Accessibility refs make browser steps short enough for agents
A snapshot returns an accessibility tree with references such as @e2, which the next command can click or fill. That is the useful idea here. An agent can inspect the current page, choose a visible control, act on it, then take another snapshot after navigation. The transcript stays much smaller than a pasted DOM, and a human can still read what the agent asked the browser to do.
The CLI also accepts CSS selectors and semantic locators, but refs fit the agent loop best. It covers tabs, frames, dialogs, downloads, screenshots, PDFs, network inspection, traces, and page diffs. JSON output makes the same commands usable from a program. The Rust daemon keeps the browser alive between calls and exits an idle headless session after 1 hour by default, which avoids paying browser startup on every action.
Contributing from source brought 1,097 packages
Our measured checkout was only 9.3 MB, yet pnpm installed 1,097 packages and occupied 931 MB. That is the contributor workspace, not the footprint of the packaged Rust binary, but it still matters for a team cloning the repository in CI. The current README asks source builders for Node 24 or newer, pnpm 11 or newer, and Rust. Normal users can install through npm, Homebrew, or Cargo.
Every route has a second setup step. agent-browser install downloads Chrome for Testing, and Linux may need agent-browser install --with-deps for browser libraries. Existing Chrome, Brave, Playwright, or Puppeteer installations may be detected. Local use does not need a service account. Remote modes for Browserbase, Browserless, Kernel, Browser Use, or AWS AgentCore add their own credentials and retention rules.
What happened when we ran it
Our sandbox installed commit 39a74c7 in 138 seconds on 3 CPUs with 8 GB of RAM. The unprivileged Node 22 container had no secrets. Installation succeeded, leaving 931 MB on disk. The repository contained 474 files, about 127,195 source lines, 2 CI workflow files, monorepo workspaces, and a tests directory. No Dockerfile was present.
The harness found no build script or target, so it skipped build. It found no test script or target, so it skipped tests. We therefore did not prove that the native CLI compiled, that the tests passed, or that Chrome launched at this commit. Those are missing checks, not failed checks. The measured result supports one narrow claim: the pnpm dependency installation completed successfully in 138 seconds.
Every safety control is opt-in
The README explicitly says its agent safety features are opt-in. Those controls include content boundary markers, a domain allowlist, action policies, confirmation for selected action classes, and output length limits. The allowlist can also block subresources and disable WebRTC in supported Chromium sessions. That is useful containment, provided the operator turns it on and includes every domain the application genuinely needs.
Authenticated browsing raises the stakes. Saved state can contain session tokens, the auth vault can fill credentials, and the full command surface includes uploads plus JavaScript evaluation. AES-256-GCM encryption is available for saved session data, while vault credentials are kept out of ordinary output. On a shared runner, use a fresh profile, a short domain list, encrypted state, and disposable credentials with the least authority required.
MCP and Claude Code are first-class entry points
agent-browser mcp starts a stdio server with a smaller core profile by default. Optional profiles expose network, stored state, debugging, tabs, React inspection, and mobile controls. Typed fields for URLs, selectors, text, sessions, and allowed domains give an MCP client more context for approval than a raw shell string. The repository also supplies a Claude Code skill through npx skills add vercel-labs/agent-browser.
WebMCP is a different layer and remains experimental. It discovers tools supplied by the page itself, limits automatic summaries to 16 tools and 4 KiB, and labels page metadata as untrusted. The README is blunt that those labels do not stop prompt injection. A host still has to reject website text that asks for secrets, shell commands, or broader authority. Discovery is convenient; permission remains the caller's job.
v0.38.2 is active, while the command surface still moves
GitHub showed 43,470 stars, 824 open issues and pull requests combined, and a last push on October 3, 2026. Release v0.38.2 arrived on October 1 with fixes for auth-vault form selection, Chrome stderr handling, small shared-memory mounts, and several cloud-browser integrations. Those dates show active maintenance. The combined open count is not a bug count, but it is a large queue to search before adopting a less common path.
One open October 1 report says a lost daemon response can cause a mutating command such as click or fill to be sent again. The report includes a proposed patch, but the issue remained open when checked. Treat consequential browser actions as operations whose outcome may be uncertain after a transport error. Pin the version, exercise the exact login and submission flow, and make payment or publishing steps idempotent outside the browser.