Agent-First Browser Engine

The Browser
Agents
Own.Claude Code runs your terminal. Kitsune runs your web.

For the first time, AI agents have complete, real control of a browser — not a limited API, not screen scraping. DOM, forms, sessions, cookies. Everything. Built in Rust. Secured by the compiler.

kitsune-agent — full context
▸ agent run "book cheapest flight to Berlin next week" // Opening 3 booking engines in parallel... ↳ Loaded: skyscanner, kayak, google/flights ↳ Parsed 47 results — comparing fares ↳ Cheapest: Tue Mar 12 — €194 — Kayak   ⚑ CONFIRM before checkout? Seat 14C · €194.00 · easyJet EZY1234 yes ✓ Booking confirmed — receipt in vault   ▸ agent run "fill all 8 job apps in my pipeline" ↳ Filling via vault — no plaintext exposed ✓ 8/8 submitted
Live agent session — sandboxed per-tab
Live Agent Demo

Watch It Work

Real tasks. Real DOM. The agent navigates, reads, decides, types — and pauses only when something irreversible needs your approval.

Skyscanner
Kayak
G.Flights
🔒 https://www.skyscanner.com/
⚑ Approval Required
Confirm Purchase
Agent is about to complete a payment
FlightEZY 1234 — LHR→BER
DateTue 12 Mar
Seat14C (window)
Total€194.00
Skyscanner
Flights
Hotels
Car hire
Help
Log in
The whole trip. All in one search.
Return
One-way
Multi-city
1 adult · Economy
From
LHR
To
BER, SXF, TXL
Depart
Add date
🔍 Senior Frontend Engineer
Jobs
Messaging
AC
Senior Frontend Engineer
Acme Corp
London, UK (Remote) · 2 days ago · 🟢 Actively hiring
$140k–$180k Remote Easy Apply
Easy Apply Contact info 1 / 3
First and last name *
Email address *
Phone number *
City, State *
Use CV: Alex_Morgan_CV_2025.pdf (from vault)
Y
Hacker News
new past comments ask show jobs
login
1.
Ask HN: How are people using agents in production? (github.com)
847 points by pg 3 hours ago | 312 comments
2.
Rust is now the 3rd most used language at Google (blog.google)
1,204 points by dang 5 hours ago | 489 comments
3.
Show HN: I built a browser agent framework in Rust (github.com)
672 points by kitsunedev 6 hours ago | 201 comments
4.
OpenAI releases new reasoning model (openai.com)
538 points by sama 7 hours ago | 194 comments
5.
Why I switched from Python to Rust for data pipelines (matklad.github.io)
421 points by matklad 9 hours ago | 87 comments
Agent Log
The Real Shift

Not Just Privacy.
Agent
Sovereignty.

Claude Code changed how developers work — because agents got real terminal access. Kitsune does this for the browser. Agents don't just see a webpage — they navigate, click, submit, authenticate, and act. Privacy is the architecture that makes full control safe to hand over.

Tool
Domain
Agent Access
Claude Code
Terminal / FS
Complete
Cursor
Code editor
Complete
Chromium + ext.
Browser
Restricted API
browser-use lib
Browser
Screenshot+CDP
KitsuneEngine
Browser
Complete ✦
✦ Native DOM, full session context, vault integration, reversible log. Not screen-scraping. Not CDP hacks.
What Agents
Actually Control
Every capability is first-class, not bolted-on. Agents run natively in the engine.
01
Full DOM Read & Write

Agents read live DOM, not screenshots. They understand page structure, state, dynamic elements, and SPA transitions — then modify or trigger any of it.

Native access
02
Session & Cookie Control

Agents operate inside real authenticated sessions. Log in once, delegate. Credentials never exposed in plaintext.

Vault-encrypted
03
Multi-Tab Orchestration

Agents open, manage, and coordinate across multiple tabs simultaneously — like a developer with 12 windows, but never confused.

Parallel execution
04
Form Filling via Vault

Argon2+Age encrypted local vault. Agents fill forms without raw secrets ever appearing in memory or logs.

