A browser tool for AI agents

The browser you
already trust,
handed to the machine.

Every other automation tool opens a blank browser and then spends the next hour trying to get past a login screen. This one drives the browser sitting in front of you — your sessions, your cookies, your fingerprint.

Quick start Read the source

It is two halves. A small server your editor runs, and an extension in Chrome or Edge. They speak to each other over a socket on your own machine, and nothing at all leaves the device.

Works today with Claude Code, Claude Desktop, Cursor, VS Code and Windsurf — and from a plain terminal.

46Tools
0Data leaving your machine
1Driver per tab
∞Editors sharing one browser

I. Capabilities

What an agent can actually do in there.

All 46 tools, grouped by intent. Actions stay deliberately terse — a short confirmation rather than a page dump — so a long working session does not drown the model in its own transcript.

01

Drive the page

  • Navigate, hard reload past the cache, go back and forward, wait for a condition rather than a guess. A navigation that did not happen says so, instead of handing you the page you were already on.
  • Click, type, hover, drag, press keys, and fill an entire form in a single call — including one that spans an embedded widget and the page around it.
  • Click by element, or by coordinate for canvases, maps and PDF viewers that no page tree can name.
  • Upload files, and answer the browser's own alert, confirm and “Leave site?” dialogs.
  • Every action waits until the element is visible, enabled, still and not covered, then waits for the page to settle.
02

Read the page

  • Structured snapshots in three sizes: lean, full, or written straight to a file.
  • Clean text, Markdown, raw HTML, and a search that returns only the elements you asked about.
  • Element references survive a re-render, and quietly recover themselves once if the page swapped them out.
  • Reading reaches inside iframes, including cross-origin ones, with empty frames dropped.
  • Ask a page for the actions it declares about itself, and call one directly instead of hunting for the button that triggers it.
03

See what went wrong

  • Console output, uncaught errors with their stacks, and service-worker lifecycle in one place.
  • A browser issues feed for the failures that print nothing at all: content blocked by policy, deprecated APIs, failed requests. Usually the answer when something silently did nothing.
  • The network list, paged newest first so a chatty page cannot spend the whole context in one call, plus the response body of any single request.
  • An accessibility audit of the page you are on, worst first, mapped back to the elements an agent can actually act on.
  • A result says which of five things happened — refused, done, partly done, failed, or nobody was listening — rather than one error flag. A failure carries a typed code and names the tool that fixes it.
  • Both logs survive the browser putting the extension to sleep, and carry across a redirect.
04

Measure speed

  • One call profiles a whole page load and reports LCP, FCP, CLS and INP against Google's own thresholds.
  • Find out where the LCP time went, not merely how long it was — the server, discovering the image, fetching it, painting it.
  • The long tasks that blocked the main thread, named rather than summarised.
  • Re-read a saved trace later without recording it again, and with no browser attached at all.
  • Watch the JS heap over a window and get the trend — no debugger, no banner.
  • Ask what real visitors experience, from public field data, instead of trusting one fast laptop.
05

Capture, and pretend

  • Screenshots of the viewport, the full scrollable page, or a single element — written to disk so the image never costs a context window.
  • A strip of stills on a timer, to show a person what happened instead of describing it.
  • Fake a location, a user agent, extra headers, or a colour scheme.
  • Emulate a phone viewport with touch, a throttled network, or a slow processor.
  • Run your own script before the page's own code, to freeze a clock or mock a request.
06

Stay out of your way

  • The agent works in its own tab. It opens one in the background on first use and leaves the tab you are reading completely alone.
  • Nothing steals your focus except the single tool whose entire job is to show you something.
  • Ownership is per tab, so two editors can drive two tabs of one browser at once, with a polite named handoff when they want the same one.
  • The connection repairs itself. Lose the relay, or start before it is ready, and the server reconnects on its own rather than failing every call until you restart it.
  • A clean, logged-out session on demand, in a private window, for checking what a first-time visitor actually sees.
  • The server leaves when your editor does, so a closed window never strands a phantom agent.
07

Keep it safe

  • Cookie, storage and download values are hidden by default. An agent reading them gets the names, not your session tokens, until it explicitly asks.
  • Allow and deny lists of sites, enforced at the network layer as well as the tool layer, plus a global read-only mode.
  • A file-path sandbox on every write, and ordinary web pages only — no local files, no browser internals.
  • A switch that lets an agent click and read a logged-in session but never run code you did not write.
  • Certificate checking is never switched off — by any tool, for any tab, in any mode.
  • An audit log of every call and its target, with secrets recorded as a length and never a value.
08

