Chrome/Brave extension · Codex + Claude plugin
Your agent got blocked.
Your browser didn't.
Add one Chrome extension, install one agent plugin, and pair them once. Claude Code and Codex can then research public pages through Chrome or Brave — static first, rendered when needed.
▸ fetch_rendered_page( url="https://docs.example.dev/api/rate-limits" ) # extension fetch: static HTML was sufficient # no tab opened · rendered fallback available ✓ finalUrl https://docs.example.dev/api/rate-limits ✓ title Rate limits — Example API ✓ markdown 1,842 chars · 6 links ✓ citation [cap_3f9a] retained in-process ## Rate limits Requests are capped at 600/min per token. Bursts above the ceiling receive a 429 with a Retry-After
How it works
Fetch first. Render only when needed.
The agent plugin starts a shared local broker automatically. Static HTML avoids opening a tab; dynamic or incomplete responses fall back to short-lived rendered navigation in the paired extension.
Agent asks
Claude Code or Codex calls an MCP tool — search_web or fetch_rendered_page.
Shared broker
The installed agent plugin starts one local broker automatically. There is no background script for the user to manage.
Static first
The paired extension fetches static HTML directly with no cookie values exposed to the agent.
Render if needed
Challenges, empty shells, and JavaScript pages fall back to an inactive tab, then return clean citation blocks.
The bundled skill fails over across search providers and replacement sources, avoids repeatedly failing domains, deduplicates equivalent results, and returns Research incomplete when evidence is insufficient. Rendered fallback tabs are closed in a finally block, and deadlines and cancellation reach queued work.
Security posture
The boundary is the point.
This tool reads policy-allowed pages through the Chrome or Brave profile where you install it. It is not an anti-bot tool: challenges and access denials trigger rendered fallback or a structured failure, never a bypass.
◆ What it does
- +Fail-closed DNS checks. Private, internal, and metadata addresses are refused before navigation — and the final URL is re-resolved after redirects.
- +Mutual token auth. A high-entropy token proves both sides by challenge–response; the secret itself never crosses the wire.
- +Read-only research. There is no click, type, or submit tool. Deletion is isolated in clearly named maintenance tools; bulk clearing requires confirmation.
- +Untrusted-content labeling. Extracted pages are marked untrusted and stripped of scripts, forms, and hidden text before your agent sees them.
- +Local controls. Allowlists, denylists, limits, URL redaction, retention, and do-not-retain mode are configurable. Body-free audits stay process-local.
✕ What it will never do
- −Solve CAPTCHAs or defeat challenge pages — they return a structured error.
- −Spoof fingerprints or run any stealth/anti-detection behavior.
- −Extract cookies , storage, history, or form values into tool output.
- −Submit forms or perform any write action on a page.
- −Circumvent login , paywalls, or access controls — logged-out pages stay logged out.
The SSRF, pairing, and malicious-local-process regressions assert that the blocked things stay blocked. The extension never returns cookie values or form data, and the browser's normal site-access controls can restrict the domains it may read. The complete threat model ships with every release.
Setup
Install twice. Pair once.
The user-facing setup has no source checkout, Node command, Native Messaging host, dedicated browser download, extension-ID copy, or long-lived token paste.
Add the browser extension
Install GroundTab from the Chrome Web Store in Chrome or Brave. No Developer Mode or separate browser download.
Install it in your agent
Add the GroundTab plugin in Codex or Claude Code. The plugin launches its local MCP broker when the agent starts.
Pair once
Ask the agent to set up GroundTab, then enter its short-lived code in the extension. No extension ID, token, or terminal setup.
Questions
The things worth asking first.
Does it expose my cookies or browsing history?
No cookie values, storage, history, or form values are returned to the agent. Page requests follow the browser's normal rules, so install it only in a profile whose site access you are comfortable granting; sensitive signed-in domains are denied by default.
Is this a scraper or a bot-evasion tool?
No. It renders pages a normal Chrome tab can open and returns structured errors on CAPTCHAs, logins, and access denials instead of getting around them. There is no stealth, no fingerprint spoofing, and no “open any site” claim — only pages your profile is already authorized to view.
What happens when a source fails?
The bundled research skill retries one transient navigation failure, switches search providers or source domains, removes canonical and syndicated duplicates, and stops once independent evidence is sufficient. If material evidence is still missing, it returns “Research incomplete” instead of guessing.
Does Chrome or Brave need to be open?
Yes. The agent plugin starts GroundTab's local broker automatically, but a browser extension cannot run while its browser is fully closed. On a cold start, GroundTab briefly waits for the paired browser to wake and reconnect before telling you to open it.
Is it safe to run?
Ordinary browsing and audit export are read-only; explicit maintenance tools can delete retained captures or audits. The broker is localhost-only, pairing uses a short-lived proof, later connections authenticate by challenge–response, and DNS checks fail closed against private targets. Chrome's site-access controls remain available if you want a narrower allowlist.
Why does the extension request access to all sites?
Unattended research can't rely on Chrome's activeTab permission, which needs a click each time. You can still restrict site access in Chrome — autonomous calls outside those origins then fail closed.
How is this different from Claude in Chrome?
It works with Codex too, exposes a harness-neutral MCP surface, and keeps ordinary research deterministic and read-only, with separate explicit maintenance tools for local retention. Think of it as a complement for agent CLIs, not a replacement for an in-browser assistant.