Mother Of All Browser (MOAB) Automations

CI License: MIT Skill version

One skill → a purpose-built AI agent for every site you log in to.

MOAB is a VS Code Copilot skill that turns a website you already sign in to — internal portal, SaaS dashboard, intranet tool — into a dedicated AI agent, without writing code.

You give it a URL. It does reconnaissance on the site, opens a real browser so you can sign in, mines the authenticated page for what is automatable, asks which of those features you want, and then scaffolds an MCP server plus two VS Code agents wired to exactly those features. The agent uses its own dedicated browser profile, so single sign-on works once and keeps working.

The idea: MOAB is a meta-agent — an AI that builds other AIs. One skill, installed once, lets you spin up an agent per site.

What actually gets built

.vscode/mcp.json                      # registers the server with VS Code
.github/agents/
  <app>.agent.md                      # runtime agent — read/search + its own tools. No terminal, no file edits.
  <app>-builder.agent.md              # privileged agent — used to add features, not for daily work
<app>-mcp-server/
  index.js  session-manager.js  feature-runner.js  ui-miner.js
  driver.js  config.js  platform.js  safety.js  redact.js  rate-limiter.js  retry.js  errors.js
  bootstrap.js                        # one-time visible sign-in
  site.config.json                    # your settings
  features/*.json                     # one file per tool — the executable contract
  test/                               # unit tests for redaction and input safety
data/<app>/                           # gitignored: browser profile, captures. Auth material.

Every agent ships with the same standard toolkit, plus one tool per feature you picked:

Tool What it does
launch Open the site and capture the page (interactive sign-in when needed)
navigate Jump to any route within the site
interact Run a sequence of fill / select / click / press / wait steps
snapshot_ui Mine the live page for automatable elements and suggested selectors
get_page_content Read a previous capture from disk — no browser
list_sessions Show cached sessions and how fresh they are

The server code is copied from tested templates, not regenerated by the model, so every agent gets the same audited implementation. The only things authored per site are site.config.json and features/*.json.

What makes it different

  • Recon first, questions second. The skill inspects the live site before it asks you anything, then asks one batched round of multiple-choice questions with defaults already filled in.
  • Features are data, not generated code. Each tool is a JSON file with selectors, an action sequence, and a smoke test. When a site redesign breaks a tool, you re-mine one selectors block instead of regenerating anything.
  • Works with whatever SSO your site uses. Entra ID, Google, Okta, Auth0, ADFS, Ping — if you can sign in once in the visible browser, the dedicated profile keeps it.
  • Your real browser is never touched. Each agent gets its own profile under data/<app>/. MOAB never reads your normal profile and never closes your windows.
  • Least privilege by default. The agent you talk to every day has no terminal and no file-editing tools, because it is the one that reads untrusted web pages.
  • Cross-platform. Windows, macOS, Linux. All OS-specific logic lives in one file.

The flow

  1. Invoke the skill from Copilot Chat.
  2. Give it a URL.
  3. It runs reconnaissance — SSO detection, SPA shape, bot-detection markers — and warns you if the site is behind a bot-detection stack.
  4. It asks one batched round of questions (app name, data location, browser channel, rate limit, redaction), all with sensible defaults.
  5. It scaffolds the server, registers it in .vscode/mcp.json, writes both agent files, and verifies data/ is gitignored.
  6. It runs bootstrap.js, which opens a real browser window so you sign in. It waits for you to press Enter — no guessing when you are done.
  7. It mines the authenticated page and presents 4–8 candidate features as a multi-select menu.
  8. It writes one feature file per selection and validates each one.
  9. It smoke-tests every non-destructive tool once, then reports what works.

Requirements

  • VS Code with GitHub Copilot Chat
  • Node.js 20+
  • Google Chrome or Microsoft Edge
  • Playwright — installed automatically during scaffolding

Install

  1. Copy the moab-browser-automation/ folder into your workspace at .github/skills/moab-browser-automation/.
  2. Run Developer: Reload Window.
  3. In Copilot Chat, ask: "Use the MOAB skill to build me an agent for https://myapp.example.com/."

