Endoplexity Browser Agent
Agentic control of your real browser, powered by the Claude or Cursor subscription you already pay for — no metered API key.
Per-dimension scores and reasoning
Least privilege is well evidenced: browser tools only, token-gated /mcp, pinned origin, loopback binding, tests pinning auth behaviour; deducted because the approval gate is an English label heuristic that SECURITY.md admits will miss non-English/odd/icon-only buttons. User confirmation has three fail-closed autonomy modes, but trust mode bypasses the gate entirely, backed only by a red banner. Data-flow and sensitive-data handling are explained well (upload/read_file asymmetry, key-based file resolution), but the documented weakness of 0600 on Windows is a real, acknowledged reduction. Dependency security: only four ordinary dependencies but no lockfile or audit evidence. Rollback is limited to attachment-copy deletion.
README, package., and tests are consistent (156 tests, 14 tools, v0.0.1); tests cover delta, auth, and attachment boundaries precisely. Not full marks because claims cannot be verified statically. Dependency availability is reasonable (Node>=24 declared); failure-message handling has concrete evidence (graceful out-of-range from, cap notices naming a callable recovery).
Audience (subscription-holding individuals) and scenarios (form filling, comparison, file Q&A) are clear; capability boundaries are stated exceptionally thoroughly (chrome:// pages, ATS comboboxes), earning 3. Environment fit explicitly concedes Windows-first with macOS/Linux autostart unimplemented, deducting 1. Trigger precision (@-references, Enter semantics) is documented but not statically verifiable.
Information architecture is good (structured README, docs/handrun.md, SECURITY.md); install notes are concrete and executable; known limitations are unusually honest and detailed (3). License is full Apache-2.0 text with NOTICE. Deductions: no CHANGELOG (excusable at v0.0.1 but absent); maintenance is a single maintainer with a good-faith one-week target, no SLA, weak update path.
Output usability is evidenced (comparison table, sources, snapshot pagination and delta design); marginal value is strong — reuse of paid subscriptions avoids metered API billing, with a measured 3.8x token reduction. Cost-benefit cites concrete measurements ($0.0959/task) but these are self-reported and unverifiable statically, deducting 1.
Fact/inference separation is strong: the demo's trust mode is disclosed, tests are labelled unit-level, cost is labelled CLI-equivalent. Claims are traceable to specific files (gate.ts, auth tests). Cross-source corroboration is internal only (README↔SECURITY↔tests consistent), with no external validation, hence deductions.
- The approval gate is an English label heuristic: non-English, unusually worded, or icon-only buttons will not be caught; do not rely on normal mode on high-risk pages.
- trust mode disables the gate entirely; selecting it removes all human confirmation.
- The file allow-list is the entire boundary: read_file puts contents into model context — only attach what you truly mean to share.
- 0600 is not enforced on Windows; any process running as your user can read the token.
- No lockfile or audit evidence for dependencies; static review cannot confirm absence of known-vulnerable dependencies.
- Single maintainer, v0.0.1, no SLA; security fix timelines are not guaranteed.
- Avoid running against browser profiles holding sensitive sessions (banking, email) — this tool operates on your real logged-in state.
What does this agent do, and when should you use it?
Endoplexity (GitHub: Endokelp/Endoplexity) pairs a Chrome extension with a local bridge so an already-subscribed claude or cursor-agent CLI can drive the real browser you are using. The architecture has three parts: an MV3 side panel that owns the chrome.debugger CDP connection itself (sidestepping MV3 idle teardown); a local TypeScript bridge on 127.0.0.1:8787 that talks to the panel over an origin-pinned WebSocket and exposes 14 browser tools to the CLI via a token-gated MCP/HTTP endpoint (/mcp); and the agent loop, which is simply your logged-in CLI. Pages reach the model as accessibility-tree snapshots rather than raw HTML, and actions return the resulting page with only changed lines resent, cutting token use. The project is early at v0.0.1 but ships 156 unit tests, an in-bridge approval gate for irreversible actions, and three autonomy modes (watch/normal/trust) — with the safety policy enforced in the bridge, never in a prompt.
You type a task in the Chrome side panel; the panel hands it to the local bridge, which invokes claude -p or cursor-agent -p over MCP to run the agent loop. The model operates the browser through 14 tools: snapshot, navigate, click, type, key, upload, read_file, select, scroll, hover, back, forward, tabs, use_tab. Pages are delivered as accessibility-tree snapshots; after the first read, only changed lines are resent to save tokens. read_file turns attachments (PDF, DOCX, XLSX, PPTX, CSV, JSON, Markdown, text) into text the model can reason about; upload pushes files into form fields. Irreversible actions hit an approval gate, and autonomy modes are enforced in the bridge.
- A job seeker with a Claude Pro subscription: have the agent complete a real Greenhouse application form end to end (measured at ~$0.0959 equivalent API spend, 10 turns, 42 seconds).
- Comparison shoppers: one instruction opens Vercel, Netlify, and Cloudflare Pages pricing in three tabs and compares free tiers in one table.
- Users who depend on logged-in sessions: the agent works on your real browser session, so no headless re-login is needed.
- Anyone submitting attachments: drop a resume on the composer and the agent can read_file it to answer questions or upload it into a form.
- Security-conscious users: watch mode requires human approval at the gate for submit, delete, and purchase actions.
What are this agent's strengths and limitations?
- Runs on subscriptions you already pay for — no per-click API billing; a full job application measured at ~$0.0959 equivalent API spend.
- Drives your real browser and real logged-in sessions, not a headless copy that must re-authenticate.
- Substantive security engineering: loopback-only bridge, RSA-pinned extension origin, 0600 token file for /mcp, CLI allowlists and isolated profiles verified by actually attempting shell execution.
- Measured performance work: incremental page returns cut tokens 3.8x (119,856 → 31,626); 156 unit tests plus an in-panel CDP self-test.
- Windows-first: npm run setup autostart is Windows-only; macOS/Linux must run npm start manually.
- Early v0.0.1: sessions live only in bridge memory and end on restart; chrome:// pages and the Web Store can't be driven; real ATS comboboxes need a click-then-click flow instead of select.
- The approval gate is a label heuristic matching English words (submit, pay, delete, etc.); non-English or unusually worded buttons will not be caught — use watch mode where it matters.
- Hard dependency on Node 24+ and a logged-in claude/cursor-agent CLI subscription; without one it cannot run at all.
How do you install or deploy this agent?
- Prerequisites: Node 24+, Chrome 114+, and a logged-in claude or cursor-agent CLI on a real subscription (Claude Pro is enough; pick Sonnet in the model dropdown). 2. Clone and install: git clone https://github.com/Endokelp/Endoplexity.git && cd Endoplexity && npm install. 3. Start the bridge: npm run setup on Windows (installs autostart via the Startup folder) or npm start to run in the foreground anywhere. 4. Load the extension: open chrome://extensions, enable Developer mode, click Load unpacked, and select the extension/ folder. 5. Optional: npm run cursor-login for a one-time Cursor login in a bridge-owned profile.
How do you use this agent?
Click the Endoplexity toolbar icon to open the side panel, type a task, and hit Run. Key behaviors: Enter starts a fresh task, Ctrl/Cmd+Enter replies within the current conversation; type @ to reference another open tab; a fresh Run attaches to whichever tab you're currently viewing, so open the target page first. Drag, paste, or paperclip-attach files for read_file or upload. Start with low-stakes tasks like summarizing the current page. Switch autonomy modes (watch/normal/trust) in the panel; trust disables the approval gate and is shown in red.