall.args[0]?.path;
+      assert.ok(tempPath);
+      await assert.rejects(fs.access(path.dirname(tempPath)));
+      sinon.assert.notCalled(context.setScreenRecorder);
     });
 
     it('passes ffmpegPath from args to puppeteer', async () => {
-      await withMcpContext(async (response, context) => {
-        const mockRecorder = createMockRecorder();
-        const selectedPage = context.getSelectedMcpPage().pptrPage;
-        const screencastStub = sinon
-          .stub(selectedPage, 'screencast')
-          .resolves(mockRecorder as never);
-
-        const experimentalFfmpegPath = '/custom/path/to/ffmpeg';
-        await startScreencast({
-          experimentalFfmpegPath,
-        } as ParsedArguments).handler(
-          {params: {}, page: context.getSelectedMcpPage()},
-          response,
-          context,
-        );
+      const {page, context, response, mockRecorder} = createScreencastMocks();
+      const filePath: `${string}.mp4` = `${path.join(os.tmpdir(), 'test')}.mp4`;
+      context.ensureExtension.resolves(filePath);
+
+      const experimentalFfmpegPath = '/custom/path/to/ffmpeg';
+      const args = parseArguments('test', [
+        'node',
+        'test',
+        '--experimental-screencast',
+        `--experimental-ffmpeg-path=${experimentalFfmpegPath}`,
+      ]);
+      await startScreencast(args).handler(
+        {params: {filePath}, page},
+        response,
+        context,
+      );
+
+      sinon.assert.calledOnceWithExactly(
+        context.ensureExtension,
+        filePath,
+        '.mp4',
+      );
+      sinon.assert.calledOnceWithExactly(page.pptrPage.screencast, {
+        path: filePath,
+        format: 'mp4',
+        ffmpegPath: experimentalFfmpegPath,
+        fps: undefined,
+      });
+      sinon.assert.calledOnceWithExactly(context.setScreenRecorder, {
+        recorder: mockRecorder,
+        filePath,
+      });
+    });
 
-        sinon.assert.calledOnce(screencastStub);
-        const callArgs = screencastStub.firstCall.args[0];
-        assert.strictEqual(callArgs?.ffmpegPath, experimentalFfmpegPath);
+    it('passes screencast fps from args to puppeteer', async () => {
+      const {page, context, response, mockRecorder} = createScreencastMocks();
+      const filePath: `${string}.mp4` = `${path.join(os.tmpdir(), 'test')}.mp4`;
+      context.ensureExtension.resolves(filePath);
+
+      const args = parseArguments('test', [
+        'node',
+        'test',
+        '--experimental-screencast',
+        '--experimental-screencast-fps=10',
+      ]);
+      await startScreencast(args).handler(
+        {params: {filePath}, page},
+        response,
+        context,
+      );
+
+      sinon.assert.calledOnceWithExactly(
+        context.ensureExtension,
+        filePath,
+        '.mp4',
+      );
+      sinon.assert.calledOnceWithExactly(page.pptrPage.screencast, {
+        path: filePath,
+        format: 'mp4',
+        ffmpegPath: undefined,
+        fps: 10,
+      });
+      sinon.assert.calledOnceWithExactly(context.setScreenRecorder, {
+        recorder: mockRecorder,
+        filePath,
       });
     });
   });
 
   describe('screencast_stop', () => {
     it('returns an error message if no recording is active', async () => {
-      await withMcpContext(async (response, context) => {
-        assert.strictEqual(context.getScreenRecorder(), null);
-        await stopScreencast.handler(
-          {params: {}, page: context.getSelectedMcpPage()},
-          response,
-          context,
-        );
-        assert.ok(
-          response.responseLines
-            .join('\n')
-            .includes('no active screencast recording to stop'),
-        );
-      });
+      const {page, context, response} = createScreencastMocks();
+      await stopScreencast.handler({params: {}, page}, response, context);
+      sinon.assert.notCalled(context.setScreenRecorder);
+      sinon.assert.calledOnceWithExactly(
+        response.appendResponseLine,
+        'Error: no active screencast recording to stop.',
+      );
     });
 
     it('stops an active recording and reports the file path', async () => {
-      await withMcpContext(async (response, context) => {
-        const mockRecorder = createMockRecorder();
-        const filePath = path.join(os.tmpdir(), 'test-recording.mp4');
-        context.setScreenRecorder({
-          recorder: mockRecorder as never,
-          filePath,
-        });
-
-        await stopScreencast.handler(
-          {params: {}, page: context.getSelectedMcpPage()},
-          response,
-          context,
-        );
-
-        sinon.assert.calledOnce(mockRecorder.stop);
-        assert.strictEqual(context.getScreenRecorder(), null);
-        assert.ok(
-          response.responseLines
-            .join('\n')
-            .includes(`stopped and saved to ${filePath}`),
-        );
+      const {page, context, response, mockRecorder} = createScreencastMocks();
+      const filePath = `${path.join(os.tmpdir(), 'test-recording')}.mp4`;
+      context.getScreenRecorder.returns({
+        recorder: mockRecorder,
+        filePath,
       });
+
+      await stopScreencast.handler({params: {}, page}, response, context);
+
+      sinon.assert.calledOnce(mockRecorder.stop);
+      sinon.assert.calledOnceWithExactly(context.setScreenRecorder, null);
+      sinon.assert.calledOnceWithExactly(
+        response.appendResponseLine,
+        `The screencast recording has been stopped and saved to ${filePath}.`,
+      );
     });
 
     it('clears the recorder even if stop() throws', async () => {
-      await withMcpContext(async (response, context) => {
-        const mockRecorder = createMockRecorder();
-        mockRecorder.stop.rejects(new Error('ffmpeg process error'));
-        context.setScreenRecorder({
-          recorder: mockRecorder as never,
-          filePath: path.join(os.tmpdir(), 'test.mp4'),
-        });
-
-        await assert.rejects(
-          stopScreencast.handler(
-            {params: {}, page: context.getSelectedMcpPage()},
-            response,
-            context,
-          ),
-          /ffmpeg process error/,
-        );
-
-        assert.strictEqual(context.getScreenRecorder(), null);
+      const {page, context, response, mockRecorder} = createScreencastMocks();
+      mockRecorder.stop.rejects(new Error('ffmpeg process error'));
+      const filePath = `${path.join(os.tmpdir(), 'test')}.mp4`;
+      context.getScreenRecorder.returns({
+        recorder: mockRecorder,
+        filePath,
       });
+
+      await assert.rejects(
+        stopScreencast.handler({params: {}, page}, response, context),
+        /ffmpeg process error/,
+      );
+
+      sinon.assert.calledOnce(mockRecorder.stop);
+      sinon.assert.calledOnceWithExactly(context.setScreenRecorder, null);
     });
   });
 });
diff --git a/tests/tools/screenshot.test.ts b/tests/tools/screenshot.test.ts
index 327c073e..587bec5e 100644
--- a/tests/tools/screenshot.test.ts
+++ b/tests/tools/screenshot.test.ts
@@ -12,9 +12,10 @@ import {describe, it, afterEach} from 'node:test';
 
 import sinon from 'sinon';
 
