Actionbook Browser Agent

The README identifies the remote MCP endpoint, Chrome extension, reuse of logged-in sessions, and external actions such as opening tabs, reading pages, clicking, and filling forms, so the broad flow and effect surface are visible. Workflows also use either empty top-level permissions or explicit limited GitHub permissions. Deductions apply because the supplied material does not document extension permissions, what page or credential data the hosted service receives or retains, encryption and deletion practices, per-action confirmation, domain restrictions, sensitive-field protections, or revocation and rollback. Dependency controls include a pinned pnpm release and one override, but most packages use ranges and Actions are pinned only to major tags, with no audit or vulnerability-response policy. Repository branding, community links, and the Cue Labs, Inc. notice provide partial attribution, but publisher identity is unverified and maintenance accountability remains incomplete.

The README, package manifest, and workflows show recognizable build, test, and release structures, including Windows unit and end-to-end configurations; the package manager and ordinary dependency sources are also specified. Deductions apply because the recommended hosted connector and extension implementation are not included in the evidence, the CLI is declared deprecated while release automation still contains CLI installation messaging, and the extension release branch is excluded by the notification job condition. Failure handling is limited to skipping integration tests when an API key is absent, failing a webhook request, and confirming connection during setup; there is no documented user-facing error taxonomy, recovery guidance, or fallback behavior.

The material clearly targets users who need agents to work across authenticated websites, produce reports, CSVs or drafts, and repeat tasks as Recipes. It names several MCP-compatible clients, giving adequate ordinary environment coverage. Deductions apply because capabilities are only summarized through subcommands such as search, manual, goto, snapshot, click, and type, while the complete command set, supported sites, read/write boundaries, and concurrency limits are deferred to external descriptions. Trigger guidance consists of a natural-language example and an optional explicit prompt, without statically reviewable routing rules, ambiguity handling, or safeguards against triggering on unsuitable pages.

The README has clear sections for positioning, installation, quick start, tools, documentation, community, contribution, and licensing. Its three-step hosted-connector setup is adequate for ordinary installation. The complete Apache-2.0 text agrees with package metadata, justifying full license marks. Changesets, version synchronization, release scripts, and tag conventions show a release path, but no changelog content is supplied and the root package remains version 0.0.0. Deductions also reflect the coexistence of the current product, a Legacy section, a deprecated CLI, and continuing CLI release logic, which weakens naming and lifecycle clarity. Examples are sparse, no FAQ is present, limitations and support coverage are largely external, and no specific maintainer or responsibility policy is identified beyond general community channels.

The README describes directly usable deliverables including sourced reports, clean CSVs, ready-to-send drafts, and reusable Recipes. Access to authenticated data, API-first operation with UI fallback, and concurrent tabs plausibly offer incremental value over generic browser agents. Deductions apply because claims of 10x speed, accuracy, resilience, and processing 192 sites in two minutes are marketing statements or a video reference without methods, baselines, or result data in the supplied files. Installation is described as free and CLI-free, but hosted-service pricing, privacy costs, service limits, resource consumption, and maintenance burden are not disclosed, leaving cost-benefit support thin.

Some claims trace to concrete artifacts, including the Apache license, pnpm version, test workflows, hosted endpoint, and CLI deprecation notice. The README, package manifest, and workflows also corroborate the project identity, package structure, and release machinery. Deductions apply because the core agent, hosted connector implementation, extension manifest, privacy controls, comprehensive tests, and linked documentation are absent, preventing closed-loop verification of the principal security and performance claims. Marketing assertions, demonstration results, and architectural implications are not systematically separated from verified facts, so all three criteria receive only thin support.