diff --git a/src/lib/mcp/tools/apps.ts b/src/lib/mcp/tools/apps.ts
index 25e317d..2c49fa8 100644
--- a/src/lib/mcp/tools/apps.ts
+++ b/src/lib/mcp/tools/apps.ts
@@ -102,6 +102,13 @@ export function registerAppCapabilities(server: McpServer) {
         .describe("(list_apps, list_deployments) Pagination offset. Default 0.")
         .optional(),
     },
+    {
+      title: "Manage Kernel apps and invocations",
+      readOnlyHint: false,
+      destructiveHint: false,
+      idempotentHint: false,
+      openWorldHint: true,
+    },
     async (params, extra) => {
       if (!extra.authInfo) throw new Error("Authentication required");
       const client = createKernelClient(extra.authInfo.token);
diff --git a/src/lib/mcp/tools/browser-curl.ts b/src/lib/mcp/tools/browser-curl.ts
index 9cb8e1b..a19c903 100644
--- a/src/lib/mcp/tools/browser-curl.ts
+++ b/src/lib/mcp/tools/browser-curl.ts
@@ -41,6 +41,13 @@ export function registerBrowserCurlTool(server: McpServer) {
         .describe("Request timeout in milliseconds.")
         .optional(),
     },
+    {
+      title: "Send HTTP request via browser",
+      readOnlyHint: false,
+      destructiveHint: true,
+      idempotentHint: false,
+      openWorldHint: true,
+    },
     async (params, extra) => {
       if (!extra.authInfo) throw new Error("Authentication required");
       const client = createKernelClient(extra.authInfo.token);
diff --git a/src/lib/mcp/tools/browser-pools.ts b/src/lib/mcp/tools/browser-pools.ts
index 8d07b5b..8c7ebbe 100644
--- a/src/lib/mcp/tools/browser-pools.ts
+++ b/src/lib/mcp/tools/browser-pools.ts
@@ -115,6 +115,13 @@ export function registerBrowserPoolCapabilities(server: McpServer) {
         .describe("(release) Reuse browser instance or recreate. Default true.")
         .optional(),
     },
+    {
+      title: "Manage Kernel browser pools",
+      readOnlyHint: false,
+      destructiveHint: true,
+      idempotentHint: false,
+      openWorldHint: false,
+    },
     async (params, extra) => {
       if (!extra.authInfo) throw new Error("Authentication required");
       const client = createKernelClient(extra.authInfo.token);
diff --git a/src/lib/mcp/tools/browsers.ts b/src/lib/mcp/tools/browsers.ts
index b6b7346..44fc864 100644
--- a/src/lib/mcp/tools/browsers.ts
+++ b/src/lib/mcp/tools/browsers.ts
@@ -356,6 +356,13 @@ export function registerBrowserCapabilities(server: McpServer) {
         )
         .optional(),
     },
+    {
+      title: "Manage Kernel browser sessions",
+      readOnlyHint: false,
+      destructiveHint: true,
+      idempotentHint: false,
+      openWorldHint: false,
+    },
     async (params, extra) => {
       if (!extra.authInfo) throw new Error("Authentication required");
       const client = createKernelClient(extra.authInfo.token);
diff --git a/src/lib/mcp/tools/computer-action.ts b/src/lib/mcp/tools/computer-action.ts
index 165642b..1dd2109 100644
--- a/src/lib/mcp/tools/computer-action.ts
+++ b/src/lib/mcp/tools/computer-action.ts
@@ -254,6 +254,13 @@ export function registerComputerActionTool(server: McpServer) {
           "Ordered list of actions. Use one action for simple operations or multiple for batched sequences.",
         ),
     },
+    {
+      title: "Control browser (mouse, keyboard, screenshot)",
+      readOnlyHint: false,
+      destructiveHint: true,
+      idempotentHint: false,
+      openWorldHint: true,
+    },
     async ({ session_id, actions }, extra) => {
       if (!extra.authInfo) throw new Error("Authentication required");
       const client = createKernelClient(extra.authInfo.token);
diff --git a/src/lib/mcp/tools/docs.ts b/src/lib/mcp/tools/docs.ts
index 9848056..bce4bf0 100644
--- a/src/lib/mcp/tools/docs.ts
+++ b/src/lib/mcp/tools/docs.ts
@@ -19,6 +19,13 @@ export function registerDocsTools(server: McpServer) {
           'Natural language search query (e.g., "how to deploy an app", "browser automation examples").',
         ),
     },
+    {
+      title: "Search Kernel documentation",
+      readOnlyHint: true,
+      destructiveHint: false,
+      idempotentHint: true,
+      openWorldHint: false,
+    },
     async ({ query }, extra) => {
       if (
         !process.env.MINTLIFY_ASSISTANT_API_TOKEN ||
diff --git a/src/lib/mcp/tools/extensions.ts b/src/lib/mcp/tools/extensions.ts
index b7d5312..83d52cf 100644
--- a/src/lib/mcp/tools/extensions.ts
+++ b/src/lib/mcp/tools/extensions.ts
@@ -14,6 +14,13 @@ export function registerExtensionTools(server: McpServer) {
         .describe("(delete) Extension ID or name to delete.")
