libretto

Name: libretto
Author: saffron-health

Warning

The AI toolkit for building reliable browser automations

773stars

62forks

TypeScript

Installation

# Add to your Claude Code skills
git clone https://github.com/saffron-health/libretto

Getting Started

Guides for using devops skills like libretto.

Getting Started with AI Skills
First-time install walkthrough for Claude Code, Codex CLI, and ChatGPT.
What is an AI Skills Marketplace?
Definitions, how marketplaces work, and how to choose between them in 2026.

Security ReportWarning

Last scanned: 5/12/2026

{
  "issues": [
    {
      "type": "npm-audit",
      "message": "@mintlify/cli: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "@mintlify/common: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "@mintlify/link-rot: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "@mintlify/models: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "@mintlify/prebuild: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@mintlify/previewing: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "@mintlify/scraping: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "@mintlify/validation: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "axios: Axios is vulnerable to DoS attack through lack of data size check",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "body-parser: body-parser vulnerable to denial of service when url encoding is enabled",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "cookie: cookie accepts cookie name, path, and domain with out of bounds characters",
      "severity": "low"
    },
    {
      "type": "npm-audit",
      "message": "engine.io: Vulnerability found",
      "severity": "low"
    },
    {
      "type": "npm-audit",
      "message": "express: express vulnerable to XSS via response.redirect()",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "js-yaml: js-yaml has prototype pollution in merge (<<)",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "lodash: Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "mint: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "path-to-regexp: path-to-regexp outputs backtracking regular expressions",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "postcss: PostCSS has XSS via Unescaped </style> in its CSS Stringify Output",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "qs: qs's arrayLimit bypass in comma parsing allows denial of service",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "send: send vulnerable to template injection that can lead to XSS",
      "severity": "low"
    },
    {
      "type": "npm-audit",
      "message": "serve-static: serve-static vulnerable to template injection that can lead to XSS",
      "severity": "low"
    },
    {
      "type": "npm-audit",
      "message": "socket.io: Vulnerability found",
      "severity": "low"
    },
    {
      "type": "npm-audit",
      "message": "tar: Denial of service while parsing a tar file due to lack of folders count validation",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "uuid: uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "zod: Zod denial of service vulnerability",
      "severity": "medium"
    }
  ],
  "status": "WARNING",
  "scannedAt": "2026-05-12T06:38:29.615Z",
  "semgrepRan": false,
  "npmAuditRan": true,
  "pipAuditRan": true
}

README.md

Frequently Asked Questions

What is libretto?

libretto is an open-source devops skill for AI coding assistants such as Claude Code, Codex CLI, and ChatGPT, built by saffron-health. The AI toolkit for building reliable browser automations. It has 773 GitHub stars.

Is libretto safe to use?

libretto returned warnings in SkillsLLM's automated security scan. It has no critical vulnerabilities, but review the flagged issues in the Security Report section before adding it to your workflow.

How do I install libretto?

Clone the repository with "git clone https://github.com/saffron-health/libretto" and add it to your Claude Code skills directory (see the Installation section above).

What programming language is libretto written in?

libretto is primarily written in TypeScript. It is open-source under saffron-health on GitHub, so you can review or fork the full source.

Are there alternatives to libretto?

Yes. SkillsLLM lists many other DevOps skills you can browse and compare side by side. Open the DevOps category from the badge at the top of this page, or use the Related Skills and comparison links further down to weigh libretto against similar tools.

LLM Engineer for Beginners

Ship LLM features to production - prompts, RAG, structured outputs, evaluation

39 minBeginner

Comments (0)

to leave a comment.

No comments yet. Be the first to share your thoughts!

Related Skills

ECC

by affaan-m

The agent harness performance optimization system. Skills, instincts, memory, security, and research-first development for Claude Code, Codex, Opencode, Cursor and beyond.

230,427

Popular in DevOps

Top skills in this category by stars

xonsh

by xonsh

🐚 Python-powered shell. Full-featured, cross-platform and AI-friendly.

9,551

ralphex claude-conductor

Libretto

Libretto is a toolkit for building robust web integrations. It gives your coding agent a live browser and a token-efficient CLI to:

Inspect live pages with minimal context overhead
Capture network traffic to reverse-engineer site APIs
Record user actions and replay them as automation scripts
Debug broken workflows interactively against the real site

We at Saffron Health built Libretto to help us maintain our browser integrations to common healthcare software. We're open-sourcing it so other teams have an easier time doing the same thing.

https://github.com/user-attachments/assets/9b9a0ab3-5133-4b20-b3be-459943349d18

Quick Links

Website: libretto.sh
Docs: libretto.sh/docs
Repository: github.com/saffron-health/libretto
Discord: discord.gg/NYrG56hVDt

Installation

# Add Libretto to your project. Requires Node.js and npm.
npm install libretto

# First-time onboarding: install skills and download Chromium
npx libretto setup

# Check workspace readiness at any time
npx libretto status

setup creates the .libretto/ directory, installs agent skills, and downloads Chromium unless you pass --skip-browsers.

