Let agents test like professional hackers. Keep every action contained and auditable.

# Browse, scrape, and automate.
h5i browser open https://example.com
h5i browser snapshot                                      # the page as a model should read it
h5i browser click @e3
h5i browser requests                                      # what it asked for, and what was refused
h5i browser audit                                         # the whole session: verbs, fetches, handovers, ending
h5i browser close

# Inspect and test the traffic generated by the browser.
h5i websec requests                                       # captured HTTP messages
h5i websec show req_42 --raw                              # inspect one request
h5i websec replay req_42 --set query.id=456               # edit and resend it
h5i websec diff res_42 res_43                             # compare the responses
h5i websec match res_43 --status 200 --contains "ok"      # assert a condition

# Find out what is there before testing it.
h5i recon extract                                         # endpoints the pages and bundles disclosed
h5i recon known                                           # robots.txt, sitemap.xml, security.txt
h5i recon crawl --max-requests 200                        # walk it, logged in, bounded
h5i recon triage --calibrate                              # fold the noise, confirm what is real
h5i recon endpoints --state confirmed                     # the inventory, with the message id for each

---

1. Install

curl -fsSL https://h5i.dev/install.sh | sh
# curl -fsSL https://raw.githubusercontent.com/h5i-dev/h5i/main/install.sh | sh  # if you would rather not add a domain to the chain:
# cargo install --path .                                                         # build from source

The agent-facing interface is a skill, and the binary carries it:

npx skills add h5i-dev/h5i         # if you do not have the binary yet
# h5i skill install                # writes it where your runtime looks
# h5i skill show policy            # or just read a page

The optional websec, recon and test plugins ship as their own archives. The installer can fetch and register them in the same pass:

curl -fsSL https://h5i.dev/install.sh | sh -s -- --websec --recon --test
# h5i plugin list                  # says what is installed

---

2. Use it

2.1. Browse, scrape, and automate

A session combines one page state, cookie jar, network policy, and request record. Agents can read pages, interact with elements, and extract structured data through one CLI:

h5i browser open https://docs.rs/ --allow docs.rs
h5i browser snapshot                        # page outline with @ref handles
h5i browser snapshot --delta                # only what changed
h5i browser click @e3
h5i browser type @e5 "serde"
h5i browser extract '{"titles": ["h2"]}'    # structured extraction
h5i browser markdown                        # readable page content
h5i browser close

h5i browser read https://docs.rs/           # for a single page without a persistent session

2.2. Test web applications

Because h5i owns the browser’s network layer, agents can capture, inspect, edit, replay, and compare HTTP traffic without a MITM proxy, CA certificate, or separate repeater.

Use these capabilities only on systems you own or are authorized to test:

h5i browser open https://target.example --capture --allow target.example

h5i websec requests                                  # list messages and IDs
h5i websec show req_42 --raw                         # inspect a request
h5i websec replay req_42 --set query.id=456          # edit and resend it
h5i websec diff res_42 res_43                        # compare responses
h5i websec match res_43 --status 200 --contains "ok" # assert a condition
h5i websec sequence flow.json                        # run a multi-step test

# Discovery, kept apart from testing: recon says what exists and how it knows.
h5i recon extract                                    # read what the session already fetched
h5i recon crawl --max-requests 200 --rate 4          # walk it under this session's login
h5i recon triage --calibrate                         # soft 404s folded, the rest confirmed
h5i recon endpoints --state confirmed --json         # each row names the message that proves it

2.3. CI/CD integration

Confirmed attack flows can be kept in a repository and replayed in CI. Templates and examples of GitHub Actions are available at examples/security-regression-ci.

- uses: h5i-dev/h5i@v1
  with:
    target: http://localhost:3000
    tests: .h5i-tests/tests
    openapi: openapi.yaml
    # min-coverage is optional; omitting it keeps coverage informational.

2.4. Control and audit agent access

Web content is untrusted input to an AI agent. h5i reduces the risks of giving agents web access by applying a network policy and recording both allowed and denied requests:

h5i browser requests    # allowed and denied network requests
h5i browser audit       # actions, fetches, handovers, and session ending
h5i browser status      # isolation, policy digest, and network placement

For sensitive interactions, a human can take control without returning credentials to the agent:

h5i browser login

For stronger isolation, define network and filesystem limits in .h5i/env.toml:

[profile.reading]
isolation = "supervised"          # workspace | process | supervised | container | microvm

[profile.reading.net]
mode = "host"
egress = ["docs.rs", "static.crates.io"]

[profile.reading.fs]
read = ["/usr", "/etc"]
write = []

Then place the browser inside that environment:

h5i box --profile reading --name docs
h5i browser open https://docs.rs/ --in docs

2.5. Contain the entire agent workflow

A sandbox can contain more than the browser. It can also hold the workspace, toolchain, development server, and agent itself. This is useful when an agent is building and testing an application in the same environment.

h5i box create alpha --profile agent-claude   # sandboxed git worktree
h5i box shell alpha                           # interactive confined session
h5i box run alpha -- cargo test               # run a command inside it
h5i box propose alpha                         # create a reviewable snapshot
h5i box apply alpha                           # merge approved changes
h5i box export alpha                          # export the patch and receipts
h5i box rm alpha                              # discard the environment

Share a running service or watch the workflow from the host:

h5i box share alpha --port 3000
h5i box share alpha --port 3000 

readme truncated — read the full docs on github