Chrome DevTools Access. The browser's deepest layer, gated.

Reach for the simplest tool that works

Most scripts never need CDP. The DOM, CM_findElement for resilient targeting, and fetch interception cover the vast majority of work, with no banner and no toggle. Turn to CM_devtools only when those genuinely fall short.

Four things CDP does differently

Turning it on, and the guardrails

Installing a script that declares the grant does not give it access. You enable the capability yourself, per session, under Settings → Scripts → Chrome DevTools Access. It is off by default and resets every Chrome restart, so the capability never quietly accumulates trust over time.

• A script must declare // @grant CM_devtools and a written // @devtools-justification (80 to 500 characters) explaining why it needs it. You see that justification before you install, and on the script row afterward.
• The Chrome DevTools Access switch is off until you turn it on, and resets on every Chrome restart.
• Chrome shows its own yellow banner the whole time a script holds a session. Click Cancel on it to stop, which locks the tab against re-attaching for about five minutes.
• One switch ends every active session at once. Turning the capability off tears down anything live immediately.
• Every session is written to a local audit log that never leaves your device.
• Marketplace scripts that use it are reviewed before they are listed.

Anatomy of a CM_devtools script

Declare the grant and the justification in the metadata header, then acquire a session, do your work, and release it. The scoped helper CM_withDevtools acquires and releases for you, even if your code throws. In an AgentScript, the same call goes inside a tool's execute body.

// @grant                   CM_devtools
// @devtools-justification  Reads the page's GraphQL responses to expose
//                          order data as a tool; CDP is needed because the
//                          calls live in a cross-origin iframe.

// Scoped session: auto-acquires, auto-releases (even on throw).
const requests = await CM_withDevtools(async (dt) => {
  await dt.send('Network.enable');
  const seen = [];
  const off = dt.on('Network.requestWillBeSent', (p) => {
    seen.push({ method: p.request.method, url: p.request.url });
  });
  // dt.on returns synchronously; give the subscription a beat to land.
  await new Promise((r) => setTimeout(r, 50));
  triggerTheActionYouWantToCapture();
  await new Promise((r) => setTimeout(r, 3000));
  off();
  return seen;
});

CDP method names come from the official DevTools Protocol reference. Customaise does not wrap or rename them; you call the protocol directly. Calls throw an Error with a .code you branch on, such as DEVTOOLS_DISABLED_BY_USER (the toggle is off) or DEBUGGER_BUSY (the DevTools panel is already open); your AI agent has the full set from the conventions.

Screenshots of any tab

The same Chrome debugger that powers CM_devtools also powers screenshots. Ask the agent in your IDE to screenshot a page and it can capture any open tab, not only the one in front, and return a full-page image of the whole scrollable page rather than just the visible part.

Because it attaches to a specific tab rather than the focused window, the capture never pulls a background tab to the front or takes focus from whatever you are doing. As with any debugger use, Chrome's yellow banner appears for the moment of capture and clears as soon as it finishes.

CM_devtools is one of five

CM_devtools is the heaviest of the Customaise-specific grants. Most scripts will not need it. The lighter grants in the same family cover the cases CDP is overkill for:

• @grant CM_promptAI runs the user's local Gemini Nano model (Chrome 148+) from your script. Free, private, no API key, no network call. Single-shot prompts, streaming, opt-in multi-turn sessions, and multimodal input (text + image + audio) all on-device. Use it to summarise, classify, describe images, transform free-form text inside the page; no CDP toggle, no banner, no consent surface beyond the grant. Most "I need AI in my script" use cases end here.
• @grant CM_findElement and CM_findExternalElement resolve dom_* identifiers (the IDs the user captures with the visual DOM picker) against the page using the bulletproof multi-tier selector system. Resilient to UI redesigns; the right reach for "click this button" or "read this table" before considering CDP.

The full reference for all five (CM_findElement, CM_findExternalElement, CM_promptAI, CM_devtools, CM_withDevtools) lives in the UserScripts CM_* API table with signatures, options, and error codes.

Frequently asked