Browser Use

You will like this if you have ever written a Playwright script that broke on the second release of the site: pip install, a task in English, and the agent navigates, fills and extracts on its own. The daily trait is that it is a library, not a product, so it lives inside your Python and your cron, and the model behind it is your choice.

Where it hurts is cost and time: every step is a model call, and a long flow is a long bill. Pick it for scraping and form work on sites you own or are allowed to touch. Pick Agent TARS when the target is a desktop app, not a tab.

The risk is the session. The README documents reusing your existing Chrome profile with saved logins, and the cloud's MCP server exposes list_browser_profiles alongside run_session, so an authenticated profile is one tool call away from any client that holds the API key. A page with hostile text in it now talks to an agent that is logged in as you. No document on the site describes an injection defence.

The consequence: run it in a throwaway profile, and give the cloud a fresh account, not your own. What it does right is stop_session: a task can be killed mid-run from the same client that started it.

Two numbers, two provenances. 1. Odysseys: 87.4% average across 200 long-horizon web tasks, first on a leaderboard the vendor maintains, with the harness in a public repository. Reproducible, but not independent. 2. Online-Mind2Web: 98% across all 300 tasks, claimed on the website. The set is public; the scaffold, model and number of attempts are not stated beside the figure.

Architecturally the agent perceives the page through the DOM rather than pixels, which keeps tokens down and depends on the page being readable as a tree. The observation: a vendor that publishes its harness has done more than most, and still has not published the conditions for its best number.

The library is the funnel; the cloud is the business, and the cloud has two meters. Browser time is $0.02 an hour, which is commodity, and the interesting line is the vendor's own model, Luna, at $0.24 per million input tokens and $1.44 per million output. Owning the model means owning the margin, which is what every wrapper on this board wishes it could say.

Founded across Zurich and San Francisco, which reads as research talent plus a sales office. Moat: the model, if it stays ahead, and residential proxies in 195 countries, which are hard to build. Likely acquirer: a cloud or a data-infrastructure company. Position: long the cloud, watch the model's lead.

The demo is a browser filling a form on its own. Procurement reads the website differently: $0.17 per solved task on the vendor's own hard set is a budgetable number, and sixty engineers running it in CI through the REST API or the TypeScript SDK is a line item, not a surprise. The problems are elsewhere. CAPTCHA solving and stealth fingerprinting are sold as features; compliance will ask whose terms of service we are automating around.

Nothing on the pricing page mentions SSO, SCIM or an audit log. Approved with conditions: internal targets only, a written scope from legal, and a spend cap per key.

MIT and Python, so I can read the whole agent loop in an evening. Ollama is a supported provider and anything else goes in as a provider-prefixed model id, which means my local box drives the browser without a cloud key. It sits on Playwright, so I can drop to raw automation when the model dithers.

The part I resent is the MCP server. It is not a local process; it is a URL at api.browser-use.com with an x-browser-use-api-key header pasted into claude_desktop_config.json or .cursor/mcp.json. Open library, closed door. I would write a local MCP wrapper in an afternoon, and I would rather not have to.