agents: decide whether page tools (agent.browserTools) are on by default #396

The decision

Phase 4 (#343) registers the read-only agent tools on the inspected page through WebMCP and devtoolstooldiscovery, so browser agents find them with no setup. The new option agent.browserTools turns this on or off.

For now it ships off by default, and a developer turns it on in the config. This needs a final decision.

Why it matters

With it on, any script on the dev page, and any agent running in the page, can call the read tools. That includes data from the server side, such as SSR requests and source scans. Calls go through the server with the same config checks and redaction as MCP, and action tools are never exposed. It only runs in development.

Options

• Keep it off by default. Safer. Browser agents need one line of config: agent: { browserTools: true }.
• Turn it on by default. Matches the "no setup" goal in phase 4 of 4: deeper diagnosis #343, at the cost of exposing read data to page scripts in development.
• On by default for page data only. Leave out server-side tools (SSR requests, source scans, build data) unless the developer opts in.

When decided

Change the default in packages/devtools/src/config.ts if needed, and update getting-started/configuration.md and agents/browser-agents.md.