FSB — Full Self Browsing
A DOM-first Chrome extension that automates browsing from plain English and exposes the same runtime to Claude Code, Codex, and other MCP clients.
- Source repo
- fullselfbrowsing/FSB
- Stars
- ★ 190
- Last updated
- 18d ago
- License
- MIT
- Primary language
- JavaScript
- FA score
- 49/100 · Major gaps
At a glance
- Works with
- Universal · cross-platformCodex · Claude Code · OpenAI API · Claude APIClaude.ai (Partial support)
- You'll need
- Typical use
- A QA or frontend engineer repeating the same page flow for regression coverage can have FSB re-run clicks, form fills, and state transitions while collecting an action log for each step.
- Main limitation
- It is tightly bound to a live browser: trigger watchers, PhantomStream preview, and coordinate tools all require Chrome and the extension to stay open, with no server-side monitoring, which rules out fully unattended long-running automation.
- Source review
- 49/100 · Major gaps
What does this agent do, and when should you use it?
FSB (Full Self Browsing) is an MIT-licensed Manifest V3 Chrome extension, currently at version 0.9.91, that turns a natural-language task into browser actions by reading the live DOM instead of screenshots. The extension captures selectors, forms, ARIA labels, and DOM deltas, plans the next tool call through a universal OpenAI-compatible provider layer, executes actions in content scripts, and verifies what changed before continuing. A companion npm package, fsb-mcp-server, is a local bridge that registers 69 tools and lets Claude Code, Codex, Cursor, VS Code, Windsurf, and similar clients drive the same extension over ws://localhost:7225. FSB also runs standalone from its popup or side panel against xAI, Gemini, OpenAI, Anthropic, OpenRouter, LM Studio, or a custom endpoint. Beyond DOM automation it ships a 128-app capability catalog with signed and audited first-party API invokes, real file uploads via CDP, single-element trigger watchers, long-term memory, and session replay. Everything runs in your own browser and local process with no hosted account, with the tradeoff that Chrome and the extension must stay open.
The MV3 background worker (extension/background.js) owns session state, model calls, tool execution, MCP routing, and storage; content scripts (extension/content/) build element references and selectors, execute actions, stream DOM state through the PhantomStream capture adapter, and wait for stable results. The AI layer (extension/ai/) handles provider settings, live model discovery, tool definitions, transcripts, and action history over one shared OpenAI-compatible request path. The action surface covers navigation, clicking, type_text, press_key, scrolling, tab management, spreadsheet ranges, coordinate tools, execute_js, and upload_file, which sets a real absolute path on an <input type="file"> through CDP DOM.setFileInputFiles, including inputs hidden behind styled dropzones. The MCP server publishes curated groups — visual sessions, autopilot, trigger watchers, manual control, read-only inspection, developer capture, capability search/invoke, observability and replay, and vault — serializing mutation tools so two clients cannot click or type at once while read-only tools bypass the queue where safe. search_capabilities and invoke_capability query a 128-app catalog where only signature-verified, audited, denylist-gated T1/T1b capabilities execute directly. Memory stores episodic, semantic, and procedural records extracted from finished sessions and retrieves them by domain, task type, recency, and keywords on later tasks.
- A QA or frontend engineer repeating the same page flow for regression coverage can have FSB re-run clicks, form fills, and state transitions while collecting an action log for each step.
- A researcher collecting visible text across many pages can use read_page and get_dom_snapshot to pull structured content directly instead of parsing screenshots.
- An operations or data-entry specialist working through structured back-office forms can drive dropdowns, custom controls, and table inputs, then verify each submission.
- A developer who wants Claude Code or Codex to exercise a local build in a real browser can install fsb-mcp-server and drive Chrome with manual tools or run_task.
- Someone monitoring a page for restocked inventory, a threshold crossing, or a content change can arm a single-element watch with trigger, get_trigger_status, list_triggers, and stop_trigger.
- A support or commerce user comparing product pages, reading dashboard tables, or preparing a cart under supervision can hand the task to the extension's autopilot loop without writing a script.
How do you install or deploy this agent?
Requirements: Chromium 116+ in a stable desktop browser (Chrome, Edge, Brave, or Chromium).
- Clone and install dependencies:
git clone https://github.com/fullselfbrowsing/FSB.git
cd FSB
npm install
npm --prefix mcp installThe extension needs no build step; load the extension/ directory directly.
- Load the extension: open chrome://extensions/, enable Developer mode, click “Load unpacked,” select the extension/ directory, then open the FSB toolbar icon, pick a provider in settings, and confirm connectivity with Test API. Settings accept xAI, Gemini, OpenAI, Anthropic, OpenRouter, LM Studio at http://localhost:1234, or a custom OpenAI-compatible endpoint.
