Agent Browser -- Browser Automation for Agents

Browser automation CLI for AI agents. Use it when a shell agent needs compact browser snapshots, screenshots, interactions, React introspection, Web Vitals, or batch browser checks.

Official docs describe agent-browser as a native Rust browser automation CLI with compact text output and Chrome/Lightpanda engines. Source: agent-browser.dev, https://agent-browser.dev/, 2026-06-18

As of the 2026-08-12 source check, npm agent-browser@latest is 0.34.0 and the pinned GitHub source snapshot is vercel-labs/agent-browser@548b159b30eef119ccf6846c8bc807d0eaa3f6f8 (Apache-2.0, 40,423 stars at capture). The machine's global binary is 0.32.3; a transient npx agent-browser@0.34.0 run passed against the live wiki. Version claims must distinguish upstream current, project-pinned, transient verified, and globally installed state. Source: npm registry; preserved repository evidence; local runtime proof, 2026-08-12

The v0.27 bookmark is the feature provenance for agent-browser's React/Web Vitals lane. It introduced react tree, react inspect, render recording/profiling, Suspense analysis, framework-agnostic vitals, and batch command usage for React/Next/SPAs. The current README still preserves the same boundary: React commands require launch with --enable react-devtools, while Web Vitals and pushstate are framework-agnostic. Source: X/@ctatedev and self-thread, 2026-05-07; Source: GitHub vercel-labs/agent-browser, 2026-07-04

Guillermo Rauch's March 2026 bookmark is provenance for agent-browser becoming a Vercel/agent-stack primitive, not a separate feature announcement. The linked source still resolves to agent-browser.dev; the durable content is that Vercel leadership amplified Chris Tate's browser automation surface before the later MCP, session, and doctor rows. Source: X/@rauchg, 2026-03-12; Source: agent-browser.dev, checked 2026-07-04

Routing Summary

Use agent-browser as Kevin's default browser automation surface for agent-driven browsing, screenshots, scraping, forms, UI QA, logged-in Chrome work, React/perf checks, and browser state. Use Playwright only for committed regression tests or existing suites; use browser-harness only for screenshot-first self-healing flows where that harness is the point.

Current Role

agent-browser is Kevin's default CLI browser automation tool for shell-agent loops. It is not the only browser tool. Route by task:

The point is not "agent-browser always." The point is "use the browser capability that matches the verification job."

Version 0.31 adds durable session memory for browser agents: stable worktree-scoped sessions, auto-restore, validation checks, transactional saves, and diagnostics. That matters for Kevin's localhost/UI loop because browser state can now be tied to the worktree rather than rediscovered every run. Source: X/@ctatedev, 2026-06-27

The current 0.34.0 executable was exercised against http://localhost:4000/system: public loading and accessibility snapshot succeeded; React tree and hydration profiling worked; document/fetch/XHR request capture worked; Web Vitals reported TTFB 190.3ms, FCP 292ms, LCP 308ms, CLS 0, and hydration 54ms; and SPA pushstate reached /system/skills. These are one local development-state receipt, not production performance badges. They prove that the modern inspection lane is callable and expose two product-state defects for correction: the displayed source-review count is stale and the Daily Brief card overstates implementation. Source: local agent-browser 0.34.0 runtime receipt, 2026-08-12

The current Apache-2.0 source is vercel-labs/agent-browser@548b159b30eef119ccf6846c8bc807d0eaa3f6f8, with 40,423 stars, six detected tests, two workflows, and eight skill files. The local runtime receipt is stronger for Kevin's callable path than repository popularity; Webwright and Browser Use remain complementary candidates for durable scripts or alternate harnesses, not replacements for the default plus Playwright browser-truth split. Source: commit-pinned repository receipt, 2026-08-12

Agent Loop Toolchain

Chris Tate's June 2026 source row groups agent-browser with three adjacent Vercel Labs primitives: Portless for named local URLs across worktrees, Emulate (Vercel-labs) for no-network third-party API emulation, and AI CLI (Vercel) for terminal-native text/image/video generation. The durable pattern is an agent-native dev loop: verify UI changes in a real browser, give every worktree a stable URL, replace external APIs with local stateful services, and keep generation tasks callable from the shell. Source: X/@ctatedev, 2026-06-21; Source: resolved links reviewed 2026-07-03

