Taprun
The action layer your agent drives in your own logged-in browser — for the exception-heavy, compliance-critical last 20% that clean APIs can't reach. Compiled once, replayed forever at zero LLM tokens.
Homepage | Blog | Verified Claims | 📬 Drift Alerts | 中文
Your agent's closed-loop action layer for the browser — the login-gated, exception-heavy, compliance-critical last 20% that clean APIs and cloud agents can't reach. Driven in your own Chrome, captured once, replayed forever at zero LLM tokens.
As APIs get walled off and metered, the work that survives lives behind logins, OTP walls, and human-gesture gates — the exceptions, approvals, and compliance steps a cloud agent architecturally can't touch. Taprun is the action layer for exactly that: your agent drives your real, already-logged-in Chrome, closes the loop (act → verify the effect → re-run on drift), and hands you a deterministic replay you own.
Every other browser agent re-runs a live LLM — and re-burns tokens — on every execution. Taprun's AI agent inspects the page once and emits a deterministic .flow.json program; every replay after that is pure data dispatch — same result every call, $0 in tokens, no agent in the loop. It runs in your real Chrome, so cookies and login sessions stay on your machine by architecture. tap verify catches breakage before your data goes stale.
Works with Claude Code, CodeBuddy, Cursor, Cline, Windsurf, and any MCP host — install straight from the chat window. Forge a tap from any URL on demand — no catalog needed.
How Taprun Compares
| Taprun | AI Browser Agents | Traditional Scrapers | |
|---|---|---|---|
| AI cost per run | $0 (compile once) | Tokens every run | Free |
| Accuracy | Deterministic | Varies per run | Deterministic |
| Silent failure detection | Per-tap CEL snapshot_equivalent predicate + 4-arm verdict | None | None |
| Breakage diagnostics | tap verify — exact diff of what changed | None | Manual spot checks |
| Detection risk | Low (real browser sessions) | High | High |
| Runtimes | 2 (Chrome extension + Playwright) | 1 | 1 |
| Code inspectable | .flow.json — bare JSON, 18-op closed vocabulary, git diff | Black box / ephemeral | Fragile scripts |
| MCP native | Yes (authoring layer only — execution is zero tokens) | No | No |
Get Started
1. Attach to your agent — from the chat window
Claude Code / CodeBuddy — paste two lines into the chat, nothing else:
That installs the Taprun MCP server plus the skills that teach your agent when to use it and the hook that routes walled fetches to Taprun — no terminal, no config file. (CodeBuddy wires plugin MCP servers at startup only, so fully restart it once after installing; Claude Code picks them up with /reload-plugins.)
Any other MCP host (Cursor · VS Code · Claude Desktop) — one command writes the config for you:
The binary self-copies to ~/.tap/bin and your agent's MCP config is written. Re-check anytime with tap embed --verify.
Using a coding agent that isn't in that list?
tap embedtargets are data, not code: drop a row into~/.tap/embed-targets.jsonand the new agent works immediately — no engine release. Each row names one of four install kinds (cc-pluginfor Claude-Code-plugin hosts,cli-mcp-addfor CLIs with a<cli> mcp add,ide-deeplink,desktop-bundle), e.g.[{"id":"kode","kind":"cc-plugin","display":"Kode CLI","tier":1,"cli":"kode"}]. Same doctrine as the rest of Taprun — the engine stays closed and mechanical; you extend it in local data.
Now pick your runtime — the extension is only needed to reuse your live logged-in Chrome:
- Public pages / open APIs / CI — nothing more to install. The MCP server runs over
npx; you're done. Append--no-extensionfor a fully in-chat Playwright runtime with its own isolated profile (no browser gesture, no click). - Logged-in sites (your bank / internal dashboard / Xiaohongshu / Zhihu) — just tell your agent "set up tap for logged-in sites" right in the chat. The tap-setup skill drives the whole bridge from the chat: it materializes the stable binary (from the engine
npxalready downloaded — no second download) and registers the native-messaging manifest, then opens the extension page. The single Add to Chrome click is the only step that isn't a chat action — it is the trust gate that lets Taprun reuse your existing login, and the in-flight call resumes automatically once it lands. - Claude Desktop: download
tap.mcpband double-click.
Other install paths (brew · curl · manual MCP JSON · raw binaries)
Manual MCP config, if you'd rather write it yourself:
| Platform | Download |
|---|---|
| macOS (Apple Silicon) | tap-macos-arm64 |
| macOS (Intel) | tap-macos-x64 |
| Linux | tap-linux-x64 |
| Windows | tap-windows-x64.exe |
2. Prove it works (~2 minutes, no login)
Run the first entry of the claims ledger — the exact verification its nightly CI runs:
"state": "committed" plus today's trending repos at zero tokens = your install works and the claim holds.
3. Forge your own
Or just ask your AI agent:
Optional: Drive the binary from your own code (TypeScript / Python)
Skip MCP — call the tap binary from your own loop:
The CLI emits ToolResult<T> envelopes as JSON — same shape the MCP surface returns — so any language with a subprocess library can drive it. See tap --help for the full verb list.
