Open Source Radar — September 18: agents borrow your browser
Today's board keeps pointing the same direction: the interesting work is no longer making agents smarter, it's letting them use the things you already have — your logged-in tabs, your notes, your laptop.
BrowserSkill (TypeScript, ~4,800 stars, MIT) — Tencent open-sourced the piece every browser agent has been missing: permission to touch the browser you're actually signed into. Instead of launching a headless clone and re-authenticating, it connects your existing Chrome or Edge session to Cursor, Claude Code, Codex, OpenClaw and anything else that can call a shell, and the work happens in a separate visible agent window so your own tabs stay yours. The tab-borrowing protocol is deliberately fussy — an agent must explicitly claim an open tab and hand it back when the task ends — and when it hits a captcha, a login prompt or a confirmation dialog, it asks you to take over and picks up afterward. This is the honest answer to the two problems that kill browser automation in practice: session state and humans-in-the-loop. macOS, Linux and Windows; Chrome and Edge for now.
Octop (Python, ~3,700 stars, MIT) — Tencent Cloud's self-hosted assistant, and the most unusual thing in it is that it assumes more than one person will use it. Multi-user isolation with JWT, an admin who runs the household or the team, a library of specialist experts you switch between per scenario, per-agent personas, and pluggable storage on local disk, Postgres, containers or object storage so conversation history never has to leave your machine. It talks through a web dashboard, CLI or the IM tools you already live in — Feishu, DingTalk, WeCom, QQ, Discord — and exposes itself over HTTP for programmatic use. It also implements ACP, the agent-client protocol that lets an IDE delegate work to OpenCode or Claude Code behind a permission gate. If your team's shared "AI setup" is one person's chat history and a shared password, this is the swap.
Skillbox (TypeScript, ~130 stars, MIT) — Every agent skill you've installed this month came from one of two places: a git repo you cloned and forgot to update, or a marketplace you don't control. Kitze's answer is a self-hosted library for them: versioned skill documents with immutable revisions, conflict detection, restore, and per-profile grants that decide who can create, edit, archive or merely propose, checked by revocable client keys rather than vibes. It serves skills to agents over both HTTP MCP and a local bridge, ships a compatibility audit, and can layer in task-aware recommendations if you bring your own model key. Docker-only, starts empty, never executes uploaded skill code. Early — a day old — but it names the problem correctly: skills are now infrastructure, and infrastructure gets version control.
Jev MCP (TypeScript, ~60 stars, MIT) — TypeSafe's Jev model is getting the strangest adoption story of the month: instead of chatting with it, people are wiring it into agents as a cheap referee. This proof-of-concept MCP server gives any agent three judgment calls — check a claim against evidence, screen a page before its text enters context, rank candidates by meaning without embeddings — each returning a probability and a confidence in roughly 150 to 500 milliseconds for a fraction of a cent. The reason it matters is arithmetic: agents skip cheap verification because a frontier model is too slow and too expensive to run on every claim or every fetched page, which is exactly how prompt injection gets in. The README's own example is a pricing page carrying a hidden instruction, blocked at 0.99 injection probability while still being read as a real page. Needs a TypeSafe key; early software, expect edges.
LokalBot (Swift, ~40 stars, GPLv3) — A Mac app with a small footprint on GitHub and a real Product Hunt launch, and the pitch is the one nobody local-first app nails: not "summarize my meetings" but "find the thing again". It records and transcribes calls on-device, keeps your dictation, autocomplete and an optional memory of screen text you chose to save, then puts one search across all of it with links back to the source — the Slack message, the page you had open, the moment in the transcript where the decision actually happened. Captures are opt-in per app and site, screenshots can be off, and no account or API key is needed for the built-in models. Apple Silicon and macOS 15 or newer, which is the real constraint. It also mounts an Agent Mode that can act on reviewed context with approval gates, which is where this whole category is heading.
Worth watching this week: whether "borrow the real browser, with a human in the loop" becomes the default pattern — or stays the thing everyone reimplements badly.
Would you hand an agent your logged-in browser session if you could watch it work in a separate window? Tell us in the comments.
Sources: BrowserSkill (GitHub) · Octop (GitHub) · Skillbox (GitHub) · Jev MCP (GitHub) · LokalBot (GitHub)
