diff --git a/packages/core/src/agents/browser/browserAgentFactory.test.ts b/packages/core/src/agents/browser/browserAgentFactory.test.ts
index 270b400c3b..003ba465c4 100644
--- a/packages/core/src/agents/browser/browserAgentFactory.test.ts
+++ b/packages/core/src/agents/browser/browserAgentFactory.test.ts
@@ -379,9 +379,19 @@ describe('browserAgentFactory', () => {
 
     it('should register ALLOW rules for read-only tools', async () => {
       mockBrowserManager.getDiscoveredTools.mockResolvedValue([
-        { name: 'take_snapshot', description: 'Take snapshot' },
-        { name: 'take_screenshot', description: 'Take screenshot' },
-        { name: 'list_pages', description: 'list all pages' },
+        {
+          name: 'take_snapshot',
+          description: 'Take snapshot',
+        },
+        {
+          name: 'take_screenshot',
+          description: 'Take screenshot',
+        },
+        {
+          name: 'list_pages',
+          description: 'list all pages',
+          annotations: { readOnlyHint: true },
+        },
       ]);
 
       await createBrowserAgentDefinition(mockConfig, mockMessageBus);
diff --git a/packages/core/src/agents/browser/browserAgentFactory.ts b/packages/core/src/agents/browser/browserAgentFactory.ts
index ab42229e89..0d28651c12 100644
--- a/packages/core/src/agents/browser/browserAgentFactory.ts
+++ b/packages/core/src/agents/browser/browserAgentFactory.ts
@@ -120,13 +120,12 @@ export async function createBrowserAgentDefinition(
     }
 
     // Reduce noise for read-only tools in default mode
-    const readOnlyTools = [
-      'take_snapshot',
-      'take_screenshot',
-      'list_pages',
-      'list_network_requests',
-    ];
-    for (const toolName of readOnlyTools) {
+    const readOnlyTools = (await browserManager.getDiscoveredTools())
+      .filter((t) => !!t.annotations?.readOnlyHint)
+      .map((t) => t.name);
+    const allowlistedReadonlyTools = ['take_snapshot', 'take_screenshot'];
+
+    for (const toolName of [...readOnlyTools, ...allowlistedReadonlyTools]) {
       if (availableToolNames.includes(toolName)) {
         const rule = generateAllowRules(toolName);
         if (!existingRules.some((r) => isRuleEqual(r, rule))) {