A browser tool for AI agents

The browser you
already trust,
handed to the machine.

And it works in its own tab, in the background — so you keep browsing while it does.

Every other automation tool opens a blank browser and then spends the next hour trying to get past a login screen. This one drives the browser sitting in front of you — your sessions, your cookies, your fingerprint.

Add to Chrome Quick start Read the source

It is two halves. A small server your editor runs, and an extension in Chrome or Edge. They speak to each other over a socket on your own machine, and nothing at all leaves the device.

Works today with Claude Code, Claude Desktop, Cursor, VS Code and Windsurf — and from a plain terminal.

46Tools

0Data leaving your machine

1Driver per tab

∞Editors sharing one browser

I. Beside you

It works next to you, not instead of you.

Most browser agents take your screen over while they work. This one opens a tab of its own, in the background, and gets on with it. You keep reading, typing and clicking in the tab in front of you — it never moves.

A tab of its own

On first use it opens a new tab in the background and works there. It never grabs the tab you are looking at, so a half-written email can never be navigated away.

Or any tab you point at

Want it on a page you already have open — your dashboard, your local site? Name it by its title or address and the agent takes that tab over right where it sits, without bringing it to the front.

Several agents, one browser

Two editors, two agents, two tabs of the same browser, at the same time. If both want the same tab, one hands it over by name and the other is told on its very next step.

And the things you only notice once they are missing.

A stranger's view, on demand

A private window with none of your logins, for checking what a first-time visitor sees — without signing out of anything.

Your secrets stay hidden

Cookie and storage values come back as names only. The agent sees your session tokens only if it explicitly asks.

You choose the sites

Allow and block lists, enforced by the browser's own network layer, plus a read-only switch for look-but-don't-touch work.

No “being debugged” bar

Ordinary work never shows Chrome's yellow warning bar. Only a few advanced features need it, and they ask first.

It cleans up after itself

When it is done it closes the tabs it opened — and never closes one of yours, even one you lent it.

See who is where

The extension's popup lists every connected agent and the tab each one is working in, so you always know who is doing what.

It reconnects on its own

Restart the browser or lose the link, and it finds its way back by itself instead of failing until you restart your editor.

Light on your AI's memory

Short replies instead of page dumps, and screenshots saved to disk, so long sessions do not drown the model.

II. Capabilities

What an agent can actually do in there.

All 46 tools, grouped by intent. Actions stay deliberately terse — a short confirmation rather than a page dump — so a long working session does not drown the model in its own transcript.

Drive the page

Navigate, hard reload past the cache, go back and forward, wait for a condition rather than a guess. A navigation that did not happen says so, instead of handing you the page you were already on.
Click, type, hover, drag, press keys, and fill an entire form in a single call — including one that spans an embedded widget and the page around it.
Click by element, or by coordinate for canvases, maps and PDF viewers that no page tree can name.
Upload files, and answer the browser's own alert, confirm and “Leave site?” dialogs.
Every action waits until the element is visible, enabled, still and not covered, then waits for the page to settle.

Read the page

Structured snapshots in three sizes: lean, full, or written straight to a file.
Clean text, Markdown, raw HTML, and a search that returns only the elements you asked about.
Element references survive a re-render, and quietly recover themselves once if the page swapped them out.
Reading reaches inside iframes, including cross-origin ones, with empty frames dropped.
Ask a page for the actions it declares about itself, and call one directly instead of hunting for the button that triggers it.

See what went wrong

Console output, uncaught errors with their stacks, and service-worker lifecycle in one place.
A browser issues feed for the failures that print nothing at all: content blocked by policy, deprecated APIs, failed requests. Usually the answer when something silently did nothing.
The network list, paged newest first so a chatty page cannot spend the whole context in one call, plus the response body of any single request.
An accessibility audit of the page you are on, worst first, mapped back to the elements an agent can actually act on.
A result says which of five things happened — refused, done, partly done, failed, or nobody was listening — rather than one error flag. A failure carries a typed code and names the tool that fixes it.
Both logs survive the browser putting the extension to sleep, and carry across a redirect.

Measure speed

One call profiles a whole page load and reports LCP, FCP, CLS and INP against Google's own thresholds.
Find out where the LCP time went, not merely how long it was — the server, discovering the image, fetching it, painting it.
The long tasks that blocked the main thread, named rather than summarised.
Re-read a saved trace later without recording it again, and with no browser attached at all.
Watch the JS heap over a window and get the trend — no debugger, no banner.
Ask what real visitors experience, from public field data, instead of trusting one fast laptop.

Capture, and pretend

Screenshots of the viewport, the full scrollable page, or a single element — written to disk so the image never costs a context window.
A strip of stills on a timer, to show a person what happened instead of describing it.
Fake a location, a user agent, extra headers, or a colour scheme.
Emulate a phone viewport with touch, a throttled network, or a slow processor.
Run your own script before the page's own code, to freeze a clock or mock a request.