Guarded Reusable Adapter Route: OpenCLI

OpenCLI is a credible reference and project-scoped candidate when a repeated authenticated website or Electron workflow should become a typed CLI adapter. It does not replace agent-browser as the default exploration and verification surface. Start with agent-browser; consider OpenCLI only after the route is repetitive enough that a reviewed adapter would amortize browser-discovery cost. Source: X/@csaba_kissi, 2026-06-18; Source: OpenCLI repository and release review, 2026-08-10

Current evidence supports a guarded route rather than a global install:

• reviewed commit a86d64705c526dc710f790e66cfcabf6ecf786b9, Apache-2.0, 28,035 GitHub stars, and latest release v1.8.6 from 2026-07-03
• typecheck passes; the repository test run is 6,733 passed, one skipped, and one relative-date/timezone failure in clis/huodongxing/events.test.js
• the extension requests debugger, tabs, cookies, active-tab, storage, downloads, tab-groups, and <all_urls> authority; cookie values may cross the localhost extension-to-daemon bridge
• the current implementation includes owned-window/tab leases, scoped cookie reads, redaction, deadlines, origin/header checks, result journaling, and a doctor, but those controls do not make a broad authenticated bridge low-authority
• the production dependency graph reported one moderate direct undici advisory at review time

Evaluation contract: use a separate Chrome profile and isolated project; inspect the exact adapter, generated command manifest, extension permissions, and dependency audit; run doctor, typecheck, and tests; and require explicit authority for publish, send, purchase, delete, or other mutations. Never install the bridge globally merely because a bookmark calls it free or open source. Source: local source review at commit a86d6470, 2026-08-10

Why It Matters

Agent-browser is designed for machine operators:

• compact accessibility-tree snapshots with stable refs
• command-line composition and batch execution
• screenshots and diffs
• React component introspection
• Web Vitals / hydration checks
• Chrome and Lightpanda engines
• cloud providers for scale or environment needs
• security controls for output boundaries, allowed domains, action policies, and confirmations
• plugin system for third-party integrations

GitHub listed the repo at 36.4K stars on 2026-06-18, which makes it a major browser-agent infrastructure project, not a niche toy with a README and a dream. Source: vercel-labs/agent-browser GitHub, https://github.com/vercel-labs/agent-browser, 2026-06-18

CLI Workflow

Basic loop:

agent-browser open https://example.com
agent-browser snapshot -i
agent-browser click @e2
agent-browser fill @e3 "kevin@example.com"
agent-browser snapshot -i

Use batch when the sequence is known:

agent-browser batch "open http://localhost:3000" "snapshot -i" "screenshot"

Re-snapshot after page changes. Refs are stateful to the current snapshot.

MCP Interface

agent-browser also exposes an MCP interface. Use it when the harness is MCP-first or a desktop/IDE agent has a browser MCP slot but not convenient shell control. In shell-driven Codex/Claude Code/Cursor loops, the CLI remains cheaper and easier to compose.

This is the Agent-Native CLIs principle in practice: one capability, multiple interfaces, route by harness.

The reviewed launch artifact shows why the MCP form matters: the agent UI presents explicit browser-tool permission cards for "Run Agent Browser Screenshot" and "Run Agent Browser Snapshot," including allowlist controls and a run button. That makes it a better fit for hands-on IDE loops where the user wants to approve browser actions instead of delegating a fully shell-driven batch. Source: local artifact wiki/assets/x-bookmarks/2066944888176849214/image-01.jpg, reviewed 2026-07-03

Engines

• Lightpanda: fast default for simple browsing and snapshots.
• Chrome: required for auth-heavy flows, profiles, extensions, file access, and browser states.
• Cloud providers: use when scale, geo/IP, or bot-detection constraints require it.

Security Controls

The upstream repo documents opt-in security controls:

export AGENT_BROWSER_CONTENT_BOUNDARIES=1
export AGENT_BROWSER_MAX_OUTPUT=50000
export AGENT_BROWSER_ALLOWED_DOMAINS="example.com,*.example.com"
export AGENT_BROWSER_ACTION_POLICY="./agent-browser-policy.json"
export AGENT_BROWSER_CONFIRM_ACTIONS="payment,email,delete"

Use them when the browser can touch authenticated, destructive, or sensitive surfaces.

