AgentTab

Any agent. Your browser. Your rules.

Local browser runtime for AI agents

Give an agent a tab, not the keys to your browser.

AgentTab lets an agent work in your existing signed-in Chrome profile without giving it unrestricted control of the profile. Each connection receives a task-owned browser workspace. The agent can create tabs, inspect and act in those tabs, wait for page state, and ask for help. The built-in 1Password broker is available by default and can fill a matching login or one-time code without exposing its value to the agent; passkeys, security keys, CAPTCHA, payment secrets, account recovery, and unsupported verification remain Your Turn. Recognizable consequential actions execute directly by default, while the popup can enable a staged Commit review when desired.

Release status

AgentTab v2 is unreleased. The local source version is 2.0.0-rc.1; it is not a public npm package, publicly installable Chrome Web Store release, hosted site, or published release artifact. The assigned Web Store item ID is frozen in config/identity.json, but its publication state is not verified here. Chrome Bridge v1.0.1 remains the available stable legacy path until the v2 launch cutover.

Do not expect npx agenttab install to work today. Stable v2 remains blocked on signing, package-registry, Chrome Web Store, controlled-domain, and platform release gates. The command below is the intended public install flow only after those dependencies are live:

npx agenttab install

The command has no path, token, or shell-specific argument and is suitable for POSIX shells, PowerShell, and cmd.exe once the package is published. Current source and prerelease setup are documented in Setup.

A task-owned workflow

1. An agent calls browser_open with mode: "create". AgentTab creates a background tab for that task and returns its task, tab, window, page-revision, and automation-route identifiers. placement: "new_window" may create the task's first tab in a separate unfocused normal window.
2. On a normal web origin, the agent calls browser_snapshot, works from revisioned accessibility references, then calls browser_act with the expected page revision. It cannot act on unrelated tabs.
3. On an ordinary sign-in page with at most three origin-matching Login items, the agent can request a short-lived opaque token and ask the host to fill named field refs through the local op command. Credential values travel only from op to the host and extension, never through Core RPC or the adapter. Owner-only policy can disable or constrain this broker. Every other human-only input uses browser_handoff, which focuses that tab and records a durable completion condition while browser automation remains available.
4. Recognized send, publish, purchase, delete, upload, authorization, and permission-grant controls execute in the original browser_act call by default. Turn off YOLO mode in the popup to require Commit review instead. In review mode, AgentTab stages the control, shows its effect in the popup, requires human approval, and then accepts the one-use token through browser_commit.
5. The task can list only its own tabs with browser_tabs. A separate client gets a separate task unless it proves its durable resume capability.
6. When browser work is complete, the agent calls browser_finish. Automatic cleanup closes tabs created by the task, preserves tabs adopted from the user's existing browser state, ungroups retained tabs, and releases task ownership. The popup setting can instead require confirmation or retain every tab.

Chrome does not expose page scripting or debugger access on browser-restricted origins such as chrome://, chrome-extension://, devtools://, and the Chrome Web Store. AgentTab reports these task tabs with automation_route: "tab_only". Explicit navigation, reload, close, load or URL waits, and human-only browser_handoff remain available. History movement is also available when managed origin constraints are absent; with constraints, AgentTab rejects it because Chrome does not expose the destination for authorization before navigation. Download waits require the full route because exact task-tab attribution comes from tab-scoped debugger events, not browser-global download state. Page snapshots, element actions, page-content waits, and raw Developer-mode CDP fail immediately with browser_restricted_origin and outcome: "not_started" before AgentTab attempts the blocked route. Use a focus-safe OS accessibility driver bound to the exact browser window when native UI work is required.

Commit is a two-party, best-effort semantic barrier, not proof that a page has no external effect. The popup records the human approval, while only the agent's later browser_commit can execute the staged action. Page content is untrusted data and a page can attach an effect to an innocently labelled control. Inspect the page and staged action before approving or committing.

Trust contract

• Task ownership is an execution and coordination boundary, not profile isolation. AgentTab can use the signed-in session in the browser profile, but Standard mode does not expose raw cookies, storage, passwords, arbitrary JavaScript, raw CDP, coordinate actions, network interception, or a generic browser-global mutation API. Its one window-level operation creates an unfocused normal window for the first tab of an otherwise empty task.
• Your Turn is the only routine focus transition. Routine task work stays in task-owned tabs. Handoff focuses the declared tab and records a durable completion condition without globally pausing browser work. This permissive default does not guarantee an observation blackout while the user types; prefer browser_credentials for ordinary sign-in fields because its values never enter AgentTab RPC or audit data.
• Consequential actions run directly by default; Commit review is available. YOLO mode skips the staging step but not task ownership, origin policy, expected page revisions, restricted-origin routing, credential isolation, or action validation. Turning YOLO mode off binds each staged action to its task, tab, page revision, element fingerprint, effect, and short expiry. Popup approval records consent but does not execute it; the agent must call browser_commit.
• Local by default. Policy, task state, audit records, and IPC stay on the machine. AgentTab has no telemetry. See Telemetry and Security.