-import type {ParsedArguments} from '../../src/bin/chrome-devtools-mcp-cli-options.js';
+import type {ParsedArguments} from '../../src/config/mcp-options.js';
 import {TextSnapshot} from '../../src/TextSnapshot.js';
 import {screenshot} from '../../src/tools/screenshot.js';
+import {resolveCanonicalPath} from '../../src/utils/files.js';
 import {screenshots} from '../snapshot.js';
 import {html, withMcpContext} from '../utils.js';
 
@@ -274,9 +275,10 @@ describe('screenshot', () => {
             response.responseLines.at(0),
             "Took a screenshot of the current page's viewport.",
           );
+          const canonicalFilePath = await resolveCanonicalPath(filePath);
           assert.equal(
             response.responseLines.at(1),
-            `Saved screenshot to ${filePath}.`,
+            `Saved screenshot to ${canonicalFilePath}.`,
           );
 
           const stats = await stat(filePath);
@@ -401,6 +403,45 @@ describe('screenshot', () => {
       });
     });
 
+    it('honors screenshotMaxWidth at device scale factors above 1', async () => {
+      const tool = screenshot({
+        screenshotMaxWidth: 100,
+      } as ParsedArguments);
+      await withMcpContext(
+        async (response, context) => {
+          const page = context.getSelectedMcpPage().pptrPage;
+          assert.equal(page.viewport(), null);
+          await page.setContent(
+            html`<div style="width:100vw;height:100vh;background:red"></div>`,
+          );
+          const source = await page.evaluate(() => ({
+            width: window.innerWidth,
+            height: window.innerHeight,
+            devicePixelRatio: window.devicePixelRatio,
+          }));
+          assert.equal(source.devicePixelRatio, 2);
+
+          await tool.handler(
+            {params: {format: 'png'}, page: context.getSelectedMcpPage()},
+            response,
+            context,
+          );
+
+          assert.equal(response.images.length, 1);
+          const buf = Buffer.from(response.images[0].data, 'base64');
+          assert.equal(pngWidth(buf), 100);
+          const expectedHeight = Math.round(
+            source.height * (100 / source.width),
+          );
+          assert.ok(
+            Math.abs(pngHeight(buf) - expectedHeight) <= 1,
+            `expected height ~${expectedHeight}, got ${pngHeight(buf)}`,
+          );
+        },
+        {args: ['--force-device-scale-factor=2']},
+      );
+    });
+
     it('downscales viewport screenshot when no viewport is emulated', async () => {
       const tool = screenshot({
         screenshotMaxWidth: 100,
diff --git a/tests/tools/script.test.ts b/tests/tools/script.test.ts
index f5689293..c92811e2 100644
--- a/tests/tools/script.test.ts
+++ b/tests/tools/script.test.ts
@@ -10,8 +10,9 @@ import {describe, it} from 'node:test';
 
 import sinon from 'sinon';
 
-import type {ParsedArguments} from '../../src/bin/chrome-devtools-mcp-cli-options.js';
+import type {ParsedArguments} from '../../src/config/mcp-options.js';
 import {TextSnapshot} from '../../src/TextSnapshot.js';
+import {zod} from '../../src/third_party/index.js';
 import {installExtension} from '../../src/tools/extensions.js';
 import {evaluateScript} from '../../src/tools/script.js';
 import {WaitForHelper} from '../../src/utils/WaitForHelper.js';
@@ -19,7 +20,6 @@ import {serverHooks} from '../server.js';
 import {
   assertNoServiceWorkerReported,
   extractExtensionId,
-  getTextContent,
   html,
   withMcpContext,
 } from '../utils.js';
@@ -72,30 +72,6 @@ describe('script', () => {
         }
       });
     });
-    it('still awaits a navigation when waitForStableDom is false', async () => {
-      await withMcpContext(async (response, context) => {
-        server.addHtmlRoute('/nav-target', html`<main>navigated</main>`);
-        const url = server.getRoute('/nav-target');
-        await evaluateScript().handler(
-          {
-            params: {
-              function: `() => {
-                location.href = '${url}';
-              }`,
-              waitForStableDom: false,
-            },
-          },
-          response,
-          context,
-        );
-        const result = await response.handle(context);
-        const textContent = getTextContent(result.content[0]);
-        assert.ok(
-          textContent.includes(`Page navigated to ${url}`),
-          `Expected the navigation to be awaited and reported, got: ${textContent}`,
-        );
-      });
-    });
     it('runs in selected page', async () => {
       await withMcpContext(async (response, context) => {
         await evaluateScript().handler(
@@ -426,7 +402,7 @@ describe('script', () => {
                 params: {
                   function: String(() => 'test'),
                   serviceWorkerId: 'example_service_worker',
-                  pageId: '1',
+                  pageId: 1,
                 },
               },
               response,
@@ -469,5 +445,41 @@ describe('script', () => {
         {categoryExtensions: true},
       );
     });
+
+    it('makes pageId optional in schema when categoryExtensions is true and pageIdRouting is true', () => {
+      const tool = evaluateScript({
+        categoryExtensions: true,
+        pageIdRouting: true,
+      } as ParsedArguments);
+      const schema = zod.object(tool.schema);
+      const validSw = schema.safeParse({
+        function: '() => 1',
+        serviceWorkerId: 'sw_1',
+      });
+      assert.strictEqual(validSw.success, true);
+
+      const validPage = schema.safeParse({
+        function: '() => 1',
+        pageId: 1,
+      });
+      assert.strictEqual(validPage.success, true);
+    });
+
+    it('makes pageId required in schema when categoryExtensions is false and pageIdRouting is true', () => {
+      const tool = evaluateScript({
+        pageIdRouting: true,
+      } as ParsedArguments);
+      const schema = zod.object(tool.schema);
+      const resultWithoutPageId = schema.safeParse({
+        function: '() => 1',
+      });
+      assert.strictEqual(resultWithoutPageId.success, false);
+
+      const resultWithPageId = schema.safeParse({
+        function: '() => 1',
+        pageId: 1,
+      });
+      assert.strictEqual(resultWithPageId.success, true);
+    });
   });
 });
diff --git a/tests/tools/slim/tools.test.ts b/tests/tools/slim/tools.test.ts
index 45a75da5..c6c5bb26 100644
--- a/tests/tools/slim/tools.test.ts
+++ b/tests/tools/slim/tools.test.ts
@@ -9,6 +9,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import {describe, it} from 'node:test';
 
