Borrowing it
Nothing to install: this file belongs to sderosiaux/chrome-agent. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/sderosiaux/chrome-agent/main/CLAUDE.mdgit clone --depth 1 https://github.com/sderosiaux/chrome-agentWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/sderosiaux/chrome-agent/claude-md)<a href="https://agentmods.dev/instructions/sderosiaux/chrome-agent/claude-md"><img src="https://agentmods.dev/badge/instructions/sderosiaux/chrome-agent/claude-md/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/instructions/sderosiaux/chrome-agent/claude-md"><img src="https://agentmods.dev/badge/instructions/sderosiaux/chrome-agent/claude-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.06639 | $0.06639 |
| Opus 5.5 | $0.02656 | $0.02656 |
| Sonnet 5.5 | $0.01328 | $0.01328 |
| Haiku 4.5 | $0.00664 | $0.00664 |
Grade A, and why
chrome-agent CLAUDE.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 168 lines — stays where its author put it; the contents beside it link to each section on GitHub.
chrome-agent v0.16.0
Single Rust binary for browser automation via CDP, built for AI agents. 44 subcommands
(chrome-agent --help), 30.9K lines of Rust in src/ across 91 files (blank and comment-only lines excluded),
one regex crate (regex-lite, for assert --matches), 3 MB binary.
Product direction
Read the mission and roadmap before extending the product.
The target is autonomous discovery of web capabilities, with verified recipes that agents can
reuse, repair and share through a GitHub catalogue or private sources. The runtime below is
the shipped foundation. discover now persists caller-driven experiments and exports local
candidates. The first isolated discovery experiment
demonstrates discovery and reuse on one synthetic site, but rejects the generated recipe for
false completeness claims. M1 and catalogue acceptance remain open. See the implemented protocol.
Discovery is driven by the calling agent; no embedded model/provider layer is planned. The
first public catalogue covers read and extraction recipes; external-write recipes come later.
Prioritize work that enables that lifecycle. Existing macros and Python examples establish
execution behavior; they are not a sandbox for recipes from untrusted sources.
Architecture
CLI (clap) → CDP Client (WebSocket) → Chrome
| Module | Role |
|---|---|
src/cli.rs, src/cli_actions.rs |
clap definition (Cli, Command, one variant per verb) and the per-verb subcommand enums (MacroAction, EmulateAction, AssertWhat, WebmcpAction, DaemonAction) |
src/discovery.rs, src/discovery_cmd.rs, src/discovery_store.rs |
Caller proposals, revision/budget/history validation, shared dispatcher execution, durable reservations, atomic private files and local candidate export. |
src/main.rs, src/run.rs, src/run_helpers.rs, src/connect_cli.rs |
the binary entry point; CLI dispatch on Command — each arm builds typed args from clap, calls the SAME pipe_dispatch::dispatch_* pipe and batch call, and renders the answer; shared output/error handling and connect_page (8-attempt retry); resolving one invocation's browser + page connection |
src/page_ctx.rs |
PageCtx: the two clients, the store, the three names that locate a page in it, and the two global flags, in one struct — so a dispatcher takes three parameters instead of eleven |
src/render.rs |
text-mode renderer: the value: / values lost: / verdict: / next: lines, colour only on a tty |
src/pipe_command.rs |
the pipe/batch protocol as types: one deny_unknown_fields struct per verb, so a mistyped key is an error instead of a silently ignored one |
src/pipe.rs, src/pipe_command.rs, src/pipe_validate.rs, src/pipe_dispatch*.rs, src/pipe_report.rs, src/pipe_emulation.rs |
pipe mode (persistent connection, JSON stdin/stdout); typed per-verb protocol plus cross-field validation; the dispatchers shared by pipe, batch and CLI batch, plus dispatch_assert and run_batch; mutates_page + attach_change_report; strict JSON emulation parsing |
src/macros*.rs |
macro file format and store (macros.rs), session history → macro (macros_record.rs), guarded execution (macros_run.rs), the macro list/show/record/run surface (macros_cmd.rs) |
src/cdp/, src/setup.rs |
WebSocket transport, message correlation, CDP types, the input-event deadline (send_input), ensure_foreground; console interceptor injection and 7 stealth patches |
src/element.rs |
uid resolution, fill, type, press, the settle machinery, js_exception. Owns SECRET_FIELD, the one predicate deciding whether a value may be printed |
src/element_pointer.rs |
the pointer path: PointerVerb, aim_and_dispatch and the one aim rule both verbs share, native mouse/touch dispatch, the JS fallback when there is no box to aim at, hover. Split from element.rs for the 1000-line cap, re-exported via pub use — it is the half of element that moves when hit_test moves |
src/element_controls.rs |
select, check/uncheck, upload, drag. Owns CHECKABLE_PROBE and SELECT_READ, which assert reads through |
src/element_selector.rs, src/element_ref.rs, src/read_back.rs |
CSS-selector actions (click/dblclick/fill/focus); the ElementRef abstraction over CDP node identity; the value:{requested,actual,verbatim} object every read-back verb puts on its response |
src/hit_test.rs, src/hit_test_report.rs, src/geometry.rs |
where a mouse event will land (probe, settle loop, Delivery classifier, --on-intercept) and what the response says about it (Dispatched, Unaimable, Refused, carrying intercepted_by/verdict/next); box-model → screenshot clip math |
