Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@UBA MCP Server Open zhihu.com and show me the top 10 AI agent discussions."
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
The open-source Browser Brain for AI agents — API-first execution, real browser identity, local-first secrets.
中文:UBA 是一个面向 Claude、GPT 与任意 Agent 的开源 Browser Brain 运行时。它让模型拥有人类级网页感知、语义理解、长期浏览记忆、真实浏览器身份。
最强烈差异化(从调研报告 7 得出):
❌ 不是 "另一个 browser-use fork"
❌ 不是 "反检测浏览器"(stealth 降级为独立插件)
❌ 不是 "AI 浏览器产品"(不做完整 UX)
✅ 是 "Browser Brain Runtime" —— 跨层聚合 6 个能力层,只做基础设施层,不做应用层
核心承诺:
API 优先 —— GitHub/X 写动作走官方 API(OAuth Device Flow,短期 token)
真实身份浏览器 —— 用户自己 Chrome + CDP attach,不是 stealth 伪造
本地优先 —— 凭据存系统 keychain,token 不出机
MCP 优先 —— Claude / Cursor / Continue 任何 MCP 客户端可直接调
Apache-2.0 —— 企业友好 + 专利授权清晰
Related MCP server: Real Browser MCP
✅ 面向 LLM 的 Browser Brain Runtime(开源)
✅ 把页面变成 page.json(统一观测对象)
✅ 三层记忆(Factual / Episodic / Semantic)
✅ Reflection(动作后自动 diff + failure cause)
✅ Approval Policy(高风险动作人类接管)
✅ Secret Vault(系统 keychain 存凭据)
✅ Local-first by default, cloud only by consent
✅ Apache-2.0 license
❌ 反检测浏览器(stay stealth 主题不在主叙事,降到独立插件) ❌ 完整 AI 浏览器产品(Comet / Dia 那种) ❌ 另一个 browser-use fork(差异化在 Memory + Reflection + Secret Vault) ❌ SaaS(本地为主)
Claude Agent
|
MCP / CLI / SDK
|
UBA Orchestrator
┌─────────────────────────────────┐
│ 1. Browser Core │ ← Provider 抽象
│ 2. Perception │ ← a11y + screenshot + DOM
│ 3. Brain Engine → page.json │ ← 语义化 + risk
│ 4. Planning + Approval │ ← 候选 + 审批
│ 5. Reflection │ ← diff + retry
│ 6. Memory OS │ ← 3 张表 + Secret Vault
└─────────────────────────────────┘
|
┌────────────────┐ ┌────────────────┐
│ API Executor │ │ Browser Exec │
│ (GitHub/X) │ │ (CDP/extension)│
└────────────────┘ └────────────────┘每层都有官方文档。
# 装
git clone https://github.com/kezhu-ai/uba.git
cd uba
uv sync
# 启动 MCP server(stdio 模式)
uv run uba-server
# Claude Code 配置 ~/.claude/mcp.json:
# {
# "mcpServers": {
# "uba": {
# "command": "uv",
# "args": ["--directory", "PATH/TO/uba", "run", "uba-server"]
# }
# }
# }然后在 Claude Code 里说:
"用 uba 打开知乎,看看 AI Agent 热榜前 10"(待录屏:同一任务"普通 browser automation vs UBA"对比,展示 page.json + 第二次访问时记忆被调出)
(完整 mermaid 架构图:6 层 + 双执行面,API 优先 + 浏览器兜底)
(uba/core/page.py 的 Pydantic 模型,字段包括: session_id / url / site / page_type / auth_state / user_goal / summary / entities[] / primary_actions[] / risk_flags[] / memory_hooks{} / evidence{})
v0.2 计划扩展:regions / selector_candidates / recent_actions / site_facts(报告 7 Page Understanding Graph)
三层:
SQLite: sessions / page_observations / action_logs / reflections / preferences / site_playbooks
Secret Vault:~/.uba/secrets.vault.json(Fernet 加密)或系统 keychain
LanceDB(v0.3):embeddings 多模态语义检索
15 个核心 MCP 工具:
browse_navigate / browse_snapshot / browse_click(ref=eN) / browse_type(ref=eN, text)
browse_screenshot / browse_extract / browse_sessions / browse_solve_captcha
uba_observe / uba_plan / uba_act / uba_reflect / uba_recall / uba_run(高阶闭环)
uba_twitter_search / uba_twitter_user_timeline(X Free API 只读)
Provider | 用途 | 默认 |
本地 Chrome CDP attach | 真实身份(报告 7 推荐) | v0.3 默认 |
Patchright | 自动化底层(API 兼容 Playwright) | v0.2 默认 |
CloakBrowser | 选配,stealth 增强 | v0.3 降级为独立插件 |
Camoufox | Firefox 路径反检测 | v0.3 选配 |
远程 Browser(Browserless / Kernel) | CI/企业部署 | 选配 |
Local-first by default, cloud only by consent
浏览器 profile 只读快照(不直接写用户原始 profile)
敏感字段(凭证/cookie/密码)绝不入 memory retrieval
Approval Policy:高风险动作(支付/登录/发信/表单提交)默认 require approval
域名 allowlist(默认拒绝银行/政府/医疗)
一键删除站点记忆:uba forget --site zhihu.com
参考 OpenAI Operator 的 takeover / Anthropic 的 sandbox 实践。
默认所有数据本地:
~/.uba/memory.db — SQLite
~/.uba/secrets.vault — 系统 keychain(WIN/macOS/Linux)+ Fernet 兜底
~/.uba/profiles/<session>/ — 浏览器 profile(只读快照)
不上传 telemetry / crash report。
版本 | 重点 | 状态 |
v0.1 | 6 层架构骨架 + 15 MCP 工具 + page.json v0.1 | ✅ 2026-07-19 release |
v0.2 | Secret Vault + GitHub App Device Flow + X Free API + 战略重塑 | ✅ 2026-07-19 |
v0.3 | CDP attach(真实身份)+ LanceDB semantic + Page Understanding Graph | 🔜 计划 |
v0.4 | browse_with_goal LLM 决策循环 + Site Playbook 自动学习 | 🔜 |