+import {parseArguments} from '../../../src/config/mcp-options.js';
 import {evaluate, navigate, screenshot} from '../../../src/tools/slim/tools.js';
 import {screenshots} from '../../snapshot.js';
 import {withMcpContext} from '../../utils.js';
@@ -48,7 +49,7 @@ describe('slim', () => {
 
   it('navigates to correct page', async t => {
     await withMcpContext(async (response, context) => {
-      await navigate.handler(
+      await navigate().handler(
         {
           params: {url: 'data:text/html,<div>Hello MCP</div>'},
           page: context.getSelectedMcpPage(),
@@ -66,6 +67,122 @@ describe('slim', () => {
     });
   });
 
+  it('throws when URL does not parse with new URL', async () => {
+    await withMcpContext(async (response, context) => {
+      await assert.rejects(
+        async () => {
+          await navigate().handler(
+            {
+              params: {url: 'not a valid url'},
+              page: context.getSelectedMcpPage(),
+            },
+            response,
+            context,
+          );
+        },
+        {
+          message:
+            'Invalid URL: "not a valid url". URLs must be valid according to the URL standard.',
+        },
+      );
+    });
+  });
+
+  it('disallows javascript, data, and vbscript URLs when javascriptEvaluation is false', async () => {
+    await withMcpContext(async (response, context) => {
+      const disabledArgs = parseArguments(
+        '1.0.0',
+        ['node', 'script.js', '--slim', '--no-javascript-evaluation'],
+        {CHROME_DEVTOOLS_MCP_NO_USAGE_STATISTICS: 'true'},
+      );
+      const tool = navigate(disabledArgs);
+      await assert.rejects(
+        async () => {
+          await tool.handler(
+            {
+              params: {url: 'javascript:alert(1)'},
+              page: context.getSelectedMcpPage(),
+            },
+            response,
+            context,
+          );
+        },
+        {
+          message:
+            'Navigating to javascript: URLs is not allowed when JavaScript evaluation is disabled.',
+        },
+      );
+      await assert.rejects(
+        async () => {
+          await tool.handler(
+            {
+              params: {url: 'data:text/html,<div>test</div>'},
+              page: context.getSelectedMcpPage(),
+            },
+            response,
+            context,
+          );
+        },
+        {
+          message:
+            'Navigating to data: URLs is not allowed when JavaScript evaluation is disabled.',
+        },
+      );
+      await assert.rejects(
+        async () => {
+          await tool.handler(
+            {
+              params: {url: 'vbscript:msgbox(1)'},
+              page: context.getSelectedMcpPage(),
+            },
+            response,
+            context,
+          );
+        },
+        {
+          message:
+            'Navigating to vbscript: URLs is not allowed when JavaScript evaluation is disabled.',
+        },
+      );
+    });
+  });
+
+  it('rejects chrome: and chrome-untrusted: URLs', async () => {
+    await withMcpContext(async (response, context) => {
+      const tool = navigate();
+      await assert.rejects(
+        async () => {
+          await tool.handler(
+            {
+              params: {url: 'chrome://settings'},
+              page: context.getSelectedMcpPage(),
+            },
+            response,
+            context,
+          );
+        },
+        {
+          message: 'Navigating to chrome: URLs is not allowed.',
+        },
+      );
+      await assert.rejects(
+        async () => {
+          await tool.handler(
+            {
+              params: {url: 'chrome-untrusted://terminal'},
+              page: context.getSelectedMcpPage(),
+            },
+            response,
+            context,
+          );
+        },
+        {
+          message: 'Navigating to chrome-untrusted: URLs is not allowed.',
+        },
+      );
+    });
+  });
+
   it('with default options', async () => {
     await withMcpContext(async (response, context) => {
       const fixture = screenshots.basic;
diff --git a/tests/tools/snapshot.test.ts b/tests/tools/snapshot.test.ts
index 5a6f5c45..1bc5bb91 100644
--- a/tests/tools/snapshot.test.ts
+++ b/tests/tools/snapshot.test.ts
@@ -4,190 +4,79 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 
-import assert from 'node:assert';
-import {describe, it} from 'node:test';
+import {afterEach, describe, it} from 'node:test';
+
+import sinon from 'sinon';
 
 import {takeSnapshot, waitFor} from '../../src/tools/snapshot.js';
-import {html, withMcpContext} from '../utils.js';
+import {createHandlerMocks} from '../mocks.js';
 
 describe('snapshot', () => {
-  describe('browser_snapshot', () => {
-    it('includes a snapshot', async () => {
-      await withMcpContext(async (response, context) => {
-        await takeSnapshot.handler(
-          {params: {}, page: context.getSelectedMcpPage()},
-          response,
-          context,
-        );
-        assert.ok(response.includeSnapshot);
-      });
-    });
+  afterEach(() => {
+    sinon.restore();
   });
-  describe('browser_wait_for', () => {
-    it('should work', async () => {
-      await withMcpContext(async (response, context) => {
-        const page = context.getSelectedMcpPage().pptrPage;
-
-        await page.setContent(
-          html`<main><span>Hello</span><span> </span><div>World</div></main>`,
-        );
-        await waitFor.handler(
-          {
-            params: {
-              text: ['Hello'],
-            },
-            page: context.getSelectedMcpPage(),
-          },
-          response,
-          context,
-        );
-
-        assert.equal(
-          response.responseLines[0],
-          'Element matching one of ["Hello"] found.',
-        );
-        assert.ok(response.includeSnapshot);
-      });
-    });
-
-    it('should work with any-match array', async () => {
-      await withMcpContext(async (response, context) => {
-        const page = context.getSelectedMcpPage().pptrPage;
-
-        await page.setContent(
-          html`<main><span>Status</span><div>Error</div></main>`,
-        );
-        await waitFor.handler(
-          {
-            params: {
-              text: ['Complete', 'Error'],
-            },
-            page: context.getSelectedMcpPage(),
-          },
-          response,
-          context,
-        );
-
-        assert.equal(
-          response.responseLines[0],
-          'Element matching one of ["Complete","Error"] found.',
-        );
-        assert.ok(response.includeSnapshot);
-      });
-    });
-
-    it('should work with any-match array when element shows up later', async () => {
-      await withMcpContext(async (response, context) => {
-        const page = context.getSelectedMcpPage().pptrPage;
-
-        const handlePromise = waitFor.handler(
-          {
-            params: {
-              text: ['Complete', 'Error'],
-            },
-            page: context.getSelectedMcpPage(),
-          },
-          response,
-          context,
-        );
 
-        await page.setContent(
-          html`<main
-            ><span>Hello</span><span> </span><div>Complete</div></main
-          >`,
-        );
-
-        await handlePromise;
-
-        assert.equal(
-          response.responseLines[0],
-          'Element matching one of ["Complete","Error"] found.',
-        );
-        assert.ok(response.includeSnapshot);
+  describe('take_snapshot', () => {
+    it('includes a snapshot', async () => {
+      const {page, context, response} = createHandlerMocks();
+      await takeSnapshot.handler({params: {}, page}, response, context);
+      sinon.assert.calledOnceWithExactly(response.includeSnapshot, {
+        verbose: false,
+        filePath: undefined,
       });
     });
 
