h5i lets agents browse the web, run code and test apps without giving them unrestricted access to your machine.
Browser. A fast, lightweight browser agents can control from the command line. Pages come back as structured snapshots, while actions and network requests are recorded for review.
Sandbox. Every session starts with lightweight isolation. For stronger protection, place the browser, the agent, and the dependencies together inside a container or a microVM.
Dashboard. See active agents, browser sessions, blocked requests, resource usage and proposed changes from one read-only screen.
Session = page + jar + policy + fail-closed log.
Box = the sandbox a session, an agent and a dev server can be placed in.
A browser session the whole agent-facing surface ├─ Page, jar, policy h5i browser open ├─ Outline with @refs h5i browser snapshot ├─ Fail-closed request log h5i browser requests ├─ Human takeover h5i browser take └─ A recorded ending h5i browser close A box optional, and where you put a session ├─ Disposable workspace h5i box . ├─ Sandboxed agent h5i box shell ├─ Egress at the boundary .h5i/env.toml ├─ Watch it, or take over h5i box view └─ Output gate h5i box export One screen every box and session at once └─ Read-only console h5i ui
@ref handles instead of noisy HTML or screenshots. Agents can read, click, type and extract structured data directly. Drive a session →| I need to… | Use |
|---|---|
| Let an agent browse a website | h5i browser open <url> |
| Give an agent an isolated copy of my repository | h5i box . |
| Run and test an external pull request | h5i box --pr 1234 |
| Watch or take over the browser | h5i box view <name> |
| See what this host can actually enforce | h5i box probe |
| Review and export the agent's work | h5i box export <name> |
| Monitor every active sandbox | h5i ui |
The loop: browser open → the agent reads and acts → browser audit. Add a boundary and it becomes box . → box shell → box export → git apply --3way.
Four workflows where containment changes what is possible, not just what is safer.
$ h5i box --pr 1234 created box pr-1234 · detached · own repository · origin remote dropped $ h5i box shell pr-1234 box$ npm ci && npm test # lifecycle scripts run in here, not on your machine box$ exit $ h5i box export pr-1234 --out ./review $ head -6 ./review/report.md # Denied egress telemetry.vendor.invalid:443 refused (not in net.egress) x7
Seven refused connections from a branch whose description says it fixes a date-formatting bug. Run the review →
$ h5i box . --profile agent-claude $ h5i box shell fix-auth box$ claude --dangerously-skip-permissions # it still cannot read what was never granted box$ cat ~/.ssh/id_ed25519 cat: /home/agent/.ssh/id_ed25519: No such file or directory # and it still cannot reach a host nobody declared box$ curl -s https://paste.example.invalid curl: (7) Failed to connect: refused by egress policy
box$ agent-browser stream enable box$ agent-browser open http://localhost:3000 $ h5i box view fix-auth # loopback-only forward, per-box token $ h5i box view fix-auth --term # draw it here instead; binds nothing $ h5i browser status fix-auth control: agent refs: fresh $ h5i browser take fix-auth # immediate; the agent's @refs go stale
Handing control back invalidates every page reference the agent held, so it must re-snapshot before acting and acting first is refused rather than mis-clicked. Use the control lock →
$ h5i box probe ── Host isolation capabilities ── os = linux mechanism = landlock+seccomp landlock_abi = 3 userns = true seccomp = true tty-injection= blocked at the kernel tiers, possible at isolation=workspace container = podman microvm = none claim workspace satisfiable = yes claim process satisfiable = yes claim container satisfiable = yes (needs rootless Podman + profile container.image) claim microvm satisfiable = no (needs microsandbox `msb` + host virtualization) process tier runnable = yes
tty-injection is h5i measuring something it declines to assert: on Linux it is your kernel's setting, on macOS it is the Seatbelt profile, and they can disagree on the same host.
Run h5i ui for a loopback-only console at http://127.0.0.1:8765. Every route is a GET.
paste.example.invalid:443.
This is host-observed: the proxy recorded it, not the box.
Left, every box with its tier, status and one signal. Right, the findings for the box you picked, a flight
recorder with one row per receipt across five lanes, and the policy that was actually enforced. Every run row
is labelled host-observed or box-claimed, because who saw a thing is part of
the thing.
Red means the egress allowlist refused a destination · amber means look
at this · grey means the evidence is weak. Nothing on the screen is a score. The console
above is the real layout, drawn in HTML; the fleet in it is an example.
The details that matter once you start using h5i. See the manual for commands and implementation details.
died, and later commands are refused instead of silently starting another browser. You can restore its storage into a new session, with the relationship between the two recorded.h5i box probe shows what the current machine can enforce, while auto selects the strongest available tier.h5i box export produces a patch, a readable report, and an execution receipt for review. Nothing is applied automatically, and sandboxes created from external URLs or pull requests cannot write directly into your repository.Run fast, lightweight browser tasks and web app testing with sandboxing, network controls and complete session records built in. One binary, local-first, no hosted h5i service. Apache 2.0.