src/snapshot.rs, src/snapshot_render.rs, src/snapshot_secret.rs |
take_snapshot and take_views over Accessibility.getFullAXTree; the pure renderer (compact text, stable uids, role filter, depth limit, subtree focus); redaction of secret field values (MARKER = <redacted>), decided by asking the page since secret-ness is a property of the element |
src/verdict.rs, src/verdict_evidence.rs, src/verdict_words.rs |
pure classifier producing verdict + verdict_reason + hint; the evidence it reads (Delivery, Postcondition, each with a no-evidence floor variant); the gloss/next_for/hint_for tables |
src/landing.rs, src/serving.rs |
where a navigation ended up vs where it aimed (redirect rule, auth-wall guess, host_and_path/origin_of); and what answered: challenge / error / nothing_actionable / unreadable / page |
src/hints/ |
error-recovery hints: one fact, one resolved command, an explicit refusal to retry when a retry is dangerous |
src/browser.rs, src/chrome_args.rs, src/daemon.rs |
Chrome launch, auto-discovery, stale DevToolsActivePort cleanup, profile management; --chrome-arg validation and the inherit-when-omitted merge; optional Unix micro-daemon with heartbeat and crash recovery |
src/session.rs, src/session_load.rs, src/session_save.rs, src/secure_fs.rs, src/profiles.rs, src/orphans.rs, src/kill.rs |
JSON session persistence (~/.chrome-agent/sessions.json, 0600) split by direction; shared 0600/0700 enforcement for files and directories; flock + read-merge-write and one-sided dead-pid prune. Plus the three-condition orphan-profile predicate; running browsers no session entry claims, recognised by --user-data-dir; KillOutcome |
src/emulation.rs |
page-scoped device metrics: validation, transactional CDP apply/reset, persistence, observed status |
src/base64.rs, src/truncate.rs |
RFC 4648 decoder for screenshot/pdf/download (no base64 crate, keeps the musl graph pure-Rust); UTF-8 safe string truncation |
src/commands/ |
25 modules: goto, click, dblclick, fill, inspect, eval, text, read, extract, diff, network, console, wait, screenshot, pdf, download, download_click, tabs, frame, batch, assert, assert_args, record, history, webmcp. select/check/upload/drag had one too, each a single call into element_controls behind a message the dispatcher already built |
src/commands/assert.rs, assert_args.rs, assert_wait.rs |
comparators, page readers, exit 2, optional bounded observation with --within; CLI/JSON → Assertion and shared argument validation |
src/commands/download_fetch.rs |
the download a URL produces: the base64 fetch through Runtime.evaluate, MAX_FETCH_BYTES derived from the transport ceiling with a const assertion tying them, and the filename derivation both paths share. Split from download.rs for the 1000-line cap, re-exported via pub use |
src/commands/download_click.rs |
the download a click produces: Browser.setDownloadBehavior arming, a subscription taken before anything can fire, bounded wait on downloadWillBegin/downloadProgress, --max-bytes cancel, 0600 move out of a private per-invocation directory, collect_abandoned deferred sweep |
src/commands/webmcp.rs |
document.modelContext.getTools()/.executeTool(); owns the thrown marker strings src/hints/ matches on |
vendor/, npm/, skills/chrome-agent/SKILL.md |
Mozilla Readability (90 KB, MIT) and the MDR/DEPTA-inspired extract.js, both via include_str! and tested under jsdom; the npm wrapper whose postinstall downloads the native binary; the agent skill file |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · +5 lines · +168 tokens per session 1622c46e7f4d
- 1mo ago Changed · +11 lines · +126 tokens per session 44d69dfae225
- 1mo ago Changed · -93 lines · -1,361 tokens per session 4e55ba87a2ee
- 1mo ago First seen · 245 lines · 7,706 tokens per session scan A 4674b9899c37
chrome-agent CLAUDE.md is an instructions file published in the GitHub repository sderosiaux/chrome-agent (96 stars, last pushed 16d ago), licensed MIT. It adds 6,639 tokens to every session, about $0.0266 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other instructions, from other repositories
vscode buildNext.instructions.md
Working notes and architecture documentation for the new esbuild-based build system in build/next. Use when making changes to the new build pipeline (transpile/bundle commands, NLS plugin, source-map handling, resource copying, or self-hosting watch tasks).
next.js AGENTS.md
AGENTS.md instructions for vercel/next.js, covering next.js development guide, codebase structure, monorepo overview, core package: packages/next and other important packages.
vscode oss-third-party-notices.instructions.md
Instructions for microsoft/vscode, covering vs code oss third-party-notices pipeline, architecture, pipeline flow in ci, cache eligibility and rollout and applying the notice (cutover).
langchain AGENTS.md
AGENTS.md instructions for langchain-ai/langchain, covering global development guidelines for the langchain monorepo, corridor security analysis, project architecture and context, monorepo structure and development tools & commands.
vscode copilot-instructions.md
Copilot instructions for microsoft/vscode, covering vs code copilot instructions, project overview, root folders, core architecture (src/ folder) and built-in extensions (extensions/ folder).
vscode model-prompts.instructions.md
Model-specific prompt authoring and registry guidelines.