Tool surface

Standard mode exposes exactly nine tools:

Tool	Purpose
browser_open	Create a task tab, create an unfocused window for a new task, or explicitly adopt the active tab. Reports whether the resulting tab supports full or tab_only automation.
browser_snapshot	Read an accessibility tree, bounded text or HTML, or a screenshot from a full-route task tab.
browser_act	Run typed actions against one task tab and expected page revision. Restricted-origin task tabs retain only navigation, history, reload, and close actions.
browser_wait	Wait for load, URL, text, selector, network-idle, or task-attributed download conditions supported by the tab's route.
browser_tabs	List only tabs owned by the current task, including each tab's automation route.
browser_handoff	Give the user control for human-only input.
browser_commit	Execute one staged consequential action.
browser_credentials	Prepare and fill an origin-matching 1Password login through opaque, short-lived host tokens. Available by default when the local op CLI is usable; owner-only policy can disable or constrain it.
browser_finish	Finish the task, apply its cleanup policy, return closed and retained tab receipts, and release ownership.

Developer mode adds one tool, browser_developer. It is absent from Standard discovery. It requires both the persistent Developer mode control in the AgentTab popup and AGENTTAB_DEVELOPER=1 in the adapter environment. Treat it as an explicit expansion of the normal boundary.

The exact schemas, return semantics, and stdio configuration are in MCP. The source contract is in Core RPC schemas and the runtime ADR.

Setup after v2 becomes available

The installer verifies one immutable versioned artifact, registers the native host, and updates supported local client configuration transactionally. It does not silently remove Chrome Bridge v1. For a prerelease source build, the extension remains an explicitly loaded unpacked development extension. See Setup for the current source path, future RC and stable flows, permissions, side-by-side migration, rollback limits, and platform state.

For a configured local installation, an MCP client starts the adapter with:

agenttab mcp

The installer writes this as an absolute local command in supported client configuration. For manual configuration, use agenttab mcp only when the installed agenttab command is on that client's PATH. Do not add a TCP port, bearer token, Python host, or manual native-host JSON for Standard mode.

Architecture

flowchart LR
    A[Agent or MCP client] --> B[Task-scoped Core RPC]
    B --> C[User-owned local IPC]
    C --> D[One Rust AgentTab host]
    D --> E[Chrome Native Messaging]
    E --> F[AgentTab extension]
    F --> G[Task-owned tabs in signed-in Chrome]
    G -. Your Turn .-> H[Human]

Loading

The extension maintains the Native Messaging relationship with the one Rust host. Local adapters use per-user IPC: a user-owned Unix socket on macOS and Linux, or a current-user named pipe on Windows. Standard mode has no port, bearer token, or manual JSON protocol. The separate agenttab proxy command is an advanced, loopback-only bridge that deliberately requires a local token file. It is not part of normal setup. Commands documents its limits.

Supported-platform state

The source maps host artifacts for macOS on Apple Silicon and Intel, Linux on ARM64 and x86_64, and Windows on ARM64 and x86_64. No signed public v2 artifact matrix is available yet, so none of these are currently offered as a public v2 installation. The extension manifest requires Chrome 127 or later. See Setup.

Repository layout

Path	Purpose
packages/extension/	Canonical browser-extension source, tests, and generated dist/ output
packages/installer/	Cross-platform installer and local client configuration
packages/mcp/, packages/omp/	Agent adapters and tool rendering
packages/gpt-control-driver/	Focus-safe external browser driver for GPT-Control
packages/sdk-python/, packages/sdk-typescript/	Client SDKs
schemas/	Versioned native and Core RPC contracts
config/	Frozen product, migration, and release identity
tests/architecture/	Cross-component safety and architecture gates
scripts/	Build, packaging, and release verification utilities
docs/	Setup, security, API, architecture, and launch documentation

Generated extension assets live only in packages/extension/dist/; they are not committed or mirrored into the repository root.

Migration and documentation

• Migrate from Chrome Bridge v1.0.1
• Setup and local paths
• Command reference
• MCP adapter and Core RPC
• Security and trust boundary
• Multi-agent behavior
• Runtime architecture decision

License

MIT