Browser Automation

Browser automation lets an agent operate the managed browser in the Captain Who right sidebar through built-in capabilities. It is appropriate for clicking, filling fields, paginating, taking screenshots, and downloading. When you only need to search for information and read web pages, prefer the simpler Web Search.

Enable the capability

Open “Settings → MCP.”
Find “Browser automation” under “Built-in.”
Enable “Allow browser automation.”
Return to the task.

This setting only allows an agent to request activation of the capability during a task. It is not permanent authorization for every web action. “Enable browser automation” or a sensitive-action approval may still appear during a run.

Prepare a browser page

Open “New panel → Browser” in the right sidebar.
Visit the target website.
If the task requires sign-in, sign in manually first and verify the current account and environment.
Return to the conversation and state the allowed website, objective, and prohibited actions explicitly.

For example:

Use the right-sidebar browser to inspect build records for the currently signed-in project. Read only: do not trigger a rerun, change settings, or download files. Summarize the causes of the three most recent failed jobs.

The agent can also request that a managed page be created or selected, but it does not take over system Chrome, Safari, Edge, or an arbitrary remote-debugging port.

Approve sensitive actions

The following operations may require separate approval or be denied by a fixed safety boundary:

Uploading or reading a local file.
Downloading content and exporting an artifact.
Accessing cookies, local/session storage, or imported or exported browser state.
Accessing localhost, private networks, internal cloud-service addresses, nonstandard ports, or URLs containing credentials.
Executing page scripts, unsafe code, or sensitive network reads.
Opening a new window, increasing risk, or changing the target identity.

An approval is bound to the current run, tool, parameters, and web target. The system may ask for approval again after page navigation, DNS changes, or parameter changes.

Upload and download

For an upload, Captain Who uses the system file picker to establish a short-lived file authorization. The model does not see or provide the real absolute path. Before approval, verify the website, file, and submission action.

A download is not written automatically to an arbitrary user directory. It first becomes a short-lived browser artifact. To keep it, use the interface's export action and select a destination. A browser artifact can live for at most 24 hours; actual resource budgets may limit its count or size sooner.

Manual browsing and browser automation share the managed in-app session. Cookies and site storage persist across pages and app restarts. When a task is complete, open the browser menu and select “Clear browsing data” if you do not want the signed-in state retained.

Website requests for camera, microphone, location, system notifications, and similar permissions are always denied. Agent approval cannot bypass this fixed boundary.

Write a safer browser task

Include four things:

The target site and account environment.
Allowed actions, such as “read only” or “may fill fields but stop before submitting.”
Prohibited actions, such as “do not send, purchase, or delete.”
The acceptance method, such as “capture the relevant pages and list their URLs.”

For actions that are difficult to undo—such as submitting, purchasing, publishing, or deleting—require the agent to pause before the final click and describe the page state.

Errors and unknown outcomes

A web page may navigate immediately after a tool call or close while the call is running. After a timeout, cancellation, browser crash, or communication interruption, Captain Who distinguishes between “Not sent” and “May have executed.” The latter must not be retried automatically. Open the website and verify the actual state first.

Current limitations

Controls only the managed browser session inside the Captain Who app.
Supports only reviewed built-in browser tools. Unknown tools or tools whose catalog has changed are denied.
All website system-permission requests are denied. Only HTTP/HTTPS and a narrowed internal PDF-viewing path are supported.
A browser artifact is a short-lived resource tied to the run lifecycle, not a permanent download library.