Borrowing it
Nothing to install: this file belongs to sderosiaux/chrome-agent. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/sderosiaux/chrome-agent/main/CLAUDE.mdgit clone --depth 1 https://github.com/sderosiaux/chrome-agentWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/sderosiaux/chrome-agent/claude-md)<a href="https://agentmods.dev/instructions/sderosiaux/chrome-agent/claude-md"><img src="https://agentmods.dev/badge/instructions/sderosiaux/chrome-agent/claude-md.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.06345 | $0.06345 |
| Opus 5 | $0.03173 | $0.03173 |
| Sonnet 5 | $0.01269 | $0.01269 |
| Haiku 4.5 | $0.00634 | $0.00634 |
Grade A, and why
chrome-agent CLAUDE.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 152 lines — stays where its author put it; the contents beside it link to each section on GitHub.
chrome-agent v0.16.0
Single Rust binary for browser automation via CDP, built for AI agents. 43 subcommands
(chrome-agent --help), 29.0K lines of Rust in src/ across 84 files (measure: tokei src/),
one regex crate (regex-lite, for assert --matches), 3 MB binary.
Architecture
CLI (clap) → CDP Client (WebSocket) → Chrome
| Module | Role |
|---|---|
src/cli.rs, src/cli_actions.rs |
clap definition (Cli, Command, one variant per verb) and the per-verb subcommand enums (MacroAction, EmulateAction, AssertWhat, WebmcpAction, DaemonAction) |
src/main.rs, src/run.rs, src/run_helpers.rs, src/connect_cli.rs |
the binary entry point; CLI dispatch on Command — each arm builds typed args from clap, calls the SAME pipe_dispatch::dispatch_* pipe and batch call, and renders the answer; shared output/error handling and connect_page (8-attempt retry); resolving one invocation's browser + page connection |
src/page_ctx.rs |
PageCtx: the two clients, the store, the three names that locate a page in it, and the two global flags, in one struct — so a dispatcher takes three parameters instead of eleven |
src/render.rs |
text-mode renderer: the value: / values lost: / verdict: / next: lines, colour only on a tty |
src/pipe_command.rs |
the pipe/batch protocol as types: one deny_unknown_fields struct per verb, so a mistyped key is an error instead of a silently ignored one |
src/pipe.rs, src/pipe_command.rs, src/pipe_validate.rs, src/pipe_dispatch*.rs, src/pipe_report.rs, src/pipe_emulation.rs |
pipe mode (persistent connection, JSON stdin/stdout); typed per-verb protocol plus cross-field validation; the dispatchers shared by pipe, batch and CLI batch, plus dispatch_assert and run_batch; mutates_page + attach_change_report; strict JSON emulation parsing |
src/macros*.rs |
macro file format and store (macros.rs), session history → macro (macros_record.rs), guarded execution (macros_run.rs), the macro list/show/record/run surface (macros_cmd.rs) |
src/cdp/, src/setup.rs |
WebSocket transport, message correlation, CDP types, the input-event deadline (send_input), ensure_foreground; console interceptor injection and 7 stealth patches |
src/element.rs |
uid resolution, fill, type, press, the settle machinery, js_exception. Owns SECRET_FIELD, the one predicate deciding whether a value may be printed |
src/element_pointer.rs |
the pointer path: PointerVerb, aim_and_dispatch and the one aim rule both verbs share, native mouse/touch dispatch, the JS fallback when there is no box to aim at, hover. Split from element.rs for the 1000-line cap, re-exported via pub use — it is the half of element that moves when hit_test moves |
src/element_controls.rs |
select, check/uncheck, upload, drag. Owns CHECKABLE_PROBE and SELECT_READ, which assert reads through |
src/element_selector.rs, src/element_ref.rs, src/read_back.rs |
CSS-selector actions (click/dblclick/fill/focus); the ElementRef abstraction over CDP node identity; the value:{requested,actual,verbatim} object every read-back verb puts on its response |
src/hit_test.rs, src/hit_test_report.rs, src/geometry.rs |
where a mouse event will land (probe, settle loop, Delivery classifier, --on-intercept) and what the response says about it (Dispatched, Unaimable, Refused, carrying intercepted_by/verdict/next); box-model → screenshot clip math |
src/snapshot.rs, src/snapshot_render.rs, src/snapshot_secret.rs |
take_snapshot and take_views over Accessibility.getFullAXTree; the pure renderer (compact text, stable uids, role filter, depth limit, subtree focus); redaction of secret field values (MARKER = <redacted>), decided by asking the page since secret-ness is a property of the element |
src/verdict.rs, src/verdict_evidence.rs, src/verdict_words.rs |
pure classifier producing verdict + verdict_reason + hint; the evidence it reads (Delivery, Postcondition, each with a no-evidence floor variant); the gloss/next_for/hint_for tables |
