Agent Browser v0.2.2 - MCP Registry publication release

Agent Browser v0.2.2 makes the project publishable to the official MCP Registry as
io.github.AetherAI3/agent-browser. It adds publication metadata and nothing else: no route,
request model, authorization boundary, listener default, runtime dependency, or distribution
permission changed. The API remains api_version: "v1".

What changed

• Added server.json at the repository root, describing both clients — the npm and PyPI
  aether-browser packages — each started as aether-browser mcp over stdio, with
  AGENT_BROWSER_URL, AGENT_BROWSER_CONTROLLER_TOKEN, and AGENT_BROWSER_OBSERVER_TOKEN
  declared as optional environment variables.
• Added the ownership proofs the registry verifies against live package metadata: an mcpName
  field in the npm client's package.json, and an mcp-name marker at the top of the PyPI
  client's README, which is that package's long description.
• Bumped the runtime, source-built image, Compose service, Node client, Python client, MCP server
  metadata, and CLI source tag to 0.2.2.

v0.2.1 could not carry those markers: both of its artifacts were already published, and neither npm
nor PyPI allows a published version to be replaced.

Install and connect

npm install aether-browser@0.2.2
pip install aether-browser==0.2.2

# Serve the same nine Agent Browser tools to an MCP client:
npx -y aether-browser@0.2.2 mcp
aether-browser mcp

The self-hosted Linux runtime still starts from source with:

docker compose up --build

Exact release evidence

• Runtime commit: 648269bf4ec5da534f2a4afe81104ab52c826bb3
• Evidence commit: 85ec2a6de4e971c6e77eab83e508c090c8f0b1f6
• Tagged manifest-closure commit: 9981040b2e873b4120d0bc57850cbbb917603708
• Final exact-tag release-evidence run: all five jobs passed, including the fresh Compose quickstart, rootless image build, 33-check isolated acceptance, and strict release-integrity gate.
• Exact-main CI run: passed.
• The committed release/evidence/manifest.json attests the evidence commit. The attached release-evidence.json asset attests the exact tagged commit; it cannot be embedded in that same commit without changing the commit SHA.

Both published packages carry npm provenance and PyPI Trusted Publishing attestations from those
runs.

The release remains source-only. No Chrome-containing image, image tar, filesystem layer, or public
layer cache is attached. Chrome inventory, vulnerability scan posture, third-party notices, host
qualification scope, and demo limits are recorded in the tag-pinned
RELEASE_EVIDENCE.md
and DEMO_EVIDENCE.md.

Agent Browser v0.2.1 - evidence-coherent patch release

Agent Browser v0.2.1 is a release-integrity and public-documentation patch for the first MCP-capable
stable line. It makes the tagged source archive, evidence record, and manifest-closure sequence
coherent without moving or rewriting the published v0.2.0 tag.

What changed

• Bumped the runtime, source-built image, Compose service, Node client, Python client, MCP server
  metadata, and CLI source tag to 0.2.1.
• Replaced stale v0.1 release-candidate launch copy with current Node, Python, npm, PyPI, and MCP
  guidance.
• Reconciled the demo record: the current recorded demonstration and superseded v0.1 still montage
  are clearly separated, current asset checksums are published, and the limits of the retained
  capture provenance are explicit.
• Corrected the release record so hosted runtime evidence is not misattributed to the separate demo
  capture or to evidence-only files excluded from the container build context.
• Closed the release in three deliberate stages before tagging: reviewed runtime, evidence rebind,
  and generated-manifest commit.

No route, request model, authorization boundary, listener default, runtime dependency, or
distribution permission changed in this patch. The API remains api_version: "v1".

Install and connect

npm install aether-browser@0.2.1
pip install aether-browser==0.2.1

# Serve the same nine Agent Browser tools to an MCP client:
npx -y aether-browser@0.2.1 mcp
aether-browser mcp

The self-hosted Linux runtime still starts from source with:

docker compose up --build

Exact release evidence

• Runtime commit: 38cc23f281001a9d678642916da522c047f9151d
• Evidence commit: 7acde1c493d2a2595554c012d1091f8371d3439d
• Tagged manifest-closure commit: 92b686861ea9aa4ec78f5345fe873c213e158810
• Final exact-tag release-evidence run: all five jobs passed, including the fresh Compose quickstart, rootless image build, 33-check isolated acceptance, and strict release-integrity gate.
• Exact-main CI run: passed.
• The committed release/evidence/manifest.json attests the evidence commit. The attached release-evidence.json asset attests the exact tagged commit; it cannot be embedded in that same commit without changing the commit SHA.

The release remains source-only. No Chrome-containing image, image tar, filesystem layer, or public
layer cache is attached. Chrome inventory, vulnerability scan posture, third-party notices, host
qualification scope, and demo limits are recorded in the tag-pinned
RELEASE_EVIDENCE.md
and DEMO_EVIDENCE.md.