Zero-exposure
05
Human-in-the-Loop Gates

Money, accounts, emails — blocked until you explicitly approve. The gate shows exactly what will happen and cannot be dismissed by accident.

Irreversible actions
06
Reversible Action Log

Every agent action is logged with undo semantics where possible. Like git for browser actions — see what happened, roll back what can be rolled back.

Full audit trail
07
No-Code Agent Builder

Describe what you want in plain English. The builder converts intent into a repeatable, shareable agent — no scripting, no selectors, no boilerplate.

Natural language
08
Agent Marketplace

Publish, install, and audit community agents — all OSS. Monitor prices, file taxes, track job postings. Inspect the code before you run it.

Open source
09
Process-Level Sandboxing

Each tab is an isolated process. A compromised agent on one tab cannot touch another. Enforced by Rust's ownership model at compile time.

Rust-native isolation
3,241+
Waitlist signups
▲ 847 this week
618
Developer tier
▲ 204 this week
941
GitHub stars
▲ 312 this week
0$
Ad spend
100% organic
Ecosystem & Workflow

The Browser
As The Hub.

Kitsune agents plug into your entire stack — OpenClaw, Claude, GPT-4o, local LLMs, Zapier, n8n, custom APIs — and the browser becomes the execution layer that ties everything together.

Your AI tools have always needed a web interface to act on. Now they have one without limits.

100×
Workflow multiplier
When your AI models can navigate, fill, submit, and orchestrate the web — every workflow that touched a browser becomes autonomous. Not faster. Fully delegated.
🦀
OpenClaw
Agent Framework

OpenClaw agents get a real browser runtime. Full web access — navigate, extract, act — no Playwright wrappers needed.

Integration live
🤖
Claude / Anthropic API
LLM Backend

Drop Kitsune in as the computer-use layer for Claude agents. The model reasons; Kitsune executes — every DOM interaction handled natively.

Integration live
n8n / Zapier
Workflow Automation

Trigger Kitsune agents from any n8n or Zapier workflow. A webhook fires, an agent logs in and does the work.

Q3 2025
🧠
Local LLMs
Ollama / LM Studio

Fully air-gapped operation. Point Kitsune at Ollama or LM Studio — reasoning and browser control both run on-device.

Q3 2025
🔗
MCP Protocol
Model Context Protocol

Expose Kitsune's browser capabilities as MCP tools. Any MCP-compatible agent gets full web access via standard protocol.

Q3 2025
🐍
Python SDK
Developer Integration

Control the full browser runtime from Python. Spin up agents, inspect DOM state, manage sessions from a script or notebook.

Q4 2025
🌊
LangChain / LangGraph
Agent Orchestration

Use Kitsune as a LangChain tool or LangGraph node. Chain browser actions with memory, branching, and rollback built in.

Planned
🔌
Custom REST API
Any Integration

Expose Kitsune via REST to any tool, any stack. If you can send an HTTP request, you can spin up an agent.

Planned
Example: Research → Draft → Publish — fully autonomous
🦀
OpenClaw
Defines intent
🤖
Claude
Reasons & plans
🦊
Kitsune Agent
Executes on web
n8n
Routes output
📄
CMS / API
Published
Human gate ⚑
Architecture

Built in Rust.
Security by
Compiler.

Every major browser is written in C++. That means use-after-free, buffer overflows, and data races are not edge cases — they're a category of bug that exists by default.

Kitsune is written entirely in Rust. The compiler eliminates that entire vulnerability class before a single line ships. No GC pauses. No null pointer panics. No race conditions. Guaranteed by the type system — not by policy, not by audit.

