h5i (pronounced high-five) is a lightweight browser for AI agents to browse, scrape, test, and automate the web. It reduces the risks of giving agents web access through network policies, sandboxing, credential isolation, and auditable sessions. The same controls let agents inspect, edit, replay, and compare HTTP traffic for automated web security testing, CTFs, and authorized red teaming.

Protect agents from the web. Use agents to test the web.

# Browse, scrape, and automate.
h5i browser open https://example.com
h5i browser snapshot                                      # the page as a model should read it
h5i browser click @e3
h5i browser requests                                      # what it asked for, and what was refused
h5i browser audit                                         # the whole session: verbs, fetches, handovers, ending
h5i browser close

# Inspect and test the traffic generated by the browser.
h5i websec requests                                       # captured HTTP messages
h5i websec show req_42 --raw                              # inspect one request
h5i websec replay req_42 --set query.id=456               # edit and resend it
h5i websec diff res_42 res_43                             # compare the responses
h5i websec match res_43 --status 200 --contains "ok"      # assert a condition

1. Install

curl -fsSL https://h5i.dev/install.sh | sh
# curl -fsSL https://raw.githubusercontent.com/h5i-dev/h5i/main/install.sh | sh  # if you would rather not add a domain to the chain:
# cargo install --path .                                                         # build from source

The agent-facing interface is a skill, and the binary carries it:

npx skills add h5i-dev/h5i         # if you do not have the binary yet
# h5i skill install                # writes it where your runtime looks
# h5i skill show policy            # or just read a page

The optional websec plugin ships as its own archive. The installer can fetch and register it in the same pass:

curl -fsSL https://h5i.dev/install.sh | sh -s -- --websec
# h5i plugin install               # says what is installed

2. Use it

2.1. Browse, scrape, and automate

A session combines one page state, cookie jar, network policy, and request record. Agents can read pages, interact with elements, and extract structured data through one CLI:

h5i browser open https://docs.rs/ --allow docs.rs
h5i browser snapshot                        # page outline with @ref handles
h5i browser snapshot --delta                # only what changed
h5i browser click @e3
h5i browser type @e5 "serde"
h5i browser extract '{"titles": ["h2"]}'    # structured extraction
h5i browser markdown                        # readable page content
h5i browser close

h5i browser read https://docs.rs/           # for a single page without a persistent session

2.2. Test web applications

Because h5i owns the browser’s network layer, agents can capture, inspect, edit, replay, and compare HTTP traffic without a MITM proxy, CA certificate, or separate repeater.

Use these capabilities only on systems you own or are authorized to test:

h5i browser open https://target.example --capture --allow target.example

h5i websec requests                                  # list messages and IDs
h5i websec show req_42 --raw                         # inspect a request
h5i websec replay req_42 --set query.id=456          # edit and resend it
h5i websec diff res_42 res_43                        # compare responses
h5i websec match res_43 --status 200 --contains "ok" # assert a condition
h5i websec sequence flow.json                        # run a multi-step test

2.3. Control and audit agent access

Web content is untrusted input to an AI agent. h5i reduces the risks of giving agents web access by applying a network policy and recording both allowed and denied requests:

h5i browser requests    # allowed and denied network requests
h5i browser audit       # actions, fetches, handovers, and session ending
h5i browser status      # isolation, policy digest, and network placement

For sensitive interactions, a human can take control without returning credentials to the agent:

h5i browser login

For stronger isolation, define network and filesystem limits in .h5i/env.toml:

[profile.reading]
isolation = "supervised"          # workspace | process | supervised | container | microvm

[profile.reading.net]
mode = "host"
egress = ["docs.rs", "static.crates.io"]

[profile.reading.fs]
read = ["/usr", "/etc"]
write = []

Then place the browser inside that environment:

h5i box --profile reading --name docs
h5i browser open https://docs.rs/ --in docs

2.4. Contain the entire agent workflow

A sandbox can contain more than the browser. It can also hold the workspace, toolchain, development server, and agent itself. This is useful when an agent is building and testing an application in the same environment.