Have an existing Playwright / Puppeteer / Stagehand script?
Don't rewrite. Convert with one of the open-source adapters — drop your existing source in, get a Taprun-compatible .flow.json plan out:
| Adapter | Source format | Coverage |
|---|---|---|
@taprun/from-playwright | .ts/.js Playwright tests | 8 page.* APIs (goto/click/fill/type/press/waitForSelector/waitForTimeout/screenshot) |
@taprun/from-puppeteer | .ts/.js Puppeteer scripts | 7 page.* APIs + page.keyboard.press |
@taprun/from-stagehand | .ts/.js Stagehand scripts | Hybrid: deterministic page.* mapped to plan ops; NL act/extract/observe flagged for honest verify verdicts |
create-tap-script | (none — scaffolder) | Generates a starter .flow.json envelope from <site>/<name> <url> |
The format itself is documented at @taprun/spec — the public protocol surface package: TypeScript types for the v2 Plan (18-op closed union + discriminated read/write Plan union) + JSON Schema 2020-12 with $id resolvable at taprun.dev/spec/plan-v1/schema.json, bidirectionally drift-guarded against the TS types. Third-party tooling (IDE $schema autocomplete, ajv-equivalent validators in Python/Ruby/Go, governance layers, alternative runtimes, MCP hosts with plan-aware permission scoping) builds against this package without depending on the proprietary Taprun engine. Plan-v1 reference: taprun.dev/spec/plan-v1. Source for all five packages: packages/ (see packages/README.md for the workspace overview).
What Can You Do?
Read — Extract data from any website
Write — Operate any website
Watch — Monitor changes
Compose — Chain like Unix pipes
Forge — Create new automations with AI
Bring your own model — works with Claude, OpenAI, DeepSeek, or any OpenAI-compatible endpoint including local Ollama / LM Studio for fully offline forge:
How It Works
- You describe what you want (URL × natural-language intent)
- AI compiles it into a
.flow.jsonprogram — bare JSON, 18-op closed vocabulary, version-controlled - Taprun runs the program on either runtime — forever, at $0
Every successful compilation makes the next one faster. Need a tap for a new site? Your agent forges one on demand with capture — no catalog required.
Verified Claims
tap-skills is no longer a skills catalog — it's a claims ledger: dated, falsifiable claims about the live web, each vendoring its own deterministic plan, re-verified nightly by CI at zero LLM tokens. A claim that drifts flips to 🟡 publicly, the same night.
Verify the first claim yourself (~2 minutes, no login, no browser):
You get the exact verification the nightly CI gets — deterministic replay, same result. The 140-skill v1 catalog is preserved untouched on the v1-archive branch; pre-built catalogs only rot, so plans are forged on demand with capture instead.
Local-first by architecture
Zero-token replay is the headline; local-first is the guarantee underneath it. Taprun runs in your browser — the Chrome extension reuses your live login sessions, so cookies, auth tokens, and credentials never leave your machine. A structural choice, not a marketing claim:
| Concern | Cloud-first browser SDKs | Taprun (local-first) |
|---|---|---|
| Where do logged-in cookies live? | On the cloud vendor's servers | Only in your local browser |
| What does the AI see? | The full session + your data | Only the page DOM during forge time |
Compliance with noindex / robots.txt / TOS | Vendor signs ToS for you | Your account, your terms |
| Internal / intranet sites | Need VPN tunneling | Just open the page |
| Decommission risk | Vendor goes down → your scrapers stop | Local code keeps running |
| Layer | Protection |
|---|---|
| Sandbox | Programs run with zero permissions — no file, network, or system access |
| Static Analysis | CI blocks dangerous patterns before they reach users |
| Local-only | Your data, sessions, and API keys never leave your machine — architecturally |
See SECURITY.md for the full threat model.
Contributing
The easiest way to contribute: forge a new tap. One .flow.json file is all it takes.
See CONTRIBUTING.md for details.
Roadmap
- Community skills catalog — retired 2026-07 in favor of the claims ledger (v1 catalog archived)
- 2 runtimes — Chrome extension + Playwright (headless / CI)
- Unix pipes —
tap A | tap B - Watch mode — monitor changes over time
- Verify —
tap verifysnapshot-equivalence check with a 4-arm drift verdict (equivalent / drifted / first_snapshot / unreachable) - Single-command MCP server —
tap mcp stdio(ortap mcp http) for any MCP host - Android runtime
- iOS runtime
- Concurrency control — deterministic coordination for M agents operating shared accounts in parallel
Support
- GitHub Discussions — Q&A, ideas, show & tell
- support@taprun.dev — licensing, private feedback, consulting
- Issues — bug reports
Privacy
Taprun is local-first by architecture. It drives your own browser on your own machine — credentials, cookies, and page data never leave it. The engine ships no telemetry and makes no outbound network calls except the ones your own saved taps explicitly direct (op:fetch). Saved taps, secrets, and traces live under ~/.tap/ on your machine only.
Full policy: taprun.dev/privacy.
License
Chrome Extension & docs: MIT. Claims ledger: MIT.