An LLM Browser Agent That Rewrites Its Own Tools Mid-Task

What it does

Browser Harness is a thin CDP bridge that parks an LLM agent directly inside your Chrome browser over a single WebSocket. When the agent needs to do something the harness does not yet support—upload a file, parse a new UI pattern, or recover from an edge case—it writes a new helper into agent_helpers.py and keeps going. Over time it also builds per-site “domain skills” in agent-workspace/domain-skills/ that shortcut familiar flows like LinkedIn outreach or Amazon checkout.

The interesting bit

The project treats the harness as mutable scaffolding rather than a fixed API. The core is only about a thousand lines across four files, and the authors deliberately keep it small so the LLM can safely edit the unprotected workspace while the protected core stays intact. It is the automation equivalent of giving the agent a wrench and letting it tune the engine while the car is running.

Key highlights

• Direct CDP link to Chrome—no thick abstraction layer between the agent and the browser.
• Agent-generated helpers and site-specific skills; the README explicitly asks humans not to hand-author skill files.
• Roughly 1,000 lines of protected core code; the rest is generated or community-contributed domain logic.
• Optional cloud browser tier with stealth mode, proxies, and captcha solving if you prefer not to wire it to your local profile.
• Skills persist across runs, so the agent theoretically stops rediscovering the same selectors every session.

Caveats

• Initial setup requires manually enabling Chrome remote debugging and approving per-attach permission popups, so it is not fully hands-off.
• The README asks users not to hand-author domain skills, leaving the quality and correctness of all helper code up to the agent.
• The architecture mentions a “protected core package” but does not explain how isolation is enforced while the agent edits files in the shared workspace.

Verdict

Worth a look if you want an LLM to operate your actual browser profile for long-running, bespoke web tasks rather than a sterile headless environment. Skip it if you need a fully locked-down, deterministic automation pipeline where the agent is not allowed to touch the tooling.