Interceptor
Let AI agents operate the real browser and macOS apps you already use — no CDP, no separate automation browser, logins and tabs intact.
- Source repo
- Hacker-Valley-Media/Interceptor
- Stars
- ★ 565
- Last updated
- 2d ago
- License
- NOASSERTION
- Primary language
- TypeScript
- FA score
- 57/100 · Major gaps
At a glance
- How it runs
- Works with
- Platform-specificCodex · Claude Code · Claude.ai
- Cost
- Free, no paid service needed
- Setup effort
- Medium · a few setup steps
- You'll need
- Typical use
- A security tester running cross-account session tests between two logged-in browser profiles uses named contexts (--context <id>) to drive Account A and Account B simultaneously.
- Not a fit if
- Windows or Linux users who need native macOS app control
- Teams unwilling to grant Screen Recording, Accessibility, and Apple Events permissions
- Unattended pipelines that cannot manually load an unpacked browser extension
- Source review
- 57/100 · Major gaps
What does this agent do, and when should you use it?
Interceptor is an agent-driven control layer from Hacker-Valley-Media with one interceptor CLI spanning three product surfaces: Browser (a WebExtension inside your real Chrome/Brave/Safari session), macOS (a Swift bridge daemon driving native apps), and iOS (an on-device XCUITest runner driving iPhone apps). The agent calls CLI commands, reads the output (element refs e1/e2/…, DOM trees, passive network logs), and decides the next step — no MCP or API keys required. A pre-load userActivation override plus the __interceptor_trust event marker lets synthetic clicks and keystrokes pass most isTrusted gates, while fetch/XHR/SSE/WebSocket traffic is captured passively without the DevTools protocol. It also ships as an MCP server (interceptor mcp install), letting MCP-native clients like Claude Code, Codex, and Cursor drive every surface through typed, safety-gated tools. Installation is via signed .pkg installers (Browser / Full / Safari add-on), with a Windows browser-only installer and a build-from-source path.
The daemon auto-starts on the first command; the CLI talks to the extension via native messaging. The Browser surface offers compound commands — open/read/inspect/act/click/type/upload/screenshot/diff: interceptor open loads a page and returns the element tree plus text; act e1 clicks and returns the updated tree with a diff; net log captures passive network traffic including full response bodies (exportable as /har/pcapng, with --redact-auth); sse log/tail handles SSE streams; the scene family manipulates Canva, Google Docs, and Google Slides scene graphs directly; monitor start records a human session and export --plan emits a replayable interceptor script; override rewrites outbound requests before send. The macOS surface (Full pkg) provides macos tree/find/act/screenshot/listen/vision commands via the bridge app, built on accessibility trees, OS-level trusted input, and on-device vision/speech/NLP. The iOS surface connects over the network to an on-device XCUITest runner, offering ios tree/click/type/screenshot/unlock plus proc/eval/web commands. In MCP mode, interceptor mcp serve (stdio) exposes interceptor_browser/macos/ios/read/local/raw tools; destructive verbs are refused by default unless --allow destructive,arbitrary-exec is passed at launch.
- A security tester running cross-account session tests between two logged-in browser profiles uses named contexts (--context <id>) to drive Account A and Account B simultaneously.
- An automation engineer harvesting a site's fetch/XHR/SSE/WebSocket traffic and CSRF/auth headers exports with interceptor net log --format har --redact-auth for analysis.
- An ops or assistant agent performing precise edits in Google Docs/Slides or Canva uses interceptor scene list/text/insert/slide goto to act on the scene graph instead of screenshot-based vision.
- Teach-and-replay onboarding: a human performs a web flow once, interceptor monitor records it, and export --plan produces a semantic-selector replay script.
- A developer using Claude Code, Codex, or Cursor registers browser and macOS control as MCP tools in one step with interceptor mcp install.
- A tester driving any app on their own unlocked Developer-Mode iPhone uses ios tree/click/type and the on-device ios eval observe-decide-act loop in a single round-trip.
How do you install or deploy this agent?