h5i box create alpha --profile agent-claude   # sandboxed git worktree
h5i box shell alpha                           # interactive confined session
h5i box run alpha -- cargo test               # run a command inside it
h5i box propose alpha                         # create a reviewable snapshot
h5i box apply alpha                           # merge approved changes
h5i box export alpha                          # export the patch and receipts
h5i box rm alpha                              # discard the environment

Share a running service or watch the workflow from the host:

h5i box share alpha --port 3000
h5i box share alpha --port 3000 --tunnel
h5i join <ticket>

h5i ui

2.5. More browser capabilities

Name sessions to run several browsers independently:

h5i browser open https://example.com/login --session auth --new
h5i browser open https://example.com/ --session public --new
h5i browser snapshot --session auth

Read media transcripts, choose a coherent browser identity, or watch a running browser:

h5i browser transcript --url https://example.com/talk --lang en
h5i browser transcript --via yt-dlp --url https://www.youtube.com/watch?v=VIDEO_ID

h5i browser open https://example.com --identity privacy
h5i browser open https://example.com --script --identity firefox-143-linux

h5i box view <name>
h5i box view <name> --term

3. Sandbox and isolation levels

h5i provides four sandbox levels, plus an unconstrained workspace mode. Run h5i box probe to see which levels your host supports. h5i never silently downgrades: an unsatisfiable request fails closed.

Tier What enforces it
workspace a separate git worktree, no confinement
process Landlock filesystem allowlist, seccomp deny-list, namespaces, rlimits
supervised all of the above, plus a private network namespace with an nftables egress allowlist pinned to resolved IPs, DNS pinned by hosts file, and a seccomp-notify socket gate
container rootless Podman, dropped capabilities, a portable image, and an HTTP/HTTPS proxy allowlist
microvm a hardware-isolated guest with its own kernel, booted by microsandbox (msb) from the same OCI images, with the egress allowlist evaluated by the VM's network stack

Host credentials do not enter a box. A runtime-scoped proxy authenticates model API requests outside the boundary, preventing cross-runtime access. Each box receives a private, one-time copy of approved HOME state.

4. Documentation

  • Official Website: project overview, Slides
  • MANUAL.md / man h5i: full command reference
  • CONTRIBUTING.md: we welcome contributions of any kind
  • curl -fsSL https://h5i.dev/man/man1/h5i.1 -o ~/.local/share/man/man1/h5i.1: install the man page

5. FAQ

h5i is a lightweight, open-source browser built for AI agents to browse, scrape, and automate the web. It combines policy-controlled, auditable sessions and configurable sandboxing with optional tools for inspecting and testing HTTP traffic. It runs locally and is written in Rust without Chromium or V8.

Use Playwright or Puppeteer when maximum compatibility with complex websites is the priority. Use h5i when you want lower resource use, direct network controls, a complete session record, built-in HTTP testing tools, or a sandbox for the browser and agent.

Not for every use case. h5i is useful when an AI agent needs to browse an application and capture, edit, replay, and compare its HTTP traffic through one interface, without a separate proxy or CA setup. Burp Suite remains better suited to mature manual workflows, automated scanning, extensions, and low-level protocol testing.

No. h5i works best for content-heavy websites and common browser interactions, but some browser APIs are not yet supported. For incompatible websites, you can run Chromium inside an h5i sandbox.

The browser uses lightweight process isolation when available. For stronger isolation, place the browser or the agent's entire workflow inside a supervised network sandbox, container, or microVM.

No browser can reliably detect or prevent every prompt injection. h5i reduces the potential impact by treating page content as untrusted, restricting network and filesystem access, isolating credentials, and recording the resulting actions for review.

The agent can reference a named credential without reading its value, or a human can take control to log in. The authenticated session continues without returning the password or cookie to the model.

h5i has no hosted service and stores its sessions locally. Browser traffic still goes to websites you allow, and model traffic goes to your configured model provider.

6. License

Apache-2.0. See LICENSE.

7. Contributors