-    it('should work with element that show up later', async () => {
-      await withMcpContext(async (response, context) => {
-        const page = context.getSelectedMcpPage().pptrPage;
-
-        const handlePromise = waitFor.handler(
-          {
-            params: {
-              text: ['Hello World'],
-            },
-            page: context.getSelectedMcpPage(),
-          },
-          response,
-          context,
-        );
-
-        await page.setContent(
-          html`<main><span>Hello</span><span> </span><div>World</div></main>`,
-        );
-
-        await handlePromise;
-
-        assert.equal(
-          response.responseLines[0],
-          'Element matching one of ["Hello World"] found.',
-        );
-        assert.ok(response.includeSnapshot);
+    it('includes a snapshot with parameters', async () => {
+      const {page, context, response} = createHandlerMocks();
+      await takeSnapshot.handler(
+        {params: {verbose: true, filePath: 'custom/path.txt'}, page},
+        response,
+        context,
+      );
+      sinon.assert.calledOnceWithExactly(response.includeSnapshot, {
+        verbose: true,
+        filePath: 'custom/path.txt',
       });
     });
-    it('should work with aria elements', async () => {
-      await withMcpContext(async (response, context) => {
-        const page = context.getSelectedMcpPage().pptrPage;
-
-        await page.setContent(
-          html`<main><h1>Header</h1><div>Text</div></main>`,
-        );
-
-        await waitFor.handler(
-          {
-            params: {
-              text: ['Header'],
-            },
-            page: context.getSelectedMcpPage(),
-          },
-          response,
-          context,
-        );
+  });
 
-        assert.equal(
-          response.responseLines[0],
-          'Element matching one of ["Header"] found.',
-        );
-        assert.ok(response.includeSnapshot);
-      });
+  describe('wait_for', () => {
+    it('waits for text and appends response line', async () => {
+      const {page, context, response} = createHandlerMocks();
+      await waitFor.handler(
+        {params: {text: ['Hello']}, page},
+        response,
+        context,
+      );
+      sinon.assert.calledOnceWithExactly(
+        page.waitForTextOnPage,
+        ['Hello'],
+        undefined,
+      );
+      sinon.assert.calledOnceWithExactly(
+        response.appendResponseLine,
+        'Element matching one of ["Hello"] found.',
+      );
+      sinon.assert.calledOnceWithExactly(response.includeSnapshot);
     });
 
-    it('should work with iframe content', async () => {
-      await withMcpContext(async (response, context) => {
-        const page = context.getSelectedMcpPage().pptrPage;
-
-        await page.setContent(
-          html`<h1>Top level</h1>
-            <iframe srcdoc="<p>Hello iframe</p>"></iframe>`,
-        );
-
-        await waitFor.handler(
-          {
-            params: {
-              text: ['Hello iframe'],
-            },
-            page: context.getSelectedMcpPage(),
-          },
-          response,
-          context,
-        );
-
-        assert.equal(
-          response.responseLines[0],
-          'Element matching one of ["Hello iframe"] found.',
-        );
-        assert.ok(response.includeSnapshot);
-      });
+    it('waits for text with timeout', async () => {
+      const {page, context, response} = createHandlerMocks();
+      await waitFor.handler(
+        {params: {text: ['Complete', 'Error'], timeout: 5000}, page},
+        response,
+        context,
+      );
+      sinon.assert.calledOnceWithExactly(
+        page.waitForTextOnPage,
+        ['Complete', 'Error'],
+        5000,
+      );
+      sinon.assert.calledOnceWithExactly(
+        response.appendResponseLine,
+        'Element matching one of ["Complete","Error"] found.',
+      );
+      sinon.assert.calledOnceWithExactly(response.includeSnapshot);
     });
   });
 });
diff --git a/tests/trace-processing/parse.test.js.snapshot b/tests/trace-processing/parse.test.js.snapshot
index bf59cc4f..4ad0153f 100644
--- a/tests/trace-processing/parse.test.js.snapshot
+++ b/tests/trace-processing/parse.test.js.snapshot
@@ -30,7 +30,7 @@ Available insights:
     example question: Which LCP subpart was most problematic?
     example question: What can I do to reduce the LCP time for this page load?
   - insight name: LCPDiscovery
-    description: [Optimize LCP](https://developer.chrome.com/docs/performance/insights/lcp-discovery) by making the LCP image discoverable from the HTML immediately, and avoiding lazy-loading
+    description: [Optimize LCP](https://developer.chrome.com/docs/performance/insights/lcp-discovery) by making the LCP image discoverable from the HTML immediately, and avoiding lazy-loading.
     relevant trace bounds: {min: 122411004828µs, max: 122411055039µs}
     example question: Suggest fixes to reduce my LCP
     example question: What can I do to reduce my LCP discovery time?
diff --git a/tests/utils.ts b/tests/utils.ts
index 1970ad6f..794b49ac 100644
--- a/tests/utils.ts
+++ b/tests/utils.ts
@@ -24,13 +24,15 @@ import type {
 } from 'puppeteer-core';
 import sinon from 'sinon';
 
-import type {ParsedArguments} from '../src/bin/chrome-devtools-mcp-cli-options.js';
+import type {ParsedArguments} from '../src/config/mcp-options.js';
 import {McpContext} from '../src/McpContext.js';
 import {McpResponse} from '../src/McpResponse.js';
 import {TextSnapshot} from '../src/TextSnapshot.js';
 import {DevTools} from '../src/third_party/index.js';
 import {stableIdSymbol} from '../src/utils/id.js';
 
+import {createMockPuppeteerPage, mockListener} from './mocks.js';
+
 export function assertNoServiceWorkerReported(targets: Target[], id: string) {
   const target = targets.find(target => {
     return target.url().includes(id) && target.type() === 'service_worker';
@@ -161,6 +163,7 @@ export async function withMcpContext(
     debug?: boolean;
     autoOpenDevTools?: boolean;
     performanceCrux?: boolean;
+    sourceMaps?: boolean;
     executablePath?: string;
     args?: string[];
     blockedUrlPattern?: string[];
@@ -183,12 +186,14 @@ export async function withMcpContext(
       {
         experimentalDevToolsDebugging: false,
         performanceCrux: options.performanceCrux ?? true,
+        sourceMaps: options.sourceMaps ?? true,
         allowList: options.allowedUrlPattern,
         blocklist: options.blockedUrlPattern,
         allowUnrestrictedPaths: options.allowUnrestrictedPaths ?? false,
         navigationTimeout:
           options.navigationTimeout ??
           (process.platform === 'win32' ? 20000 : undefined),
+        categoryExtensions: args?.categoryExtensions,
       },
       Locator,
     );
@@ -302,6 +307,9 @@ export function html(
 }
 
 export function stabilizeStructuredContent(content: unknown): string {
+  if (typeof content === 'string') {
+    return stabilizeResponseOutput(content);
+  }
   const stabilize = (c: unknown): unknown => {
     if (typeof c === 'string') {
       return stabilizeResponseOutput(c);
@@ -371,53 +379,24 @@ export function getMockAggregatedIssue(): sinon.SinonStubbedInstance<DevTools.Ag
   return mockAggregatedIssue;
 }
 
