What is easi.run?
easi.run runs isolated Google Chrome sessions on your own Linux server and hands them to AI agents through a built-in MCP server or a REST API. A person watches each session live in the browser and takes control with one click for a login, a 2FA code or a CAPTCHA; the agent waits, then carries on. Persistent sessions keep logins between runs, encrypted under a key derived from the admin password, and sessions can record replays, pass files and downloads, and play audio. It brings no model of its own: the agent is whatever MCP client you connect.
It is AGPL-3.0-only, written mostly in Rust, and young: the repository was created on 22 October 2026, had 59 stars and no tagged releases when checked, and ships as container images on GitHub's registry built from each commit. It needs a Linux x86-64 host with systemd and rootful Docker Engine 28 or newer.
How to install easi.run
curl -fsSLO https://easi.run/install.sh && bash install.shIs easi.run worth it?
easi.run solves the problem that stops most browser agents: the login. Hosted services such as Browserbase rent a browser by the hour; easi.run puts Google Chrome in its own containers on your server, streams it to you through a Rust compositor, and lets a person take over when a page needs a password, a 2FA prompt or a CAPTCHA. The agent can ask for that itself with request_person, which marks the session as needing you and can post a signed webhook to Slack or Discord, then block on wait_for_control until you hand back.
The security model is documented boundary by boundary, with the test that proves each one. The admin listens on HTTPS at 127.0.0.1:9443 and is meant to be reached over an SSH tunnel, Tailscale or Cloudflare Access; the password must be 12 characters or more, is stored as an Argon2id hash, and can be backed by an authenticator app or a passkey. Each browser gets no network of its own, no route into the private network and HTTPS-only egress. Once a person takes over, screenshots to the agent stop and anything typed of four characters or more reaches it as [redacted]; password fields never reach it. One exposure is easy to miss: when the installer can see the server's IPv4 address, it binds the UDP media port 9443 on every address, though that port admits only a signed-in viewer's live ticket.
Saved profiles are the asset to think about. Each is sealed with XChaCha20-Poly1305 under its own key, wrapped by a key derived from the admin password, so a stolen disk does not open them. That key stays in the admin process's memory from your login until the admin stops, and logging out does not clear it, by design, so agents can resume saved sessions while you are away. Any agent token you allow on a saved session then acts on those sites as you. Tokens reach only their own sessions and the profiles you grant, are stored as SHA-256 hashes and can be revoked at once, but the local MCP path has no token at all: anyone who can run docker exec on the server has an agent's rights. The optional CDP port on 9222 lets anything on the server attach and read everything the browser holds.
The agent surface is lean: start_session, list_sessions, session_status, stop_session and list_saved_sessions, the Cua Driver's desktop tools for clicking, typing and scrolling, inspect_page for reading the DOM by CSS selector, and tools for files and calling a person. Downloads and uploads ask you first by default, and call_id keeps a retried submit or payment from running twice. Every page the agent reads is untrusted input, as with any browser agent. The benchmark against KasmVNC (55 fps against 24 when scrolling) is the project's own; with no releases yet and three weeks of history, the bigger unknown is how updates behave on a server you depend on.
Where it earns its place
An operations engineer automating a supplier portal with no API
Download monthly invoices from a site that needs 2FA every few weeks
Save a persistent session after logging in once and allow the agent's token on it. When the portal asks for a code, the agent calls request_person, a webhook pings Slack, and the engineer types it in the watch_url window. Cost is the server, from a 4 GB VPS.
A two-person agency running browser agents for clients
Replace per-hour hosted browser bills with one server
Run sessions on a 16 GB Linux box, which the README sizes at four concurrent browsers, with one token per client agent and recordings for review. No usage fees; the AGPL applies if they offer a modified version over a network.
A QA engineer with existing Playwright scripts
Debug a flaky checkout flow in a real, watchable Chrome
Start a session with CDP on, attach with connectOverCDP to 127.0.0.1:9222 through an SSH tunnel, and watch or take over live. Anything on the server can attach to that port, so turn it on only for scripted sessions.
Before you commit
- Setup
- curl -fsSLO https://easi.run/install.sh && bash install.sh as a docker-group user; it pulls about 550 MB of signed images, adds Chrome from Google's repository and takes one to two minutes on 2 cores. It sets an iptables rule and TCP settings through a short-lived privileged container, then registers itself in Claude Code and Codex if present.
- Integrations
- MCP over stdio (docker exec, or SSH from another machine) and Streamable HTTP at /mcp with a bearer token; the same tools over REST under /api/agent/. Playwright, Puppeteer and Selenium can attach over CDP. Signed webhooks for person.needed, approval.needed and unlock.needed.
- Data and privacy
- Everything stays on your server; models are external, so page content and screenshots go to your agent's model provider. Saved profiles and replays are encrypted at rest. Admin HTTPS is on loopback only; the UDP media port may be public. A token-holding agent can act as you on allowed saved sessions, and every page it reads is a prompt-injection source.
- Cost at scale
- No licence fee. Each session takes 2 CPUs and 2 GiB or more for Chrome plus 1152 MiB for its helpers; the README sizes 8 GB for two concurrent sessions and 16 GB for four, up to 16 per install.
- Limits
- Linux x86-64 with rootful Docker 28+ and systemd only. Eight tabs per session by default; one agent call at a time per session. run_javascript needs Developer tools, which token-started sessions never get. Up to 32 agent tokens.
What’s good
- Live takeover for logins, 2FA and CAPTCHAs
- Saved profiles encrypted under the admin password
- Typing redacted from the agent after takeover
- Browsers cut off from the private network
What’s not
- Unlock key stays in memory after logout
- Local MCP path has no token; docker exec is enough
- Installer binds the UDP media port publicly when it can
- No releases yet; three weeks of history
Best for
Engineers who want agents to work in logged-in browser sessions on hardware they control, and who will run the admin behind an SSH tunnel or an identity-aware proxy.
easi.run alternatives
easi.run: common questions
- Is easi.run worth it?
- An unusually well-documented self-hosted browser for agents, whose real risk is the one it sells: a logged-in Chrome that an agent can drive as you. We rate it 3.8 out of 5.
- How much does easi.run cost?
- Free and open source (AGPL-3.0-only); you pay only for the server, from 2 cores and 4 GB of memory for one session.
- What are the downsides of easi.run?
- Unlock key stays in memory after logout; local MCP path has no token; docker exec is enough; installer binds the UDP media port publicly when it can; no releases yet; three weeks of history.
- Who is easi.run best for?
- Engineers who want agents to work in logged-in browser sessions on hardware they control, and who will run the admin behind an SSH tunnel or an identity-aware proxy.
- How much does easi.run cost for a team or in production?
- No licence fee. Each session takes 2 CPUs and 2 GiB or more for Chrome plus 1152 MiB for its helpers; the README sizes 8 GB for two concurrent sessions and 16 GB for four, up to 16 per install.
- Is easi.run safe for company data?
- Everything stays on your server; models are external, so page content and screenshots go to your agent's model provider. Saved profiles and replays are encrypted at rest. Admin HTTPS is on loopback only; the UDP media port may be public. A token-holding agent can act as you on allowed saved sessions, and every page it reads is a prompt-injection source.
- What are the best easi.run alternatives?
- The closest alternatives we have reviewed are Browserbase MCP, Playwright MCP and Chrome DevTools MCP.
Answers checked Nov 11, 2026.