openbrowserclaw

Name: openbrowserclaw
Author: sachaa

by sachaa

Warning

Browser-native personal AI assistant. Zero infrastructure, the browser is the server.

584stars

79forks

TypeScript

Added 3/9/2026

View on GitHub Download ZIP Scan for vulnerabilities

AI Agentsai-agentsai-assistantbrowserclaudeclaw

Installation

# Add to your Claude Code skills
git clone https://github.com/sachaa/openbrowserclaw

Getting Started

Guides for using ai agents skills like openbrowserclaw.

Caveman: Cut Claude Token Use by 65%
How agent-side prompt compression works, when to use it, and when not to.
What is an AI Skills Marketplace?
Definitions, how marketplaces work, and how to choose between them in 2026.
Getting Started with AI Skills

Security ReportWarning

Last scanned: 5/12/2026

{
  "issues": [
    {
      "type": "npm-audit",
      "message": "@babel/plugin-transform-modules-systemjs: @babel/plugin-transform-modules-systemjs generates arbitrary code when compiling malicious input",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "@rollup/plugin-terser: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "brace-expansion: brace-expansion: Zero-step sequence causes process hang and memory exhaustion",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "fast-uri: fast-uri vulnerable to path traversal via percent-encoded dot segments",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "lodash: lodash vulnerable to Code Injection via `_.template` imports key names",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "minimatch: minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "picomatch: Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "postcss: PostCSS has XSS via Unescaped </style> in its CSS Stringify Output",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "rollup: Rollup 4 has Arbitrary File Write via Path Traversal",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "serialize-javascript: Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "vite: Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "workbox-build: Vulnerability found",
      "severity": "high"
    }
  ],
  "status": "WARNING",
  "scannedAt": "2026-05-12T06:40:20.244Z",
  "semgrepRan": false,
  "npmAuditRan": true,
  "pipAuditRan": true
}

README.md

Agentic AI for Beginners

Build your first AI agent from scratch - tool use, ReAct pattern, memory, deployment

41 minBeginner

Comments (0)

to leave a comment.

No comments yet. Be the first to share your thoughts!

Related Skills

ECC

by affaan-m

The agent harness performance optimization system. Skills, instincts, memory, security, and research-first development for Claude Code, Codex, Opencode, Cursor and beyond.

213,760

heym frontman

OpenBrowserClaw

Disclaimer: OpenBrowserClaw is a personal, open-source project. It is not affiliated with any cryptocurrency, meme coin, token, or social media account. If you see coins, tokens, or social media profiles claiming association with this project, they are not legitimate and are not endorsed by the author(s). Stay safe and do your own research.

Browser-native personal AI assistant. Zero infrastructure — the browser is the server.

Built as a browser-only reimagination of NanoClaw. Same philosophy, small enough to understand, built for one user, but running entirely in a browser tab.

Quick Start

cd openbrowserclaw
npm install
npm run dev

Open http://localhost:5173, paste your Anthropic API key, and start chatting.

Architecture

┌──────────────────────────────────────────────────────────┐
│  Browser Tab (PWA)                                       │
│                                                          │
│  ┌──────────┐  ┌──────────┐  ┌────────────────────────┐  │
│  │ Chat UI  │  │ Settings │  │ Task Manager           │  │
│  └────┬─────┘  └─────┬────┘  └───────┬────────────────┘  │
│       └──────────────┼───────────────┘                   │
│                      ▼                                   │
│              Orchestrator (main thread)                  │
│              ├── Message queue & routing                 │
│              ├── State machine (idle/thinking/responding)│
│              └── Task scheduler (cron)                   │
│                      │                                   │
│          ┌───────────┼───────────┐                       │
│          ▼           ▼           ▼                       │
│     IndexedDB      OPFS    Agent Worker                  │
│     (messages,   (group    (Claude API                   │
│      tasks,       files,    tool-use loop,               │
│      config)     memory)    WebVM sandbox)               │
│                                                          │
│  Channels:                                               │
│  ├── Browser Chat (built-in)                             │
│  └── Telegram Bot API (optional, pure HTTPS)             │
└──────────────────────────────────────────────────────────┘