Stay out of your way

The agent works in its own tab. It opens one in the background on first use and leaves the tab you are reading completely alone.
Nothing steals your focus except the single tool whose entire job is to show you something.
Ownership is per tab, so two editors can drive two tabs of one browser at once, with a polite named handoff when they want the same one.
The connection repairs itself. Lose the relay, or start before it is ready, and the server reconnects on its own rather than failing every call until you restart it.
A clean, logged-out session on demand, in a private window, for checking what a first-time visitor actually sees.
The server leaves when your editor does, so a closed window never strands a phantom agent.

Keep it safe

Cookie, storage and download values are hidden by default. An agent reading them gets the names, not your session tokens, until it explicitly asks.
Allow and deny lists of sites, enforced at the network layer as well as the tool layer, plus a global read-only mode.
A file-path sandbox on every write, and ordinary web pages only — no local files, no browser internals.
A switch that lets an agent click and read a logged-in session but never run code you did not write.
Certificate checking is never switched off — by any tool, for any tab, in any mode.
An audit log of every call and its target, with secrets recorded as a length and never a value.

Reach further

Drive a browser on another machine, with a shared secret that is mandatory the moment it leaves your own — and that is never sent over the socket, only used to sign a challenge.
Set a proxy for the whole browser, not merely for one request.
A terminal client that can answer in JSON for scripting, sharing the same relay as every editor you have open.
Serve a smaller set of tools — core or slim — so the schemas cost less of every single request.

No “started debugging this browser” banner. Ever, unless you ask for it.

Interactions run through ordinary scripting. The debugger is attached only where nothing else can do the job, and it detaches again straight after.

III. The full list

All 46 tools, and what each one is for.

The section above groups them by what you are trying to do. This one names every single one, because an agent calls them by name and you may reasonably want to know exactly what you are handing over. A sentence or two each.

Navigation & history

browser_navigate: Opens a web address in the agent's own tab, in the background. It never takes over the tab you are looking at.
browser_go_back: Goes back a page, the way the back button does.
browser_go_forward: Goes forward again after going back.

Snapshot & interaction

browser_snapshot: Takes a structured reading of the page and hands back a label for every element on it. This is how the agent refers to the thing it wants to click or type into, rather than guessing at a selector.
browser_click: Clicks something — either by its label, or by a point on screen for canvases, maps and PDF viewers that have no label to give.
browser_hover: Moves the pointer over an element, for menus and tooltips that only appear when you hover.
browser_type: Types text into a box.
browser_select_option: Picks an option from a dropdown.
browser_drag: Drags one element onto another.

Input & timing

browser_press_key: Presses a key or a combination — Enter, Tab, Control+A — on whatever currently has focus.
browser_wait: Waits a fixed number of seconds. A blunt instrument, and usually the wrong one.
browser_wait_for: Waits until something is actually true: text appears, an element goes away, the address changes. Almost always the better choice, because it stops as soon as the thing happens instead of burning a guess.

Reading content

browser_read_page: Reads the page's main content as clean text or Markdown, with the navigation, scripts and styling stripped out. The cheapest way to find out what a page actually says.
browser_get_html: Returns the raw markup, for when the structure or the attributes are the point and a plain reading would lose them.
browser_find: Finds elements by their text, their role or a selector and returns labels for just those, skipping the cost of reading the whole page.

Page-declared actions

browser_page_tools: Lists and calls actions a page publishes about itself, so the agent can invoke them directly instead of hunting for the button. These survive redesigns that break clicking — but this is forward-looking, and almost no live site declares any yet.

Forms & scrolling

browser_fill_form: Fills many fields at once — text boxes, dropdowns, checkboxes, radio buttons — in a single call, including a form that spans an embedded widget and the page around it. If some fields refuse, it says which and reports itself as partly done rather than as a success.
browser_clear: Empties a field.
browser_scroll: Scrolls the page or a panel inside it — by a screenful, to the top or bottom, or just far enough to bring one element into view.

Cookies, storage, network and downloads

browser_get_cookies: Lists the cookies for the site being driven. Values come back hidden unless they are explicitly asked for, so an agent reading cookies gets the names and not your session.
browser_set_cookie: Creates or overwrites a cookie, which is how a signed-in state gets seeded without going through a login screen.
browser_storage: Reads and writes the two stores a page keeps inside your browser. Values are hidden by default, the same as cookies.
browser_network_requests: Lists the requests the page made — method, address, status, type and timing — newest first and paged, so a chatty page cannot swallow the whole conversation in one call.
browser_handle_dialog: Deals with the browser's own pop-ups: alerts, confirmations, prompts and the native "Leave site?" warning. It can answer them as they arrive, or report the ones already seen.
browser_downloads: Lists recent downloads with where each one landed on disk, its type and size. Paths only — it never reads the contents.
browser_proxy: Routes traffic through a proxy. Worth knowing: this affects the whole browser, not only the automated tab, because Chrome offers no per-tab setting.

Speed, measured on real visitors

browser_perf_field_data: Reports what people actually visiting an address experienced, from Google's public dataset, rather than what one fast laptop managed once. No browser is involved — and it does send the address you ask about to Google.

