Run more browser tasks · Control where agents can go · Review what they accessed

A Secure, Auditable Browser
for AI Agents

Let agents securely browse the web and test web apps. In benchmarks on simple websites, h5i reads pages ~3× faster with ~86% less peak memory, while recording every browser action and network request for review.

curl -fsSL https://h5i.dev/install.sh | sh
Apache 2.0 · one Rust binary · no daemon, no SaaS · read the manual · source
580+GitHub stars 50+forks 20+contributors Apache 2.0open source, no lock-in
The problem

Giving AI agents a browser creates new security risks.

Agents do more than read pages. They follow instructions, submit forms, use logged-in sessions, access local services, and test code on your machine. A malicious website, a vulnerable app, or a simple agent mistake can turn that access into unsafe actions.

Websites can manipulate the agent
A prompt injection can make an agent ignore its task, click unsafe links, submit forms, or send data somewhere it should not.
The agent can leak local data
An agent with access to source code, credentials, logged-in sessions, or internal services can accidentally expose them through the browser.
Web app testing runs code on your machine
Testing an app often means running agent-written code, third-party dependencies, and a browser on the same host. Without isolation, they share access to your files and network.
Ordinary browser logs are incomplete
A list of clicks, background requests, redirects, blocked connections, crashes, and restarts may be missing when you need to understand what happened.
What h5i gives you

A browser you can control, isolate, and audit.

h5i lets agents browse and test web apps under rules you set. Control where they can connect, review what they did, take over sensitive steps, and isolate the browser, or the entire testing workflow, from your machine.

Review the complete browser session
See every browser action and network request, including blocked requests and why they were denied. Crashes, human takeovers, and how the session ended are recorded too.
Control where the agent can connect
Allow only the websites and services required for the task. h5i blocks every other request before it leaves and records the attempt.
Limit the damage of prompt injection
Page content is marked as untrusted. Even if a page still manipulates the agent, it can reach only the files and network destinations allowed by the sandbox policy.
Isolate web app testing from your machine
Sandbox only the browser, or isolate the agent, generated code, dependencies, development server, and browser together. Choose lightweight process isolation, a container, or a microVM.
The browser

Built for agents. Still under your control.

Agents browse with simple commands and receive compact, structured snapshots instead of raw HTML. You can review the complete session, take control when needed, and keep credentials out of the model's context.

Open a session and read what it reached →

one session, start to close
$ h5i browser open https://docs.rs/ --allow docs.rs
✔  browser session br_7k2xqa
   requests : engine-claimed (fail-closed, and the engine's own account of what it fetched)

$ h5i browser snapshot          # outline, with @ref handles
$ h5i browser click @e3
$ h5i browser snapshot --delta  # only what changed
$ h5i browser requests          # refusals included
  4 requests, 1 denied
  denied https://tracker.example/px  origin not in the allowlist
$ h5i browser close
$ h5i browser audit             # the whole session, afterwards
  host   session opened
  engine  verb   snapshot
  host   control -> human  (taken by a human)
  engine  #1 DENIED GET https://tracker.example/px
  host   session closed
Pages in a format agents can use
h5i returns a compact page outline with @ref handles. Agents can read, click, type, and extract data without processing screenshots or noisy HTML.
A complete session history
Browser actions, network requests, blocked connections, human takeovers, crashes, and how the session ended are kept in one timeline.
Human control for sensitive steps
Take control for logins, payments, or approvals, then hand the session back to the agent. Credentials are entered or substituted without being returned to the model.
The box

Sandbox the browser, or the entire agent workflow.

Run only the browser in a sandbox, or isolate the agent, source code, dependencies, development server, and browser together. This lets agents build and test web apps while limiting access to your host files, credentials, and network. Choose lightweight process isolation, a container, or a microVM without changing the browser commands.

01

Create the right boundary →

Start from a repository or pull request and choose the isolation the task needs: lightweight OS controls, a rootless container, or a microVM with its own kernel.

$ h5i box create fix-auth --profile agent-claude
under 200 ms lightweight · container · microVM
02

Build and test inside it →

The agent, child processes, dependencies, dev server, and browser run in the same boundary. Host files, browser profiles, and credentials stay outside.

$ h5i box view fix-auth
agent + toolchain + dev server + browser · one boundary
03

Share only the demo service →

Expose one port from the box without exposing your laptop. Use an end-to-end P2P connection , or generate a browser-ready demo link for everyone else.

$ h5i box share fix-auth --port 3000
encrypted P2P · add --tunnel for a browser-ready link
04

Review, then take the work →

Inspect the proposed diff and the boundary's record of what ran and what was denied. Only then apply the snapshot to the parent branch.

$ h5i box propose fix-auth
review diff · export receipt · apply snapshot
The dashboard

See what every agent is doing from one place.

Monitor active sandboxes and browser sessions, inspect the pages agents see, review commands and network requests, and spot blocked actions or policy violations.

FAQ

Frequently asked questions

The short answers. The manual has the long ones.

What is h5i?
h5i is a fast, lightweight browser for AI agents, with built-in auditing and configurable sandboxing. It runs locally and is open source.
Why use h5i instead of Playwright or Puppeteer?
Use Playwright or Puppeteer when maximum website compatibility is your priority. Use h5i when you need lower resource use, network controls, a complete session record, or a sandbox for both the browser and agent.
Does h5i work on every website?
No. h5i works best for content-heavy websites and common browser interactions, but some browser APIs are not yet supported. For incompatible websites, you can run Chromium inside an h5i sandbox.
Is h5i sandboxed by default?
The browser uses lightweight process isolation when available. For stronger isolation, place the browser, or the agent's entire workflow, inside a container or microVM.
Can h5i prevent prompt injection?
No browser can guarantee that. h5i limits the damage by treating page content as untrusted and restricting what a misled agent can access through network rules and sandboxing.
Can the agent see my passwords or cookies?
The agent can reference a named credential without reading its value, or a human can take control to log in. The authenticated session continues without returning the password or cookie to the model.
Does h5i keep my data local?
h5i has no hosted service and stores its sessions locally. Browser traffic still goes to websites you allow, and model traffic goes to your configured model provider.

Let agents browse. Keep control.

Run fast, lightweight web browsing and app testing with sandboxing, network controls, and complete session records built in. Local-first, Apache 2.0, with no hosted service.

curl -fsSL https://h5i.dev/install.sh | sh
Start your first session Star on GitHub