Vercel Labs' agent-browser 0.42.0 Adds Saved Flows, Its Fifth Release in 14 Days
Software / news
Vercel Labs' agent-browser 0.42.0 Adds Saved Flows, Its Fifth Release in 14 Days
The Rust browser CLI for AI agents has 48,622 stars, and the new feature replays recorded tasks as HTTP requests where it can.
Vercel Labs shipped agent-browser 0.42.0 on Nov. 10, its fifth release in 14 days, adding an experimental "saved flows" feature that records a browser task once and replays it as plain HTTP requests where it can. The Apache-2.0 command-line tool had 48,622 GitHub stars on Nov. 10, 10 months after the repository was created on Jan. 11.
What the tool is
agent-browser is a browser automation CLI for AI agents, written as a native Rust binary, according to its README. An agent runs agent-browser open <url>, then snapshot -i, which lists the page's interactive elements as the accessibility tree with short references such as @e1. Later commands act on those references: click @e1, fill, type, press. A background daemon holds the browser per --session and talks to Chrome over the Chrome DevTools Protocol, so each shell command is short.
Install is npm install -g agent-browser followed by agent-browser install, which downloads Chrome for Testing. The README lists native binaries for macOS, Linux (glibc and musl) and Windows. Its own limitations section is candid: references go stale after navigation or a DOM change, clicks fail when a consent banner covers the target, and the daemon closes headless browsers after one hour with no commands.
What 0.42.0 changes
The 0.42.0 release notes, published at 00:37 UTC on Nov. 10, describe saved flows this way: a run tries a direct HTTP request first, then the same request from inside the page, then a replay of the recorded commands, and saves whichever tier worked. The notes label the feature experimental and say "Runs send requests only to public addresses." That last line is the one a security reviewer will want in writing, since a replayed request that could reach a private address would turn a recorded task into a way to probe an internal network.
The same release raises the minimum to Node 22, rejects unknown commands and cookie operations, and persists security settings across daemon restarts. The README points to a security guide covering an auth vault, domain allowlists and action policies, but the page itself does not describe how any of them work.
| Release | Published (UTC) | Headline entry |
|---|---|---|
| v0.40.0 | Oct. 27, 21:32 | Breaking: eve integration needs eve 0.84.0 or later |
| v0.41.0 | Oct. 29, 02:52 | Breaking: eve tools come from the MCP tool catalog |
| v0.41.1 | Nov. 1, 15:29 | Bug fix: cookie attribute handling |
| v0.41.2 | Nov. 3, 23:46 | Targeted skill references |
| v0.42.0 | Nov. 10, 00:37 | Saved flows (experimental) |
How it sits next to Playwright MCP
Microsoft's Playwright MCP solves the same problem through a different door. It also feeds agents an accessibility snapshot rather than pixels, and its action tools take an element reference from that snapshot. It is Apache-2.0 as well, with 39.4k stars and 3.4k forks.
Playwright MCP's own README concedes the argument agent-browser is built on: coding agents increasingly favor CLI workflows because they are "more token-efficient" and avoid "loading large tool schemas and verbose accessibility trees into the model context." It presents the MCP server as the better fit for specialized loops that need persistent state.
- agent-browser49K stars
- Playwright MCP39K stars
Source: GitHub API for vercel-labs/agent-browser; Playwright MCP README (39.4k, rounded by the project page), accessed 2026-11-10
Stars measure attention, not adoption. agent-browser's repository also carries 537 open issues and pull requests, against 3,309 forks.
The security caveat
Playwright MCP states that it is "not a security boundary" and describes its browser_run_code_unsafe tool as "RCE-equivalent," meaning it runs arbitrary JavaScript in the server process. agent-browser's README makes no comparable statement on the page we read, and a search of its open issues for a security label returned none. Neither fact shows the tool is safe: it shows the project has not published a threat model on its front page. Any agent pointed at untrusted pages through either tool should run in a throwaway environment.
The next test is whether saved flows leave the experimental label, and whether the public-address rule survives redirects, which the notes do not address.
Related: Rivet's Launch HN made agent-runtime claims with no workload named, and OpenAI's Pierre Computer deal shows where agent tooling money is going.
Sources
More in Software
- 01Git Contributors Draft a Debian-Style Vote on Whether to Keep the Ban on AI-Looking PatchesThe project has not agreed who may vote, how ballots are counted or what the options are, and the policy under dispute rejects any patch that looks AI generated.
- 02.NET 11 Ships With C# 15 Union Types, the Same Day .NET 8 and 9 Lose SupportMicrosoft's release is a two-year Standard Term Support build whose end-of-support date matches .NET 10's, which changes the upgrade maths for teams still on .NET 8.
- 03Agent Skills: Why Matt Pocock's 27-Skill Repo Has More Stars Than Anthropic'sBoth repositories are on GitHub trending. They share one file format, differ in intent, and one of them tells you in its README not to rely on it.
- 04Sherlock 0.16.2 Writes Reports Outside Its Folder on a ../ UsernameTwo unmerged pull requests would fix the bug, and the last two gaps between Sherlock releases were 435 and 359 days.