Jet Browser is a portable WPE WebKit runtime for AI agents, packaging a WPE WebKit and Rust WebDriver bridge as a standalone runtime. One container runs one isolated browser session; the control side (harness) sends ordered JSONL commands and receives machine-readable results. It requires no account, API key, model, database, or hosted control plane, making it suitable for any model, agent loop, CI task, or deterministic test runner.
[Purpose] Jet Browser is positioned as a runtime execution layer that needs a clear, inspectable browser boundary. When isolation matters, each container uses a disposable browser session with a clear lifecycle and resource limits; when evidence needs to be consistent, native input, DOM state, and new screenshots come from the same runtime rather than a separate replay path; when the control side should remain replaceable, ordered JSONL can work with any model, agent loop, CI task, or deterministic test runner; when a non-Chromium runtime is needed, WPE WebKit provides a second engine without introducing yet another browser agent framework. It does not attach to a daily-use Chrome, nor does it include models or agents. If a browser matrix, extension ecosystem, or a logged-in Chrome profile is needed, Playwright, CDP, or an existing browser stack should continue to be used.
[Main capabilities] Supports native input, DOM and text reading, new screenshots, and ordered JSONL, MCP, and JavaScript SDK interfaces. Each input line is one JSON command, and each output line is one JSON response. Provides versioned tool declarations (sdk/tools.mjs) and a framework-agnostic binding pattern. Python applications can supervise the same container and ordered JSONL boundary without third-party packages. Includes reproducible runtime benchmarks: Jet Browser reaches a verified page in 1,445.25 milliseconds, with 189.6 MiB active memory, ready time 72.7% lower than the next result, and memory 33.2% lower. Provides a stability run command npm run stability. The default 10-second scenario creates three isolated pages across two switch cycles, verifies native input, JavaScript state, semantic DOM, and a new PNG for each page, samples memory and runtime process health, and writes a machine-readable report.
[Usage] Only Dock is requireder runs verified smoke tests without cloning, Node.js, an account, an API key, or outbound browser network. The reviewable script downloads a release-locked seccomp policy, verifies its SHA-256, selects native linux/amd64 or linux/arm64 from an immutable multi-platform image, and tests browser launch, native input, DOM state, and PNG capture; it starts a one-off, resource-constrained, network-disabled container, mounting neither the Docker socket nor host directories. Full source checkout and SDK paths require Docker and Node.js 24+. Provides a VS Code MCP install link (with review prompt), one-click Cursor install, and Jet Browser skills for Codex and Claude Code; the repository-local skill is located at .agents/skills/jet-browser/SKILL.md. The Hermes plugin registers a bounded verification tool that runs an immutable public image, disables browser network, and returns launch, native input, DOM, and PNG evidence; it is a runtime verifier rather than a CDP browser provider. The MCP verifier is published as io.github.masakaai/jet-browser in the official MCP Registry, exposing the same bounded proof via a local stdio server and a versioned OCI package, declaring an immutable runtime contract, running acceptance with network disabled, and accepting no URLs, profiles, credentials, or arbitrary commands. The Docker socket grants host-level control and should only be installed for trusted local MCP clients.
[Deployment and Boundaries] The published multi-platform manifest provides native linux/amd64 and linux/arm64 images and per-platform provenance, and production should pin the manifest digest. The smoke test disables outbound network, launches a real browser, opens a local page, types through the native input path, verifies the DOM, captures a PNG, and closes the session. The GitHub Marketplace Action runs the same acceptance without a repository or account key, selects the runner's native release image, prepares the WPE sandbox on GitHub-hosted Linux runners, launches a real browser with outbound network disabled, verifies native input and DOM state, captures a PNG, and cleans up the container; self-hosted runners must already allow unprivileged user namespaces. Distributed preview, human takeover, persistence, and scheduling are optional components around the same runtime and are not required for standalone use. Each mutually untrusted session should use a dedicated container; in your own integration, treat evaluate, importing configuration files, downloads, and outbound network access as privileged capabilities. Only start the smoke-only loopback page when JET_BROWSER_SMOKE=1. The included seccomp profile allows the user and mount namespace operations required by WPE WebKit's own bubblewrap sandbox; on AppArmor hosts, the outer container profile is disabled because it would block the inner sandbox, but the process still gains no SYS_ADMIN capability, has no effective capabilities after startup, and is not privileged mode.
[Development and Licensing] You can build only the standalone runtime, or build the optional distributed worker. Repository structure: rust/ contains the native WebDriver bridge and browser helpers; src/ contains the optional distributed worker, preview, input, state, and security boundaries; sdk/ contains client transport and agent tool declarations; scripts/standalone-smoke.mjs is the offline end-to-end verification; test/ contains Node regression tests (Rust tests are located alongside their respective modules); docs/ contains protocol, architecture, and integration documentation. Jet Browser is browser infrastructure, not an LLM or agent framework; the core exposes a JSONL action protocol rather than pretending WPE implements Chromium-only extensions, policies, or CDP contracts. Licensed under the Apache License 2.0.
