| Full browser policy | SDK browser creation, SDK agent browser creation, SDK quick actions, REST browser creation, REST quick actions, MCP manage_browsers create | Use BrowserNavigationPolicy fields such as allowedDomains, authDomains, downloads, uploads, and approvals. |
| CLI agent domain boundary | web agent --allow-domain <domain> | The CLI agent exposes domain allow-listing, not the full policy object. |
| MCP server startup policy | web mcp run --allow-domain, --allow-origin, --private-access localhost | Applies to browsers the MCP runtime creates. |
| Custom proxy | SDK browser creation, SDK agent browser creation, SDK quick actions, CLI browser creation, CLI quick actions, REST browser creation, REST quick actions | Keep proxy URLs in environment variables. |
| MCP custom proxy | Not exposed | MCP tool schemas do not include a browser-create proxy field. |
CLI web agent custom proxy | Not exposed | Use SDK web.agent({ browser: { create: { proxy } } }) when browser-agent work needs a custom proxy. |