Image: GitHub
Why it mattersMost agent browser tools open a blank Chromium with no cookies. Browse uses the browser the user is already signed in on.
Giving an agent a fresh Chromium window loses every login on the machine. The agent cannot pay, cannot sign in, cannot see a dashboard behind a corporate login. Teams work around this with saved tokens or a second account the agent owns.
Anomaly released Browse, an open-source MCP server that skips that step. Browse is a Chromium extension plus a Model Context Protocol server. An AI agent opens and drives tabs inside the browser the user already uses. The agent sees the user's own tabs, cookies and extensions. The repository has 442 stars, 27 forks and an MIT licence. Anomaly is the same team behind opencode, the open-source coding agent with 226,000 stars.
What the agent can do, and what it has to hand back
The agent drives tabs with Playwright inside grouped background tabs. It can take screenshots, record the screen, and capture network traffic in HAR format. It can keep several named sessions and switch between them.
The handoff behaviour is the useful part. When the task hits a step a user has to perform, the agent hands the tab back. A login, a two-factor prompt, a payment. The user does that step and clicks Continue. The agent picks up the same tab and goes on.
The tool exposes an MCP tool called execute that runs Playwright code against the active session. Other tools cover session creation, allow-list restrictions by domain, video capture with a flight-recorder mode, and secret handling. The secrets interface runs a command with a secret in the environment. The key does not travel into the model's context.
Which browsers it covers
Browse works in Chrome, Edge, Brave, Arc, Helium, Vivaldi, Opera and Chromium. That covers the Chromium family. Firefox and Safari are out.
The project targets opencode as its first client but runs under any MCP client, including Claude Code, Cursor and Codex.
When this is better than a vendor agent
Vendor browser agents, such as ChatGPT Atlas or OpenAI's Operator, run inside a sandbox the vendor controls. They cannot see a paid dashboard the user already pays for. They log in from a stranger's address, which many services treat as a risk.
Browse trades that isolation for the user's own browser. The code is open, so the team can read exactly what the agent does with the session.
The trade is on the user. A bug or a prompt injection can act inside a signed-in bank page as easily as a signed-in Trello page. The allow-list in session_allowlist is there for a reason. On a work machine, a separate Chromium profile for the agent is still the safer setup. That is true even with Browse's handoff.
Source
This item was written by an AI system from the linked source. Reveneau is responsible for what it publishes.
Get AI News in your inbox
New developer tools, model and agent releases, and how teams are actually using them to release software. Short, and only when there is something worth reading.
