Interceptor
Let AI agents operate the real browser and macOS apps you already use — no CDP, no separate automation browser, logins and tabs intact.
Evidence shows tiered installers (browser-only requires zero TCC consents), MCP destructive verbs refused by default, Safari requiring manual user consent, and uninstall/downgrade scripts — least_privilege/user_confirmation/rollback get 2. Deductions: the agent holds sweeping power over the real browser and OS input by design; secret delivery features (`macos secret`, `--browser-login`) are described in one line with no storage/exposure detail (sensitive_data_handling 1); dependency security shows only package. plus one patch, no lockfile/audit evidence (dependency_security 1); the product's core purpose is total control of a real browser and system input, so the external-effects surface is inherently large (external_effects 1); LICENSE names Hacker Valley Media but metadata is NOASSERTION with no maintainer docs (source_attribution 1).
CI pins lockfile and Xcode toolchain, runs typecheck + tests + capability-blind audit; README and package. versions agree (self_consistency/dependency_availability 2). Deduction: actionable error formatting is only demonstrated for the bridge-recovery path in tests; static review cannot confirm coverage across all commands (failure_messages 2).
README states target users (agent operators, CI flow tests) and per-platform boundaries (full macOS, browser-only Windows, dev-mode iPhone for iOS); Safari-incompatible APIs degrade explicitly (audience/boundaries/environment 2). Deduction: agents consume untrusted page content directly; prompt-injection protection is asserted as 'fenced as untrusted data' with no implementation evidence in scope (trigger_precision 1).
Install documentation is exceptionally thorough (installer comparison tables, per-component destinations, troubleshooting) — 3; architecture and naming are coherent, examples ample (2). Deductions: known limitations are scattered (ad-hoc signing TCC loss etc.), no dedicated Limitations section (known_limitations 1); no CHANGELOG, only a version number (versioning_changelog 1); license text is complete Elastic 2.0 but metadata is NOASSERTION and the license is source-available, not OSI open source (license 2); CI, release badges and Sparkle updates exist but no stated maintainer commitment (maintenance_responsibility 2).
Structured tree+diff output designed for agent parsing (output_usability 2); clear differentiation from CDP tooling (real logged-in profile, record-replay) supports marginal value (marginal_value 2); nonzero setup cost (daemon, manual extension load) traded for real automation capability (cost_benefit 2). Deduction: all claims are asserted, not executed-verified.
Comparison tables, use-case docs, and unit tests for recovery/validation logic support claim traceability (claim_traceability 2). Deduction: claims about competitors' capabilities in the comparison table cannot be corroborated within the repository (cross_source_corroboration 1); the README largely separates facts from vision without exaggerated unverifiable performance claims (fact_inference_separation 2).
- By default the tool grants the agent full control of a real logged-in browser and (in Full mode) macOS system input; evaluate in an isolated environment before production use.
- Credential-delivery features (macos secret, --browser-login, ios unlock) have minimal documented storage/exposure detail; audit before handling sensitive credentials.
- Agents directly consume page and network content; prompt-injection protection is asserted but not evidenced in scope — keep defenses against untrusted page content.
- Licensed under Elastic License 2.0 (source-available, not OSI open source) with hosting-service restrictions; repo metadata is NOASSERTION — verify compliance manually.
- This is a static review (low confidence); no install or command was executed, and all capability claims derive from docs and test code.
What does this agent do, and when should you use it?
Interceptor is an agent-driven control layer from Hacker-Valley-Media with one interceptor CLI spanning three product surfaces: Browser (a WebExtension inside your real Chrome/Brave/Safari session), macOS (a Swift bridge daemon driving native apps), and iOS (an on-device XCUITest runner driving iPhone apps). The agent calls CLI commands, reads the output (element refs e1/e2/…, DOM trees, passive network logs), and decides the next step — no MCP or API keys required. A pre-load userActivation override plus the __interceptor_trust event marker lets synthetic clicks and keystrokes pass most isTrusted gates, while fetch/XHR/SSE/WebSocket traffic is captured passively without the DevTools protocol. It also ships as an MCP server (interceptor mcp install), letting MCP-native clients like Claude Code, Codex, and Cursor drive every surface through typed, safety-gated tools. Installation is via signed .pkg installers (Browser / Full / Safari add-on), with a Windows browser-only installer and a build-from-source path.
