AI agents that browse the web burn through tokens fast. Every action requires a fresh screenshot, the agent re-interprets pixels, and a simple task like filling a form or clicking through a dashboard eats up dozens of turns. A new open-source tool called brw takes a different approach: give agents stable references to page elements and let them act from structured data instead of re-reading the screen every time.

brw is built by Revitt and released under AGPL-3.0. It controls a real, visible Chrome or Chromium instance through the Chrome DevTools Protocol (CDP) and exposes that control as MCP tools and an HTTP JSON API. The tool connects to your signed-in browser profile through a Chrome extension, so agents work with the same cookies, sessions, and authentication state you already have. No sandboxed copy, no isolated browser container, no re-login required.

How the ref-based model works

Most agent browser tools operate on one of two models: CSS selectors, which break the moment a site changes its markup, or screenshots, which force the agent to re-interpret visual pixels on every single action. brw uses a third approach. It combines DOM structure and accessibility tree data into stable element references, like e17 or e23, that persist across interactions.

When an agent wants to click a button or fill an input field, it targets the ref directly. After each action, brw returns a plain-text observation describing what changed on the page. The agent does not need to take a new screenshot, parse an image, or guess what happened. This observation loop is what drives the token savings: fewer redundant reads, fewer misinterpretations, fewer recovery turns.

Pre-release head-to-head comparisons against Claude-in-Chrome show brw completing the same tasks with fewer turns and lower token usage. A public benchmark is planned to formalize these results.

What agents can do with brw

The tool supports a wide surface of browser interactions: click, type, fill, select, scroll, drag, upload, wait, and assert, all by ref. Agents can pull structured data directly from pages, including prose, links, headings, forms, tables, and product information. Screenshots are available as a visual fallback, with optional Set-of-Marks overlays that label elements using the same refs the agent acts on.

Beyond page interaction, brw manages tabs and tab groups, handles downloads, captures console output, records network traffic, supports request replay, and allows cancellation of in-progress actions. Work can be organized into named runs that a human operator can watch in real time.

The MCP surface is large. Running brwd --mcp --mcp-tools core advertises just the common-flow tools while keeping the full API callable. Any client that speaks MCP or HTTP can drive the same browser instance, whether that is Claude Code, Codex, Cursor, opencode, pi, Gemini, or a custom harness.

Reaching pages an agent browser cannot

Agent-specific browsers like those from Anthropic or other vendors operate in isolated environments. They cannot access gated dashboards, signed-in applications, or internal tools that require your authentication state. brw bridges to your installed Chrome profile through an extension, so the agent sees exactly what you see.

For remote setups, stdio MCP over SSH is the first-class path. The visible browser stays on the machine that owns the profile. SSH carries the MCP connection, so cookies, passkeys, and downloaded files never leave the local machine. The HTTP API binds to loopback by default, keeping the attack surface minimal.

The extension has a single permanent ID trusted by the daemon with zero configuration: amocjcgddnoakjijfggdpnefdnboilpe. On Chromium, you can force-install it from a policy file in /etc/chromium/policies/managed/, no Chrome Web Store review required. If no policy infrastructure exists, brw can launch Chromium with the extension loaded via --load-extension, a flag that Chrome 137 and later dropped. A Chrome Web Store build is under review for standard Chrome users.

Installing and running brw

Native installers are available on GitHub for all major platforms. Windows gets .msi for amd64 and arm64. macOS gets a universal .pkg. Linux gets .deb and .rpm packages. The installers place brwd, brwctl, brwcheck, and brw-devtools-mcp on your PATH.

The daemon runs as a stdio MCP server or exposes an HTTP JSON API on loopback:

# run as an MCP server over stdio
brwd --mcp --http off

# or expose the HTTP API on loopback
brwd --http 127.0.0.1:17310

# open a page and read its controls
curl -s 127.0.0.1:17310/api/browser/open \
    -H 'content-type: application/json' \
    -d '{"url":"https://example.com"}'

curl -s 127.0.0.1:17310/api/page/snapshot | jq

For source builds, clone the repository and run make build. The extension is only needed when bridging into an already-authenticated Chrome profile over WebSocket.

What this means for agent builders

The core tension in agent browser tools has been security versus capability. Sandboxed browsers are safe but limited. Full browser access is powerful but risky. brw lands in the middle by keeping the browser on your machine, binding HTTP to loopback, and using SSH for remote access. The profile stays where it belongs.

For teams building browser-using agents, the practical impact is straightforward. Token costs drop because agents stop re-reading screenshots. Task completion improves because agents act from structured data instead of pixel interpretation. And the login wall, which has been a hard blocker for most agent browser frameworks, disappears because the agent uses your real browser profile.

brw does not add stealth features, CAPTCHA bypass, or consent bypass. It controls a normal browser that a human can watch and interact with. Released under AGPL-3.0, it is free to use and modify, with the requirement that improvements flow back upstream. A commercial licence is available from Revitt for use cases that do not fit the open-source terms.