# Codex/MCP authenticated network-response task — development smoke

Date: **2026-09-23**. This is one visible, synthetic development task per direct-tool arm, not a held-out or repeated evaluation of overall Browser Use superiority. The same native `codex exec` agent (`0.155.0-alpha.9.2`, `gpt-6-astra`, `ultra`) used isolated Chrome 153.0.8010.53 at a 1280×713 CSS viewport. Browser Use was pinned to `d8110c5ff87ccba887aaa726cdb780f2f84bef8d`; Harness to `afbcc381b963040c19627d788e40c7e7663171ee`. Each attempt reset the browser and server state.

The fixture opens a cross-origin provider popup. Authorization makes the original app request JSON; its receipt reference is **absent from the DOM**. The agent must inspect the authenticated response and submit the exact reference once in the original tab. The independent server judge requires one correct write, one authorization, and at least one receipt request. A page message or claimed success alone cannot pass. This tests response access in one local workflow; it does not test real OAuth, CSV/download verification, general JavaScript/CDP execution, persistent profiles, or the complete products.

| Direct MCP entry | Business judge | Codex process | Input / output tokens | Server observations |
| --- | --- | ---: | ---: | --- |
| Tablaze with `--capture-network` | **Pass** | 149.560 s | 254,352 / 1,106 | 1 correct write, 1 authorization, 1 receipt GET |
| Browser Harness MCP | **Pass** | 190.380 s | 177,861 / 1,288 | 1 correct write, 1 authorization, 1 receipt GET |
| Browser Use `--cli-mcp` | **Pass** | 291.881 s | 636,350 / 2,796 | 1 correct write, 1 authorization, 3 receipt GETs |
| Browser Use structured `--mcp`, direct tools | **No write; deadline** | 300.012 s | Incomplete | 0 writes, 2 authorizations, 1 receipt GET |

The direct-tool timer includes the Codex process, model inference, MCP calls, and automatic approval review. It excludes external Chrome startup, independent judging, and cleanup. All direct arms had a 300 s outer deadline and 60 s MCP tool timeout. The structured MCP direct catalog has no response-body or general script tool; in this restricted run its built-in Agent fallback lacked an API key. This is a failure of that **entry/configuration in this attempt**, not proof Browser Use cannot perform the task. The Browser Use CLI-MCP programmable entry passed. The Tablaze trace shows the model actually calling `tab_network` to list and read the response.

We also enabled the structured MCP's nested Browser Use Agent through a local Codex-model gateway, as a **separate full-capability variant**. Attempt 1: outer deadline 600 s, MCP tool timeout 300 s, Codex returned after 545.626 s, but the business judge saw 0 writes (2 authorizations, 3 receipt GETs); nested Agent had 11 calls, 2 cancelled, so nested usage is incomplete. Attempt 2: outer deadline 900 s, MCP tool timeout 600 s, deadline at 900.010 s, 0 writes (4 authorizations, 4 receipt GETs); nested Agent had 20 calls, no failed calls recorded, but outer usage is incomplete. Neither attempt passed. These nested runs use a second Agent and different deadlines, so their times and tokens are not ranked against the direct-tool table. We retained both outcomes rather than rerunning until success.

The measured tree was uncommitted atop base HEAD `58a091183e5f612766c1139905a6362c266b4843`. Exact source, build and runner SHA-256 values, per-arm prompts/settings, judge state, raw-report hashes, and trace hashes are in [the consolidated record](evidence/native-codex-network-receipt-v1.json). The first four arms used [the archived direct runner](evidence/network-receipt-direct-runner-v1.mjs); the extended runner changed the configurable timeout for the nested attempts. Raw reports are [direct](evidence/native-mcp-network-direct-v1.json), [nested attempt 1](evidence/native-mcp-network-full-attempt1.json), and [nested attempt 2](evidence/native-mcp-network-full-attempt2.json). The six per-arm JSONL traces are linked by name and hash in the consolidated record. Server records, not agent statements, determine business pass.

The new `tab_network` is opt-in, scoped to Tablaze-owned tabs/popups, and limited to small declared text bodies; it does not expose arbitrary requests or their headers. See [the contract](NETWORK.md). A single task and uneven tool surfaces cannot establish a stable speed or quality ranking; broader held-out tasks, repetitions, uncertainty and full variant coverage remain required.