Historical correction

The v0.2.0 package provenance remains valid for its immutable tag, but that source tag was created
before its later evidence-rebind and manifest commits. v0.2.1 preserves the old tag and supersedes
that evidence-packaging order with a tag created only after closure. Use v0.2.1 for the coherent
source-and-evidence release record.

Agent Browser v0.2.0 - See what your agent sees, from any MCP client

Important

Evidence-packaging notice: The v0.2.0 tag has not been moved, and the package provenance remains bound to that original release commit. However, the tag was created before the later v0.2.0 evidence-rebind and manifest commits, so its source archive does not contain that final evidence state. v0.2.1 corrects the ordering and is the recommended release for a source tree, package set, and exact-tag evidence bundle that all agree.

An 18-second presentation of the takeover flow. It shows the agent signing in over the API, stopping at a 2FA prompt, a human taking over the same displayed session to type the code, and control returning to the agent. The capture operator recorded it as one continuous run; the public repository does not contain the raw capture or action log needed to independently prove single-take or no-replay provenance.

---

Agent Browser is now an MCP server

Point Claude Code, Claude Desktop, Cursor or Windsurf at the session a human is watching:

docker compose up --build
claude mcp add agent-browser -- npx -y aether-browser@0.2.0 mcp

Already have the Python client? aether-browser mcp serves the same nine tools.

Nine tools — browser_open, browser_navigate, browser_read, browser_click, browser_type, browser_press, browser_scroll, browser_status, browser_close — shipped in both clients under the same names, with a test asserting the two toolsets cannot drift apart.

Neither client gains a runtime dependency. The JSON-RPC stdio transport is implemented directly in clients/node/src/mcp.js and clients/python/src/aether_browser/mcp.py.

browser_open returns the live view URL and every later response repeats it, so the human always knows where to look. The server tells the model, on connect, to stop and ask for a takeover at a login, a payment, or a 2FA prompt rather than guessing — the loop shown in the recording above.

Setup and limits: docs/MCP.md.

A demo that is actually a demo

The 0.1.0 demo was a montage of three static frames with no live motion, linked as a relative .mp4 that GitHub renders as a link rather than a player. The v0.2.0 asset is an inline GIF that presents a continuous x11grab capture of the flow. The current evidence statement—including the retained-evidence limits—is in docs/DEMO_EVIDENCE.md at v0.2.1.

Breaking-ish

Important

GET /browser/health now reports "version": "0.2.0". The field is a schema Literal, so this is visible in the contract. api_version is untouched and remains v1.

Also in this release

• The Node MCP server reads its version from its own package.json rather than hardcoding it, with a test per client asserting the advertised version matches the package. A future bump cannot leave a server introducing itself as a stale version.
• docs/ARCHITECTURE.md no longer lists "MCP server" among the things this project does not have. It states the boundary instead: the MCP server is a client of the API contract, not an extension of it — no new route, no widened authority.
• docs/SOURCE-RECOVERY.md no longer claims no client SDK ships; docs/llms.txt no longer announces a release candidate; SECURITY.md names the current release line.
• Documentation describing an ongoing property of the pre-1.0 line now says v0.x rather than v0.1, so it stays true across releases.

Full changelog: https://github.com/AetherAI3/agent-browser/blob/v0.2.0/CHANGELOG.md
Compare: v0.1.0...v0.2.0

Agent Browser v0.1.0 — See what your agent sees

Self-hosted Chrome for AI agents. The agent drives one headed session through a bounded API, and a live noVNC view of that same session is open in front of you.

Source-only, as before: no Chrome-containing image, image tar, filesystem layer, or reusable layer cache is published.

Install

npm install aether-browser     # TypeScript client + CLI
pip install aether-browser     # Python client + CLI

Both leave the release-candidate line at this tag. The two clients are the same client in two ecosystems — same name, same commands, same closed v1 contract, released version for version, and CI fails if they drift.

Run it

docker compose up --build

Linux with Docker Compose v2. The first build installs a hash-locked Python environment and the current Google Chrome Stable package, so it takes several minutes. aether-browser doctor says what is missing before you start.

Evidence

Runtime commit 02ee77bf, image sha256:8b603281…, 33-check isolated acceptance against that exact image ID, quickstart reproduced from a fresh directory, SBOM over 630 packages, Google Chrome 152.0.7977.82. Full record: docs/RELEASE_EVIDENCE.md · release/evidence/manifest.json

Security

The v0.1 noVNC surface is unauthenticated and intended for numeric loopback on a machine you control. Do not expose it through a tunnel, reverse proxy, or container bridge. See the security model.

