Crabbox is a remote execution control plane that lets a local command run on managed cloud capacity, an SSH host, or another delegated sandbox while syncing code, streaming output, and recording evidence. It is for maintainers, contributors, teams, AI agents, and automation that need repeatable remote testing, builds, browser checks, or platform-specific validation. The catalogue add-ons provide commands and instructions for controlling Crabbox runs.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/openclaw/crabbox/webvncgit clone --depth 1 https://github.com/openclaw/crabboxWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/openclaw/crabbox/webvnc)<a href="https://agentmods.dev/commands/openclaw/crabbox/webvnc"><img src="https://agentmods.dev/badge/commands/openclaw/crabbox/webvnc.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.06087 |
| Opus 5 | $0.00000 | $0.03044 |
| Sonnet 5 | $0.00000 | $0.01217 |
| Haiku 4.5 | $0.00000 | $0.00609 |
Grade A, and why
webvnc scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 516 lines — stays where its author put it; the contents beside it link to each section on GitHub.
webvnc
crabbox webvnc opens a desktop lease in a browser tab. Coordinator-backed
leases bridge into the authenticated coordinator portal. Direct macOS providers
such as Tart and Parallels use that same portal whenever coordinator login is
configured; Crabbox registers the external lease until crabbox stop or normal
coordinator expiry. Without coordinator auth, direct macOS keeps a
localhost viewer as its offline fallback. The local container provider serves
noVNC locally over an SSH tunnel. An existing loopback VNC tunnel can use the
provider-neutral webvnc local bridge on a macOS or Linux host.
crabbox warmup --desktop
crabbox webvnc --id swift-crab
crabbox webvnc --id swift-crab --network tailscale
crabbox webvnc --id swift-crab --open
crabbox webvnc --id swift-crab --open --take-control
crabbox webvnc --id swift-crab --target macos --preflight
secret-command | crabbox webvnc local --vnc-host 127.0.0.1 --vnc-port 5900 --username admin --password-stdin --open
crabbox webvnc daemon start --id swift-crab --open
crabbox webvnc daemon status --id swift-crab
crabbox webvnc daemon list
crabbox webvnc daemon stop --id swift-crab
crabbox webvnc status --id swift-crab
crabbox webvnc reset --id swift-crab --open
The lease must have the desktop capability. Reusing a lease for WebVNC
requires that capability to be present (see
Capabilities).
How it works
webvnc resolves the lease the same way crabbox vnc does, verifies the
desktop capability, and probes the runner's loopback VNC service
(127.0.0.1:5900) over SSH. Coordinator-backed leases then mint a short-lived
bridge ticket over the authenticated coordinator API and connect the local
bridge to the coordinator portal. The local container provider instead starts
websockify inside the local container and tunnels that local noVNC endpoint to
the browser. Direct-SSH startup records a private remote process identity and
uses an owner-specific loopback port allocated under a host-wide remote lock.
The owner ID supplies only the first candidate: occupied ports are skipped and
startup bind collisions retry another candidate. The exact selected port is
persisted in the owner's mode-0600 identity and reused only with that owner's
exact listener and recorded websockify process, so concurrent workspaces on one
SSH host remain isolated even when their first candidates collide. Adapter
raw ownership material is domain-separated into the public owner ID before any
subprocess starts. The remote websockify process carries only a fresh per-launch
nonce, recorded in its identity, rather than the adapter owner token. After the
SSH tunnel opens, Crabbox proves that the exact expected SSH process owns the
local listener before retrieving a VNC credential. Password-authenticated VNC
sessions complete a noVNC WebSocket and VNC password challenge, recheck
ownership, and only then use the authenticated one-time browser handoff. In ARD
mode, whether the viewer uses the coordinator portal or a local bridge, the
Crabbox relay authenticates to Screen Sharing itself; it exposes no credential
endpoint and sends no account credential to the browser. A missing/zero
expected PID, unrelated listener, or unauthenticated endpoint never receives a
password probe or handoff.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 516 lines · 0 tokens per session scan A e74450defab9
webvnc is a command published in the GitHub repository openclaw/crabbox (1,368 stars, last pushed today), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 6,087 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other commands, from other repositories
splunk-observability-synthetics-setup
Render focused Splunk Observability Synthetic Monitoring plans and native-ops specs for browser, API, HTTP, SSL, and port tests.
gh-issue-use-aws-chrome
Like /gh-issue-use-aws-browser (correlated browser + read-only AWS full-stack dive), but the browser phase is pinned to the Chrome MCP (claude-in-chrome). Example — /gh-issue-use-aws-chrome "file export > Download" clicking Download 403s on staging effort:max.
gh-issue-use-aws-playwright
Like /gh-issue-use-aws-browser (correlated browser + read-only AWS full-stack dive), but the browser phase is pinned to the Playwright MCP. Example — /gh-issue-use-aws-playwright "file export > Download" clicking Download 403s on staging effort:max.
jira-issue-use-aws-playwright
Like /jira-issue-use-aws-browser (correlated browser + read-only AWS full-stack dive), but the browser phase is pinned to the Playwright MCP. Example — /jira-issue-use-aws-playwright "file export > Download" clicking Download 403s on staging effort:max.
e2e
Generate comprehensive E2E tests for user workflows using Playwright.
auto-browse
Auto-browse — learn, optimize, and graduate browser operations or web data-mining workflows.