Key Files

File	Purpose
`src/index.ts`	Entry point, bootstraps UI
`src/orchestrator.ts`	State machine, message routing, agent invocation
`src/agent-worker.ts`	Web Worker: Claude API tool-use loop
`src/tools.ts`	Tool definitions (bash, read/write files, fetch, etc.)
`src/vm.ts`	WebVM wrapper (v86 Alpine Linux in WASM)
`src/db.ts`	IndexedDB: messages, sessions, tasks, config
`src/storage.ts`	OPFS: per-group file storage
`src/router.ts`	Routes messages to correct channel
`src/channels/browser-chat.ts`	In-browser chat channel
`src/channels/telegram.ts`	Telegram Bot API channel
`src/task-scheduler.ts`	Cron expression evaluation
`src/crypto.ts`	AES-256-GCM encryption for stored credentials
`src/ui/`	Chat, settings, and task manager components

How It Works

You type a message in the browser chat (or send one via Telegram)
The orchestrator checks the trigger pattern, saves to IndexedDB, queues for processing
The agent worker (a Web Worker) sends your message + conversation history to the Anthropic API
Claude responds, possibly using tools (bash, file I/O, fetch, JavaScript)
Tool results are fed back to Claude in a loop until it produces a final text response
The response is routed back to the originating channel (browser chat or Telegram)

Tools

Tool	What it does
`bash`	Execute shell commands in a sandboxed Linux VM (Alpine in WASM)
`javascript`	Execute JS code in an isolated scope (lighter than bash)
`read_file` / `write_file` / `list_files`	Manage files in OPFS per-group workspace
`fetch_url`	HTTP requests via browser `fetch()` (subject to CORS)
`update_memory`	Persist context to CLAUDE.md (loaded on every conversation)
`create_task`	Schedule recurring tasks with cron expressions

Optional. Works entirely via HTTPS — no WebSockets or special protocols.

Create a bot with @BotFather on Telegram
Open Settings in OpenBrowserClaw, paste the bot token
Send /chatid to your bot to get the chat ID
Add the chat ID in Settings
Messages from Telegram are processed the same as browser chat

Caveat: The browser tab must be open for the bot to respond. Messages queue on Telegram's side and are processed when you reopen the tab.

WebVM (Optional)

The bash tool runs commands in a v86-emulated Alpine Linux. To enable:

Download the v86 WASM binary and Alpine rootfs image
Place them in public/assets/:
- public/assets/v86.wasm
- public/assets/v86/libv86.js
- public/assets/alpine-rootfs.ext2
The VM boots automatically on first use (~5-15 seconds)

Without these assets, the bash tool returns a helpful error. All other tools work without the VM.

Comparison with NanoClaw

	NanoClaw	OpenBrowserClaw
Runtime	Node.js process	Browser tab
Agent sandbox	Docker/Apple Container	Web Worker + WebVM
Database	SQLite (better-sqlite3)	IndexedDB
Files	Filesystem	OPFS
Primary channel	WhatsApp	In-browser chat
Other channels	Telegram, Discord	Telegram
Agent SDK	Claude Agent SDK	Raw Anthropic API
Background tasks	launchd service	setInterval (tab must be open)
Deployment	Self-hosted server	Static files (any CDN)
Dependencies	~50 npm packages	0 runtime deps

Development

npm run dev        # Vite dev server with HMR
npm run build      # Production build → dist/
npm run preview    # Preview production build
npm run typecheck  # TypeScript type checking

Deploy

npm run build
# Upload dist/ to any static host:
# GitHub Pages, Cloudflare Pages, Netlify, Vercel, S3, etc.

No server needed. It's just HTML, CSS, and JS.

Security

OpenBrowserClaw is a proof of concept. All data stays in your browser, nothing is sent to any server except the Anthropic API. Here's an honest look at the current security posture:

What it does:

API keys are encrypted at rest with AES-256-GCM using a non-extractable CryptoKey stored in IndexedDB. JavaScript cannot export the raw key material.
All storage (IndexedDB, OPFS) is same-origin scoped by the browser.
The agent runs in a Web Worker, separate from the UI thread.

What it doesn't do (yet):

The encryption protects against casual inspection (DevTools, disk forensics) but not a full XSS attack on the same origin, an attacker with script execution could call the encrypt/decrypt API.
The javascript tool runs eval() in the Worker, which has access to fetch(). This means Claude can make arbitrary HTTP requests through the JS tool regardless of any fetch_url restrictions.
Outgoing HTTP requests (via fetch_url or the JS tool) have no user confirmation step.
The Telegram bot token is currently stored in plaintext.

This is a single-user local tool, not a multi-tenant platform. Contributions to improve the security model are welcome.