A fast browser, a secure sandbox, and one place to see it all.

h5i lets agents browse the web, run code and test apps without giving them unrestricted access to your machine.

Three parts, and the first one stands alone

Browser. A fast, lightweight browser agents can control from the command line. Pages come back as structured snapshots, while actions and network requests are recorded for review.

Sandbox. Every session starts with lightweight isolation. For stronger protection, place the browser, the agent, and the dependencies together inside a container or a microVM.

Dashboard. See active agents, browser sessions, blocked requests, resource usage and proposed changes from one read-only screen.


Session = page + jar + policy + fail-closed log.
Box = the sandbox a session, an agent and a dev server can be placed in.

A browser session  the whole agent-facing surface
├─ Page, jar, policy         h5i browser open
├─ Outline with @refs        h5i browser snapshot
├─ Fail-closed request log   h5i browser requests
├─ Human takeover            h5i browser take
└─ A recorded ending         h5i browser close

A box  optional, and where you put a session
├─ Disposable workspace      h5i box .
├─ Sandboxed agent           h5i box shell
├─ Egress at the boundary    .h5i/env.toml
├─ Watch it, or take over    h5i box view
└─ Output gate               h5i box export

One screen  every box and session at once
└─ Read-only console         h5i ui
BrowsingGive agents a browser you can control.
h5i browser open
Run more browser tasks
In our benchmarks, h5i reads pages ~3× faster with ~86% less peak memory. Sessions start quickly and can run in parallel without the overhead of a conventional browser.
the cost of reading a page decides how many pages an agent can afford to read.
h5i browser snapshot · click · type
Pages in a format agents can use
h5i returns a compact page outline with @ref handles instead of noisy HTML or screenshots. Agents can read, click, type and extract structured data directly. Drive a session →
a handle names an element; a screenshot only names a pixel.
h5i browser audit · requests
Review the complete session
Browser actions, network requests, blocked connections, human takeovers, crashes and how the session ended are kept in one timeline.
a request that is not in the log did not happen.
net.egress = [ … ]
Control where the browser can connect
Allow only the websites and services the task requires. Other requests, including redirects to unapproved destinations, are blocked before they leave and recorded.
denials are findings, not silence.
UNTRUSTED PAGE CONTENT
Limit the damage of prompt injection
Page content is marked as untrusted. If a page still manipulates the agent, it can reach only the files and network destinations the sandbox policy allows.
h5i does not detect injection; it bounds what a persuaded agent can reach.
h5i browser take · release · login · --secret
Take over sensitive steps
Take control for logins, payments or approvals, then hand the session back to the agent. Credentials can be typed by you or substituted from the host by name.
handing control back invalidates the agent's page refs, so it re-reads before it acts.
SandboxIsolate the browser, or everything the agent runs.
isolation = workspace | process | supervised | container | microvm
Start with the right level of isolation
Browser sessions use lightweight process isolation by default. Choose stronger network isolation, a rootless container or a microVM
the tier you asked for is the tier you got, or creation refused.
h5i box . · --pr 1234 · <url> · --new
Keep the entire testing workflow inside
Place the agent, the source, the dependencies, the development server and the browser inside one disposable environment.
install scripts from a stranger's branch run in there, not in your shell.
[[profile.X.auth]] · h5i box secrets
Keep credentials access under control
Model and service credentials stay on the host and are inserted into approved requests without becoming readable files inside the sandbox.
a prompt-injected agent has no reusable token to read or exfiltrate.
DashboardSee every agent and sandbox from one place.
h5i ui
Monitor the whole workflow
See which sandboxes are running, what isolation they use, which pages agents are viewing, what commands ran and which network requests were blocked.
nothing on the console is a score, and the console cannot act.
source: host-observed | box-claimed
Review records the agent cannot rewrite
Execution results, resource usage and denied connections are stored outside the sandbox, where the box has no write path.
you can tell testimony from observation without trusting either.
h5i box export <name> --out ./review
Bring work out deliberately
Export a proposed patch, a readable report and the associated execution record. Nothing is applied to your repository until you review and accept it.
getting work out is a step you take, not something the box can do.
Working with h5iSecurity that fits into real agent workflows.
h5i skill install · show · path
Works with the agents you already use
Any agent that can run command-line tools can use h5i.
an agent acts on stale documentation without hesitating, then reports your tool as broken.
h5i box cache refresh · ls · mounts
Reuse dependencies safely
Read-only caches avoid downloading and rebuilding the same dependencies for every sandbox. Caches are keyed by the project's lockfile digest and mounted read-only.
cold install is the difference between a twenty-second box and a four-minute one.
h5i box share · h5i join
Share the app, not the sandbox
Expose only the development server an agent built, without exposing your machine or the rest of the sandbox. Share it over an encrypted peer-to-peer connection.
this is the one path that lets something in, and it is scoped to one port.
I need to…Use
Let an agent browse a websiteh5i browser open <url>
Give an agent an isolated copy of my repositoryh5i box .
Run and test an external pull requesth5i box --pr 1234
Watch or take over the browserh5i box view <name>
See what this host can actually enforceh5i box probe
Review and export the agent's workh5i box export <name>
Monitor every active sandboxh5i ui

The loop: browser open → the agent reads and acts → browser audit. Add a boundary and it becomes box .box shellbox exportgit apply --3way.