Fastest path: download a signed installer from GitHub Releases and double-click. Choose Interceptor-Browser-<version>.pkg (recommended, no TCC consents, macOS 11+) or Interceptor-Full-<version>.pkg (adds the macos surface; requires Screen Recording/Accessibility/Apple Events, macOS 14+), optionally plus Interceptor-Safari-<version>.pkg. Windows has a browser-only installer (Windows 11 24H2+). Source builds need Bun and Brave/Chrome: git clone https://github.com/Hacker-Valley-Media/Interceptor.git && cd Interceptor && bun install && bash scripts/build.sh, then bash scripts/install.sh --browser-only or --full. For Chrome/Brave, manually enable Developer Mode in the extensions page and Load unpacked from /Library/Application Support/Interceptor/extension/. Update with interceptor update; uninstall with sudo bash "/Library/Application Support/Interceptor/uninstall.sh".
How do you use this agent?
After installing, open a terminal and verify: interceptor status shows mode (browser-only or full); interceptor open "https://example.com" spawns the daemon and returns the element tree plus text; interceptor act e1 clicks and returns the updated tree; interceptor inspect combines tree, text, and network log. Use interceptor macos open "Finder" and interceptor macos act e5 for the macOS surface. For MCP: interceptor mcp install auto-configures detected AI clients; restart the client; interceptor mcp status shows registrations. With multiple browsers connected, list contexts via interceptor contexts and target with --context safari. Agent skill packages live at .agents/skills/interceptor-browser/, interceptor-macos/, and interceptor-ios/.
What are this agent's strengths and limitations?
- Non-CDP architecture: works inside your existing logged-in browser profile with cookies, sessions, and tabs intact, avoiding the separate-automated-browser footprint.
- Passive network capture covers fetch/XHR/SSE/WebSocket/sendBeacon/BroadcastChannel with no debugger and no infobanner.
- The pre-load userActivation override plus __interceptor_trust marker passes most isTrusted gates; OS-level CGEvent (--os) is a fallback, not the default.
- One CLI covers browser, native macOS apps, and iPhone, sharing the same e1/e2 ref system and daemon.
- Record-and-replay: export a human session as a replay script with semantic selectors, including tab-handoff lines for multi-tab sessions.
- The macOS Full surface requires Screen Recording, Accessibility, and Apple Events TCC consents; ad-hoc-signed dev bridges lose grants on every rebuild and must be re-granted.
- Chrome/Brave extensions must be loaded manually via Load unpacked — those browsers disallow programmatic installation outside the Web Store, a step the core installers cannot perform.
- Strong platform binding: full capability requires macOS (Full needs macOS 14/15+), iOS needs an owned, unlocked Developer-Mode iPhone; Windows supports browser-only.
- Grants agents real autonomy over your browser and apps — the README itself warns to treat it like an agent, not a toy script runner; MCP destructive verbs stay gated until explicitly --allow-ed at launch.
- License is flagged NOASSERTION in repository metadata; verify licensing terms before adoption.
How does this agent compare with similar options?
Key facts side by side with the most closely related agents.
| Agent | Source review | Form / cost | Stars | Updated | Language | Full support on |
|---|---|---|---|---|---|---|
| Interceptor This agent | 57 · Major gaps | CLIFree | ★ 565 | 2d ago | TypeScript | Codex · Claude Code · Claude.ai |
| OpenTabs | 49 · Major gaps | CLIFree + model costs | ★ 991 | 2mo ago | TypeScript | Claude Code |
| Page Agent | 48 · Major gaps | Library / SDKFree + model costs | ★ 30k | 1mo ago | TypeScript | — |
| Uni-CLI | 72 · Some gaps | CLIFree | ★ 232 | 14d ago | TypeScript | ChatGPT · Codex · Claude Code |
How does FollowAgents rate this agent?
Why each dimension lost points
Evidence shows tiered installers (browser-only requires zero TCC consents), MCP destructive verbs refused by default, Safari requiring manual user consent, and uninstall/downgrade scripts — least_privilege/user_confirmation/rollback get 2. Deductions: the agent holds sweeping power over the real browser and OS input by design; secret delivery features (`macos secret`, `--browser-login`) are described in one line with no storage/exposure detail (sensitive_data_handling 1); dependency security shows only package. plus one patch, no lockfile/audit evidence (dependency_security 1); the product's core purpose is total control of a real browser and system input, so the external-effects surface is inherently large (external_effects 1); LICENSE names Hacker Valley Media but metadata is NOASSERTION with no maintainer docs (source_attribution 1).
