h5i — A Security-First Headless Browser for AI Agents
A lightweight, pure-Rust browser with no Chromium or V8, letting agents browse, scrape, test, and automate the web inside sandboxed, auditable sessions.
Evidence is unusually strong: five isolation tiers with fail-closed downgrade refusal, nftables egress allowlists pinned to resolved IPs, DNS pinning, credential isolation via an auth proxy that keeps provider tokens out of the box, a runtime-resolving secrets broker writing 0600 files that are unlinked after the run, and recording of both allowed and denied requests. Deductions: rollback only covers the box lifecycle (box rm/apply/export); no update/rollback path for the binary itself. Dependency security has lockfile platform verification and well-reasoned dependency choices, but no evidence of cargo-audit/cargo-deny style scanning. User confirmation mechanisms exist (human login takeover, setcap command printed rather than executed, per-run grant announcements), but curl|sh remains the default install chain. Source attribution is complete in docs and LICENSE, but the LICENSE appendix copyright placeholder is unfilled and publisher identity is unverified.
README, Cargo.toml, SECURITY.md, and both workflows cross-reference consistently (the boa fork, single-binary design, and plugin names all align), so self_consistency is full marks. Deductions: the core engine depends on a self-maintained boa fork pinned to a git revision (acknowledged as pending upstream), an availability risk; failure-message quality at the CLI level cannot be confirmed from static files — only the policy-level fail-closed guarantees and CI asset assertions are evidenced.
Audiences and scenarios are clearly delimited (agent browsing/scraping, authorized websec testing, sandboxed agent workflows); the FAQ explicitly says it does not work on every website; platform differences (Linux/macOS as different mechanisms, no cgroups on macOS) are enumerated, and box probe lets users test host capability. Deduction: trigger precision is only inferable from README examples; the specific per-tier triggering conditions live in MANUAL.md, which is not in the evidence.
Information architecture, install notes (three paths, with an explicit explanation that h5i.dev and raw.githubusercontent carry different trust chains), FAQ, known limitations (the SECURITY.md non-goals section is exceptionally thorough), and full Apache-2.0 text are all present. Deductions: the project is at v0.4.2 (pre-1.0); no CHANGELOG file appears in the evidence (release notes are auto-generated); maintenance responsibility rests on a 'fixes target main' statement with no CODEOWNERS or named maintainer identity.
Differentiation from Playwright/Burp is argued honestly in the FAQ (not a replacement for every use case), and the '~3× faster, ~86% less memory' claim points to an in-repo benchmark design doc, making it traceable. Deduction on output usability: structured outputs (--, markdown, snapshot --delta) are visible only at the CLI-example level; actual output quality is unverified without execution.
Nearly every claim carries a source: design doc paths, module paths (crates/h5i-sandbox/src/auth_proxy.rs), ROADMAP items (D1–D14, R1–R13), and CI assertions (a 24-asset count check) are all checkable. Fact/inference separation is a highlight — SECURITY.md mandates labeling evidence by observer (host-observed / box-claimed / kernel-observed) and refuses to average them into a score. Deduction: cross-source corroboration comes mostly from internal cross-references; independent external corroboration in the evidence is limited to a trendshift badge.
- Publisher identity is unverified; this is a static review with no execution — performance and isolation claims are untested.
- Default install is curl | sh; prefer the repository-direct URL or build from source. SECURITY.md itself notes the two install chains carry different trust.
- The JS engine depends on a maintainer-controlled boa fork pinned to a git revision — a supply-chain single point until upstream merges.
- Take SECURITY.md's own residual risks seriously: TTY two-way nature of box shell, session login withholding reads but not viewer frames, and user-writable install directories that an in-box agent can replace.
- Use websec/recon only on systems you own or are authorized to test; recon output is explicitly candidate evidence, not vulnerability verdicts.
- The LICENSE appendix copyright placeholder is unfilled; attribution metadata is incomplete.
What does this agent do, and when should you use it?
h5i (pronounced "high-five") is a lightweight open-source browser built for AI agents to browse, scrape, test, and automate the web, driven through a single h5i CLI. Written entirely in Rust with no Chromium or V8, its benchmarks claim roughly 3× faster performance and ~86% less memory than Chromium-based approaches. Because h5i owns the browser's network layer, agents can capture, inspect, edit, replay, and compare HTTP traffic without a MITM proxy, CA certificate, or separate repeater. It reduces the risks of granting agents web access through tiered sandboxing (workspace, process, supervised network, container, microVM), egress allowlists, credential isolation, and fully auditable sessions. Licensed Apache-2.0, it runs locally as a binary with no hosted service, keeping session data on your machine.
