Auto Browser v2 reads public pages as inert text, and nothing more

What it does

Agents that browse the web are a standing injection risk, because a page is untrusted input that frequently tries to sound like an instruction. Auto Browser v2 takes the boring, correct position: it reads explicitly allowed public websites and returns inert text.

Fetching is separated from extraction. The fetch step uses an HTTPS allowlist, public IPv4 only, pinned DNS and no redirects. The extraction step runs a sandboxed Chromium with scripts disabled and requests blocked.

What changed

Commit a3839bd, merged as pull request #6 on September 10, replaces the 2025 code with a bounded v2 runtime: a snapshot workflow, a CLI with status, test, benchmark and mcp, an MCP server with a policy resource, and MetaHarness maintainer profiles.

Hard limits are part of the contract rather than a configuration suggestion: 1 MiB of HTML, a 10 second fetch, one MCP snapshot at a time, and a 15 second process-group deadline that includes browser descendants.

Get started

Node 22 or newer:

git clone https://github.com/ruvnet/auto-browser.git
cd auto-browser
npm ci --ignore-scripts
npx playwright install chromium
BROWSER_ORIGINS=https://example.com node src/cli.js snapshot https://example.com

Expected result: a text snapshot of example.com. Any origin that is not in BROWSER_ORIGINS is refused rather than fetched.

MCP uses stdio, with the repository as the working directory:

{"mcpServers":{"auto-browser":{"command":"node","args":["/absolute/path/auto-browser/src/cli.js","mcp"],"cwd":"/absolute/path/auto-browser"}}}

Only the operator configures corpus paths or origin permissions. Tool callers cannot execute shell commands or supply local paths, and project_validate and project_benchmark require RUV_ALLOW_VALIDATION=1 in the operator environment.

Use it today

Practical case: letting an agent read a small set of approved documentation sites without giving it a general browser. Input is an allowlist of origins. Workflow is snapshot each page, feed the text to the agent as data, and keep the origin list under human control. Output is text the agent cannot mistake for authority.

Acceptance test: put a line in a test page that instructs the reader to run a command, then snapshot it. The command must appear in the returned text as ordinary characters and must never be executed.

Push it further

Experimental commentary. A snapshot with a content hash is a decent primitive for change detection — snapshot weekly, diff, and you have a cheap watcher for pages that have no feed.

Limitation: receipts are unsigned content hashes, not attestations, and the benchmark reports fixture performance only. Falsifiable test: snapshot the same static page twice. The hashes should match; if they do not, something in the pipeline is non-deterministic and the diff signal is worthless.