Process isolation — per-tab sandboxRust
// Each tab = isolated process. // Cross-tab memory access is a // compile-time error, not a runtime check.   pub struct TabProcess { handle: ProcessHandle, vault_ref: Arc<Mutex<Vault>>, agent_scope: Isolated<AgentRuntime>, }   impl TabProcess { pub fn fill_form(&self, field: &DomNode) { // vault returns opaque token, never &str let token = self.vault_ref .lock().unwrap() .get_token(field.hint); field.inject_opaque(token); // no &str exposed } }
L1
Rust Core Engine
HTML5 parser, CSS cascade, layout engine, TLS 1.3. Zero unsafe blocks in the critical path. The compiler owns correctness.
Written in Rust
L2
Process Sandbox
Each tab is a separate OS process. Kitsune's ownership model makes cross-tab memory access a compile-time error, not a runtime check.
Memory safe
L3
Zero-Exposure Vault
Argon2 key derivation + Age encryption. Credentials stored as opaque tokens — agents receive handles, never plaintext strings.
Zero plaintext
L4
Agent Runtime
Native DOM access via Rust bindings — no CDP, no screenshot parsing. HIL gates enforced at the type boundary, not by convention.
Native bindings
L5
Anti-Fingerprint Layer
Canvas, WebGL, AudioContext, font metrics, navigator — all normalised per-session. Tracking surfaces patched at engine level, not via extension.
Engine-level
🦀
No Memory Vulnerabilities

Use-after-free, buffer overflows, null pointer dereferences — Rust's borrow checker makes this entire bug class impossible to compile.

Proven by compiler, not audit
🧵
No Data Races

Concurrent agent execution with zero risk of data races. Rust's ownership model makes it impossible to share mutable state unsafely.

Guaranteed at compile time
No GC Pauses

No garbage collector means no stop-the-world pauses. Agents run at predictable latency — critical when orchestrating multi-tab workflows.

Zero-cost abstractions
🔍
Fully Auditable

Apache 2.0. Every line of the engine, vault, agent runtime, and HIL system is open source. The security guarantees are math, and the math is public.

Apache 2.0 — fork & audit
Claim Your Spot

Get in
Before
Launch.

First cohort shapes the product. Direct access to the team, early agent runtime builds, and lifetime OSS tier access — no subscription ever.

Early builds before public beta
Direct feature input to the roadmap
Agent Marketplace early publisher slot
Lifetime open-source tier — free, forever
Private Discord with the engineering team
3,241 people have already reserved a spot
Developer Tier — Free
Build With the Engine

Full agent runtime, open source core, early API access. Build your own agents, publish to the marketplace, audit everything.

Full agent runtime — native DOM access
Marketplace early publisher slot
API access pre-beta
Apache 2.0 — fork, audit, extend
Enterprise vault sync
Priority HIL routing
🦊
You're In
Watch your inbox. We'll reach out when the first developer build goes live. That's a promise.
No spam. No data sold. Ever.
Power User Tier — Free
Delegate Your Browser

Install community agents, run your own, use the no-code builder. The browser you want when AI agents are your co-pilot.

No-code agent builder
Agent marketplace install access
Privacy vault — local, encrypted
Ghost sessions + anti-fingerprinting
Semantic tab memory
Custom agent runtime config
🦊
You're In
Watch your inbox. No spam, ever.
No spam. No data sold. Ever.
Enterprise Tier — Paid (Q4 2025)
Fleet-Grade Agent Control

Deploy Kitsune across your team with enterprise vault sync, custom agent signing, audit logs, and dedicated support.

Everything in Developer + Power User
Enterprise vault sync — E2E encrypted
Custom agent signing & policy enforcement
Compliance-ready audit logs
Dedicated Slack + SLA
On-prem deployment option
🦊
Request Received
We'll reach out within 48 hours. No pitch decks. Just engineers talking.
Early partners shape the pricing model.
Signal for Investors
The browser is the largest unsolved surface for AI agents. Nobody has given agents real control of it. We're changing that — and making Kitsune the execution layer every AI stack plugs into.
$0
Marketing spend
Every signup is organic — dev forums, social, word of mouth.
3,241
Waitlist in 3 weeks
847 signups last week. No press coverage yet.
68%
Developer tier signups
Unusually high. Signals platform potential beyond consumer use.
Apache 2.0
Open source core
Enterprise tier sits on top. Moat is agent runtime, vault, marketplace.