Vercel agent-browser: a Skill That Gives Your Coding Agent a Browser

• Loads the real how-to guide for the agent from the installed CLI

  The installed skill is a stub. Its first instruction is to run `agent-browser skills get core` (add --full for the full command reference and templates) so the agent reads instructions that match the CLI version you have.

  Runs code · skills get core

• Extra guides for desktop apps, Slack, QA bug hunts, API clients and cloud browsers

  Loaded with `agent-browser skills get <name>`: Electron apps like VS Code or Figma, Slack workspace tasks, exploratory testing, turning a recorded HAR into an API client, running in Vercel Sandbox, reaching protected Vercel previews, AWS AgentCore browsers, and building WebMCP tools.

  Runs code · Specialized skills (electron, slack, dogfood, derive-client, vercel-sandbox, protected-vercel-deployments, agentcore, webmcp-gen)

• Starts the browser and goes to a page; close shuts it down

  `agent-browser open <url>` launches Chrome (headless by default) and navigates. The browser stays up between commands. `close` ends the session, `close --all` ends every session.

  Runs code · open / close

• Lists what is on the page with short refs like @e1 the agent can act on

  Returns the page's accessibility tree with refs. `snapshot -i` keeps only interactive elements, which is what the core loop uses. Re-snapshot after the page changes.

  Read · snapshot

• Clicks, types, picks options and uploads files on the page

  Acts on a ref or CSS selector: click buttons and links, clear-and-fill inputs, type text, press keys, choose dropdown values, tick checkboxes, drag and drop, and upload local files.

  Write · click / fill / type / press / select / check / upload / drag

• Finds an element by role, label or text and acts on it

  For when refs do not fit: e.g. `find role button click --name "Submit"` locates by accessible role and name.

  Write · find (semantic locators)

• Reads text, values, attributes, URL or title; checks visible or enabled

  `get text|html|value|attr|title|url|count|box|styles` pulls data from the page; `is visible|enabled|checked` answers yes or no.

  Read · get / is

• Fetches a page as clean text or markdown without opening Chrome

  Fetches a URL as markdown or readable text, tries .md and llms.txt for docs sites, or reads the open tab's rendered DOM with your session's logins.

  Network · read

• Waits for text, an element, a URL or the network to settle

  Pauses until a condition holds so the agent does not act on a half-loaded page; the core skill has a 'read this' section on waiting.

  Read · wait

• Saves a picture or PDF of the page, with optional numbered labels

  `screenshot [path]` (--full for the full page, --annotate to number elements, --if-changed to skip unchanged images and save tokens). `pdf <path>` saves the page as PDF.

  Files · screenshot / pdf

• Runs JavaScript inside the page

  Runs any JavaScript in the page and returns the result. Handy for extraction; can be gated with --confirm-actions eval or an action policy.

  Runs code · eval

• Opens and switches tabs, enters iframes, answers pop-up dialogs

  Tabs have stable ids (t1, t2) or your own labels. `frame <sel>` enters an iframe. alert and beforeunload dialogs are auto-accepted; confirm and prompt need `dialog accept|dismiss`.

  Write · tab / window / frame / dialog

• Blocks or fakes requests, lists traffic and records HAR files

  `network route` blocks or mocks URLs, `network requests` lists and filters traffic, `network har start/stop` records a HAR that includes text response bodies by default.

  Write · network

• Reads, sets and clears cookies and local or session storage

  Includes importing cookies from a Copy-as-cURL dump, which the core skill recommends instead of pasting secrets.

  Delete · cookies / storage

• Gives each agent or task its own separate browser

  Each named session has its own browser, cookies, history and login state. The core skill tells the agent to set a named session first so it does not take over a shared browser.

  Runs code · --session / session list

• Reuses your Chrome logins or saves login state between runs

  Reuse a Chrome profile's cookies, keep a persistent profile folder, or auto-save cookies and localStorage per session to ~/.agent-browser/sessions (plaintext unless an encryption key is set).

  Write · --profile / --restore / state save

• Stores passwords encrypted and logs in without showing them to the AI

  Saves credentials in a local encrypted vault and fills the login form by name. Credential provider plugins can supply secrets from another vault.

  Write · auth save / auth login

• Shows what changed on the page since the last look

  Compares the page structure or pixels against the last snapshot or a saved baseline.

  Files · diff snapshot / diff screenshot

• Records a video and collects console and error logs for debugging

  Debug commands capture browser console output, page errors, traces and video recordings of the workflow.

  Files · record / trace / console / errors

• Runs accessibility audits, Web Vitals and React inspection

  `a11y` runs axe-core on the page; `vitals` reports LCP, CLS, TTFB, FCP, INP; `react tree|inspect|renders` needs launching with --enable react-devtools.

  Read · a11y / vitals / react

• Runs several commands in one call

  Pass several quoted commands, or pipe them as JSON, with --bail to stop on the first error.

  Runs code · batch

• Runs the same commands in a cloud browser instead of your machine

  Browserbase, Browserless, Browser Use, Kernel and AWS AgentCore, each with its own API key or AWS credentials.

  Network · -p <provider> (cloud browsers)

• Runs agent-browser as an MCP server for MCP clients

  `agent-browser mcp` starts a stdio MCP server; the default core profile keeps tools few, `--tools all` exposes everything.

  Runs code · mcp

• Local web dashboard to watch the browser live, plus optional AI chat

  Dashboard on port 4848 shows a live viewport, command feed and console. `chat` turns plain-English requests into commands and needs a Vercel AI Gateway key.

  Try: “agent-browser chat "open google.com and search for cats"”

  Runs code · dashboard / chat

• Downloads Chrome, updates the CLI and fixes a broken install

  `install` gets Chrome for Testing (`--with-deps` adds Linux libraries via sudo), `upgrade` updates via your package manager, `doctor` checks and cleans stale daemon files.

  Runs code · install / upgrade / doctor

Watch out for

• skills.sh: Snyk warn

  W011, third-party content exposure (Oct 30, 2026): it browses arbitrary pages, so page text could carry hidden instructions to your agent. skills.sh

• No guardrails unless you turn them on

  agent-browser's security page says navigation, action and output controls are opt-in. agent-browser.dev

• Open: guardrail gaps

  An allowlist that parses to zero domains turns containment off (#1902), and the MCP server skips maxOutput and content boundaries (#2245). github.com

• Fixed: repo config could launch programs

  A repo's ./agent-browser.json could name an executable that ran on open. Project config now accepts only a short list of display keys. github.com

• skills.sh: Gen Agent Trust Hub pass

  Rated safe, with notes on prompt injection, the global npm install, instructions loaded at runtime and access to login sessions. skills.sh

• skills.sh: Socket pass

  Passed on Oct 30, 2026 with no findings. skills.sh

Security advisories

In their words