- Optional MCP bridge, one command per client:
npx -y fsb-mcp-server@latest install --claude-code
npx -y fsb-mcp-server@latest install --claude-desktop
npx -y fsb-mcp-server@latest install --cursor
npx -y fsb-mcp-server@latest install --vscode
npx -y fsb-mcp-server@latest install --windsurf
npx -y fsb-mcp-server@latest install --codex
npx -y fsb-mcp-server@latest install --allAppend --dry-run to preview without writing, then restart the client so the server is picked up. No FSB API key is needed on this path because the MCP client's own model does the reasoning.
How do you use this agent?
Standalone: click the FSB toolbar icon, open the popup or side panel, paste a provider API key in settings, and type a task such as “Scroll down,” “Search for cats on Google,” or “Read this page and summarize it.” Start with read-only tasks, then simple click or type tasks, and leave the visual overlay on while evaluating. Stay on a normal webpage, not a chrome:// or extension page.
Through MCP: verify the bridge first with npx -y fsb-mcp-server@latest doctor and npx -y fsb-mcp-server@latest status --watch, then issue instructions from the client. Manual tools are the default path: read_page or get_dom_snapshot to understand the page, execute_js for safe DOM reads and DOM-triggered clicks, native click, type_text, press_key, and drag when real browser events matter, then verify with a fresh snapshot and set is_final:true on the last action to clear the overlay immediately. Use run_task when you explicitly want FSB's own loop. The extension connects to the bridge on ws://localhost:7225, and an optional Streamable HTTP mode exposes http://127.0.0.1:7226/mcp. Trigger watchers are local to the open session: Chrome and the extension must stay running, results come back to the MCP caller, and there is no server-side monitoring or push delivery.
What are this agent's strengths and limitations?
- The DOM-first design produces a concrete latency and cost gap: the README claims 50–200 ms per step versus 1–3 seconds for vision-based agents, and hidden elements stay visible in the structure.
- MCP onboarding is a single npx install per client for Claude Code, Claude Desktop, Cursor, VS Code, Windsurf, and Codex, with no FSB API key required when the client's model does the reasoning.
- Provider coverage is broad — xAI, Gemini, OpenAI, Anthropic, OpenRouter, LM Studio local models, and custom OpenAI-compatible endpoints — plus live model discovery and 30 bundled fallback models.
- The reliability plumbing is real: post-action verification, stuck-action detection, smart waiting, a serialized mutation queue, audit records, and Node tests covering extension modules, MCP contracts, and bridge behavior.
- Native file upload goes beyond synthetic drag-drop: upload_file uses CDP DOM.setFileInputFiles for real file inputs, including ones hidden behind styled dropzones, behind a sensitive-path denylist that logs audit metadata without persisting disk paths.
- It is tightly bound to a live browser: trigger watchers, PhantomStream preview, and coordinate tools all require Chrome and the extension to stay open, with no server-side monitoring, which rules out fully unattended long-running automation.
- Capability coverage is narrower than the 128-app catalog suggests — only signed and audited T1/T1b entries execute directly, while other hits return learn-pending, discovery-pending, or guarded fail-closed responses.
- Autopilot is explicitly framed as production ready only for supervised automation; the README warns that complex or sensitive sites remain unpredictable and that failures should be debuggable via inspection rather than guaranteed.
- There is migration debt: background agents are retired, and while old chrome.storage.local['bgAgents'] data is preserved, scheduled or recurring automation is no longer an active feature.
- Model cost is entirely on the user's provider account, and task context including visible page text and form labels is sent to that provider, so sensitive pages need a deliberate decision before use.
How does this agent compare with similar options?
The README directly contrasts FSB with Project Mariner, Claude Computer Use, and OpenAI Operator, which rely on visual page understanding, and reports latency, hidden-element visibility, and token-cost differences in FSB's favor. It also credits OpenTabs as the inspiration for the Native Capability Catalog's first-party API execution model.
Key facts side by side with the most closely related agents.
| Agent | Source review | Stars | Updated | Language | Full support on |
|---|---|---|---|---|---|
| FSB — Full Self Browsing This agent | 49 · Major gaps | ★ 190 | 18d ago | JavaScript | Codex · Claude Code · OpenAI API · Claude API |
| WebBrain | 65 · Some gaps | ★ 1.1k | 3d ago | JavaScript | Claude Code |
| Open Claude in Chrome | 40 · Major gaps | ★ 223 | 23d ago | HTML | Claude Code |
| Obscura Headless Browser | 75 · Good | ★ 27k | 4d ago | Rust | Claude.ai |
How does FollowAgents rate this agent?