CI pins lockfile and Xcode toolchain, runs typecheck + tests + capability-blind audit; README and package. versions agree (self_consistency/dependency_availability 2). Deduction: actionable error formatting is only demonstrated for the bridge-recovery path in tests; static review cannot confirm coverage across all commands (failure_messages 2).
README states target users (agent operators, CI flow tests) and per-platform boundaries (full macOS, browser-only Windows, dev-mode iPhone for iOS); Safari-incompatible APIs degrade explicitly (audience/boundaries/environment 2). Deduction: agents consume untrusted page content directly; prompt-injection protection is asserted as 'fenced as untrusted data' with no implementation evidence in scope (trigger_precision 1).
Install documentation is exceptionally thorough (installer comparison tables, per-component destinations, troubleshooting) — 3; architecture and naming are coherent, examples ample (2). Deductions: known limitations are scattered (ad-hoc signing TCC loss etc.), no dedicated Limitations section (known_limitations 1); no CHANGELOG, only a version number (versioning_changelog 1); license text is complete Elastic 2.0 but metadata is NOASSERTION and the license is source-available, not OSI open source (license 2); CI, release badges and Sparkle updates exist but no stated maintainer commitment (maintenance_responsibility 2).
Structured tree+diff output designed for agent parsing (output_usability 2); clear differentiation from CDP tooling (real logged-in profile, record-replay) supports marginal value (marginal_value 2); nonzero setup cost (daemon, manual extension load) traded for real automation capability (cost_benefit 2). Deduction: all claims are asserted, not executed-verified.
Comparison tables, use-case docs, and unit tests for recovery/validation logic support claim traceability (claim_traceability 2). Deduction: claims about competitors' capabilities in the comparison table cannot be corroborated within the repository (cross_source_corroboration 1); the README largely separates facts from vision without exaggerated unverifiable performance claims (fact_inference_separation 2).
- By default the tool grants the agent full control of a real logged-in browser and (in Full mode) macOS system input; evaluate in an isolated environment before production use.
- Credential-delivery features (macos secret, --browser-login, ios unlock) have minimal documented storage/exposure detail; audit before handling sensitive credentials.
- Agents directly consume page and network content; prompt-injection protection is asserted but not evidenced in scope — keep defenses against untrusted page content.
- Licensed under Elastic License 2.0 (source-available, not OSI open source) with hosting-service restrictions; repo metadata is NOASSERTION — verify compliance manually.
- This is a static review (low confidence); no install or command was executed, and all capability claims derive from docs and test code.
Recent releases
Latest entries from the project's GitHub Releases. Notes are quoted from upstream as written, not rewritten or tested by FollowAgents.
-
v2.1.5 Interceptor v2.1.5
Release notes excerpt
Interceptor v2.1.5 What is Interceptor? Interceptor is an AI-agent control surface for the browser, desktop apps, and iPhone you already use. It works with your real signed-in sessions, so your cookies, accounts, tabs, and app state stay intact while an agent reads the interface and takes action. Four surfaces, one CLI: …View on GitHub ↗ -
v2.1.3 Interceptor v2.1.3
Release notes excerpt
Interceptor v2.1.3 What is Interceptor? Interceptor is an AI-agent control surface for the browser, desktop apps, and iPhone you already use. It works with your real signed-in sessions, so your cookies, accounts, tabs, and app state stay intact while an agent reads the interface and takes action. Four surfaces, one CLI: …View on GitHub ↗ -
v2.1.2 Interceptor v2.1.2
Release notes excerpt
Interceptor v2.1.2 What is Interceptor? Interceptor is an AI-agent control surface for the browser, desktop apps, and iPhone you already use. It works with your real signed-in sessions, so your cookies, accounts, tabs, and app state stay intact while an agent reads the interface and takes action. Four surfaces, one CLI: …View on GitHub ↗