The box in action

Four workflows where containment changes what is possible, not just what is safer.

01
Review a pull request by running it
Checking out a stranger's branch used to mean handing its install scripts your shell. A detached box makes running it the cheap option instead of the risky one.
~/my-project
$ h5i box --pr 1234
  created box pr-1234 · detached · own repository · origin remote dropped

$ h5i box shell pr-1234
box$ npm ci && npm test      # lifecycle scripts run in here, not on your machine
box$ exit

$ h5i box export pr-1234 --out ./review
$ head -6 ./review/report.md

# Denied egress
  telemetry.vendor.invalid:443   refused (not in net.egress)   x7

Seven refused connections from a branch whose description says it fixes a date-formatting bug. Run the review →

02
Let an agent run with permissions off, safely
Inside a box, permission mode is a convenience setting rather than a boundary. The boundary is the policy that was hashed before the box existed.
~/my-project
$ h5i box . --profile agent-claude
$ h5i box shell fix-auth
box$ claude --dangerously-skip-permissions

# it still cannot read what was never granted
box$ cat ~/.ssh/id_ed25519
cat: /home/agent/.ssh/id_ed25519: No such file or directory

# and it still cannot reach a host nobody declared
box$ curl -s https://paste.example.invalid
curl: (7) Failed to connect: refused by egress policy
03
Watch the page the agent is driving, then take over
The stream port is never published. h5i enters the box's network namespace by pid, connects from inside, and hands the socket back out.
~/my-project
box$ agent-browser stream enable
box$ agent-browser open http://localhost:3000

$ h5i box view fix-auth          # loopback-only forward, per-box token
$ h5i box view fix-auth --term   # draw it here instead; binds nothing

$ h5i browser status fix-auth
  control: agent   refs: fresh
$ h5i browser take fix-auth      # immediate; the agent's @refs go stale

Handing control back invalidates every page reference the agent held, so it must re-snapshot before acting and acting first is refused rather than mis-clicked. Use the control lock →

04
Find out what this machine can actually enforce
A functional self-test, not a feature probe. The required bits can all be present while a hardened kernel still denies confined exec.
~/my-project
$ h5i box probe
── Host isolation capabilities ──
  os           = linux
  mechanism    = landlock+seccomp
  landlock_abi = 3
  userns       = true
  seccomp      = true
  tty-injection= blocked at the kernel tiers, possible at isolation=workspace
  container    = podman
  microvm      = none

  claim workspace  satisfiable = yes
  claim process    satisfiable = yes
  claim container  satisfiable = yes (needs rootless Podman + profile container.image)
  claim microvm    satisfiable = no  (needs microsandbox `msb` + host virtualization)
  process tier runnable = yes

tty-injection is h5i measuring something it declines to assert: on Linux it is your kernel's setting, on macOS it is the Seatbelt profile, and they can disagree on the same host.

The whole fleet, on one read-only screen

Run h5i ui for a loopback-only console at http://127.0.0.1:8765. Every route is a GET.

Left, every box with its tier, status and one signal. Right, the findings for the box you picked, a flight recorder with one row per receipt across five lanes, and the policy that was actually enforced. Every run row is labelled host-observed or box-claimed, because who saw a thing is part of the thing.
Red means the egress allowlist refused a destination · amber means look at this · grey means the evidence is weak. Nothing on the screen is a score. The console above is the real layout, drawn in HTML; the fleet in it is an example.

Boundaries, fallbacks, and failure modes

The details that matter once you start using h5i. See the manual for commands and implementation details.

What exactly does the audit record?
The audit includes browser commands, allowed and denied network requests, human takeovers, and how the session ended. It also tells you whether network activity was reported by the browser itself or independently observed at a sandbox boundary.
What happens if the browser crashes?
The session is recorded as died, and later commands are refused instead of silently starting another browser. You can restore its storage into a new session, with the relationship between the two recorded.
What happens if my machine cannot provide the requested isolation?
An explicitly requested isolation tier is never silently downgraded: the sandbox is not created. h5i box probe shows what the current machine can enforce, while auto selects the strongest available tier.
What if h5i cannot render a website correctly?
You can run Chromium inside an h5i sandbox for websites that require unsupported browser APIs. The sandbox still limits filesystem and network access, but h5i's engine-level request record and enforced browser takeover are not available.
Can an agent use credentials without reading them?
Yes. The agent can name a browser credential without receiving its value, and model or service API keys can remain on the host and be added only to approved requests. A human can also take over the browser to complete a login.
How does work leave the sandbox?
h5i box export produces a patch, a readable report, and an execution receipt for review. Nothing is applied automatically, and sandboxes created from external URLs or pull requests cannot write directly into your repository.

Let agents browse. Keep control.

Run fast, lightweight browser tasks and web app testing with sandboxing, network controls and complete session records built in. One binary, local-first, no hosted h5i service. Apache 2.0.