core

name core description Core agent-browser usage guide. Read this before running any agent-browser commands. Covers the snapshot-and-ref workflow, navigating pages, interacting with elements (click, fill, type, select), extracting text and data, taking screenshots, managing tabs, handling forms and auth, waiting for content, running multiple browser sessions in parallel, and troubleshooting common failures. Use when the user asks to interact with a website, fill a form, click something, extract data, take a screenshot, log into a site, test a web app, or automate any browser task. allowed-tools Bash(agent-browser:*), Bash(npx agent-browser:*) agent-browser core Fast browser automation CLI for AI agents. Chrome/Chromium via CDP, no Playwright or Puppeteer dependency. Accessibility-tree snapshots with compact @eN refs let agents interact with pages in ~200-400 tokens instead of parsing raw HTML. Most normal web tasks (navigate, read, click, fill, extract, screenshot) are covered here. Load a specialized skill when the task falls outside browser web pages — see When to load another skill . The core loop agent-browser open <url> # 1. Open a page agent-browser snapshot -i # 2. See what's on it (interactive elements only) agent-browser click @e3 # 3. Act on refs from the snapshot agent-browser snapshot -i # 4. Re-snapshot after any page change Refs ( @e1 , @e2 , ...) are assigned fresh on every snapshot. They become stale the moment the page changes — after clicks that navigate, form submits, dynamic re-renders, dialog opens. Always re-snapshot before your next ref interaction. Always use your own session Before your first command, set a named session for the whole task: export AGENT_BROWSER_SESSION= " $(agent-browser session id --scope worktree --prefix task) " The default (unnamed) session is a single shared browser: it is shared with every other agent on the machine and it persists across conversations, so working in it can hijack another agent's page mid-task or navigate away from something the human left open. Every example below assumes a named session is active. See Run multiple browsers in parallel and references/session-management.md . Quickstart # Install once npm i -g agent-browser && agent-browser install # Linux hosts can install required browser libraries too agent-browser install --with-deps # Take a screenshot of a page agent-browser open https://example.com agent-browser screenshot home.png agent-browser close # Search, click a result, and capture it agent-browser open https://duckduckgo.com agent-browser snapshot -i # find the search box ref agent-browser fill @e1 "agent-browser cli" agent-browser press Enter agent-browser wait --load networkidle agent-browser snapshot -i # refs now reflect results agent-browser click @e5 # click a result agent-browser screenshot result.png The browser stays running across commands so these feel like a single session. By default, an inactive daemon saves configured restore state, closes its headless browser, and exits after one hour; the next command starts it again. Without --restore or another restore key, shutdown discards transient browser state and open tabs. Dashboard mouse, keyboard, and touch input count as activity. Headed browsers, Safari and iOS WebDriver sessions, and user-attached browsers are exempt from the default; provider-owned cloud browsers are not. Use --idle-timeout <time> or AGENT_BROWSER_IDLE_TIMEOUT_MS to tune the timeout, and use 0 to disable it. Still run agent-browser close (or close --all ) when you're done. MCP integration For tools that support Model Context Protocol servers, start the stdio server: agent-browser mcp agent-browser mcp --tools all agent-browser mcp --tools core,network,react Configure the MCP client to launch agent-browser with ["mcp"] . The server defaults to MCP protocol 2025-11-25 and accepts older supported client protocol versions during initialization. The default tools profile is core , which keeps MCP context small for everyday browser automation. Use --tools all for the full typed CLI parity surface, or combine profiles with commas, such as --tools core,network,react . Profiles are core , network , state , debug , tabs , react , mobile , and all ; the debug profile includes accessibility audits, plugin registry, and command.run tools. Each tool accepts typed arguments plus extraArgs for advanced CLI flags and exact CLI parity. The common allowedDomains