-export function mockListener() {
-  const listeners: Record<string, Array<(data: unknown) => void>> = {};
-  return {
-    on(eventName: string, listener: (data: unknown) => void) {
-      if (listeners[eventName]) {
-        listeners[eventName].push(listener);
-      } else {
-        listeners[eventName] = [listener];
-      }
-    },
-    off(_eventName: string, _listener: (data: unknown) => void) {
-      // no-op
-    },
-    emit(eventName: string, data: unknown) {
-      for (const listener of listeners[eventName] ?? []) {
-        listener(data);
-      }
-    },
-  };
-}
-
-export function getMockPage(): Page {
-  const mainFrame = {} as Frame;
-  const cdpSession = {
-    ...mockListener(),
-    send: () => {
-      // no-op
-    },
-    target: () => ({_targetId: '<mock target ID>'}),
-  };
-  return {
-    mainFrame() {
-      return mainFrame;
-    },
-    ...mockListener(),
-    // @ts-expect-error internal API.
-    _client() {
-      return cdpSession;
-    },
-  } satisfies Page;
-}
-
 export function getMockBrowser(options?: {
   process?: ChildProcess | null;
   wsEndpoint?: string;
 }): Browser {
-  const pages = [getMockPage()];
+  const page = createMockPuppeteerPage();
+  const listener = mockListener();
+  page.on.callsFake((eventName, handler) => {
+    listener.on(eventName, handler);
+    return page;
+  });
+  page.off.callsFake((eventName, handler) => {
+    if (handler) {
+      listener.off(eventName, handler);
+    }
+    return page;
+  });
+  (page as unknown as {emit: typeof listener.emit}).emit = listener.emit;
+  const pages = [page as unknown as Page];
   return {
     process() {
       return options?.process ?? null;
diff --git a/tests/utils/bytes.test.ts b/tests/utils/bytes.test.ts
new file mode 100644
index 00000000..1b938dab
--- /dev/null
+++ b/tests/utils/bytes.test.ts
@@ -0,0 +1,122 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import assert from 'node:assert';
+import {describe, it} from 'node:test';
+
+import {
+  byteSizeRangeSchema,
+  parseByteSize,
+  parseByteSizeRange,
+} from '../../src/utils/bytes.js';
+
+describe('parseByteSize', () => {
+  it('should parse plain numeric strings', () => {
+    assert.strictEqual(parseByteSize('0'), 0);
+    assert.strictEqual(parseByteSize('1024'), 1024);
+    assert.strictEqual(parseByteSize('  1048576  '), 1048576);
+  });
+
+  it('should parse bytes units', () => {
+    assert.strictEqual(parseByteSize('100B'), 100);
+    assert.strictEqual(parseByteSize('100b'), 100);
+    assert.strictEqual(parseByteSize('100 Bytes'), 100);
+    assert.strictEqual(parseByteSize('100 byte'), 100);
+  });
+
+  it('should parse kilobytes units', () => {
+    assert.strictEqual(parseByteSize('1K'), 1000);
+    assert.strictEqual(parseByteSize('1k'), 1000);
+    assert.strictEqual(parseByteSize('1KB'), 1000);
+    assert.strictEqual(parseByteSize('1kb'), 1000);
+    assert.strictEqual(parseByteSize('1KiB'), 1024);
+    assert.strictEqual(parseByteSize('1.5 KB'), 1500);
+  });
+
+  it('should parse megabytes units', () => {
+    assert.strictEqual(parseByteSize('1M'), 1000000);
+    assert.strictEqual(parseByteSize('1m'), 1000000);
+    assert.strictEqual(parseByteSize('1MB'), 1000000);
+    assert.strictEqual(parseByteSize('1mb'), 1000000);
+    assert.strictEqual(parseByteSize('1MiB'), 1048576);
+    assert.strictEqual(parseByteSize('2.5MB'), 2500000);
+  });
+
+  it('should parse gigabytes units', () => {
+    assert.strictEqual(parseByteSize('1G'), 1000000000);
+    assert.strictEqual(parseByteSize('1g'), 1000000000);
+    assert.strictEqual(parseByteSize('1GB'), 1000000000);
+    assert.strictEqual(parseByteSize('1gb'), 1000000000);
+    assert.strictEqual(parseByteSize('1GiB'), 1073741824);
+    assert.strictEqual(parseByteSize('0.5GB'), 500000000);
+  });
+
+  it('should parse terabytes units', () => {
+    assert.strictEqual(parseByteSize('1T'), 1000000000000);
+    assert.strictEqual(parseByteSize('1TB'), 1000000000000);
+    assert.strictEqual(parseByteSize('1TiB'), 1099511627776);
+  });
+
+  it('should throw for invalid inputs', () => {
+    assert.throws(() => parseByteSize(''), /Invalid byte size/);
+    assert.throws(() => parseByteSize('   '), /Invalid byte size/);
+    assert.throws(() => parseByteSize('abc'), /Invalid byte size/);
+    assert.throws(() => parseByteSize('10XYZ'), /Unknown unit/);
+    assert.throws(() => parseByteSize('-10MB'), /Invalid byte size/);
+    assert.throws(() => parseByteSize(`${'9'.repeat(300)}TB`), /Invalid byte/);
+  });
+
+  it('should parse inclusive byte-size ranges', () => {
+    assert.deepStrictEqual(parseByteSizeRange('10M'), {
+      min: 10 * 1000 * 1000,
+      max: undefined,
+    });
+    assert.deepStrictEqual(parseByteSizeRange('1KB-2MiB'), {
+      min: 1000,
+      max: 2 * 1024 * 1024,
+    });
+    assert.deepStrictEqual(parseByteSizeRange('-1MB'), {
+      min: 0,
+      max: 1000 * 1000,
+    });
+    assert.deepStrictEqual(parseByteSizeRange('1MiB-'), {
+      min: 1024 * 1024,
+      max: undefined,
+    });
+    assert.deepStrictEqual(parseByteSizeRange(' 1 KB - 2 MB '), {
+      min: 1000,
+      max: 2 * 1000 * 1000,
+    });
+  });
+
+  it('should reject invalid byte-size ranges', () => {
+    assert.throws(() => parseByteSizeRange(''), /Invalid byte size/);
+    assert.throws(() => parseByteSizeRange('-'), /At least one bound/);
+    assert.throws(() => parseByteSizeRange('2MB-1MB'), /lower bound/);
+    assert.throws(() => parseByteSizeRange('1MB-2MB-3MB'), /Invalid byte/);
+    assert.throws(() => parseByteSizeRange('invalid-1MB'), /Invalid byte/);
+  });
+});
+
+describe('byteSizeRangeSchema', () => {
+  it('parses valid byte-size range string', () => {
+    const schema = byteSizeRangeSchema('test');
+    const result = schema.safeParse('1KB-2MB');
+    assert.strictEqual(result.success, true);
+    if (result.success) {
+      assert.deepStrictEqual(result.data, {
+        min: 1000,
+        max: 2 * 1000 * 1000,
+      });
+    }
+  });
+
+  it('fails for invalid byte-size range string', () => {
+    const schema = byteSizeRangeSchema('test');
+    const result = schema.safeParse('2MB-1MB');
+    assert.strictEqual(result.success, false);
+  });
+});
diff --git a/tests/utils/files.test.ts b/tests/utils/files.test.ts
index 2cfc5e40..032064bb 100644
--- a/tests/utils/files.test.ts
+++ b/tests/utils/files.test.ts
@@ -8,88 +8,113 @@ import assert from 'node:assert';
 import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
-import {describe, it} from 'node:test';
+import {afterEach, beforeEach, describe, it} from 'node:test';
 