Capture & evaluation

browser_screenshot: Captures the visible screen, the full scrollable page, or a single element, as PNG, JPEG or WebP. It can write straight to a file so the image never costs a conversation, and can take a strip of stills on a timer to show a person what happened.
browser_get_console_logs: The page's console output, uncaught errors with their stacks, and background-worker lifecycle, in one place. These survive the browser putting the extension to sleep.
browser_issues: The problems the browser noticed that print nothing at all: content blocked by policy, deprecated features, failed and error-status requests. Usually the answer when something silently did nothing.
browser_eval: Runs a piece of JavaScript in the page and returns the result — either a quick expression, or a function handed the elements already found. Can be switched off entirely if you would rather no agent-written code ran at all. Needs Chrome's "Allow User Scripts" switch turned on for the extension, once.

Tabs

browser_list_tabs: Lists the open tabs, with their addresses and titles.
browser_new_tab: Opens a new tab in the background and drives that, stealing no focus.
browser_switch_tab: Brings a tab to the front. The one tool that deliberately takes your focus, for when you asked to be shown something.
browser_select_tab: Takes over a tab you already have open without bringing it forward — the tool for "pick up the testing I started".
browser_close_tab: Closes a tab.

Several editors, several browsers

browser_list_clients: Lists every browser connected to the shared relay — Chrome and Edge at once, say — across every editor you have open.
browser_select_client: Chooses which of those browsers the following actions apply to.
browser_force_claim: Takes over a browser another agent is currently driving. The other agent is told, the next time it tries to act.
browser_release_client: Hands a browser back so another agent can pick it up. Optional — claims also lapse on their own once an agent goes idle.
browser_status: The diagnostic. Reports the relay, this agent's own name, every connected browser and who is driving it, and any warnings — including whether a dropped connection is coming back. The first thing to call when something seems off.

Advanced mode, off by default

browser_advanced_mode: Attaches Chrome's debugger to the tab being driven, which is the only thing that shows the yellow automation banner. Required by the four tools below, asked for by name every time, and remembered nowhere — it is gone the moment it detaches.
browser_upload_file: Puts real files into a file-picker field, as a genuine upload rather than a simulated one.
browser_get_network_request: Fetches the actual response body of a request, along with its status and headers — the part a request list cannot show you.
browser_perf_trace: Records a performance trace while the page is driven and turns it into answers: the vitals rated against Google's thresholds, where the largest paint's time went, and the tasks that blocked the page. It can re-read a saved trace later with no browser attached, and its memory mode samples the heap with no debugger and no banner.
browser_emulate: Pretends to be somewhere or something else — a location, a phone screen with touch, a user agent, extra headers, a colour scheme, a slow network or a slow processor.

IV. Architecture

One relay in the middle, and no ports to configure.

A single lightweight relay owns the local socket. Each editor dials in as a controller; each browser extension dials in as a browser. The relay routes calls and hands out one lease per tab.

   IDE 1 (Claude Code)         IDE 2 (Cursor)           IDE 3 (VS Code)
       (controller)              (controller)             (controller)
             \                        |                        /
              +----------------> 127.0.0.1:9009 <-------------+
                                    Relay
                                      |
              +-----------------------+-----------------------+
              |                       |                       |
          Chrome ext              Edge ext               Brave ext
          (your tab)              (your tab)             (your tab)

Fig. 1 — Every editor shares the same browsers through one relay process.

The relay: One long-lived socket host. It is spawned on demand and exits by itself roughly five minutes after the last peer disconnects.
The controller: The server your editor runs. It opens no port of its own. It dials the relay, registers under a human name, and forwards calls.
The browser: The extension. It connects on startup with no button to press, and runs the work inside your tab.

V. Download

Ready-made files, for the routes that take them.

Always the latest release. Every earlier version, and what changed in each, is on the releases page.

Claude Desktop

The server in one file. Open it, or drag it onto Settings → Extensions, and Claude Desktop installs it — no terminal, no config to edit.

Download .mcpb

Agent skill

Teaches your agent to use the tools well: which tab it owns, how to wait, what each error means. Unzip it into your agent's skills folder — for Claude Code, ~/.claude/skills/.

Download skill .zip

Browser extension

Needed on every route — the files above are only the server half. One click from the Chrome Web Store, and it works in Edge too.

Add to Chrome

VI. Quick start

Three steps. About five minutes.

Add the extension

Chrome or Edge, version 137 or newer. Add it from the Chrome Web Store — in Edge, allow extensions from other stores when it asks. It connects on its own; there is no button to press.

Install the server

In Claude Code, one plugin brings the server and the skill together:

/plugin marketplace add farazpawle/automatebrowser
/plugin install automate-browser@automatebrowser

On Claude Desktop, download the .mcpb and open it instead.

Or point any other client at it

npx -y --package @automatebrowser/mcp mcp-server-automatebrowser

The browser youalready trust,handed to the machine.