v1.0 | 10k star + 1+ enterprise user + public benchmark | 🔜 |
(待 v0.3 公开 20-50 任务基准,衡量:
action success rate
token cost per task
memory recall precision/recall
recovery rate from failure
v0.2 已有 60 个单元测试,覆盖核心)
三层入口:
Provider / Plugin — 加新浏览器后端、新 LLM 适配
Site Playbook — 贡献某站点的结构经验(知乎怎么登录、淘宝怎么下单)
Memory / Eval — 基准、召回、反思逻辑
详见 CONTRIBUTING.md。
维护者:@uba-agent-core
RFC 流程:大改动走 rfcs/
License:Apache-2.0(核心)+ 独立 stealth 插件仓库(规避 license 风险)
中文社区 + 英文社区双语
报告 7 强约束:
GitHub 走 App + Device Flow(不是 PAT 网页自动化)
X 走 OAuth 2.0 PKCE(短期 token)
凭据走系统 keychain(不存明文)
2FA / 验证码默认 human-in-the-loop(不绕过)
审批 + 审计 + 速率限制(防止滥用)
详见 SECURITY.md。
(开始攒,目标是 v1.0 前 10k stars)
📖 CLAUDE.md — 架构 + 当前状态
📋 docs/chatgpt-handoff.md — ChatGPT 设计对话
📋 docs/deep-research-report (2).md — 战略重塑调研
📋 docs/issues/backlog.md — 10 个 starter issues
📋 docs/integrations/claude-code-mcp.md — Claude Code 5 分钟接入
📋 docs/strategic/x-twitter-integration.md — X 集成分析
browser-use — fork 选型
Playwright — 浏览器底层
Model Context Protocol — Anthropic MCP spec
OpenAI Operator — takeover/watch mode 参考
Anthropic Computer Use — sandbox 参考
Apache-2.0 — 见 LICENSE。stealth 插件在独立仓库。
按 ref 点击(ref 来自 browse_snapshot 返回的 refs)。
| Name | Required | Description | Default |
|---|---|---|---|
| ref | Yes | ||
| session_id | No | default |
| Name | Required | Description |
|---|---|---|
No output parameters | ||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, and the description fails to disclose important behavioral traits such as whether the click triggers navigation, waits for page load, or handles errors. For an action tool, this is insufficient.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence that front-loads the action and provides key context without unnecessary words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given that an output schema exists (not shown), the description does not need to detail return values. However, it lacks information on error scenarios, success indicators, or behavioral effects, making it only minimally complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description adds essential context by linking ref to browse_snapshot. It does not clarify session_id, but the primary parameter is well explained.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description explicitly states the action ('click by ref') and indicates that ref comes from browse_snapshot, clearly differentiating from the sibling tool browse_navigate.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explains that ref is obtained from browse_snapshot, implying a prerequisite. However, it does not specify when not to use this tool or mention alternatives explicitly.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
The two tools have clearly distinct purposes: one navigates to a URL, the other clicks elements based on references. No ambiguity between them.
Both tools follow a consistent browse_verb_noun pattern (browse_navigate, browse_click), maintaining good naming uniformity.
Only 2 tools for a web browsing server is too few. Typical browsing automation requires additional tools for extracting content, inputting data, or scrolling.
The tool surface is severely incomplete for web browsing. Missing essential operations like getting page content, filling forms, or executing other interactions.
Unclaimed servers have limited discoverability.
If you are the server author, to access and configure the admin panel.
Autonomous cloud agent tasks: real browser + your tools, structured evidence-backed results.
MCP-first toolbox for agents: KV storage, auth, queue, and utility tools. Free in early access.
Hosted MCP with 91 agent tools: X, domains, SEO, Maps, Trends, Search, YouTube, TikTok, and more.
One profile — skills, credentials, and memory — synced to every agent tool via one MCP URL.
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/kezhu-ai/uba'
If you have feedback or need assistance with the MCP directory API, please join our Discord server