Treat cookies, storage state, profile directories, HAR/network captures, screenshots, downloads, and restored sessions as sensitive artifacts. Use an isolated project/profile, avoid printing cookie values or authorization headers, redact exported traffic, scope allowed domains, keep session names non-secret, and delete task-scoped state after verification. Importing or restoring a profile never grants send, publish, purchase, delete, or account-change authority.

Eve extension route

For an Eve agent, use @agent-browser/eve@0.34.0 at the same pinned repository revision instead of wrapping the CLI by hand. It runs each command through ctx.getSandbox(), keeps browser state inside the sandbox, provides stable per-sandbox sessions, and omits cookie/storage/saved-auth commands from the model-facing tools. Configure allowedDomains, contentBoundaries, and maxOutputChars; mirror the allowlist in the sandbox network policy; preinstall the pinned CLI and Chromium for production; and use Eve overrides to disable or approval-gate evaluate, upload, and any other action the agent should not perform unattended. The upstream tests prove configuration flags reach every command, but project acceptance still needs a real target-domain, authentication, redaction, cancellation, and cleanup fixture. Source: X 2086471205998264699; packages/@agent-browser/eve at vercel-labs/agent-browser@548b159b, reviewed 2026-08-12

Verification Patterns

Frontend check:

agent-browser batch "open http://localhost:3000" "snapshot -i" "screenshot" "vitals"

After edits:

agent-browser diff snapshot
agent-browser diff screenshot --baseline before.png
agent-browser react renders

Auth fallback:

agent-browser --engine chrome --session-name myapp open https://app.example.com

Recording evidence: v0.37.1 documentation snapshot

As checked on 2026-09-11, npm latest and the latest GitHub release are 0.37.1; this machine's executable reports 0.34.0. The following is upstream documentation and source review, not a local recording test or an upgrade. Preserve the dated August runtime proof separately. Source: npm registry; GitHub v0.37.1 release; local version command, 2026-09-11

For a short motion review on a compatible installation, the documented command is agent-browser record start ./motion.webm --fps 60. Recording defaults to 30 fps and accepts 1–60. It captures the active page; an optional URL navigates that tab first. ffmpeg and the appropriate encoder must be available: libvpx for WebM, libx264 for MP4. Stop recording before closing the session. Source: agent-browser recording docs at v0.37.1, reviewed 2026-09-11

Interpret frames as output frames and capturedFrames as distinct captured frames. Requested 60 fps does not prove 60 distinct repaints per second. Static frames may be repeated, and holds cap at five seconds, so the video alone cannot establish complete stall duration. Keep assertions and performance measurements alongside the clip. The source tweet's comparison still is visual provenance only; its full demo and local capture performance remain unverified. Source: recording docs and recording.rs at v0.37.1; X/@ctatedev, 2026-09-08

The author's follow-up v0.37.1 link concerns Windows headless desktop isolation and process cleanup. It does not establish a fix for the separate immediate-stop recording report, GitHub #1780. Source: v0.37.1 release notes; issue #1780, checked 2026-09-11

Doctor Command

agent-browser doctor is the environment sanity check. The reviewed terminal artifact shows checks for environment, Chrome, daemons, config, providers, network, and launch test; the daemon row warns while cleaning one stale daemon, then the launch test passes in 2.2s. Pair it with --fix when a browser loop fails before blaming the app under test. Source: local artifact wiki/assets/x-bookmarks/2044927187476677115/image-01.jpg, reviewed 2026-07-04

When Not To Use It

• Do not replace committed Playwright E2E suites with ad-hoc snapshots; use agent-browser to discover and prove, then Playwright to gate.
• Do not use it as a stealth scraper when the site blocks headless browsers; route to Web Scraping Stealth (TLS Fingerprinting & Anti-Bot Evasion).
• Do not use MCP if the shell CLI is available and token budget matters.
• Do not trust browser output from an unbounded domain without output limits.