The daemon auto-starts on the first command; the CLI talks to the extension via native messaging. The Browser surface offers compound commands — open/read/inspect/act/click/type/upload/screenshot/diff: interceptor open loads a page and returns the element tree plus text; act e1 clicks and returns the updated tree with a diff; net log captures passive network traffic including full response bodies (exportable as /har/pcapng, with --redact-auth); sse log/tail handles SSE streams; the scene family manipulates Canva, Google Docs, and Google Slides scene graphs directly; monitor start records a human session and export --plan emits a replayable interceptor script; override rewrites outbound requests before send. The macOS surface (Full pkg) provides macos tree/find/act/screenshot/listen/vision commands via the bridge app, built on accessibility trees, OS-level trusted input, and on-device vision/speech/NLP. The iOS surface connects over the network to an on-device XCUITest runner, offering ios tree/click/type/screenshot/unlock plus proc/eval/web commands. In MCP mode, interceptor mcp serve (stdio) exposes interceptor_browser/macos/ios/read/local/raw tools; destructive verbs are refused by default unless --allow destructive,arbitrary-exec is passed at launch.
- A security tester running cross-account session tests between two logged-in browser profiles uses named contexts (--context <id>) to drive Account A and Account B simultaneously.
- An automation engineer harvesting a site's fetch/XHR/SSE/WebSocket traffic and CSRF/auth headers exports with interceptor net log --format har --redact-auth for analysis.
- An ops or assistant agent performing precise edits in Google Docs/Slides or Canva uses interceptor scene list/text/insert/slide goto to act on the scene graph instead of screenshot-based vision.
- Teach-and-replay onboarding: a human performs a web flow once, interceptor monitor records it, and export --plan produces a semantic-selector replay script.
- A developer using Claude Code, Codex, or Cursor registers browser and macOS control as MCP tools in one step with interceptor mcp install.
- A tester driving any app on their own unlocked Developer-Mode iPhone uses ios tree/click/type and the on-device ios eval observe-decide-act loop in a single round-trip.
What are this agent's strengths and limitations?
- Non-CDP architecture: works inside your existing logged-in browser profile with cookies, sessions, and tabs intact, avoiding the separate-automated-browser footprint.
- Passive network capture covers fetch/XHR/SSE/WebSocket/sendBeacon/BroadcastChannel with no debugger and no infobanner.
- The pre-load userActivation override plus __interceptor_trust marker passes most isTrusted gates; OS-level CGEvent (--os) is a fallback, not the default.
- One CLI covers browser, native macOS apps, and iPhone, sharing the same e1/e2 ref system and daemon.
- Record-and-replay: export a human session as a replay script with semantic selectors, including tab-handoff lines for multi-tab sessions.
- The macOS Full surface requires Screen Recording, Accessibility, and Apple Events TCC consents; ad-hoc-signed dev bridges lose grants on every rebuild and must be re-granted.
- Chrome/Brave extensions must be loaded manually via Load unpacked — those browsers disallow programmatic installation outside the Web Store, a step the core installers cannot perform.
- Strong platform binding: full capability requires macOS (Full needs macOS 14/15+), iOS needs an owned, unlocked Developer-Mode iPhone; Windows supports browser-only.
- Grants agents real autonomy over your browser and apps — the README itself warns to treat it like an agent, not a toy script runner; MCP destructive verbs stay gated until explicitly --allow-ed at launch.
- License is flagged NOASSERTION in repository metadata; verify licensing terms before adoption.
How do you install or deploy this agent?
Fastest path: download a signed installer from GitHub Releases and double-click. Choose Interceptor-Browser-<version>.pkg (recommended, no TCC consents, macOS 11+) or Interceptor-Full-<version>.pkg (adds the macos surface; requires Screen Recording/Accessibility/Apple Events, macOS 14+), optionally plus Interceptor-Safari-<version>.pkg. Windows has a browser-only installer (Windows 11 24H2+). Source builds need Bun and Brave/Chrome: git clone https://github.com/Hacker-Valley-Media/Interceptor.git && cd Interceptor && bun install && bash scripts/build.sh, then bash scripts/install.sh --browser-only or --full. For Chrome/Brave, manually enable Developer Mode in the extensions page and Load unpacked from /Library/Application Support/Interceptor/extension/. Update with interceptor update; uninstall with sudo bash "/Library/Application Support/Interceptor/uninstall.sh".
How do you use this agent?
After installing, open a terminal and verify: interceptor status shows mode (browser-only or full); interceptor open "https://example.com" spawns the daemon and returns the element tree plus text; interceptor act e1 clicks and returns the updated tree; interceptor inspect combines tree, text, and network log. Use interceptor macos open "Finder" and interceptor macos act e5 for the macOS surface. For MCP: interceptor mcp install auto-configures detected AI clients; restart the client; interceptor mcp status shows registrations. With multiple browsers connected, list contexts via interceptor contexts and target with --context safari. Agent skill packages live at .agents/skills/interceptor-browser/, interceptor-macos/, and interceptor-ios/.