# Tabkyra: You steer. Your agents work the tabs. > A free, open-source Chromium extension and CLI that lets Claude Code, Codex and other MCP agents use your real, signed-in browser in a tab group of their own, in the background, asking before they open a new site. By Donovan Baney (@baney75). Page: https://dbaney.com/projects/tabkyra/ - **Price:** Free - **Status:** Developer preview, extension 1.1.8 - **Runs on:** Chromium 141 or newer (Helium, Chrome, Brave and others) on macOS and Linux; Windows untested - **Built with:** TypeScript. A Chromium extension, a Node CLI and MCP server, and a native messaging host - **License:** AGPL-3.0 - **Source:** https://github.com/baney75/tabkyra - **Live:** https://dbaney.com/tabkyra/ - **Documentation:** https://dbaney.com/projects/tabkyra/docs/ (Markdown: https://dbaney.com/projects/tabkyra/docs.md) ## Why I built it A coding agent without a browser stops at the first page that wants a sign-in. A browser tool that takes over your window stops you instead. I wanted my agents to use the browser I already have open, in tabs of their own, while I keep working in mine. [0xSero](https://github.com/0xSero) had already built most of that bridge, on top of [Mario Zechner](https://github.com/badlogic)'s Sitegeist extension. Tabkyra is my take on their work: one-command setup, a doctor that tells you what's wrong, skills that teach an agent to use it well, a source library, a private mode and a new name. Tabkyra is *tab* plus *kyra*, from the Greek *kybernētēs*, helmsman. You steer. It works the tabs. ## How it works Your agent talks to `tabkyra mcp` over MCP. That process reaches a small native host the browser starts, over a Unix socket only your user account can open, and the host talks to the extension through native messaging. The extension drives tabs in the agent's own group through Chrome's debugger API, which works on hidden tabs, so your window never has to be in front. By default nothing listens on the network. Remote access for cloud agents is opt-in: `tabkyra serve` listens on this computer only, needs a token scoped to the tools you pick, and reaches other machines only through a Tailscale or Cloudflare tunnel you start. ## Safety, and its limits Your browser is signed in as you, so the defaults are careful. An agent asks before it opens a new site. Every agent is told that page text is untrusted, that it must ask you before sending, posting, buying or deleting anything, and that it never types passwords or payment details. The side panel uses your own API key or a model on your own machine, never a borrowed sign-in; the subscription sign-ins it inherited worked by posing as other companies' apps, so I took them out. Remote access is off until you create a scoped token and start `tabkyra serve`, and a remote session never answers site-permission requests; those wait for you in the side panel. Those rules are instructions to the model, not a lock. A hostile page can still try prompt injection, and the site permission limits where an agent goes, not what it does on a site you've allowed. Allow only sites you'd let an agent act on, and keep high-stakes accounts in a browser profile your agents don't use. ## Skills and the lint Skills teach an agent a job: academic research with verified citations, OSINT with a purpose check, news with more than one side heard, and more. A skill is text an agent follows with your sign-in, so a bad one is a prompt injection that never expires. Every skill passes `tabkyra skill lint`, which refuses hidden text, instruction overrides, piped remote code, secret handling and config tampering, and CI runs it on every pull request. ## A browser for your agents, inside yours - Coding agents drive the browser you already use, signed in where you are, through MCP. Claude Code, Codex, OpenCode, Cursor, OMP, pi and any MCP client work. - Each agent gets its own tab group. Its tabs open in the background, it can't see your other tabs, and its popups don't steal focus. - An agent asks before it opens a site you haven't allowed. Approve once or for good, or allow a site ahead of time from the command line. - One setup command builds the extension, registers it with every Chromium browser it finds and connects Claude Code and Codex. A doctor command prints the fix for anything wrong. - Thirteen bundled skills, from academic research and OSINT to news, search operators, Proton Pass credentials and /fix for skills that fail a smaller model. Every skill passes a lint that refuses prompt-injection patterns, and CI runs it on every pull request. - A source library saves papers by DOI, checks them for retractions, and exports BibTeX, RIS, CSL or Obsidian notes. - Private mode keeps the side panel agent to OpenRouter with zero data retention or to models on your own machines. Bug reports are opt-in and never sent for you. ## Limits It loads in developer mode today; there's no Chrome Web Store listing yet. Prompt injection is contained, not impossible. The site permission limits where an agent goes, not what it does on a site you've allowed. Tested end to end in headless Chromium; Windows is untested. ## Install ``` mkdir tabkyra-src && cd tabkyra-src git clone https://github.com/baney75/tabkyra && cd tabkyra (cd cli && npm install && npm run build && npm link) tabkyra setup ``` ## Questions and answers ### What is Tabkyra? A free, open-source Chromium extension and CLI that lets Claude Code, Codex and other MCP agents use your real, signed-in browser in a tab group of their own, in the background, asking before they open a new site. ### Is Tabkyra free? Yes. Tabkyra costs nothing, and its source code is on GitHub under the AGPL-3.0 license. ### How do I install Tabkyra? Clone the repository into a folder of its own, build the CLI and run `tabkyra setup`. It builds the extension, registers it with your browsers and connects Claude Code and Codex. The one step it can't do is in the browser: turn on Developer mode, click Load unpacked and pick the folder it shows you. Or paste the setup prompt from the Tabkyra site into your agent and let it do the rest. ### What does Tabkyra run on? A Chromium browser at version 141 or newer, like Helium, Chrome or Brave, on macOS or Linux, with Node 20 or newer and git. Windows is untested. ### Does Tabkyra collect my data? No. Tabkyra collects nothing and runs no hosted service, so nothing is sent to me, and the bridge stays on your computer unless you turn on remote access with a scoped token. What an agent reads through it, like page text and screenshots, goes to that agent's model provider, as with any tool the agent uses. ### Does Tabkyra have limits? It loads in developer mode today; there's no Chrome Web Store listing yet. Prompt injection is contained, not impossible. The site permission limits where an agent goes, not what it does on a site you've allowed. Tested end to end in headless Chromium; Windows is untested. ## Related projects - [BaneySpaces](https://dbaney.com/projects/baneyspaces/): A free Mac workspace manager. Press ⌘1–⌘9 to switch spaces instantly, add Shift to move a window, and open a Deck of terminals and coding agents. Agents get a workspace of their own so automation stays out of your way. - [Waypost](https://dbaney.com/projects/waypost/): Waypost connects AI agents to Proton Mail, Drive and Calendar through a local CLI and MCP server. Reading is the default; sending and uploading stay off until you allow them, and every write needs confirmation. - [Myelinate](https://dbaney.com/projects/myelinate/): An AI tutoring skill that teaches from your own course materials. It asks you to recall before it explains, coaches homework without doing the graded work for you, and runs as instructions for Claude Code, claude.ai or Codex. No API key or server required.