Reach further

  • Drive a browser on another machine, with a shared secret that is mandatory the moment it leaves your own — and that is never sent over the socket, only used to sign a challenge.
  • Set a proxy for the whole browser, not merely for one request.
  • A terminal client that can answer in JSON for scripting, sharing the same relay as every editor you have open.
  • Serve a smaller set of tools — core or slim — so the schemas cost less of every single request.
No “started debugging this browser” banner. Ever, unless you ask for it.

Interactions run through ordinary scripting. The debugger is attached only where nothing else can do the job, and it detaches again straight after.

II. The full list

All 46 tools, and what each one is for.

The section above groups them by what you are trying to do. This one names every single one, because an agent calls them by name and you may reasonably want to know exactly what you are handing over. A sentence or two each.

01

Navigation & history

browser_navigate
Opens a web address in the agent's own tab, in the background. It never takes over the tab you are looking at.
browser_go_back
Goes back a page, the way the back button does.
browser_go_forward
Goes forward again after going back.
02

Snapshot & interaction

browser_snapshot
Takes a structured reading of the page and hands back a label for every element on it. This is how the agent refers to the thing it wants to click or type into, rather than guessing at a selector.
browser_click
Clicks something — either by its label, or by a point on screen for canvases, maps and PDF viewers that have no label to give.
browser_hover
Moves the pointer over an element, for menus and tooltips that only appear when you hover.
browser_type
Types text into a box.
browser_select_option
Picks an option from a dropdown.
browser_drag
Drags one element onto another.
03

Input & timing

browser_press_key
Presses a key or a combination — Enter, Tab, Control+A — on whatever currently has focus.
browser_wait
Waits a fixed number of seconds. A blunt instrument, and usually the wrong one.
browser_wait_for
Waits until something is actually true: text appears, an element goes away, the address changes. Almost always the better choice, because it stops as soon as the thing happens instead of burning a guess.
04

Reading content

browser_read_page
Reads the page's main content as clean text or Markdown, with the navigation, scripts and styling stripped out. The cheapest way to find out what a page actually says.
browser_get_html
Returns the raw markup, for when the structure or the attributes are the point and a plain reading would lose them.
browser_find
Finds elements by their text, their role or a selector and returns labels for just those, skipping the cost of reading the whole page.
05

Page-declared actions

browser_page_tools
Lists and calls actions a page publishes about itself, so the agent can invoke them directly instead of hunting for the button. These survive redesigns that break clicking — but this is forward-looking, and almost no live site declares any yet.
06

Forms & scrolling

browser_fill_form
Fills many fields at once — text boxes, dropdowns, checkboxes, radio buttons — in a single call, including a form that spans an embedded widget and the page around it. If some fields refuse, it says which and reports itself as partly done rather than as a success.
browser_clear
Empties a field.
browser_scroll
Scrolls the page or a panel inside it — by a screenful, to the top or bottom, or just far enough to bring one element into view.
07

Cookies, storage, network and downloads

browser_get_cookies
Lists the cookies for the site being driven. Values come back hidden unless they are explicitly asked for, so an agent reading cookies gets the names and not your session.
browser_set_cookie
Creates or overwrites a cookie, which is how a signed-in state gets seeded without going through a login screen.
browser_storage
Reads and writes the two stores a page keeps inside your browser. Values are hidden by default, the same as cookies.
browser_network_requests
Lists the requests the page made — method, address, status, type and timing — newest first and paged, so a chatty page cannot swallow the whole conversation in one call.
browser_handle_dialog
Deals with the browser's own pop-ups: alerts, confirmations, prompts and the native "Leave site?" warning. It can answer them as they arrive, or report the ones already seen.
browser_downloads
Lists recent downloads with where each one landed on disk, its type and size. Paths only — it never reads the contents.
browser_proxy
Routes traffic through a proxy. Worth knowing: this affects the whole browser, not only the automated tab, because Chrome offers no per-tab setting.
08

