Features

Features for red teaming with AI agents.

Automate browsing, discover application endpoints with recon, and inspect or edit HTTP traffic with websec. Configure sandbox limits and audit the resulting sessions.

The browser runs on its own; recon and websec are optional plugins. Plugin installation →

Browser

Automated browsing

Read and interact with web applications through one CLI. Browser guide →

h5i browser open <url>

Fast, lightweight sessions

Pure Rust, no Chromium or V8. In our simple-site benchmarks, ~3× faster reads with ~86% less peak memory than headless Chromium.
h5i browser snapshot · click · type

Pages agents can act on

Compact snapshots provide @ref handles for clicking, typing, and extracting data. Delta snapshots return changes between actions.
h5i browser login · take · release

Authenticated testing

Keep separate sessions for different identities. Let a human complete sensitive login steps, then return control to the agent without exposing the password.
Recon plugin

Application reconnaissance

Build an endpoint inventory from the application and its traffic. Recon reference →

h5i recon extract · known · import

Find exposed endpoints

Extract URLs from HTML, JavaScript, JSON, and response headers. Include paths disclosed by robots.txt and sitemaps, or import inventories from other tools.
h5i recon crawl --max-requests 200 --rate 4

Crawl with explicit limits

Crawl under the browser session's identity and network policy, with request budgets, depth limits, and per-host rates. Resume interrupted jobs from recorded progress.
h5i recon triage · endpoints

Review endpoints with evidence

Separate unvisited candidates from observed and confirmed endpoints. Calibration identifies responses that differ from missing-page responses; recorded message IDs link observations to their evidence.
Websec plugin

Direct HTTP capture and editing

Inspect and test browser traffic for authorized web red teaming, pentesting, and CTFs. Web security guide →

h5i websec requests · show

Capture requests and responses

Inspect headers and bodies using stable message IDs. h5i owns its HTTP client, so no separate MITM proxy or CA setup is required.
h5i websec replay · diff

Edit, replay, and compare

Modify captured requests and replay them with the session's cookies and policy. Compare responses to see how the application behaved.
h5i websec match · sequence

Repeat security tests

Match response content and combine requests into multi-step flows. Keep the requests and responses available for reviewing and repeating a test.
Sandbox

Restrict the agent's access

Sandbox the entire red-teaming workflow to constrain tools. Policy guide →

h5i box . --profile <profile>

Isolate the workflow

Place the agent, code, dependencies, development server, and browser in one disposable environment. Choose process, supervised, container, or microVM isolation according to host support.
.h5i/env.toml · h5i box probe

Set network and filesystem limits

Allow the destinations and files needed for the engagement. Enforcement depends on the selected tier and policy; an unrestricted workspace is not a sandbox.
h5i box secrets · h5i browser type --secret

Keep credentials outside the agent

Model and service credentials can remain on the host and be inserted into approved requests. The agent can use named browser credentials without reading their values.
Audit and dashboard

Review what the agent actually did

Review actions and network activity, including blocked requests. The dashboard brings active sessions, isolation settings, and resource usage into one view.

h5i browser audit · requests

Session records

Review browser commands, allowed and denied requests, human takeovers, and session endings. A browser crash is recorded rather than silently replaced with a new session.
h5i ui

Independent observations

Host records remain outside the sandbox. Records distinguish activity observed at the sandbox boundary from activity reported by the browser or sandbox itself.
h5i box export <name> --out ./review

Reviewable output

Export a proposed patch, report, and execution receipt for review before applying changes. Audit guide →
View the dashboard example
Working with h5i

Use your existing agents and tools.

h5i skill install

Command-line agents

Any agent that can run CLI tools can use h5i. Install the bundled skill for its command reference. Agent setup →
h5i box --pr 1234 · h5i box cache refresh

Disposable test environments

Run a repository or pull request in an isolated workspace. Reuse dependencies through read-only caches. PR review guide · Cache reference
h5i box view · h5i box share

Human review and app sharing

Watch browser sessions, take over sensitive steps, or share a selected development-server port. Browser controls · App sharing
FAQ

Plugins, scope, and compatibility.

Are recon and websec included with the browser?
They are optional plugins. The installer accepts --recon and --websec to install them alongside h5i. Recon builds an endpoint inventory; websec inspects and tests HTTP traffic.
Does a confirmed recon endpoint mean a vulnerability?
No. Confirmed means its response differs from the application's missing-page baseline. Recon records endpoints and observations; it does not establish that an endpoint is vulnerable.
What happens if the requested isolation is unavailable?
An explicitly requested tier is not silently downgraded: creation fails. Use h5i box probe to check what your machine supports before choosing an isolation tier.
Does sandboxing prevent every unsafe action?
No. Configured network and filesystem limits restrict access, but an agent can still take harmful actions on an allowed target. Sandboxing the browser alone does not constrain the agent's other tools.
What if h5i cannot render a website correctly?
Some browser APIs are not supported. You can run Chromium inside an h5i sandbox, but h5i's engine-level traffic capture and browser takeover are not available for that Chromium session.

Equip your AI agent for web red teaming.

Install h5i with the recon and websec plugins. Local-first, open source, Apache 2.0.

curl -fsSL https://h5i.dev/install.sh | sh -s -- --websec --recon
View on GitHub Read the manual

Compare with Burp Suite, OWASP ZAP, or Caido.