Browser for AI agents

A browser for your AI agents.

Lilo has a built-in MCP server. Claude Code, Codex, Cursor or any MCP client open tabs, click, type, and read pages, the console and the network, in a real browser beside you, in their own Space. There is no AI inside Lilo: bring the agent you already use.

Connect an agent
Download for MacmacOS 26+GitHub
What agents can do

A real browser, not a headless one.

Agents drive the same WebKit tabs you use, so you can watch them work and take over at any moment.

Browse. Open, navigate and close tabs in their own folder; click, type, fill forms and take screenshots.
Read. The page as an accessibility tree with element references, its text, the console and the network requests.
Debug. Devtools commands, network mocking and emulation, for testing the site you are building on localhost.
Fetch. Send an HTTP request from a tab, as the page would, with its origin, CORS rules and cookies. Cookies and authorization headers are never returned to the agent.
Run. One JavaScript program that calls the other tools in a loop, in a single call, instead of dozens of round trips.
Borrow a profile. Agents start signed in nowhere. When a task needs one of your accounts, they can borrow a profile after you allow it.
You stay in charge

Lilo asks before it matters.

Agents never take your keyboard, your mouse or your tabs, and the important clicks wait for you.

Their own Space

Agents work in the Agents Space, in a throwaway profile wiped after each session. They never see or act on a private Space.

Sends, pays, deletes

Before an agent clicks something that sends, pays, buys, deletes, publishes or signs up, Lilo asks: Allow Once, Always Allow on the site, or Deny.

Approved once, by program

The first time a client connects, you allow it. The approval is tied to the program behind the connection, not to the name it announces.

Your files and cookies

Lilo always asks before an agent hands a page one of your files, and before a request other than GET or HEAD goes out with the cookies of one of your profiles.

Connecting

One switch, one click.

Agents connect to Lilo over a local socket on your Mac. Read the agent docs.

1

Turn it on

Settings, AI agents, "Let AI agents use Lilo". It is off until you do.

2

Connect your client

Connect adds Lilo to Claude Code, Claude Desktop, Codex or Cursor. Any other MCP client copies the configuration.

3

Ask your agent

Its tabs appear in the Agents Space as it works, and Lilo asks you when a click matters.

Questions

About agents.

Does Lilo have AI built in?

No. Lilo ships no model and no assistant. It gives the agents you already run a browser to work in, through its MCP server.

Which agents work with Lilo?

Claude Code, Claude Desktop, Codex and Cursor connect in one click. Any other MCP client works with the configuration Lilo copies for you.

Can agents see my tabs and accounts?

Not by default. They work in the Agents Space, in a profile wiped after each session and signed in nowhere. They can borrow one of your profiles for a task after you allow it, and never see a private Space.

Is the approval prompt a sandbox?

No. It is a safety net for well-behaved agents. Code an agent runs itself, through JavaScript or devtools commands, is not covered by it, so connect only agents you trust.

Does anything go through a server?

Lilo runs no server and sends nothing to us. Agents talk to it over a local socket. What an agent reads goes to the model provider that agent uses, as with any other tool it runs.

Is it free?

Yes. Lilo, its MCP server included, is free and open source under the MIT license.

Give your agent a browser.

Turn on AI agents in Settings, connect your client, and watch it work beside you.

Download for MacmacOS 26+GitHub