The same tools for a web page and a native app

MCP-native, across eight engines and onto the host

browxai

The same tools for a web page and a native app. Eight engines in three families: five browsers, two native apps on an emulator or simulator, and a desktop Electron app. Everything past a browser starts off.

Get startedTool reference

$ npm install -g browxai

agent · snapshot()

# a page an agent can read, not a DOM dump

form”Sign in”[ref=e3]

textbox”Email”[ref=e4]actionable

textbox”Password”[ref=e5]actionable

button”Continue”[ref=e6]actionable

ActionResultcloses the loop

navigatego to a URL

snapshotread the page as refs

findlocate a target

actclick, fill, verify

Why it exists

browxai is not a wrapper over someone else’s MCP server. It owns its own transport to all eight engines it drives, so it owns the whole session lifecycle. Where a task leaves the browser, for a native app, a desktop app or your host machine, browxai follows it under a capability you switch on.

// surface

Token-efficient

snapshot() is a scoped, paginated, budgeted accessibility tree. find() returns ranked candidates with evidence, not a guess. Results stay small on purpose.

// native

Native apps, same tools

Switch on native-device and find, click and fill drive an app on an Android emulator or the iOS Simulator. The tree comes off the app’s view hierarchy, with the same refs a page gets. Android is verified against a live emulator; the iOS lane is newer and needs a WebDriverAgent you run. Emulators and simulators only, no real devices.

// desktop

The Electron app you have open

An Electron app is Chromium, so one started with —remote-debugging-port answers the same CDP browxai already speaks. Attach to VS Code or Slack and snapshot and find read its UI. Attach-only, navigate refuses, and whether a port opens at all is up to the app and the version.

// host

Reaches past the tab

A web task leaves the browser. Switch a capability on and browxai writes the real OS clipboard, or pulls a login and a TOTP code from 1Password, Bitwarden, LastPass or oathtool. File IO is rooted at one workspace directory. All three capabilities start off.

// safety

Safe by default

Capability-gated tools, an origin allow and block list, confirmation hooks, and a hard anti-wedge deadline on every call. Arbitrary JS, full response bodies, the OS clipboard, your password manager, the native engines, attaching to a desktop app and network mocking are all off until you opt in.

// clients

Model-agnostic

Any MCP client over stdio. Use it from Claude, Codex, or anything else that speaks the protocol. It is not tied to one model or one vendor.

// sessions

Sessions and lifecycle

Isolated per-session contexts: persistent, incognito, or attach to a Chrome you already have open, on your desktop or on a plugged-in Android phone. Headed and headless. Pick the engine per session, so one server can hold a Chromium page and an emulator app at once. Config is driven over MCP, with no out-of-band setup.

Wire it into your agent

Read the threat model