Web Reader

The Web Reader is an MCP capability that lets an agent read a web page from its URL and get its content back as Markdown. Use it when the user pastes a link, asks about a specific page, or when the answer needs the actual content behind a search result rather than its snippet. Web search returns snippets; Web Reader returns the page. It sits alongside MCP servers, Custom Tools, Skills, and File Search under the agent’s Capabilities tab, and ships as two catalog entries:

​

Add it to an agent

1. Open your agent → Capabilities → Add capability.
2. Pick Web Reader (category Search). The server URL is pre-filled; nothing to type.
3. (Recommended) Add Web Reader (skill) as well.

​

Approving a new website

The first time the agent wants to read a website in a conversation, the chat pauses on an approval card that names the website and shows the full address the agent is about to open. Nothing is read before you answer.

• Approve: the page is read and the agent picks up. That website is not asked again for the rest of the conversation.
• Reject: the agent is told you said no and continues without the page.

The card shows the full address because that address is what the website receives. If it carries text from the conversation that you did not expect, reject it. When a page redirects to another website, that other website is asked for in turn, before anything is read from it. When the agent reads several pages at once, one card lists every new website. Websites your administrator allows in advance are read without a card (see For administrators). Sub-agents never show a card: when a delegated agent needs a website you have not approved, the read is refused.

​

The tools

​

web_read

​

web_read_many

Each page is read independently: a page that fails comes back with its reason while the others keep their content. A successful read returns the page as Markdown with a citation of the address actually read, after redirects. A long page is cut at max_chars, and the text says so at the end. A result longer than about 30,000 characters is moved out of the conversation into a paginated artifact, as for any tool.

​

What it can and cannot read

• Web pages, plain text, JSON and XML. HTML is converted to Markdown: headings, lists, tables, code blocks and links are kept, and navigation, footers and hidden text are dropped.
• No JavaScript. A page that builds itself in the browser comes back empty, and the agent says so instead of inventing content.
• No documents. A PDF, an image or an Office file behind a URL is refused. Attach the file to the conversation instead, where it is parsed and indexed.
• Public websites only. Internal and private network addresses, cloud metadata endpoints and the platform’s own API are always refused, whatever the configuration. Each redirect is checked against the same rules before it is followed.
• Bounded requests. Each request stops after 15 seconds without data, and a response larger than 5 MB is not downloaded.

​

Page content is treated as data

Everything a page returns was written by whoever runs that website. The tool puts a warning first, then the page between two markers the page cannot know in advance or fake, and the skill tells the agent never to follow instructions found in a page. This narrows the risk of prompt injection; it does not remove it. Keep the approval of each new website, and do not give an agent that reads the web tools that act without approval.

​

For administrators

The tool’s settings live in the configuration of the Web Reader workspace (tools-web-reader) and apply to every agent that uses it: A textual check cannot detect a public name that resolves to a private address. If your platform runs in a private network, also restrict the runtime’s outbound traffic at the network level.

​

Errors

The tool tells the agent what happened, and the skill has it relay the reason rather than guess at the content:

​

Next Steps