array maps to --allowed-domains and activates the same WebRTC containment and launch-mode restrictions, while idleTimeout maps to --idle-timeout . Tool discovery is paginated and includes read-only/open-world annotations so modern MCP clients can load the large typed surface incrementally. Use the tool session argument or AGENT_BROWSER_SESSION to isolate browser sessions. eve agent integration For eve agents, mount the @agent-browser/eve extension instead of hand-writing browser tools. It adds namespaced tools such as browser__navigate , browser__snapshot , browser__click , browser__fill , browser__find , and browser__screenshot , all backed by agent-browser running inside the eve sandbox. The sandbox bootstrap helpers ( installAgentBrowser , agentBrowserRevalidationKey ) ship with the same package under @agent-browser/eve/sandbox , so agent/sandbox.ts needs no extra dependency. Reading a page agent-browser snapshot # full tree (verbose) agent-browser snapshot -i # interactive elements only (preferred) agent-browser snapshot -i -u # include href urls on links agent-browser snapshot -i -c # compact (no empty structural nodes) agent-browser snapshot -i -d 3 # cap depth at 3 levels agent-browser snapshot -s "#main" # scope to a CSS selector agent-browser snapshot -i --json # machine-readable output Snapshot output looks like: Page: Example - Log in URL: https://example.com/login @e1 [heading] "Log in" @e2 [form] @e3 [input type="email"] placeholder="Email" @e4 [input type="password"] placeholder="Password" @e5 [button type="submit"] "Continue" @e6 [link] "Forgot password?" For unstructured reading (no refs needed): agent-browser read # read rendered active-tab DOM agent-browser read https://docs.example.com/guide # docs-friendly fetch, prefers markdown agent-browser read https://docs.example.com/guide --filter auth # one matching section agent-browser read https://docs.example.com/guide --outline # compact page headings agent-browser read https://docs.example.com --llms index --filter auth # compact llms.txt discovery agent-browser get text @e1 # visible text of an element agent-browser get html @e1 # innerHTML agent-browser get attr @e1 href # any attribute agent-browser get value @e1 # input value agent-browser get title # page title agent-browser get url # current URL agent-browser get count ".item" # count matching elements Use read [url] when you need to consume documentation or other text pages rather than interact with a rendered UI. Omit the URL to read the rendered DOM of the active tab in the current browser session, including browser auth state and client-side updates. Explicit URL reads send Accept: text/markdown , try the same URL with .md appended when the first response is not markdown, walk ancestor paths toward / to find the nearest llms.txt for a matching docs link, print markdown/plain text when available, and fall back to readable text extracted from HTML without launching Chrome. Add --filter <text> to narrow a page to matching heading sections, --outline for compact headings on one page, --llms index for a compact nearest-ancestor llms.txt link list, and --llms full only when you explicitly need llms-full.txt . With --llms or --require-md , omitting the URL uses the active tab URL because those modes depend on HTTP resources. With --llms or --outline , --filter <text> narrows links, sections, or headings. Add --require-md when you specifically want to verify markdown negotiation, --raw when you need the response body unchanged, and --json when you need metadata such as source and contentType . Global safeguards such as --allowed-domains , --content-boundaries , and --max-output also apply to read fetches and output. For sessions that handle sensitive data, use --allowed-domains to restrict navigations and page-initiated network traffic. Supported Chromium sessions also disable RTCPeerConnection while the allowlist is active so WebRTC STUN, TURN, and related DNS traffic cannot bypass the HTTP filter. Dedicated and shared workers are guarded with a bootstrap wrapper; if a page CSP forbids that wrapper, the worker fails closed rather than running without the allowlist guard. Pre-existing CDP sessions, auto-connect, Chrome profiles, direct-page provider plugins, agent-browser restore or state-file replay, raw Chrome args that select profiles, restore sessions, or open startup pages, iOS, and Safari reject this option because