 import {resolveCanonicalPath} from '../../src/utils/files.js';
 
 describe('resolveCanonicalPath', () => {
-  it('should resolve an existing standard file path', async () => {
-    const tmpDir = await fs.mkdtemp(
+  let tmpDir: string;
+  let canonicalTmpDir: string;
+
+  beforeEach(async () => {
+    tmpDir = await fs.mkdtemp(
       path.join(os.tmpdir(), 'resolve-canonical-test-'),
     );
-    try {
-      const filePath = path.join(tmpDir, 'test.txt');
-      await fs.writeFile(filePath, 'hello');
-
-      const resolved = await resolveCanonicalPath(filePath);
-      const canonicalTmpDir = await fs.realpath(tmpDir);
-      assert.strictEqual(resolved, path.join(canonicalTmpDir, 'test.txt'));
-    } finally {
-      await fs.rm(tmpDir, {recursive: true, force: true});
-    }
+    canonicalTmpDir = await fs.realpath(tmpDir);
+  });
+
+  afterEach(async () => {
+    await fs.rm(tmpDir, {recursive: true, force: true});
+  });
+
+  it('should resolve an existing standard file path', async () => {
+    const filePath = path.join(tmpDir, 'test.txt');
+    await fs.writeFile(filePath, 'hello');
+
+    const resolved = await resolveCanonicalPath(filePath);
+    assert.strictEqual(resolved, path.join(canonicalTmpDir, 'test.txt'));
   });
 
   it('should resolve a non-existent file whose parent directory exists', async () => {
-    const tmpDir = await fs.mkdtemp(
-      path.join(os.tmpdir(), 'resolve-canonical-test-'),
+    const filePath = path.join(tmpDir, 'non-existent.txt');
+
+    const resolved = await resolveCanonicalPath(filePath);
+    assert.strictEqual(
+      resolved,
+      path.join(canonicalTmpDir, 'non-existent.txt'),
     );
-    try {
-      const filePath = path.join(tmpDir, 'non-existent.txt');
-
-      const resolved = await resolveCanonicalPath(filePath);
-      const canonicalTmpDir = await fs.realpath(tmpDir);
-      assert.strictEqual(
-        resolved,
-        path.join(canonicalTmpDir, 'non-existent.txt'),
-      );
-    } finally {
-      await fs.rm(tmpDir, {recursive: true, force: true});
-    }
   });
 
   it('should resolve a non-existent deeply nested file whose parent directories do not exist', async () => {
-    const tmpDir = await fs.mkdtemp(
-      path.join(os.tmpdir(), 'resolve-canonical-test-'),
+    const filePath = path.join(
+      tmpDir,
+      'nested1',
+      'nested2',
+      'non-existent.txt',
+    );
+
+    const resolved = await resolveCanonicalPath(filePath);
+    assert.strictEqual(
+      resolved,
+      path.join(canonicalTmpDir, 'nested1', 'nested2', 'non-existent.txt'),
     );
-    try {
-      const filePath = path.join(
-        tmpDir,
-        'nested1',
-        'nested2',
-        'non-existent.txt',
-      );
-
-      const resolved = await resolveCanonicalPath(filePath);
-      const canonicalTmpDir = await fs.realpath(tmpDir);
-      assert.strictEqual(
-        resolved,
-        path.join(canonicalTmpDir, 'nested1', 'nested2', 'non-existent.txt'),
-      );
-    } finally {
-      await fs.rm(tmpDir, {recursive: true, force: true});
-    }
   });
 
   it('should resolve existing files with symlinks in path', async () => {
-    const tmpDir = await fs.mkdtemp(
-      path.join(os.tmpdir(), 'resolve-canonical-test-'),
+    const targetDir = path.join(tmpDir, 'target');
+    await fs.mkdir(targetDir);
+    const targetFile = path.join(targetDir, 'file.txt');
+    await fs.writeFile(targetFile, 'hello');
+
+    const symlinkDir = path.join(tmpDir, 'symlink_dir');
+    await fs.symlink(targetDir, symlinkDir, 'dir');
+
+    const filePathWithSymlink = path.join(symlinkDir, 'file.txt');
+
+    const resolved = await resolveCanonicalPath(filePathWithSymlink);
+    const canonicalTargetDir = await fs.realpath(targetDir);
+    assert.strictEqual(resolved, path.join(canonicalTargetDir, 'file.txt'));
+  });
+
+  it('should resolve non-existent files with symlinks in path', async () => {
+    const targetDir = path.join(tmpDir, 'target');
+    await fs.mkdir(targetDir);
+
+    const symlinkDir = path.join(tmpDir, 'symlink_dir');
+    await fs.symlink(targetDir, symlinkDir, 'dir');
+
+    const filePathWithSymlink = path.join(symlinkDir, 'non-existent.txt');
+
+    const resolved = await resolveCanonicalPath(filePathWithSymlink);
+    const canonicalTargetDir = await fs.realpath(targetDir);
+    assert.strictEqual(
+      resolved,
+      path.join(canonicalTargetDir, 'non-existent.txt'),
+    );
+  });
+
+  it('should resolve dangling symlink at the end of path', async () => {
+    const nonExistentTarget = path.join(tmpDir, 'non-existent-target.txt');
+    const danglingSymlink = path.join(tmpDir, 'dangling-symlink.txt');
+    await fs.symlink(nonExistentTarget, danglingSymlink);
+
+    const resolved = await resolveCanonicalPath(danglingSymlink);
+    assert.strictEqual(
+      resolved,
+      path.join(canonicalTmpDir, 'dangling-symlink.txt'),
+    );
+  });
+
+  it('should resolve path with a dangling symlink directory in the middle', async () => {
+    const nonExistentTargetDir = path.join(tmpDir, 'non-existent-dir');
+    const danglingSymlinkDir = path.join(tmpDir, 'dangling-dir');
+    await fs.symlink(nonExistentTargetDir, danglingSymlinkDir, 'dir');
+
+    const filePath = path.join(danglingSymlinkDir, 'file.txt');
+    const resolved = await resolveCanonicalPath(filePath);
+    assert.strictEqual(
+      resolved,
+      path.join(canonicalTmpDir, 'dangling-dir', 'file.txt'),
     );
-    try {
-      const targetDir = path.join(tmpDir, 'target');
-      await fs.mkdir(targetDir);
-      const targetFile = path.join(targetDir, 'file.txt');
-      await fs.writeFile(targetFile, 'hello');
-
-      const symlinkDir = path.join(tmpDir, 'symlink_dir');
-      await fs.symlink(targetDir, symlinkDir, 'dir');
-
-      const filePathWithSymlink = path.join(symlinkDir, 'file.txt');
-
-      const resolved = await resolveCanonicalPath(filePathWithSymlink);
-      const canonicalTargetDir = await fs.realpath(targetDir);
-      assert.strictEqual(resolved, path.join(canonicalTargetDir, 'file.txt'));
-    } finally {
-      await fs.rm(tmpDir, {recursive: true, force: true});
-    }
   });
 });
diff --git a/tests/utils/url.test.ts b/tests/utils/url.test.ts
index 1fadcab1..ac3bb508 100644
--- a/tests/utils/url.test.ts
+++ b/tests/utils/url.test.ts
@@ -7,7 +7,7 @@
 import assert from 'node:assert';
 import {describe, it} from 'node:test';
 