---

Timeline

• 2026-08-12 | Added the tested Eve integration route and its limits: browser state stays in the sandbox, credential-bearing commands stay unexposed, domain/content/output controls and network policy are required, and upload or PR mutation remains separately authorized. Source: X 2086471205998264699; @agent-browser/eve@0.34.0

• 2026-08-12 | Refreshed to upstream 0.34.0 at 548b159b, distinguished it from the globally installed 0.32.3, and exercised React, network, Web Vitals, hydration, snapshot, and pushstate commands against the live wiki. Added a privacy contract for profiles, cookies, state, HARs, screenshots, downloads, and sessions. Source: npm/GitHub; local runtime receipt

• 2026-08-10 | Routed OpenCLI as a guarded, project-scoped adapter candidate beneath agent-browser for repeated authenticated website/Electron workflows. Recorded its broad extension/cookie authority, current test and audit state, separate-profile requirement, and mutation boundary; did not globally install it. Source: X/@csaba_kissi; Source: OpenCLI repository/release review, 2026-08-10

• 2026-07-04 | Promoted agent-browser from one browser option to Kevin's default agent browser substrate: browser interactions, screenshots, scraping, logged-in Chrome work, React/perf checks, and UI QA start here; Playwright is retained as the committed regression-test ratchet. Source: User request, 2026-07-04; agent-browser docs

• 2026-07-04 | Deep-reviewed the agent-browser doctor terminal artifact and refreshed source state: npm 0.31.1, main/v0.31.1 at ed2e10598c9064aecfaeb7cf21b540684db4be2c, GitHub 37,781 stars. Source: X/@ctatedev, 2026-04-16; GitHub/npm, 2026-07-04

• 2026-07-04 | Reviewed the v0.31 durable-session image artifact. The card shows the new restore/namespace/scope surface (--restore [name], --namespace <name>, --scope worktree|cwd|git-root), confirming the session-memory claim is CLI-level state routing rather than only product copy. npm remains 0.31.1; GitHub main remains ed2e10598c9064aecfaeb7cf21b540684db4be2c with Apache-2.0 and 37,813 stars. Source: X/@ctatedev, local image artifact, npm registry, GitHub, 2026-07-04

• 2026-07-04 | Source-reviewed Guillermo Rauch's March agent-browser bookmark. The resolved link remains agent-browser.dev; row is provenance for agent-browser's Vercel/agent-stack placement rather than a new feature surface. Source: X/@rauchg, 2026-03-12; Source: agent-browser.dev, checked 2026-07-04

• 2026-07-03 | Deep-reviewed the agent-loop toolchain row that links agent-browser, Portless, Emulate, and AI CLI as a cohesive Vercel Labs loop for browser verification, stable worktree URLs, local API emulation, and terminal generation. Source: X/@ctatedev, 2026-06-21

• 2026-07-03 | Deep-reviewed the agent-browser MCP launch artifact and refreshed source state: npm 0.31.1, main/v0.31.1 at ed2e10598c9064aecfaeb7cf21b540684db4be2c, GitHub around 37.8K stars. Source: X/@ctatedev, 2026-06-16; GitHub/npm, 2026-07-03

• 2026-06-18 | Refreshed from official docs/GitHub: clarified CLI vs MCP routing, security controls, engines, verification patterns, and current 36.4K-star ecosystem position. Source: agent-browser.dev, https://agent-browser.dev/, 2026-06-18; vercel-labs/agent-browser, https://github.com/vercel-labs/agent-browser, 2026-06-18

• 2026-06-28 | Added v0.31 durable session memory: worktree-scoped sessions, auto-restore, validation checks, transactional saves, and diagnostics. Source: X/@ctatedev, 2026-06-27

• 2026-06-16 | agent-browser MCP became available: same automation exposed as MCP tools for IDE/desktop agents. Captured as "both from one spec" interface. Source: X/@ctatedev, 2026-06-16

• 2026-05-25 | Microsoft Webwright surfaced as a complementary terminal-native web-agent framework. Source: X/@mr_r0b0t, 2026-05-25

• 2026-05-07 | v0.27 launch thread foregrounded React introspection, Web Vitals, and batch commands for Next.js/React/SPAs. Current source review confirms --enable react-devtools is required for React subcommands, while vitals stays framework-agnostic. Source: X/@ctatedev and self-thread, 2026-05-07; Source: GitHub vercel-labs/agent-browser, 2026-07-04