Agent-browser is a command-line browser automation tool written for AI agents rather than people. An agent opens a page, takes a snapshot of the accessibility tree in which each element carries a short ref such as @e2, and then clicks, fills, types, or reads by ref. Output is compact text, with filters for interactive elements only, depth and scope limits, delta snapshots, and screenshots that are skipped when nothing changed, so a task costs few tokens.
The CLI and the daemon are both native Rust and talk to the browser directly over the Chrome DevTools Protocol, with no Node.js or Playwright runtime. The daemon starts on the first command, persists between commands, and exits after an hour of inactivity. Chrome from Chrome for Testing is the default engine, Lightpanda Browser and Obscura are selectable engines, and Safari on iOS is driven through WebDriver. Cloud browsers from Browserless, Browserbase, Browser Use, Kernel, and AWS Bedrock AgentCore can be selected as providers when no local browser is available, and the tool also runs inside Vercel Sandbox and AWS Lambda.
Agents reach it three ways: by calling the CLI directly, through a skill for Claude Code, Codex, Cursor, Gemini CLI, GitHub Copilot, Goose, OpenCode, and Windsurf that loads the current workflow instructions from the installed binary, or through a built-in MCP server over stdio whose tool profiles (core, network, state, debug, tabs, react, mobile, all) keep the tool list small. Beyond navigation and forms, commands cover semantic locators by role, text, or label, network routing and HAR capture, cookies and storage, tabs, frames and dialogs, snapshot and screenshot diffs, tracing, profiling, video recording, axe-core accessibility audits, React component inspection, Web Vitals, and page WebMCP tools.
Security features are opt-in: an encrypted credential vault so the model never sees passwords, a domain allowlist that also blocks sub-resource and WebSocket requests, content boundary markers that separate page text from tool output, a static action policy, per-category action confirmation, and output length limits. Out-of-process plugins add credential providers, browser providers, launch mutators, and commands such as CAPTCHA solving. An optional dashboard shows live frames, an activity feed, and console output for every session, and a chat command (through Vercel AI Gateway, Claude Sonnet 4.6 by default) turns natural-language instructions into agent-browser commands.
Features
- Accessibility-tree snapshots: each element gets a ref (@e1, @e2) that later click, fill, and get commands target, with interactive-only, compact, depth, scope, and delta filters
- Native Rust client and daemon: direct CDP control with no Node.js or Playwright runtime, and a daemon that persists between commands and exits after an hour idle
- Engines and providers: Chrome by default, Lightpanda Browser and Obscura engines, Safari on iOS via WebDriver, and Browserless, Browserbase, Browser Use, Kernel, or AgentCore cloud browsers
- MCP server: a stdio server with tool profiles (core, network, state, debug, tabs, react, mobile, all) and typed fields so clients show meaningful approval prompts
- Coding-assistant skill: works with Claude Code, Codex, Cursor, Gemini CLI, GitHub Copilot, Goose, OpenCode, and Windsurf, loading workflow content from the installed CLI so instructions match the version
- Semantic locators: finds elements by ARIA role, text, label, placeholder, alt, title, or test id, alongside CSS, text, and XPath selectors
- Read mode: fetches a URL as Markdown without launching Chrome, with heading outlines and llms.txt link lists, or reads the rendered DOM of the active tab
- Diffs and debugging: snapshot, screenshot, and URL diffs, traces, CPU profiles, video recording, console and error logs, and DevTools access
- React and Web Vitals: component tree, props and hooks inspection, render recording, Suspense boundaries, and LCP, CLS, TTFB, FCP, and INP metrics
- Accessibility audits: an embedded axe-core engine audits a page or subtree offline and reports violations with impact, rule id, and failing selectors
- Sessions and auth: named sessions, tab pinning, Chrome profile reuse, saved and encrypted auth state, and a credential vault the model never reads
- Opt-in guardrails: domain allowlist, content boundary markers, action policy file, action confirmation, output length limits, and out-of-process plugins