-import {isLocalhost} from '../../src/utils/url.js';
+import {isAllowedUrl, isLocalhost, validateUrl} from '../../src/utils/url.js';
 
 describe('isLocalhost', () => {
   it('should return true for valid localhost and loopback URLs', () => {
@@ -87,3 +87,345 @@ describe('isLocalhost', () => {
     assert.strictEqual(isLocalhost('not a url'), false);
   });
 });
+
+const defaultOptions = {
+  javascriptEvaluation: undefined,
+  categoryExtensions: undefined,
+};
+
+describe('validateUrl', () => {
+  it('should return URL object for valid URLs', () => {
+    assert.strictEqual(
+      validateUrl('https://example.com', defaultOptions).href,
+      'https://example.com/',
+    );
+    assert.strictEqual(
+      validateUrl('http://localhost:3000', defaultOptions).href,
+      'http://localhost:3000/',
+    );
+    assert.strictEqual(
+      validateUrl('about:blank', defaultOptions).href,
+      'about:blank',
+    );
+    assert.strictEqual(
+      validateUrl('data:text/html,<div>test</div>', defaultOptions).href,
+      'data:text/html,<div>test</div>',
+    );
+  });
+
+  it('should reject URLs that do not parse with new URL', () => {
+    assert.throws(
+      () => validateUrl('not a url', defaultOptions),
+      /Invalid URL: "not a url"/,
+    );
+    assert.throws(() => validateUrl('', defaultOptions), /Invalid URL: ""/);
+    assert.throws(
+      () => validateUrl('http://', defaultOptions),
+      /Invalid URL: "http:\/\/"/,
+    );
+    assert.throws(
+      () => validateUrl('://', defaultOptions),
+      /Invalid URL: ":\/\/"/,
+    );
+  });
+
+  it('should allow javascript, data, and vbscript URLs when javascriptEvaluation is true or omitted', () => {
+    assert.strictEqual(
+      validateUrl('javascript:alert(1)', defaultOptions).protocol,
+      'javascript:',
+    );
+    assert.strictEqual(
+      validateUrl('javascript:alert(1)', {
+        javascriptEvaluation: true,
+        categoryExtensions: undefined,
+      }).protocol,
+      'javascript:',
+    );
+    assert.strictEqual(
+      validateUrl('data:text/html,<div>test</div>', defaultOptions).protocol,
+      'data:',
+    );
+    assert.strictEqual(
+      validateUrl('data:text/html,<div>test</div>', {
+        javascriptEvaluation: true,
+        categoryExtensions: undefined,
+      }).protocol,
+      'data:',
+    );
+    assert.strictEqual(
+      validateUrl('vbscript:msgbox(1)', defaultOptions).protocol,
+      'vbscript:',
+    );
+    assert.strictEqual(
+      validateUrl('vbscript:msgbox(1)', {
+        javascriptEvaluation: true,
+        categoryExtensions: undefined,
+      }).protocol,
+      'vbscript:',
+    );
+  });
+
+  it('should reject javascript, data, and vbscript URLs when javascriptEvaluation is false', () => {
+    assert.throws(
+      () =>
+        validateUrl('javascript:alert(1)', {
+          javascriptEvaluation: false,
+          categoryExtensions: undefined,
+        }),
+      /Navigating to javascript: URLs is not allowed when JavaScript evaluation is disabled\./,
+    );
+    assert.throws(
+      () =>
+        validateUrl('JAVASCRIPT:alert(1)', {
+          javascriptEvaluation: false,
+          categoryExtensions: undefined,
+        }),
+      /Navigating to javascript: URLs is not allowed when JavaScript evaluation is disabled\./,
+    );
+    assert.throws(
+      () =>
+        validateUrl('javascript:void(0)', {
+          javascriptEvaluation: false,
+          categoryExtensions: undefined,
+        }),
+      /Navigating to javascript: URLs is not allowed when JavaScript evaluation is disabled\./,
+    );
+    assert.throws(
+      () =>
+        validateUrl('data:text/html,<div>test</div>', {
+          javascriptEvaluation: false,
+          categoryExtensions: undefined,
+        }),
+      /Navigating to data: URLs is not allowed when JavaScript evaluation is disabled\./,
+    );
+    assert.throws(
+      () =>
+        validateUrl('DATA:text/html,<div>test</div>', {
+          javascriptEvaluation: false,
+          categoryExtensions: undefined,
+        }),
+      /Navigating to data: URLs is not allowed when JavaScript evaluation is disabled\./,
+    );
+    assert.throws(
+      () =>
+        validateUrl('vbscript:msgbox(1)', {
+          javascriptEvaluation: false,
+          categoryExtensions: undefined,
+        }),
+      /Navigating to vbscript: URLs is not allowed when JavaScript evaluation is disabled\./,
+    );
+    assert.throws(
+      () =>
+        validateUrl('VBSCRIPT:msgbox(1)', {
+          javascriptEvaluation: false,
+          categoryExtensions: undefined,
+        }),
+      /Navigating to vbscript: URLs is not allowed when JavaScript evaluation is disabled\./,
+    );
+  });
+
+  it('should allow chrome://newtab/ and chrome://inspect', () => {
+    assert.strictEqual(
+      validateUrl('chrome://newtab/', defaultOptions).href,
+      'chrome://newtab/',
+    );
+    assert.strictEqual(
+      validateUrl('chrome://newtab', defaultOptions).href,
+      'chrome://newtab',
+    );
+    assert.strictEqual(
+      validateUrl('chrome://inspect', defaultOptions).href,
+      'chrome://inspect',
+    );
+    assert.strictEqual(
+      validateUrl('chrome://inspect/#devices', defaultOptions).href,
+      'chrome://inspect/#devices',
+    );
+  });
+
+  it('should reject chrome: and chrome-untrusted: URLs', () => {
+    assert.throws(
+      () => validateUrl('chrome://settings', defaultOptions),
+      /Navigating to chrome: URLs is not allowed\./,
+    );
+    assert.throws(
+      () => validateUrl('chrome://version', defaultOptions),