         .optional(),
     },
+    {
+      title: "Manage Kernel browser extensions",
+      readOnlyHint: false,
+      destructiveHint: true,
+      idempotentHint: false,
+      openWorldHint: false,
+    },
     async (params, extra) => {
       if (!extra.authInfo) throw new Error("Authentication required");
       const client = createKernelClient(extra.authInfo.token);
diff --git a/src/lib/mcp/tools/playwright.ts b/src/lib/mcp/tools/playwright.ts
index 2cebe3c..2778765 100644
--- a/src/lib/mcp/tools/playwright.ts
+++ b/src/lib/mcp/tools/playwright.ts
@@ -20,6 +20,13 @@ export function registerPlaywrightTool(server: McpServer) {
         )
         .optional(),
     },
+    {
+      title: "Execute Playwright code",
+      readOnlyHint: false,
+      destructiveHint: true,
+      idempotentHint: false,
+      openWorldHint: true,
+    },
     async ({ code, session_id }, extra) => {
       if (!extra.authInfo) throw new Error("Authentication required");
       const client = createKernelClient(extra.authInfo.token);
diff --git a/src/lib/mcp/tools/profiles.ts b/src/lib/mcp/tools/profiles.ts
index d341c78..b65e9cc 100644
--- a/src/lib/mcp/tools/profiles.ts
+++ b/src/lib/mcp/tools/profiles.ts
@@ -79,6 +79,13 @@ export function registerProfileCapabilities(server: McpServer) {
         .describe("(setup) If true, update existing profile. Default false.")
         .optional(),
     },
+    {
+      title: "Manage Kernel browser profiles",
+      readOnlyHint: false,
+      destructiveHint: true,
+      idempotentHint: false,
+      openWorldHint: true,
+    },
     async (params, extra) => {
       if (!extra.authInfo) throw new Error("Authentication required");
       const client = createKernelClient(extra.authInfo.token);
diff --git a/src/lib/mcp/tools/projects.ts b/src/lib/mcp/tools/projects.ts
index f3a425b..f7eda73 100644
--- a/src/lib/mcp/tools/projects.ts
+++ b/src/lib/mcp/tools/projects.ts
@@ -36,6 +36,13 @@ export function registerProjectCapabilities(server: McpServer) {
         .optional(),
       ...paginationParams,
     },
+    {
+      title: "Manage Kernel projects",
+      readOnlyHint: false,
+      destructiveHint: true,
+      idempotentHint: false,
+      openWorldHint: false,
+    },
     async (params, extra) => {
       if (!extra.authInfo) throw new Error("Authentication required");
       const client = createKernelClient(extra.authInfo.token);
diff --git a/src/lib/mcp/tools/proxies.ts b/src/lib/mcp/tools/proxies.ts
index c41c5e3..94b5725 100644
--- a/src/lib/mcp/tools/proxies.ts
+++ b/src/lib/mcp/tools/proxies.ts
@@ -48,6 +48,13 @@ export function registerProxyTools(server: McpServer) {
         .describe("(create, custom type) Auth password.")
         .optional(),
     },
+    {
+      title: "Manage Kernel proxy configurations",
+      readOnlyHint: false,
+      destructiveHint: true,
+      idempotentHint: false,
+      openWorldHint: false,
+    },
     async (params, extra) => {
       if (!extra.authInfo) throw new Error("Authentication required");
       const client = createKernelClient(extra.authInfo.token);
diff --git a/src/lib/mcp/tools/shell.ts b/src/lib/mcp/tools/shell.ts
index 21d88e2..53235df 100644
--- a/src/lib/mcp/tools/shell.ts
+++ b/src/lib/mcp/tools/shell.ts
@@ -23,6 +23,13 @@ export function registerShellTool(server: McpServer) {
         .optional(),
       as_root: z.boolean().describe("Run with root privileges.").optional(),
     },
+    {
+      title: "Run shell command in browser VM",
+      readOnlyHint: false,
+      destructiveHint: true,
+      idempotentHint: false,
+      openWorldHint: true,
+    },
     async ({ session_id, command, args, cwd, timeout_sec, as_root }, extra) => {
       if (!extra.authInfo) throw new Error("Authentication required");
       const client = createKernelClient(extra.authInfo.token);