The full upstream README, mirrored here for reference. Install config, tool schemas, adoption signals, and an original overview live on the Newton Browser listing page.
Newton Browser is a local MCP browser-control product for agents. Each session launches an isolated Chrome or Edge process and controls it through inherited private CDP pipes. By default browser traffic uses Chromium's normal networking with no Newton proxy, origin allowlist, request interception, or resource filtering.
The default runtime requires no browser extension, relay, daemon, debug TCP port, database, telemetry, hosted service, or model-provider integration.
The default source runtime now uses the replacement shared engine, with isolated workers from a shared Newton login source and an optional thin existing-browser adapter. Native actions, precise editing, contextual controls, records/documents, screenshots, tab ownership and update foundations are implemented. This is an unreleased development checkpoint, not completed real-world acceptance.
The legacy direct runtime is retired (2026-09-25): the session engine is the only action, receipt and ref authority. Build, typecheck, boundary lint and the full suite pass. Feedback/reading refinements, platform and authenticated task QA, and three unchanged packed release gates remain open. See the current progress ledger, remaining roadmap and consolidation record.
Package version remains 0.6.4; historical receipts apply only to their recorded candidates. No package or browser-store release is implied by the source checkpoint.
Newton implements only stateless MCP 2026-07-28 over newline-delimited stdio JSON.
Clients send protocol version and capabilities in every request. Newton exposes no legacy
handshake or framing mode.
2026-07-28, local stdio servers, and image content.That is enough for ephemeral sessions: Newton discovers Chrome or Edge and creates a fresh isolated identity per session. Optional setup only selects a default browser:
Every owned session is an isolated copy of a shared login source (default unless the
session names another). To sign in once for later sessions, open the source's visible
browser, sign in personally, and confirm:
Newton never asks an agent to enter or retrieve credentials. The published sign-in becomes the source's next generation; running sessions keep their own copies, and nothing a session does is merged back.
The local installer can update Codex configuration or print a generic entry:
Codex installation enables Codex's mcp_2026_07_28 feature, pins
CODEX_MCP_PROTOCOL_VERSION=2026-07-28, and verifies the exact candidate's live
stateless discovery, self-reported package version, and required browser-tool catalog
before atomically replacing its configuration. The resulting entrypoint/version pair is
pinned; incompatible or stale candidates cannot displace a working install.
Tools (tools/list is authoritative): browser.session.start, browser.observe,
browser.act, browser.command, browser.document.read, browser.document.continue,
browser.screenshot, browser.console, browser.network, browser.pages.list,
browser.page.select, browser.sessions.list, browser.session.stop, and the
operator-selected existing-browser tools browser.existing.discover and
browser.existing.setup.
A normal loop:
browser.session.start with a complete URL returns the session, its first page and
nextCommandId.browser.observe returns bounded controls with refs; records mode reads links, tables
and forms; browser.document.read reads text with a continuation cursor.browser.act performs one typed action or a sequence and returns a receipt: dispatch,
postcondition, and the next state when it changed. Reuse a commandId only for the
identical command; after an uncertain receipt, reconcile with browser.command rather
than replaying.browser.session.stop ends the session independently of its queue.Popups and new tabs are attached as session pages without changing the selected page;
browser.pages.list and browser.page.select move between them. A hung renderer is
reopened on the same page and the receipt says so. Console and network recording is
opt-in because enabling it is visible to pages.
Identities are the store's opaque browser profiles; login sources and session copies are built on them. Operator utilities:
Import byte-copies a narrow allowlist of authentication-bearing files from a closed, stable local profile and never modifies the source. Passwords, autofill, history, downloads, extensions, sessions, service workers, and caches are excluded. Browser encryption may prevent copied authentication from remaining usable; Newton does not bypass that protection.
NEWTON_BROWSER_EGRESS=public); otherwise networking is ordinary Chromium networking.See Security, Privacy, and MCP clients.
Run pnpm eval:real-sites once per required browser/platform. Release then requires
pnpm release:check to pass from the exact packed candidate three consecutive times on
Windows and Linux with no skipped critical tests, plus the pinned Linux Chrome for Testing
matrix and matching cross-platform tarball hashes.
The source is licensed under the MIT License. Publishing or distributing a Newton Browser release remains a separate maintainer-controlled action.