PicassoWeb Documentation

Documentation / 05

Security and limitations

PicassoWeb opens untrusted pages in Chromium. Its defaults reduce network risk, but the caller still controls what is inspected, written, and reused.

View Markdown View on GitHub

Network safeguards

  • Only HTTP and HTTPS target URLs are accepted.
  • URLs containing embedded credentials are rejected.
  • Localhost, private, link-local, and reserved network ranges are blocked by default.
  • Redirects and browser subresource requests are checked by the same network guard.
  • analyze_html blocks external network requests.
  • Navigation time, input sizes, DOM sampling, selector matches, CSS collection, and returned HTML are bounded.

Inspect a trusted local site

Pass allowPrivateNetwork: true only when the target is a trusted local development service:

json
{
  "url": "http://127.0.0.1:3000",
  "allowPrivateNetwork": true
}

Keep this setting disabled when tool inputs can be influenced by untrusted users or content.

compare_replica treats the replica differently: allowPrivateReplica defaults to true, allowing the expected workflow of comparing a public original against localhost or a local file. The original URL remains guarded.

Filesystem writes

Several tools accept an absolute output path and write evidence there. Choose a dedicated directory, review generated files before executing or publishing them, and avoid sensitive locations.

Downloaded assets are the files served by the target website. PicassoWeb does not determine whether you have permission to reuse them.

Practical limitations

  • Authentication, cookie consent, CAPTCHAs, and anti-bot systems are not bypassed.
  • User-specific content may require a separate authorized browser session before analysis.
  • Component-family recognition is heuristic; use inspect_component for exact follow-up evidence.
  • extract_animations is a settled static census, not a recording of the complete JavaScript timeline.
  • capture_motion samples real wall-clock time, so very fast animation may produce few distinct frames.
  • extract_layout provides stacking evidence and DOM order, not the browser's complete global paint order.
  • crawl_site follows standard anchor links only and intentionally limits page count and depth.
  • Pixel comparison can still contain noise from canvas, video, WebGL, timers, live data, and nondeterministic rendering.

Responsible use

Inspect websites and reuse assets only when you have authorization. Treat downloaded code, media, branding, and typography as potentially copyrighted or licensed material.

PicassoWeb provides replication evidence. It is not a license or a mechanism for bypassing access controls.

Next