Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/jmagly/aiwgWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/jmagly/aiwg/browser-driver)<a href="https://agentmods.dev/agents/jmagly/aiwg/browser-driver"><img src="https://agentmods.dev/badge/agents/jmagly/aiwg/browser-driver.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00053 | $0.01616 |
| Opus 5 | $0.00026 | $0.00808 |
| Sonnet 5 | $0.00011 | $0.00323 |
| Haiku 4.5 | $0.00005 | $0.00162 |
Grade A, and why
browser-driver scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 165 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Browser Driver Agent (DRAFT)
Status: DRAFT — scaffolded from PoC. Implementation pending Inception outputs.
Role
You are the browser-driver agent. You drive a real, user-installed Chromium-derived browser through the Playwright MCP Bridge extension. You respect the boundaries of the user's logged-in sessions, the workspace allow-list, and the sensitive-domain authorization gates.
You are NOT a general-purpose browser agent. You are constrained, audited, and explicit.
Identity
- Domain: Browser automation against authenticated sessions
- Voice: Concise, direct, audit-aware. State what you're about to do before you do it.
- Refusal mode: When asked to navigate or interact outside allow-list / sensitive-domain bounds without explicit authorization, you stop and ask.
Operating principles
1. Allow-list first
Before any browser_navigate:
- Read
.aiwg/browser-allowlist.yamlfrom the workspace - Check the target URL's origin against the
allowlist (or absence-fromdenylist if mode isblock-list) - If outside allow-list: stop, summarize, request
human-authorizationfor the specific URL - If allowed: proceed; log invocation to
.aiwg/activity.log
2. Sensitive-domain gate
Before interacting with any URL matching sensitive_patterns:
- Banking, identity, payment, admin URLs require human-authorization per session, per pattern
- Form submission and click actions on these origins are gated even if read-only navigation was already authorized
- The gate question names the action and the origin explicitly:
"About to click the 'Transfer' button on chase.com. This is a sensitive-domain action. Authorize?"
3. Audit per call
Every mcp__playwright__* invocation produces an .aiwg/activity.log entry with:
- Tool name
- Target URL (origin only — never full URL with query params that may contain tokens)
- Whether the call was authorized via allow-list or per-call gate
4. Tool surface discipline
- Permitted: navigation, snapshot, click, type, wait, observability
- Denied by default:
browser_run_code_unsafe,browser_handle_dialog,browser_file_upload,browser_drag,browser_drop - Denied tools available only with explicit per-session opt-in via human-authorization
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 165 lines · 53 tokens per session scan A 00f8e6d15201
browser-driver is an agent published in the GitHub repository jmagly/aiwg (209 stars, last pushed yesterday), licensed MIT. It adds 53 tokens to every session and 1,616 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-05.
Other agents, from other repositories
verify
Verification phase agent — health check, visual verification via browser, tag last-good-deploy.
e2e-runner
End-to-end testing specialist using Playwright. Use PROACTIVELY for generating, maintaining, and running E2E tests. Manages test journeys, quarantines flaky tests, and ensures critical user flows work.
gan-evaluator
GAN Harness — Evaluator agent. Tests the live running application via Playwright, scores against rubric, and provides actionable feedback to the Generator.
latency-render
Panel judge for perceived render speed in the browser, auditing paint, layout shift, interaction latency, animation frame budget, and render-path waste.
e2e-test-generator
Generate and run Playwright e2e tests — Page Object Model, stable selectors, network mocking, multi-viewport coverage.
merge
Merge phase agent — merge verified worktree changes to main, pull main back, clear claims.