Agent Browser v0.1.0-rc.1 (source-only release candidate)

Drive it from TypeScript

npm install aether-browser

The client and CLI for this release are published as aether-browser — zero runtime dependencies, TypeScript types included, Node 18+. withSession guarantees the session is ended even if your callback throws. Source in clients/node.

Docs site: https://aetherai3.github.io/agent-browser/

---

Agent Browser v0.1.0-rc.1 is a source-first, self-hosted release candidate. It is not a hosted service, and it is not a production release.

Self-hosted Chrome for AI agents: drive one browser session through a closed HTTP API, and watch or take over that exact same session through noVNC.

Distribution is source-only

This release publishes source only. No Chrome-containing OCI image, image tar, filesystem layer, or reusable layer cache is distributed. You build the image yourself from this checkout, which is what the documented quickstart does.

The SBOM and third-party notice bundle captured during release evidence are inventory and transparency records. They do not by themselves grant redistribution authorization for Google Chrome.

Quickstart

Requires Docker Engine on Linux with Docker Compose v2.

docker compose up --build

Then open the live browser view at http://127.0.0.1:6080/vnc.html and check the API:

curl -fsS http://127.0.0.1:8092/browser/health | jq .

The first build installs a hash-locked Python environment and uses Patchright to install the then-current Google Chrome Stable package, so it can take several minutes.

What is in this candidate

• A closed v0.1 API surface for session create/end, navigation, snapshot, and bounded interaction. There is no arbitrary-endpoint, JavaScript, DevTools, shell, or credential-import escape hatch.
• Separate controller and observer authorization roles.
• One owned session at a time, with fail-closed capacity rejection.
• Egress policy that refuses direct SSRF targets and refuses redirects out of policy.
• Downloads are non-persistent and popups are bounded rather than silently allowed.
• A noVNC surface for live human observation and takeover of the same session.
• Deterministic teardown: process, profile, and container cleanup.

Naming

This is the first candidate published as Agent Browser by Aether AI. The Python package is agent_browser, the distribution is agent-browser, and the runtime environment prefix is AGENT_BROWSER_*.

An earlier candidate was briefly published under the working name "Aether Browser" before the rename settled. It was withdrawn rather than kept alongside this one, so this is the only release and it carries the final naming throughout. If you pulled that earlier tag, re-pull this one and rename any AETHER_BROWSER_* variables you had set.

Evidence

Every runtime proof for this candidate is bound to runtime commit 0ff618ae70a9640fe1d43e893cdc15a422a5f710.

• Isolated acceptance against the exact built image returned PASS over 33 checks, covering image binding, --network none pod isolation, session authority, interaction, refusals, noVNC/RFB readiness, same-display visual binding, and cleanup.
• The documented Linux Compose quickstart was reproduced from a clean checkout.
• The strict repository gate passed on the tagged commit, with ci and all five release-evidence jobs green.

Human-readable records: docs/RELEASE_EVIDENCE.md and docs/DEMO_EVIDENCE.md. The machine-readable attestation is committed at release/evidence/manifest.json and attached to this release.

The demo video in the README is an eight-second silent montage of stills generated from the accepted image. It is illustrative. The acceptance record, not the video, is the proof.

Supply-chain hardening

The privileged release workflows check out a statically trusted ref (github.sha, already proven by the ref-proof job to be the exact refs/heads/main tip) rather than an indirect job output, so a privileged run cannot execute an unproved tree and poison default-branch Actions caches. This closed five High CodeQL findings (actions/cache-poisoning/poisonable-step) before this candidate was cut.

At the tagged commit there are no open CodeQL, Dependabot, or secret-scanning alerts. No workflow uses pull_request_target; the one self-hosted job is workflow_dispatch only, so forks cannot reach it. All actions are SHA-pinned, every job is time-bounded, all checkouts use persist-credentials: false, and no ${{ }} expression is interpolated into a run: block.

Security posture and limits

• Read docs/SECURITY-MODEL.md before exposing anything.
• The v0.1 noVNC surface is unauthenticated and is intended for numeric loopback on a machine you control. The Compose quickstart binds user-facing listeners to loopback for this reason. Do not expose it to a network.
• Grype ran against the exact image with --fail-on high --only-fixed and did not block the build, meaning no fixed high-or-higher findings. That is not a claim that the image is free of vulnerabilities: of the recorded findings, 12 carry an available fix, 520 have no released fix, and 330 are marked will-not-fix by the Debian-derived base. Re-scan any image you build and apply your own risk policy.
• Evidence covers a single local, network-isolated container run. It does not demonstrate hosted or multi-tenant operation, remote network security, sustained load, or availability.
• Rebuilding this source later may resolve a newer Chrome Stable version than the one recorded in the evidence.

Feedback

This is a release candidate and the API may change before v0.1.0. Issues and design discussion are welcome, including the open client-library and worker-pool issues.