What it is : A browser agent. Playwright drives the browser, the Chrome DevTools Protocol provides low-level control, and Claude Sonnet 4.6 handles reasoning and tool-use. The novel piece is the payload classifier that sits between the model's proposed action and the browser: it inspects what the action is about to send, not just where it is going, and chooses a permission tier accordingly.
Why payload classification : Most browser agents classify by URL or domain. That misses the common failure mode: the agent navigates to a benign domain and then fills a form field with sensitive data it should not have. Classifying by payload content catches that case. A "post to pastebin.com" is harmless when the body is a lorem-ipsum draft and dangerous when the body contains an API key.
Demo :
[Hero GIF placeholder: 10 to 15 seconds of the agent completing one task end-to-end, with the payload classifier badge visible in the HUD.]
Architecture :
- Playwright owns the browser context, isolated per-session, with a stripped-down default permission set.
- Chrome DevTools Protocol provides interception hooks for network, storage, and input events.
- Claude Sonnet 4.6 drives action selection via tool use. Each tool call is a structured action proposal, not a free-form response.
- Payload classifier runs on every proposed action: inputs include target URL, request body or form payload, and an action-type tag. Output is a permission tier.
- Permission gate enforces tier: pass, require re-confirmation, or block.
Permission classes : [TODO: list the five classes with one-line definitions and one example payload per class.]
Failure gallery : [TODO: five specific prompts that broke the agent, with root cause and fix status. Candidates include: ambiguous target disambiguation, classifier false-positive on legitimate credential pasting, state races between CDP interception and page navigation.]
Cost and latency : [TODO: measured table. Columns: task tier (easy, medium, hard), median latency, p99 latency, median tokens, dollar cost per task. Rows: with payload classifier on, with classifier off, baseline raw tool-use loop.]
Honest comparison to Anthropic's computer use : Anthropic ships computer use directly in the Claude API. For many tasks that is the right tool. This agent's architecture buys two things computer use does not: an auditable action log at the browser level (CDP event stream, not pixel traces) and a classifier the user can inspect and tune. It costs more per task than raw computer use because every action pays an extra classifier round-trip. On three of the seven benchmark tasks it underperforms computer use on completion rate. The repo documents which three and why.
What this does not do :
- Not a general-purpose RPA tool. The task catalog is small and deliberate.
- Classifier is a model, not a formal verifier. False negatives are possible by design.
- No sandboxing beyond Playwright's defaults. Running against untrusted sites still carries the usual browser-automation risks.
- CDP coverage is Chromium-only. Firefox and WebKit paths are stubbed.
What's next :
- Measured failure gallery and cost table published.
- MCP server variant so the agent can be driven by another host.
- Extended-thinking budget tuning per task tier, with the measurement showing where it helps and where it does not.
Tech stack :
Runtime: TypeScript, Node.js
Browser: Playwright (Chromium), Chrome DevTools Protocol
Model: Claude Sonnet 4.6 via the Anthropic SDK, tool use with JSON schema inputs, prompt caching on the system prompt
Classifier: Smaller Claude Haiku pass with a tight schema, cached across similar payloads
Observability: Structured action log, CDP event stream capture, trace replay on failure