agent-browser cannot install equivalent containment before page scripts run. This is browser-level containment, not an operating-system firewall; see Trust boundaries for deployment guidance. Interacting agent-browser click @e1 # click agent-browser click @e1 --new-tab # open link in new tab instead of navigating agent-browser dblclick @e1 # double-click agent-browser hover @e1 # hover agent-browser focus @e1 # focus (useful before keyboard input) agent-browser fill @e2 "hello" # clear then type agent-browser type @e2 " world" # type without clearing agent-browser press Enter # press a key at current focus agent-browser press Control+a # key combination agent-browser check @e3 # check checkbox agent-browser uncheck @e3 # uncheck agent-browser select @e4 "option-value" # select dropdown option agent-browser select @e4 "a" "b" # select multiple agent-browser upload @e5 file1.pdf # upload file(s) agent-browser scroll down 500 # scroll page (up/down/left/right) agent-browser scrollintoview @e1 # scroll element into view agent-browser drag @e1 @e2 # drag and drop When refs don't work or you don't want to snapshot Use semantic locators: agent-browser find role button click --name "Submit" agent-browser find role heading text --name "Skills" # implicit roles work: <h2>=heading, <ul>=list, top-level <header>=banner agent-browser find text "Sign In" click agent-browser find text "Sign In" click --exact # exact match only agent-browser find label "Email" fill "user@test.com" agent-browser find placeholder "Search" fill "query" agent-browser find testid "submit-btn" click agent-browser find first ".card" click agent-browser find nth 2 ".card" hover Or a raw CSS selector: agent-browser click "#submit" agent-browser fill "input[name=email]" "user@test.com" agent-browser click "button.primary" Rule of thumb: snapshot + @eN refs are fastest and most reliable for AI agents. find role/text/label is next best and doesn't require a prior snapshot. Raw CSS is a fallback when the others fail. Waiting (read this) Agents fail more often from bad waits than from bad selectors. Pick the right wait for the situation: agent-browser wait @e1 # until an element appears agent-browser wait 2000 # dumb wait, milliseconds (last resort) agent-browser wait --text "Success" # until the text appears on the page agent-browser wait --url "**/dashboard" # until URL matches pattern (glob) agent-browser wait --load networkidle # until network idle (post-navigation) agent-browser wait --load domcontentloaded # until DOMContentLoaded agent-browser wait --fn "window.myApp.ready === true" # until JS condition After any page-changing action, pick one: Wait for a specific element you expect to appear: wait @ref or wait --text "..." . Wait for URL change: wait --url "**/new-page" . Wait for network idle (catch-all for SPA navigation): wait --load networkidle . Avoid bare wait 2000 except when debugging — it makes scripts slow and flaky. Timeouts default to 25 seconds. Common workflows Log in agent-browser open https://app.example.com/login agent-browser snapshot -i # Pick the email/password refs out of the snapshot, then: agent-browser fill @e3 "user@example.com" agent-browser fill @e4 "hunter2" agent-browser click @e5 agent-browser wait --url "**/dashboard" agent-browser snapshot -i Credentials in shell history are a leak. For anything sensitive, use the auth vault (see references/authentication.md ): agent-browser auth save my-app --url https://app.example.com/login \ --username user@example.com --password-stdin # (type password, Ctrl+D) agent-browser auth login my-app # fills + clicks, waits for form If credentials live in an external vault, use a configured credential provider plugin instead of putting secrets in the command line: agent-browser plugin add agent-browser-plugin-vault --name vault agent-browser plugin list agent-browser auth login my-app --credential-provider vault --item "My App" agent-browser auth login my-app --credential-provider vault --item "My App" --url https://app.example.com/login --username-selector "#email" --password-selector "#password" Plugins can also provide browser providers, launch mutators such as stealth setup, and arbitrary namespaced commands: agent-browser --provider cloud-browser open https://example.com agent-browser plugin run captcha captcha.solve --payload '{"siteKey":"...","url":"https://example.com"}' plugin run is for command.run and custom capabilities. Core