WebBrain
Open-source browser AI agent: reads pages, clicks, types, and runs multi-step workflows from a side panel, on local llama.cpp/Ollama or any cloud LLM you choose.
Least privilege and external effects rest on documentation alone: SECURITY.md self-reports broad permissions (<all_urls>, debugger, downloads, tabCapture) and operation on authenticated sessions. Necessity for a browser agent is plausible, but no manifest or permission-gating code is in the provided evidence to verify containment, so both score 1. User confirmation is stronger: Ask/Act/Dev mode layering, plan-before-Act approval, per-site authorization, though a /dangerously-skip-permissions bypass exists — score 2. Data-flow and sensitive-data handling point to dedicated docs (privacy-and-data-flow, security-model, trace isolation) but are asserted rather than statically verifiable — score 2. Dependency security is thin: only two devDependencies, no lockfile audit or scanning evidence — score 1. Rollback is limited to a claim of reversible edits in Dev mode — score 1. Attribution is excellent: named author, BibTeX citation, clear license history — score 3.
Self-consistency is acceptable: README's GPL≥33.0.0 aligns with package. 34.1.6 and its GPL-3.0 field, but registry metadata says NOASSERTION — score 2. Dependency availability: npm ci in CI, minimal devDeps — score 2. Failure messages: only stop/continue buttons and retry budgets are mentioned; no concrete error copy or degradation behavior in evidence — score 1.
Audience and scenarios are exceptionally clear: three modes, compact/mid/full tool tiers for small local models, many example prompts — score 3. Capability boundaries are a standout strength: the known-issues section details specific Firefox gaps (no CDP: no shadow-DOM traversal, untrusted mouse events, no SPA re-injection retry) — score 3. Trigger precision: slash commands with options, /watch baseline and dedup logic described concretely, but mostly documented assertion — score 2. Environment fit: Chrome/Firefox/Edge, local and cloud providers (106 cards), explicit 16k-context floor; Firefox is explicitly degraded — score 2.
Information architecture is excellent: monorepo layout, trilingual docs, topic-organized index (architecture, tools, security, injection defense, privacy) — score 3. Install notes cover store installs plus precise source-loading steps for Chrome and Firefox including temporary-signature limits — score 3. Known limitations are detailed and specific — score 3. License: full GPL-3.0 text with a clear MIT→GPL history, but registry metadata NOASSERTION is not fully aligned — score 2. Versioning has bump/release scripts and a CHANGELOG.md reference (content not in evidence); formats are versioned (webbrain-config/1) — score 2. Maintenance responsibility: named maintainer, response timelines in SECURITY.md, CONTRIBUTING present — score 2. Good examples, no FAQ — score 2. Naming is stable — score 2.
Output usability is good: streaming Ask answers, copy buttons, /export of conversations/traces/config, versioned export formats — score 2. Marginal value: the browser-agent field is crowded, but multi-provider support (106 cards), local llama.cpp/Ollama, a standalone LM Studio plugin, and offline relevance benchmarks add differentiation — score 2. Cost-benefit evidence is weak: temperature settings, token-aware compaction, and step caps are mentioned but no measured token/cost data — score 1.
Claim traceability is decent: README claims link to specific docs (agent-tools, slash-commands, providers, etc.) — score 2. Cross-source corroboration is moderate: package.'s test:security matches README's injection-defense corpus, SECURITY.md scope aligns with claimed defenses, and CI workflows match stated practices, but the test implementations themselves are not in evidence — score 2. Fact/inference separation: docs explicitly state 'known limits' of injection defense and Firefox deltas rather than absolute claims — score 2.
- Static review only: scoring is based on repository files; no tests were executed. Core behaviors (authorization prompts, injection defense, data flow) are documented claims — verify docs/security-model.md and docs/privacy-and-data-flow.md independently.
- The extension requests broad permissions (<all_urls>, debugger, downloads, tabCapture) and drives authenticated sessions; proportionate to its function but a high-risk surface. Avoid the /dangerously-skip-permissions bypass and be cautious with Act/Dev modes.
- Publisher identity is unverified; the project is maintained by an individual (Emre Sokullu). Cross-check store signatures against repository source before installing.
- Registry license metadata is NOASSERTION while the repository is GPL-3.0-or-later (since 33.0.0 due to vendored Xapian/libzim); confirm licensing boundaries for your compliance needs.
- The Firefox build is significantly weaker than Chrome (no shadow-DOM traversal, no CDP screenshots); validate critical workflows on Chrome.
What does this agent do, and when should you use it?
WebBrain is an open-source browser extension (monorepo: webbrain-one/webbrain) that puts an AI agent in a side panel on Chrome, Firefox, and Edge, able to read the current page and click, type, navigate, upload, and download on your behalf. It reads pages via the accessibility tree rather than brittle selectors, and runs on the model you pick: the managed WebBrain Compass 1.0 needs no setup, or you can point it at any local OpenAI-compatible server (llama.cpp, Ollama, vLLM) or one of 106 built-in cloud provider cards including OpenAI, Claude, Gemini, and Bedrock. The repository ships Chrome (Manifest V3) and Firefox (Manifest V2) builds, an MCP server, an LM Studio plugin, docs in English, Chinese, and French, and a Node test suite. It is licensed GPL-3.0-or-later from version 33.0.0 and is built by Emre Sokullu.
