main (unreleased, dfbeea7)

The store release of main at dfbeea7 (version 1.0.1), built and checked exactly as a v* release is. It is not on the Chrome Web Store; use the latest release for that.

To load it: unzip onlyread-latest.zip, then on chrome://extensions turn on Developer mode, Load unpacked, and choose the onlyread folder. It has the store's extension ID, so remove the store install first. To update: unzip the new one over it and press reload on the extension's card.

onlyread-latest-webstore.zip is the store zip itself, unchanged; onlyread-latest.zip is the same files with the store's public key in the manifest, which gives it the store's ID.

OnlyRead 1.0.1

What's Changed

• Bump the dev-dependencies group with 2 updates by @dependabot[bot] in #1
• Bump qs from 6.16.0 to 6.17.1 by @dependabot[bot] in #2
• LinkedIn: let compose boxes open, show every refusal, count a site's retries once by @aviyam181199 in #3
• Pro users: "Try the demo" on the account page; framed settings match its theme by @aviyam181199 in #4
• Release: put main's store build on a rolling main-latest pre-release by @aviyam181199 in #5
• An agent's browser applies a site removal made on the Pro account while an agent works there by @aviyam181199 in #6
• Demo GIFs for posts by @Hedingber in #8
• Support reports: binary bodies and unstorable characters no longer fail the send by @aviyam181199 in #10
• Pro account page: a framed dialog covers the whole window by @aviyam181199 in #12
• Guard every site guards each site as if it were switched on by @aviyam181199 in #11
• Release 1.0.1 by @aviyam181199 in #9

New Contributors

• @dependabot[bot] made their first contribution in #1
• @aviyam181199 made their first contribution in #3
• @Hedingber made their first contribution in #8

Full Changelog: v1.0.0...v1.0.1

OnlyRead 1.0.0

OnlyRead 1.0.0: the read-only mode for AI agents in the browser. First release.

Hand any agent that drives your browser your real inbox, calendar and work tools. Reads pass, and every send, post, like, edit, delete or settings change is refused before it leaves the browser. It's enforced below the model, on the network requests themselves, so nothing the agent is told can change what gets through.

Install

• Add OnlyRead to Chrome. It works in any Chromium browser that installs Chrome extensions.
• Or download onlyread-1.0.0.zip below, unzip it, and load its onlyread/ folder unpacked in chrome://extensions (Developer mode). It's the same build as the store's. The SHA-256 of both zips is in SHA256SUMS.txt.

What's in it

• Four layers: rules, per-site decoders (Google's sync channels, LinkedIn server actions, Facebook GraphQL), a verdict cache of reviewed endpoints, and an AI judge for whatever is left. Jev decides, and Claude reviews what Jev can't settle. Unsure, or no judge reachable, means refused.
• Choose your judge: your own OpenRouter or Vercel AI Gateway key (free, you pay the gateway), or OnlyRead Pro (sign in, 1,000 free judged requests).
• Guards while an agent works by default. Choose Always in the settings to guard all the time, behind a settings PIN. An agent can't switch OnlyRead off or lower its settings.
• Tested on 100+ sites. Gmail, Google Calendar, Linear, LinkedIn, Facebook, X, Telegram, WhatsApp and Reddit were tested in depth (docs/SITES.md). Any other site can be guarded from the settings or with Guard this site in the popup.
• Works with any agent in a Chromium browser: Claude in Chrome, ChatGPT in Chrome, Gemini in Chrome, Comet, Dia, Opera Neon, Edge Copilot Mode, Browser Use, Playwright and more.
• Privacy: a judge sees only the request in question (its address and a short body preview with passwords, tokens and card numbers removed), never cookies, headers, responses or the page (PRIVACY.md).

Known limits

• Chrome shows a "started debugging this browser" banner while OnlyRead guards. By default that's only while an agent is working.
• Agents that drive the screen from outside the browser are covered only in Always mode.

What's next is in the roadmap. Questions and reports: Discussions · Discord.