auto-browser

"Give your AI agent a real browser, with a human in the loop." MIT-licensed, single-maintainer (LvcidPsyche), latest release 1.8.1: an MCP control plane in front of one shared Playwright/Chromium session, built so a person can take the wheel mid-task instead of only watching. 826 stars, 143 forks and 292 commits at ingest, 0 open issues.

Shape

A controller/ FastAPI service speaks MCP (/mcp over HTTP, or uvx auto-browser-mcp over stdio) and REST, and drives Chromium in a browser-node/ container running Xvfb, x11vnc and noVNC. noVNC on port 6080 shows the live session: when a site breaks the automation, a human watches the same pixels the agent sees and can click in directly. By default every session shares one Chromium process and desktop, so cookies stay isolated but a takeover can see other sessions' windows too. make up-isolation gives each session its own container instead.

Claude Code, Cursor and VS Code connect over HTTP; Claude Desktop uses the stdio bridge; anything speaking MCP, or plain curl, works. Tool profiles ration what the model sees. The default curated profile lists 20 tools: sessions, screenshot/observe, actions, page and download reading, tabs, auth profiles, takeover. MCP_TOOL_PROFILE=full adds diagnostics, audit, harness and admin tools. The stated reason for the split is that every listed tool spends context on every request, the same tool-surface economy agentic-awesome-skills and how-many-tools-should-an-agent-see argue from a different angle.

Auth profiles let an operator log into a site by hand once, save the session, and reopen it already signed in. Since 1.7.0 a profile belongs to the operator who saved it and can be encrypted at rest. Model support runs past the three labs to any OpenAI-compatible endpoint (OpenRouter, Grok, DeepSeek, MiniMax, Ollama, vLLM, LM Studio, Azure, Together, Groq, Fireworks) plus LangChain, LangGraph and CrewAI adapters and a auto-browser-client Python SDK on PyPI.

Safety machinery, and a published account of it failing

Most agent-browser tools stop at an approval prompt. This one adds two things past it.

Witness receipts: every governed call chains into an Ed25519-signed receipt, and the exported bundle verifies with a standalone script that "imports nothing from the project." The point is that the person checking the log doesn't have to trust the controller that produced it. That is a different answer to the fatigue problem agent-permission-model documents than any of that page's five positions, not fewer prompts, not a bigger ceiling, but a record that survives the human clicking through anyway.

A self-audit that names its own failures: docs/audits/2026-08-execution-audit.md is a public writeup of safety controls that "reported success while doing nothing." It includes reproductions, the fixes, and the gates added afterward, and version 1.7.0's changelog closes fail-open issues tracked as GHSA-xmh3-cw7j-9gp5. Disclosing that a control silently no-op'd, rather than only shipping the fix quietly, is the rarer move. It is also first-hand evidence for agent-permission-model's running argument that an approval gate can degrade in ways nobody watching it would notice.

Underneath both sit ALLOWED_HOSTS and CONTROLLER_ALLOWED_HOSTS (parsed the way Chromium parses URLs, after an earlier bypass), DNS-rebinding protection, sandboxed downloads, and PII scrubbing. An APP_ENV=production mode refuses to start unless a bearer token, operator ID, Fernet-encrypted auth state, share-token secret, both allowlists, rate limiting, metrics and STEALTH_ENABLED=false are all set. Compliance presets (strict/balanced, with the old HIPAA/SOC2/GDPR/PCI-DSS names deprecated but still accepted) write the applied policy to a manifest file rather than just asserting compliance.

Convergence harness: Agent Skill Induction (experimental, Stage 0)

A separate, explicitly early feature. Run a task under a structured contract, record a tamper-checked trace, verify the task actually finished, then write a staged skill candidate with provenance attached. Provenance is signed when a mesh identity is configured and checked on read; unsigned or invalid candidates are refused outright, and candidates produced by mock runs are tagged simulated so they can't pass as real. Promotion out of the staging area stays a manual, explicit step.

This is the same shape as hermes-learn-skill-capture's autonomy spectrum, an agent turning its own verified runs into reusable skills, but auto-browser's gate is cryptographic provenance plus a required human promotion. That sits closer to self-improving-agents's zouroboros-style consensus gate than to Hermes's off-by-default review queue. See self-improving-agents for the fuller comparison across instances.

Non-goals, stated plainly

The README rules out CAPTCHA solving, unauthorized scraping or account automation, and tooling built to disguise identity or bypass protections. Most browser-automation projects leave that scope line implicit; this one writes it down.

Read with care

The architecture, tool surface, licensing, profile split, and allowlist and production-mode mechanics are checkable facts about the artifact and grade T1. The star count, the "Glama grade A" badge, and the self-audit's account of what got fixed are the maker's own claims about how well the thing works, not an independent measurement. Nobody outside the project has verified that the witness-receipt chain resists a controller that wants to lie, or tested the Convergence harness's skill candidates for quality. Single maintainer, one repo, no independent report.

model-context-protocol · agent-permission-model · browser-use · claude-browser-use · anthropic-browser-use-tool · webmcp · self-improving-agents · hermes-learn-skill-capture · agentskills-spec · agent-skills · text-first-agent-design · agentic-awesome-skills · how-many-tools-should-an-agent-see