Auto Browser gives AI agents and human operators one shared Playwright browser, exposed as an MCP server, a stdio bridge, and a REST API. It targets authorized workflows such as internal dashboards and admin tools, operator-assisted QA, and sites where a person may need to recover a broken flow. CAPTCHA solving, unauthorized scraping, and identity spoofing are out of scope.
A person can watch any session and take it over through noVNC (a browser-based remote desktop) without breaking the agent's session. Sessions can be saved as named auth profiles, so an agent logs in once and later opens new sessions that are already signed in. The stack runs locally with Docker Compose, with an optional mode that gives each session its own browser container and takeover surface.
Safety controls include approval gates for sensitive actions, operator identity, PII scrubbing, request rate limits, host allowlists, and Witness receipts: Ed25519-signed chains that a recipient verifies with a standalone script. Two compliance presets, strict and balanced, apply a set of these controls at startup.
A convergence harness turns verified browser traces into staged skill candidates with provenance. Candidates stay staged until a reviewer promotes them, and candidates from mock runs are marked as simulated.
First-party adapters cover OpenAI, Claude, and Gemini through an API or their CLIs. A generic OpenAI-compatible adapter reaches OpenRouter, Grok, DeepSeek, MiniMax, and self-hosted servers such as Ollama, vLLM, or LM Studio.
Features
- MCP server: a curated profile of 20 browsing tools by default, with diagnostics, audit, harness, and admin tools in a full profile
- Client support: connects to Claude Code, Codex, Google Antigravity, Cursor, and VS Code over HTTP, and to Claude Desktop through a stdio bridge
- Browser control: Playwright sessions with screenshots, DOM summaries, OCR excerpts, tab controls, downloads, and network inspection
- Human takeover: an operator watches or takes over a live session through noVNC
- Auth profiles: saves a signed-in session under a name and reopens new sessions from it
- Approvals and audit: approval gates, operator identity, audit events, and PII scrubbing
- Witness receipts: Ed25519-signed receipt chains that export as a bundle anyone can verify independently
- Compliance presets: strict and balanced postures set encryption, operator ID, PII scrubbing, isolation, and maximum session age
- Session isolation: an optional mode gives each session its own browser container
- Skill induction: a convergence harness writes verified traces into staged, reviewed skill candidates
- Framework adapters: adapters for LangChain, LangGraph, and CrewAI