Why each dimension lost points
README asserts encrypted keys, vault unlock, redaction, DOMPurify, capability signature/audit gates, origin and upload-path denylists, and consent gates, and test filenames (consent-gate, audit-log-no-secret, upload-path-denylist, network-capture-consent) corroborate them, so sensitive_data_handling scores 2. However the manifest declares host_permissions <all_urls> plus tabs, scripting, system.memory and windows, with no least-privilege narrowing documented, so least_privilege is 1. User confirmation rests on prose ('supervised automation', 'extra confirmation on sensitive origins') without a verifiable confirmation flow, so 1. Data-flow transparency is a single README paragraph with no field-level or diagrammatic account, so 1. Dependency security shows only npm ci and lockfiles, with no audit, SBOM or vulnerability handling, so 1. External effects (real clicks, uploads, credential/payment vault) have audit and denylists but no sandbox or blast-radius definition, so 1. Rollback offers only advice ('reinstalling MCP config should be the last step') with no state rollback mechanism, so 1. Source attribution has MIT copyright and acknowledgements (OpenTabs, Project Mariner), but publisher identity is unverified and a contributor is an AI name, so 1.
self_consistency scores 2: version 0.9.91 is consistent across README, package.json and badges, and CI enforces version:check and tag binding, but the README also cites 'Engineering milestone 0.11.0', an internal version-narrative inconsistency. dependency_availability scores 1: dependencies include scoped private packages (@full-self-browsing/phantom-stream, the lattice alias, @opentabs-dev/plugin-sdk) whose availability depends on external publishing and cannot be confirmed statically. failure_messages scores 2: README ships a troubleshooting table and doctor/status diagnostics, and tests cover recovery-messaging, restricted-tab and ownership-error-codes, but no error-code catalogue is present.
audience_and_scenarios scores 2: QA, research, data entry, ecommerce, finance, trigger watchers, developer and accessibility scenarios are enumerated with a supervised-use caveat. capability_boundaries scores 2: it explicitly states FSB is not a stealth browser, scraper farm or unsupervised account operator, and notes background agents are retired and triggers need Chrome open. trigger_precision scores 1: triggers are described as single-element watches with threshold/regex/compound conditions, but no static evidence of debounce or false-trigger handling. environment_fit scores 2: Chrome/Edge/Brave/Chromium 116+, Node >=24, named MCP clients and local ports are specified, though the Windows native host requires an MSVC toolchain, a heavy environment requirement.
information_architecture scores 2: the README is well structured with a repository layout table and architecture diagram. install_notes scores 2: one-command installs, manual configs, dry-run, doctor and prerequisites are provided. naming_stability scores 1: FSB/Full Self Browsing coexists with package names fsb-mcp-server and fsb-full-self-browsing, and a 'remote-control-rebrand' test signals naming churn. examples_and_faq scores 2: quick-start examples, screenshots and a troubleshooting table are present. known_limitations scores 1: only scattered caveats (unpredictable complex sites, triggers need Chrome open, HLS/DASH deferred) with no consolidated limitations list. license scores 2: full MIT text matches package.json. versioning_changelog scores 2: CHANGELOG.md, mcp/CHANGELOG.md, version-sync scripts and a tag release flow exist. maintenance_responsibility scores 1: the publisher is unverified, with only an individual author and a sponsorship link and no governance or security-response channel.
output_usability scores 2: outputs support Markdown, sanitized HTML, Mermaid, Chart.js and progress messages across popup, side panel and logs. marginal_value scores 2: the DOM-first approach is clearly differentiated from vision-based agents on latency and cost, reinforced by a capability catalog and triggers. cost_benefit scores 1: the README gives a latency comparison but no measured benchmarks or cost data, and the stack pulls several private packages and a heavy environment, so the benefit case is thin.
claim_traceability scores 1: most capability claims point to files or test names, but conclusions such as 'tested', 'the automated test suite is green' and 'production ready' have no corresponding evidence file. cross_source_corroboration scores 1: README, package.json and CI workflows partially corroborate version and test chains, but security and capability claims lack a second source. fact_inference_separation scores 1: the README mixes marketing language with engineering fact (e.g. 'production ready' beside 'can still behave unpredictably') without separating verified from inferred.
- The manifest declares <all_urls> host permissions plus broad tabs/scripting/system.memory/windows permissions with no least-privilege narrowing; verify each permission before deployment.
- Publisher identity is unverified and the package.json author email is a placeholder ([email protected]); do not infer trust from it.
- Dependencies include scoped private packages (@full-self-browsing/phantom-stream, the lattice alias, @opentabs-dev/plugin-sdk) whose availability and supply-chain risk cannot be confirmed statically.
- The README is internally inconsistent on versioning (v0.9.91 vs 'Engineering milestone 0.11.0') and pairs 'production ready' with 'can still behave unpredictably'; treat code and CI as authoritative.
- Security mechanisms (capability catalog, signature/audit gates, consent gates) are supported only by README prose and test filenames, with no verifiable spec or audit samples.
- Triggers and DOM live preview require Chrome and the extension to stay open, and HLS/DASH discovery is deferred, so real coverage may be narrower than described.