New to VS Code? Five-minute setup

  1. Install VS Code — code.visualstudio.com/Download.
  2. Install Chrome or Edge if you do not have one.
  3. Sign in to GitHub Copilot — account icon, bottom-left. No subscription yet? github.com/features/copilot.
  4. Create a dedicated folder (e.g. C:\dev\my-agents) and open it with File → Open Folder…. Use a folder set aside for this, not your main repo.
  5. Open Copilot Chat — Ctrl+Alt+I (Windows/Linux) or Cmd+Ctrl+I (Mac) — and pick Agent from the mode dropdown.
  6. Turn on auto-approve while building. Scaffolding installs packages and runs commands, so auto-approve saves a lot of clicking.

Turn auto-approve back off before daily use. It is genuinely useful while building and genuinely risky at runtime, when the agent is reading live web pages. See Security.

Using your agent

  1. Open Copilot Chat, click the agent dropdown, pick your new agent (e.g. myapp).
  2. Talk to it in plain English:
    • "Export the last 90 days of records to CSV and group them by category."
    • "What changed on the dashboard since yesterday?"
    • "Pull every open ticket assigned to me and summarize the blockers."
  3. The first call opens a browser window. By default every call does, so you can handle MFA and consent prompts. Once an agent has been stable for a while you can set "alwaysInteractive": false in site.config.json to allow silent headless runs.
  4. Adding a feature later: switch to the <app>-builder agent and ask. It re-mines the page, writes a new feature file, validates it, and restarts the server. No code edits.

Security & responsible use

MOAB caches a live authenticated browser session and feeds third-party web content into an AI agent. Both halves deserve attention — the full threat model is in SECURITY.md.

  • Prompt injection is the main risk. Everything captured from a page is wrapped in <untrusted-page-content> delimiters and both agents are instructed to treat it as data, never as instructions. The runtime agent has no terminal or file-editing tools, so a successful injection has a much smaller blast radius. Nothing makes this risk zero — keep auto-approve off for daily use.
  • data/ is auth material. It holds the browser profile. Scaffolding refuses to continue unless data/ is gitignored, writes a second ignore file inside it, and restricts its permissions. Treat it like a password. Delete it when you are done with an agent.
  • Captured content is redacted — JWTs, GitHub/AWS/Slack tokens, private keys, bearer headers, assigned API keys, and Luhn-valid card numbers — at the tool boundary as well as on disk, with an audit log at data/<app>/redaction-log.jsonl. Regexes are best-effort, not a guarantee.
  • Destructive tools require explicit confirmation on every call and are never smoke-tested.
  • Authorized use only. Use this on sites you are allowed to automate, and respect their terms. MOAB rate-limits per host (750 ms default) and retries transient failures with backoff.
  • Stealth is opt-in. The default driver is stock Playwright. The stealth driver exists for sites behind aggressive WAFs that you are authorized to automate — not for circumventing access controls. See reference/patchright.md.

Limitations & known issues

Worth knowing before you start:

  • Sites with hard bot detection may never work silently. If Cloudflare, Akamai, Datadome or a captcha is in the path, expect a visible browser and a human on every run.
  • Selectors drift. A site redesign breaks features. That is why they are JSON — recovery is re-mining one block, not rebuilding the agent.
  • Conditional access can force re-authentication regardless of cached session state. That is the policy working as intended and cannot be solved headlessly.
  • Redaction has false positives and false negatives. Card-number detection can match long numeric IDs; hex-blob redaction is off by default because it destroyed git SHAs. Check the audit log.
  • Canvas-heavy and deeply custom UIs mine poorly. Accessibility and DOM mining need real elements; a vision fallback exists but coordinate clicks are fragile.
  • Downloads that require OS-level dialogs are not handled.
  • Only Chromium-based channels are supported. Firefox and WebKit are out.

Telemetry

Zero. MOAB and every agent it generates send nothing to the author, to Microsoft, to GitHub, or to anyone else. A generated agent talks to exactly two places: the site it automates, and whatever you explicitly tell it to call. If you fork this, please keep it that way.

Contributing

Issues, ideas, and pull requests welcome — see CONTRIBUTING.md for the ground rules and repository layout. Before opening a PR:

cd moab-browser-automation/templates/mcp-server && node --test
node moab-browser-automation/scripts/validate-feature.mjs moab-browser-automation/examples/features

Both run in CI on Linux, macOS, and Windows, along with a scaffold smoke test. Please do not add telemetry, and do not grant the runtime agent execute or edit tools.

Changes are tracked in CHANGELOG.md. Licensed under MIT.