h5i exposes three CLI command families. The browser family (h5i browser) combines one page state, cookie jar, network policy, and request record per session: open loads a page, snapshot emits a page outline with @ref handles (or --delta changes only), click/type interact with elements, extract pulls structured data by selector, markdown renders readable content, requests shows allowed and denied fetches, audit records actions, fetches, handovers, and session ending, and login lets a human take over without returning credentials to the model. The websec plugin captures and manipulates HTTP messages: requests lists them, show inspects one, replay edits and resends, diff compares responses, match asserts conditions, sequence runs multi-step tests. The recon plugin performs authorized discovery: extract reads endpoints pages already disclosed, known fetches robots.txt/sitemap.xml/security.txt, crawl walks the site under request/rate bounds, triage folds soft-404 noise, and endpoints outputs an inventory where each row names the proving message. The box subsystem defines isolation tiers (workspace/process/supervised/container/microvm), egress allowlists, and filesystem bounds in .h5i/env.toml, then runs the browser—or an entire agent workflow with a git worktree, toolchain, and dev server—inside it, with propose/apply/export change snapshots and h5i join for remote admission.
- Engineering teams granting agents web access: restrict agents to allowlisted domains while keeping a full record of allowed and denied requests.
- Authorized penetration testers: have an agent capture, edit, replay, and compare HTTP traffic inside a browser session for request tampering and multi-step web security tests.
- CTF players: use h5i's websec/recon commands to surface endpoints, verify hypotheses, and assert response conditions quickly.
- Scraping engineers: run structured extraction (snapshot/extract/markdown) over content-heavy sites that don't need full Chromium compatibility.
- Agent security researchers: run entire agent workflows inside supervised/container/microVM isolation where host credentials never enter the box and changes are merged only after propose/apply review.
What are this agent's strengths and limitations?
- Pure Rust with no Chromium/V8; official benchmarks claim roughly 3× speed and ~86% memory savings.
- Own network layer: capture, edit, replay, and diff HTTP traffic with no MITM proxy, CA certificate, or separate repeater.
- Five isolation tiers including nftables egress allowlists pinned to resolved IPs and microVMs with their own kernels; unsatisfiable requests fail closed instead of silently downgrading.
- Credential isolation: agents reference named credentials or a human takes over via h5i browser login—passwords and cookies never enter model context.
- Fully auditable sessions: audit logs actions, fetches, handovers, and session ending, and each discovered endpoint traces back to a proving message ID.
- Not compatible with every website: some browser APIs are unsupported, and complex sites may require running Chromium inside an h5i sandbox.
- Not a full Burp Suite replacement: no mature scanner, extension ecosystem, or low-level protocol testing.
- Strong isolation depends on external components—Podman for the container tier and microsandbox (msb) for microVMs—so host support varies; check with h5i box probe.
- Explicitly cannot reliably detect or prevent prompt injection; it only mitigates impact via isolation and audit.
- A young project (visible via its Trendshift badge), with limited long-term production track record or third-party evaluation evidence.
How do you install or deploy this agent?
1) One-line install: curl -fsSL https://h5i.dev/install.sh | sh (alternatively use the raw install.sh URL on GitHub, or cargo install --path . to build from source). 2) Agent skill file: npx skills add h5i-dev/h5i, or run h5i skill install once the binary exists. 3) Optional plugins: curl -fsSL https://h5i.dev/install.sh | sh -s -- --websec --recon, then verify with h5i plugin list. 4) Man page: curl -fsSL https://h5i.dev/man/man1/h5i.1 -o ~/.local/share/man/man1/h5i.1. Run h5i box probe to see which isolation tiers your host supports.
How do you use this agent?
Basic browsing: h5i browser open https://docs.rs/ --allow docs.rs, then h5i browser snapshot (or --delta), h5i browser click @e3, h5i browser type @e5 "serde", h5i browser extract '{"titles": ["h2"]}', h5i browser markdown, and h5i browser close. One-shot read: h5i browser read <url>. Security testing: h5i browser open https://target.example --capture --allow target.example, then use h5i websec requests/show/replay/diff/match/sequence plus h5i recon extract/crawl/triage/endpoints. Sandboxing: define a profile in .h5i/env.toml (isolation, net.egress, fs.read/write), then h5i box --profile reading --name docs and h5i browser open <url> --in docs. To sandbox a whole workflow: h5i box create alpha --profile agent-claude, then h5i box shell/run/propose/apply/export. Run parallel browsers with --session, set a coherent identity with --identity (e.g. firefox-143-linux), and fetch media transcripts with h5i browser transcript.
How does this agent compare with similar options?
The README directly compares h5i with Playwright and Puppeteer: choose those for maximum compatibility with complex websites; choose h5i for lower resource use, direct network controls, complete session records, built-in HTTP testing tools, or sandboxing of the browser and agent. It also states h5i does not replace Burp Suite in every case—Burp remains better for mature manual workflows, automated scanning, extensions, and low-level protocol testing.