+      /Navigating to chrome: URLs is not allowed\./,
+    );
+    assert.throws(
+      () => validateUrl('chrome:version', defaultOptions),
+      /Navigating to chrome: URLs is not allowed\./,
+    );
+    assert.throws(
+      () => validateUrl('CHROME://version', defaultOptions),
+      /Navigating to chrome: URLs is not allowed\./,
+    );
+    assert.throws(
+      () => validateUrl('chrome-untrusted://terminal', defaultOptions),
+      /Navigating to chrome-untrusted: URLs is not allowed\./,
+    );
+    assert.throws(
+      () => validateUrl('chrome-untrusted:terminal', defaultOptions),
+      /Navigating to chrome-untrusted: URLs is not allowed\./,
+    );
+  });
+
+  it('should reject chrome-extension: URLs unless categoryExtensions is enabled', () => {
+    assert.throws(
+      () => validateUrl('chrome-extension://abcdef/popup.html', defaultOptions),
+      /Navigating to chrome-extension: URLs is not allowed without --categoryExtensions\./,
+    );
+    assert.throws(
+      () =>
+        validateUrl('chrome-extension://abcdef/popup.html', {
+          javascriptEvaluation: undefined,
+          categoryExtensions: false,
+        }),
+      /Navigating to chrome-extension: URLs is not allowed without --categoryExtensions\./,
+    );
+    assert.strictEqual(
+      validateUrl('chrome-extension://abcdef/popup.html', {
+        javascriptEvaluation: undefined,
+        categoryExtensions: true,
+      }).href,
+      'chrome-extension://abcdef/popup.html',
+    );
+  });
+});
+
+describe('isAllowedUrl', () => {
+  it('should allow chrome://newtab/ and chrome://inspect', () => {
+    assert.strictEqual(
+      isAllowedUrl('chrome://newtab/', {categoryExtensions: undefined}),
+      true,
+    );
+    assert.strictEqual(
+      isAllowedUrl('chrome://newtab', {categoryExtensions: undefined}),
+      true,
+    );
+    assert.strictEqual(
+      isAllowedUrl('CHROME://newtab/', {categoryExtensions: undefined}),
+      true,
+    );
+    assert.strictEqual(
+      isAllowedUrl('chrome://inspect', {categoryExtensions: undefined}),
+      true,
+    );
+    assert.strictEqual(
+      isAllowedUrl('chrome://inspect/', {categoryExtensions: undefined}),
+      true,
+    );
+    assert.strictEqual(
+      isAllowedUrl('chrome://inspect/#devices', {
+        categoryExtensions: undefined,
+      }),
+      true,
+    );
+    assert.strictEqual(
+      isAllowedUrl('CHROME://inspect', {categoryExtensions: undefined}),
+      true,
+    );
+  });
+
+  it('should disallow internal chrome: and chrome-untrusted: URLs', () => {
+    assert.strictEqual(
+      isAllowedUrl('chrome://settings', {categoryExtensions: undefined}),
+      false,
+    );
+    assert.strictEqual(
+      isAllowedUrl('chrome://version', {categoryExtensions: undefined}),
+      false,
+    );
+    assert.strictEqual(
+      isAllowedUrl('chrome:version', {categoryExtensions: undefined}),
+      false,
+    );
+    assert.strictEqual(
+      isAllowedUrl('CHROME://settings', {categoryExtensions: undefined}),
+      false,
+    );
+    assert.strictEqual(
+      isAllowedUrl('chrome-untrusted://terminal', {
+        categoryExtensions: undefined,
+      }),
+      false,
+    );
+    assert.strictEqual(
+      isAllowedUrl('chrome-untrusted:terminal', {
+        categoryExtensions: undefined,
+      }),
+      false,
+    );
+    assert.strictEqual(
+      isAllowedUrl('CHROME-UNTRUSTED://terminal', {
+        categoryExtensions: undefined,
+      }),
+      false,
+    );
+  });
+
+  it('should disallow chrome-extension: URLs when extensions are disabled and allow when enabled', () => {
+    assert.strictEqual(
+      isAllowedUrl('chrome-extension://abcdef/popup.html', {
+        categoryExtensions: undefined,
+      }),
+      false,
+    );
+    assert.strictEqual(
+      isAllowedUrl('chrome-extension://abcdef/popup.html', {
+        categoryExtensions: false,
+      }),
+      false,
+    );
+    assert.strictEqual(
+      isAllowedUrl('chrome-extension:abcdef', {categoryExtensions: false}),
+      false,
+    );
+    assert.strictEqual(
+      isAllowedUrl('chrome-extension://abcdef/popup.html', {
+        categoryExtensions: true,
+      }),
+      true,
+    );
+    assert.strictEqual(
+      isAllowedUrl('chrome-extension:abcdef', {categoryExtensions: true}),
+      true,
+    );
+  });
+
+  it('should allow standard web and navigation URLs', () => {
+    assert.strictEqual(
+      isAllowedUrl('https://example.com', {categoryExtensions: undefined}),
+      true,
+    );
+    assert.strictEqual(
+      isAllowedUrl('http://localhost:3000', {categoryExtensions: undefined}),
+      true,
+    );
+    assert.strictEqual(
+      isAllowedUrl('about:blank', {categoryExtensions: undefined}),
+      true,
+    );
+    assert.strictEqual(
+      isAllowedUrl('data:text/html,<div>test</div>', {
+        categoryExtensions: undefined,
+      }),
+      true,
+    );
+  });
+
+  it('should return false for unparseable URLs', () => {
+    assert.strictEqual(
+      isAllowedUrl('not a url', {categoryExtensions: undefined}),
+      false,
+    );
+    assert.strictEqual(
+      isAllowedUrl('', {categoryExtensions: undefined}),
+      false,
+    );
+    assert.strictEqual(
+      isAllowedUrl('://', {categoryExtensions: undefined}),
+      false,
+    );
+  });
+});
diff --git a/third_party/devtools-frontend b/third_party/devtools-frontend
index eaad2491..2a5562de 160000
--- a/third_party/devtools-frontend
+++ b/third_party/devtools-frontend
@@ -1 +1 @@
-Subproject commit eaad2491924990cb310a4c753b2851e64d515f00
+Subproject commit 2a5562dea4bfa759c15700d2311fc623c1b684d1