Use cases

Libretto is designed to be used as a skill through your coding agent. Here are some example prompts:

One-shot script generation

Use the Libretto skill. Go on LinkedIn and scrape the first 10 posts for content, who posted it, the number of reactions, the first 25 comments, and the first 25 reposts.

Your coding agent will open a window for you to log into LinkedIn, and then automatically start exploring.

Interactive script building

I'm gonna show you a workflow in the eclinicalworks EHR to get a patient's primary insurance ID. Use libretto skill to turn it into a playwright script that takes patient name and dob as input to get back the insurance ID. URL is ...

Libretto can read your actions you perform in the browser, so you can perform a workflow, then ask it to use your actions to rebuild the workflow.

Convert browser automation to network requests

We have a browser script at ./integration.ts that automates going to Hacker News and getting the first 10 posts. Convert it to direct network scripts instead. Use the Libretto skill.

Libretto can read network requests from the browser, which it can use to reverse engineer the API and create a script that directly calls those requests. Directly making API calls is faster, and more reliable, than UI automation. You can also ask Libretto to conduct a security analysis which analyzes the requests for common security cookies, so you can understand whether a network request approach will be safe.

Fix broken integrations

We have a browser script at ./integration.ts that is supposed to go to Availity and perform an eligibility check for a patient. But I'm getting a broken selector error when I run it. Fix it. Use the Libretto skill.

Agents can use Libretto to reproduce the failure, pause the workflow at any point, inspect the live page, and fix issues, all autonomously.

CLI usage

You can also use Libretto directly from the command line. All commands accept --session <name> to target a specific session.

npx libretto open <url>                    # launch browser and open a URL
npx libretto run ./integration.ts --headless # run a workflow and close on success
npx libretto run ./integration.ts --headless --stay-open-on-success # keep a successful run inspectable
npx libretto snapshot --session <name>     # capture a screenshot and compact accessibility tree
npx libretto exec "<code>"                 # execute Playwright TypeScript against the open page
npx libretto close                         # close the browser

run sessions are inspectable through the same daemon-backed commands as open sessions. Successful runs close the browser by default; pass --stay-open-on-success to keep the browser open for pages, snapshot, and exec. Failed or paused workflows keep the browser open so you can inspect the exact page state before fixing or resuming the workflow.

Run npx libretto help for the full list of commands.

Configuration

All Libretto state lives in a .libretto/ directory at your project root. See the configuration docs for details on config files, sessions, and profiles.

Telemetry

Libretto records CLI telemetry to help understand CLI usage and help us prioritize improvements. Each resolved command can send only an install id, timestamp, command event name such as libretto run, error boolean, package version, build channel (node_modules, source, or unknown), and, when signed into Libretto Cloud, the configured cloud user id. Libretto does not send command arguments, URLs, project paths, session cookies, API keys, error messages or details, or emails.

The install id is stored in the telemetry file at ~/.libretto/telemetry.json. The implementation lives in packages/libretto/src/cli/core/telemetry.ts.

To disable telemetry, set LIBRETTO_TELEMETRY_DISABLED=1, set DO_NOT_TRACK=1, run with CI=1, or edit ~/.libretto/telemetry.json and set "enabled": false.

Join the Community

Join our Discord to connect with other developers, get help, and share what you've built:

For longer-form threads, head to GitHub Discussions. Found a bug? Open an issue.

License

MIT License — use it freely in commercial and open-source projects.

Development

For local development in this repository:

pnpm i
pnpm build
pnpm type-check
pnpm test

Source layout:

packages/libretto/src/cli/ — CLI commands
packages/libretto/src/runtime/ — browser runtime (network, recovery, downloads)
packages/libretto/src/shared/ — shared utilities (config, LLM client, logging, state)
packages/libretto/test/ — test files (*.spec.ts)
packages/libretto/README.template.md — source of truth for the repo and package READMEs
packages/libretto/skills/libretto/ — source of truth for the Libretto skill

Run pnpm sync:mirrors after editing packages/libretto/README.template.md or anything under packages/libretto/skills/libretto/.

To check that generated READMEs, skill mirrors, and skill version metadata are in sync without fixing them, run pnpm check:mirrors. To release, run pnpm prepare-release.

[!NOTE] This is an early-stage project under active development. APIs may change before version 1.0. We recommend pinning to specific versions in production.

Built by the team at Saffron Health.