capabilities and protocol request types use their dedicated command paths. Persist session across runs # Derive one stable id for this agent/worktree SESSION= " $(agent-browser session id --scope worktree --prefix my-app) " # Pass the same id and restore request on every command agent-browser --session " $SESSION " --restore open https://app.example.com --restore with no value uses the current --session as the persistence key. Agent skills should prefer this over hand-built state file paths. Use --restore-save auto by default so a failed restore does not overwrite the previous known-good state. State is saved on close and also periodically while the browser is open (at most once per AGENT_BROWSER_AUTOSAVE_INTERVAL_MS , default 30000), so state survives even if the user closes the browser window by hand. agent-browser --session " $SESSION " --restore --restore-check-text Dashboard open https://app.example.com agent-browser --session " $SESSION " session info --json Extract data # Structured snapshot (best for AI reasoning over page content) agent-browser snapshot -i --json > page.json # Targeted extraction with refs agent-browser snapshot -i agent-browser get text @e5 agent-browser get attr @e10 href # Arbitrary shape via JavaScript cat << 'EOF' | agent-browser eval --stdin const rows = document.querySelectorAll( "table tbody tr" ); Array.from(rows).map(r => ({ name: r.cells[0].innerText, price: r.cells[1].innerText, })); EOF Prefer eval --stdin (heredoc) or eval -b <base64> for any JS with quotes or special characters. Inline agent-browser eval "..." works only for simple expressions. Screenshot agent-browser screenshot # temp path, printed on stdout agent-browser screenshot page.png # specific path agent-browser screenshot --full full.png # full scroll height agent-browser screenshot --annotate map.png # numbered labels + legend keyed to snapshot refs Headless Chromium screenshots hide native scrollbars for consistent image output. Pass --hide-scrollbars false when launching to keep native scrollbars visible. --annotate is designed for multimodal models: each label [N] maps to ref @eN . Handle multiple pages via tabs agent-browser tab # list open tabs (with stable tabId) agent-browser tab new https://docs... # open a new tab (and switch to it) agent-browser tab t2 # switch to tab t2 agent-browser tab close t2 # close tab t2 Stable tabId s mean t2 points at the same tab across commands even when other tabs open or close. After switching, refs from a prior snapshot on a different tab no longer apply — re-snapshot. tab list --json also reports each tab's CDP targetId , accepted anywhere a tab ref is accepted; target ids stay stable across daemon restarts, unlike t<N> ids. Tabs opened through tab new or click --new-tab inherit the session's user agent, headers, HTTP credentials, init scripts, routes, and emulation overrides before their first document loads. Runtime init-script identifiers are session-wide. Removing one clears it from every open tab where it was registered and from the setup replayed into future tabs. Switching has two special cases worth knowing: Discarded tab (Chrome Memory Saver). A backgrounded tab may have its renderer dropped. Switching to it reactivates the tab, which reloads the page and discards unsaved state (form input, scroll position). The switch result then includes "revived": true , so treat prior in-page state as gone and re-snapshot. Closing the active tab onto a discarded successor reports "activeTabRevived": true for the same reason. Tab blocked by a dialog. If the target tab has an open dialog ( confirm / prompt , or alert / beforeunload under --no-auto-dialog ) its renderer is paused, not discarded, so the switch leaves it untouched and reports "dialogBlocked": true . Resolve the dialog with dialog accept / dialog dismiss before interacting with the page. Run multiple browsers in parallel Each --session <name> is an isolated browser with its own cookies, tabs, and refs. For agent skills, derive stable names with agent-browser session id --scope worktree --prefix <skill> . Useful for testing multi-user flows or parallel scraping: agent-browser --session a open https://app.example.com agent-browser --session b open https://app.example.com agent-browser --session a fill @e1 "alice@test.com" agent-browser --session b fill @e1 "bob@test.com" AGENT_BROWSER_SESSION=myapp sets the default session for the current shell.