Auto Browser
Give your AI agent a real browser, with a human in the loop.
Auto Browser is an MCP-native browser control plane for authorized workflows. It gives MCP clients, LLM agents, and operators a shared Playwright browser with human takeover, reusable auth profiles, approvals, audit trails, and local-first deployment.
Works with:
- Claude Code, Codex (CLI, IDE extension, and app), Google Antigravity, Cursor, and VS Code, connected directly over HTTP
- Claude Desktop, through the bundled stdio bridge
- any MCP client that can talk HTTP or stdio
- direct REST callers when you want curl-first control
Why Auto Browser
- MCP-native from day one. The browser surface is already packaged as an MCP server instead of bolted on after the fact.
- Human takeover when the web gets brittle. noVNC keeps the same live session available when a person needs to step in.
- Login once, reuse later. Save named auth profiles and reopen fresh sessions that are already signed in.
- Local-first by default. Run the full stack on your own box with Docker Compose, or use Codespaces for a quick hosted demo.
- Safety rails built in. Approvals, operator identity, PII scrubbing, Witness receipts, and policy presets are all part of the product surface.
- Evidence you can hand to someone else. Witness receipt chains are Ed25519-signed, and an exported bundle verifies with
scripts/verify_witness_bundle.py— which imports nothing from this project, so a recipient need not run or trust this controller to check it. - We audit ourselves in public.
docs/audits/2026-08-execution-audit.mddocuments an adversarial audit of this repo that found safety controls which reported success while doing nothing, with reproductions, the fixes, and the gates that close the class. - Governed skill induction. Verified browser traces can become staged skill candidates with provenance that is signed when a mesh identity is configured — and checked on read, not just produced — plus verifier adapters and review-only graduation — agents that prove they can repeat themselves correctly, not just act once.