Speed, measured on real visitors

browser_perf_field_data
Reports what people actually visiting an address experienced, from Google's public dataset, rather than what one fast laptop managed once. No browser is involved — and it does send the address you ask about to Google.
09

Capture & evaluation

browser_screenshot
Captures the visible screen, the full scrollable page, or a single element, as PNG, JPEG or WebP. It can write straight to a file so the image never costs a conversation, and can take a strip of stills on a timer to show a person what happened.
browser_get_console_logs
The page's console output, uncaught errors with their stacks, and background-worker lifecycle, in one place. These survive the browser putting the extension to sleep.
browser_issues
The problems the browser noticed that print nothing at all: content blocked by policy, deprecated features, failed and error-status requests. Usually the answer when something silently did nothing.
browser_eval
Runs a piece of JavaScript in the page and returns the result — either a quick expression, or a function handed the elements already found. Can be switched off entirely if you would rather no agent-written code ran at all.
10

Tabs

browser_list_tabs
Lists the open tabs, with their addresses and titles.
browser_new_tab
Opens a new tab in the background and drives that, stealing no focus.
browser_switch_tab
Brings a tab to the front. The one tool that deliberately takes your focus, for when you asked to be shown something.
browser_select_tab
Takes over a tab you already have open without bringing it forward — the tool for "pick up the testing I started".
browser_close_tab
Closes a tab.
11

Several editors, several browsers

browser_list_clients
Lists every browser connected to the shared relay — Chrome and Edge at once, say — across every editor you have open.
browser_select_client
Chooses which of those browsers the following actions apply to.
browser_force_claim
Takes over a browser another agent is currently driving. The other agent is told, the next time it tries to act.
browser_release_client
Hands a browser back so another agent can pick it up. Optional — claims also lapse on their own once an agent goes idle.
browser_status
The diagnostic. Reports the relay, this agent's own name, every connected browser and who is driving it, and any warnings — including whether a dropped connection is coming back. The first thing to call when something seems off.
12

Advanced mode, off by default

browser_advanced_mode
Attaches Chrome's debugger to the tab being driven, which is the only thing that shows the yellow automation banner. Required by the four tools below, asked for by name every time, and remembered nowhere — it is gone the moment it detaches.
browser_upload_file
Puts real files into a file-picker field, as a genuine upload rather than a simulated one.
browser_get_network_request
Fetches the actual response body of a request, along with its status and headers — the part a request list cannot show you.
browser_perf_trace
Records a performance trace while the page is driven and turns it into answers: the vitals rated against Google's thresholds, where the largest paint's time went, and the tasks that blocked the page. It can re-read a saved trace later with no browser attached, and its memory mode samples the heap with no debugger and no banner.
browser_emulate
Pretends to be somewhere or something else — a location, a phone screen with touch, a user agent, extra headers, a colour scheme, a slow network or a slow processor.

III. Architecture

One relay in the middle, and no ports to configure.

A single lightweight relay owns the local socket. Each editor dials in as a controller; each browser extension dials in as a browser. The relay routes calls and hands out one lease per tab.

   IDE 1 (Claude Code)         IDE 2 (Cursor)           IDE 3 (VS Code)
       (controller)              (controller)             (controller)
             \                        |                        /
              +----------------> 127.0.0.1:9009 <-------------+
                                    Relay
                                      |
              +-----------------------+-----------------------+
              |                       |                       |
          Chrome ext              Edge ext               Brave ext
          (your tab)              (your tab)             (your tab)

Fig. 1 — Every editor shares the same browsers through one relay process.

The relay
One long-lived socket host. It is spawned on demand and exits by itself roughly five minutes after the last peer disconnects.
The controller
The server your editor runs. It opens no port of its own. It dials the relay, registers under a human name, and forwards calls.
The browser
The extension. It connects on startup with no button to press, and runs the work inside your tab.

IV. Quick start

Three steps. About five minutes.

Load the extension

Chrome or Edge, version 137 or newer. Turn on Developer mode, choose Load unpacked, and select the build output folder.

# in Chrome-extension/
npm install
npm run build    → .output/chrome-mv3/

Build the server

It carries its own dependencies, so it builds standalone with nothing else to install first.

# in the repository root
npm install
npm run build

Point your AI client at it

Then restart the client. You never choose a port — the server discovers the relay on its own.

claude mcp add automatebrowser -- node "/path/to/dist/index.js"