The agent takes natural-language instructions in the side panel, reads page text, links, forms, tables, PDFs, and interactive elements through the accessibility tree, and executes a tool-use loop of clicks, typing, scrolling, navigation, uploads, and downloads — up to 195 configurable steps (default 130). Three modes gate permissions: Ask (read-only), Act (page manipulation), and Dev (adds page source, styles, console, network, and reversible edits). Act/Dev can generate a structured plan for user approval before any tool runs, and per-site permission prompts precede consequential actions. Slash commands cover /schedule, /watch polling, /teach and /workflow for saved reusable workflows, /memory, /screenshot, and more. On the model side, BaseLLMProvider subclasses registered in providers/manager.js normalize to { content, toolCalls, usage }, with compact/mid/full tool tiers for small local models. An MCP server (@webbrain/mcp-server, WebSocket port 17374) lets coding agents like Claude Code delegate browser tasks to the user's signed-in browser.
- A user who needs to summarize, question, or extract links and tables from the current tab — Ask mode handles this read-only, without pasting content into a chatbot.
- Someone automating form-filling or data pulls on SSO-authenticated sites (e.g., listing last week's failed Stripe payments) — the MCP server lets Claude Code or Cursor reuse the browser's cookies and session.
- Privacy-conscious users or those without cloud API access can point WebBrain at a local llama.cpp/Ollama/LM Studio server (at least 16k context recommended) and run fully offline.
- Anyone monitoring a page for a condition (e.g., a new commit appearing) and triggering an action can use /watch, which polls every 30–120 seconds.
- Operators of repetitive multi-step web workflows can record a demonstration with /teach, save it as an exportable, shareable workflow, and re-run it in one step.
- Developers adding custom providers subclass BaseLLMProvider, implement chat(), and register in providers/manager.js, mirroring changes to both Chrome and Firefox builds.
What are this agent's strengths and limitations?
- Complete model freedom: the default Compass needs no key, and 106 provider cards, local llama.cpp/Ollama/vLLM/LM Studio, and an endpoint-free WebGPU option mean no vendor lock-in.
- Reads pages via the accessibility tree rather than brittle CSS selectors, which is more robust on client-rendered React/Vue apps, with compact/mid/full tool tiers for small local models.
- Concretely auditable safety design: approval-gated plans for Act/Dev, per-site permission prompts before consequential actions, dedicated prompt-injection-defense and privacy docs, and the permission gate living inside the agent loop.
- Ships an MCP server that delegates tasks to the user's real signed-in browser session, avoiding the login walls that stall headless browser frameworks.
- The Firefox build is meaningfully weaker than Chrome: no chrome.debugger/CDP means no shadow-DOM piercing, no trusted mouse events, no SPA-navigation-aware retries, and no pixel-perfect screenshots; Chromium is required for those features and for MCP.
- Local models carry a real floor: at least a 16k-token context window is required (8k only works with the Compact tier, 4k is too small), or conversations get over-compacted or fail.
- Licensing changed to GPL-3.0-or-later at version 33.0.0 because the extension bundles the GPL-licensed Xapian/libzim WASM runtime; commercial integrations should evaluate compliance (earlier releases are MIT).
- The MCP bridge is Chromium-only and the extension holds one bridge socket at a time (WebBrain Cloud 17373, MCP 17374, LM Studio 17375), limiting concurrent delegation across tools.
How do you install or deploy this agent?
Option 1: install from the Chrome Web Store, Firefox Add-ons, or Edge Add-ons (direct links in the README). Option 2: from source — git clone https://github.com/webbrain-one/webbrain.git, then in Chrome open chrome://extensions/, enable Developer mode, click Load unpacked, and select the webbrain/src/chrome folder; in Firefox open about:debugging#/runtime/this-firefox, click Load Temporary Add-on, and select src/firefox/manifest. (temporary add-ons are removed on restart; permanent installs require signing via addons.mozilla.org). Models: the default WebBrain Compass 1.0 needs no key; for local models start any OpenAI-compatible server, e.g. llama-server -m your-model.gguf --port 8080 or ollama serve (:11434/v1).
How do you use this agent?
Click the WebBrain icon to open the side panel and type instructions such as "Summarize this page", "Fill in the search box with 'AI agents' and click Search", or "Navigate to github.com and find trending repositories". Switch modes with Ctrl+Shift+A/X/D (Cmd on Mac); type /help for all command signatures; press Escape to stop a run. Pick a model in Settings: a local server URL, one of 106 cloud provider cards, or the built-in endpoint-free WebGPU option (LFM2.5 2.6B preset). For MCP delegation run npx -y @webbrain/mcp-server, then in WebBrain → Settings → General → Advanced → MCP set ws://127.0.0.1:17374/extension and enable it (Chromium only). LM Studio plugin: lms clone webbrain/web-tools.