src/landing.rs, src/serving.rs |
where a navigation ended up vs where it aimed (redirect rule, auth-wall guess, host_and_path/origin_of); and what answered: challenge / error / nothing_actionable / unreadable / page |
src/hints/ |
error-recovery hints: one fact, one resolved command, an explicit refusal to retry when a retry is dangerous |
src/browser.rs, src/chrome_args.rs, src/daemon.rs |
Chrome launch, auto-discovery, stale DevToolsActivePort cleanup, profile management; --chrome-arg validation and the inherit-when-omitted merge; optional Unix micro-daemon with heartbeat and crash recovery |
src/session.rs, src/session_load.rs, src/session_save.rs, src/secure_fs.rs, src/profiles.rs, src/orphans.rs, src/kill.rs |
JSON session persistence (~/.chrome-agent/sessions.json, 0600) split by direction; shared 0600/0700 enforcement for files and directories; flock + read-merge-write and one-sided dead-pid prune. Plus the three-condition orphan-profile predicate; running browsers no session entry claims, recognised by --user-data-dir; KillOutcome |
src/emulation.rs |
page-scoped device metrics: validation, transactional CDP apply/reset, persistence, observed status |
src/base64.rs, src/truncate.rs |
RFC 4648 decoder for screenshot/pdf/download (no base64 crate, keeps the musl graph pure-Rust); UTF-8 safe string truncation |
src/commands/ |
25 modules: goto, click, dblclick, fill, inspect, eval, text, read, extract, diff, network, console, wait, screenshot, pdf, download, download_click, tabs, frame, batch, assert, assert_args, record, history, webmcp. select/check/upload/drag had one too, each a single call into element_controls behind a message the dispatcher already built |
src/commands/assert.rs, assert_args.rs |
comparators (pure), page readers, the NotHeld carrier for exit 2; CLI/JSON → Assertion and the argument combinations it refuses |
src/commands/download_fetch.rs |
the download a URL produces: the base64 fetch through Runtime.evaluate, MAX_FETCH_BYTES derived from the transport ceiling with a const assertion tying them, and the filename derivation both paths share. Split from download.rs for the 1000-line cap, re-exported via pub use |
src/commands/download_click.rs |
the download a click produces: Browser.setDownloadBehavior arming, a subscription taken before anything can fire, bounded wait on downloadWillBegin/downloadProgress, --max-bytes cancel, 0600 move out of a private per-invocation directory, collect_abandoned deferred sweep |
src/commands/webmcp.rs |
document.modelContext.getTools()/.executeTool(); owns the thrown marker strings src/hints/ matches on |
vendor/, npm/, skills/chrome-agent/SKILL.md |
Mozilla Readability (90 KB, MIT) and the MDR/DEPTA-inspired extract.js, both via include_str! and tested under jsdom; the npm wrapper whose postinstall downloads the native binary; the agent skill file |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago Changed · -93 lines · -1,361 tokens per session 4e55ba87a2ee
- 7d ago First seen · 245 lines · 7,706 tokens per session scan A 4674b9899c37
chrome-agent CLAUDE.md is an instructions file published in the GitHub repository sderosiaux/chrome-agent (87 stars, last pushed 7d ago), licensed MIT. It adds 6,345 tokens to every session, about $0.0317 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other instructions, from other repositories
codex AGENTS.md
AGENTS.md instructions for openai/codex, covering rust/codex-rs, the codex-core crate, code review rules, crate api surface and model visible context.
vscode buildNext.instructions.md
Working notes and architecture documentation for the new esbuild-based build system in build/next. Use when making changes to the new build pipeline (transpile/bundle commands, NLS plugin, source-map handling, resource copying, or self-hosting watch tasks).
next.js AGENTS.md
AGENTS.md instructions for vercel/next.js, covering next.js development guide, codebase structure, monorepo overview, core package: packages/next and other important packages.
langchain AGENTS.md
AGENTS.md instructions for langchain-ai/langchain, covering global development guidelines for the langchain monorepo, corridor security analysis, project architecture and context, monorepo structure and development tools & commands.
vscode oss-third-party-notices.instructions.md
Instructions for microsoft/vscode, covering vs code oss third-party-notices pipeline, architecture, pipeline flow in ci, applying the notice (cutover) and fallback chain (never fail the build).
spec-kit AGENTS.md
AGENTS.md instructions for github/spec-kit, covering agents.md, about spec kit and specify, quickstart — add a new integration in 5 steps, integration architecture and integrationmanifest — file tracking.