Optional experimental pack that reads chats and messages without opening them, so they stay unread. Read-only; any action still goes through the normal tools and the user's approval.
Ships a pack that reads a video's details, search results, and the videos listed on any page (home, channel, playlist, subscriptions), returning complete, exact rows with channel, views and length in a single call without moving the tab.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@Tabgeist summarize the new videos in my YouTube subscriptions feed"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
AI agents in your own browser. Tabgeist lets Claude Code, Codex, Cursor or any MCP agent work in the Chrome or Edge you already use, signed in as you, while you keep the signals: risky steps wait for your click, every step leaves a receipt, and a task that worked once becomes a routine that runs again without the AI.
Everything runs on your computer. Nothing listens beyond 127.0.0.1, and no page, cookie or password goes to a server of ours. There is no server of ours.
Most browser agents start a fresh, logged-out browser, or drive yours with nobody watching. Tabgeist was built around three questions:
Usual browser agents | Tabgeist | |
Which browser? | A new headless one: log in again, solve captchas | Your own Chrome or Edge, every account already signed in. Agent tabs sit in their own tab group |
Who decides? | The agent, or a prompt that asks it nicely | You. Send, post, pay, delete and upload wait for your click in the browser. The agent cannot approve, and a denied step stays denied |
What happens next time? | The AI does every click again | Save it once as a routine. It replays without the AI, through the site's own data calls where it can. When the site changes a little it finds its way; when it changes a lot, the agent proposes a fix and you decide |
Related MCP server: MEXX-Browser-Agent
Tool | What it does |
| Find or open tabs |
| The page as a short map of controls with refs ( |
| The text people see. |
| Click, type, select, drag, upload, like a person (real mouse and keys) |
| Pictures, files, and questions only you can answer (codes, PINs) |
| Turn what worked into a routine; run it again |
| What earlier agents learned about a site, and your rules for it |
| Routines a site change broke, and fixes the agent proposes (you decide) |
Windows 10/11, Node 22+, Chrome or Edge. macOS and Linux should work but are not tested yet.
npm install -g tabgeist
tabgeist setupFrom the source instead: git clone https://github.com/MuhammadAwais-Automation/tabgeist, then npm install, npm run build, node dist/cli.mjs setup.
setup adds Tabgeist to Claude Code, Codex and Cursor (whichever you have), installs its two skills, starts the daemon and opens your browser's extensions page with the extension folder on your clipboard. Then, once:
Turn on Developer mode → Load unpacked → paste the folder.
The side panel shows a 6-digit code: approve it in the control room that setup opened.
Restart your agent and ask it to do something in your browser.
tabgeist update installs the newest version and runs setup again. Run setup again any time; it only changes what is missing.
Reading the screen is slow and lossy: a page shows what fits, a feed loads as you scroll. Most apps already hold the exact data. A pack is a small folder per site that reads it, so the agent gets clean rows in one call and the tab does not move.
Pack | Reads |
| a video's details, search results, the videos on any page (home, channel, playlist, subscriptions) |
| story lists, whole comment threads |
| chats and messages without opening them, so they stay unread |
tabgeist pack # packs in use
tabgeist pack new <site> [folder] # start one, with your saved routines for that site
tabgeist pack try <folder> <url> [op] # run it on a public page, in a throwaway browser
tabgeist pack add <folder | git URL> # install or update onePacks only read. Any action still goes through the normal tools and your click. Packs are code that runs in your page, so they come only from you: the ones that ship with Tabgeist, and folders or repositories you add. An agent can call a pack's ops, but it can never install a pack or send its own code. Your own rules, notes and routines for a site always win over its pack.
tabgeist pack new linkedin.com starts a folder: pack.json, a starter adapter.js, notes.md, and the routines you saved for that site.
Ask your agent to fill it in. The tabgeist-pack skill teaches it to find where the data lives, write the ops, and test them with pack try.
tabgeist pack add <folder> to use it yourself.
To share it, push the folder to a public GitHub repository. Anyone can then run tabgeist pack add https://github.com/you/tabgeist-pack-linkedin. Read a pack's adapter.js before you add someone else's: it runs in your signed-in pages.
Routines travel the same way: a pack's routines/ folder. Read yours before sharing, since a routine can hold values you typed.
WhatsApp's terms forbid automation, and accounts have been banned for unofficial clients. The WhatsApp pack only reads, but your account is your risk. That is why it is not on by default.
Measured by node e2e/run.mjs --bench in a throwaway Chrome, logged out. Characters are what the agent's model has to read; a token is about four.
Task | Way | Calls | Size | Time | Got |
Hacker News front page | screen text | 1 | 4.5k chars | 15 ms | 29/30 stories |
page map | 1 | 5.8k | 0.25 s | 20/30 | |
pack | 1 | 5.5k | 0.3 s | 30/30, with ids, links, exact points | |
A 150-comment HN thread | open + read by scrolling | 2 | 32.7k | 4.0 s | 150/150 |
pack | 1 | 31.8k | 0.7 s | 150/150, with depth | |
YouTube search, 20 results | screen text | 1 | 7.7k | 0.4 s | 10/20 |
page map | 1 | 3.9k | 0.3 s | 4/20 | |
pack | 1 | 3.5k | 1.1 s | 18–20/20, with channel, views, length | |
A two-step form task | agent: look, act, check | 3 | 0.7k | 1.7 s | 3 model turns |
routine | 1 | 0.4k | 2.0 s | no model turns when you or a schedule run it |
The honest reading: a pack is not always smaller than the screen, but it is complete, exact and often much faster. The big saving is routines. A model turn re-reads the whole conversation, so a task the agent never has to think about again costs nothing the next hundred times.
Approvals the agent cannot skip. Risky steps are found by what they do (the button's words in many languages, the form, the network request), not by asking the agent. They wait for your click in the browser or the control room. Agents cannot open, read or click the control room.
Your rules per site. block, ask, allow, limits like send: 5/h, and which other domains a site may send data to.
Secret fog. Passwords, one-time codes and card numbers reach the agent as {{secret:N}}. It can type one back on the same site, never elsewhere.
Data does not wander. Text read on one site cannot be sent to another without your yes. Hidden page text (invisible, off-screen, zero-width) never reaches the agent.
Receipts. Every step lands in a timeline with what was asked, what happened, who approved it and a picture after each action.
What it does not protect against, and why: docs/architecture.md.
Plain files in ~/.tabgeist you can read, edit and back up: sites/<site>/ (your rules, notes, routines, health), packs/, timeline/, shots/, heal/. The control room (tabgeist open) shows all of it.
npm install
npm test # unit tests
npm run typecheck
npm run build # dist/cli.mjs and the control room
npm run e2e # the real extension in a throwaway Chrome, never your profileHow the pieces fit and the threat model: docs/architecture.md. The design system: design/README.md. Packs, fixes and bug reports: CONTRIBUTING.md.
MIT
This server cannot be deployed
Connect AI agents to your own Chrome with scoped access, approvals, and verified task results.
Let your AI agent operate any website through a real, logged-in browser session.
Logs your AI agent into websites, catches verification codes, and asks you before anything risky.
Context and control for any AI. Agent identity, scoped access, and proof across tools.
