Thanks to visit codestin.com
Credit goes to h5i.dev

Web red teaming · Direct HTTP control · Sandboxed execution

The Red-Teaming Browser
for AI Agents

Give AI agents page automation and direct HTTP control to test web applications from an attacker's perspective. h5i lets them inspect, edit, replay, and compare traffic through one interface. Set sandbox and network limits, then review what they did.

curl -fsSL https://h5i.dev/install.sh | sh -s -- --websec
Apache 2.0 · Pure Rust, no Chromium or V8 · browser + websec plugin · read the manual · source
600+GitHub stars 60+forks 20+contributors Apache 2.0open source, no lock-in
The problem

Automating red teaming safely is hard.

Many browsers and red-teaming tools were built for people, not AI agents. Automating them adds complexity, while controlling and auditing the agent's actions remains difficult.

Existing tools for human are too slow
Complex GUIs require agents to interpret screens and navigate menus. Full browser engines also add startup time and memory overhead to automated testing.
Manual red-teaming workflows are hard to automate
Tools designed for human operators often require manual setup and switching between browser, proxy, and request editor. Connecting these steps for an AI agent takes extra work.
AI agents can attack the wrong systems
An agent can make a mistake or follow a prompt injection and attack an unrelated application. Telling it to stay within scope does not enforce that restriction.
AI actions are hard to audit
An agent's summary may omit actions, and logs may be scattered across tools. Reconstructing which systems it reached and what it actually did is difficult.
What h5i gives you

Auto-browsing. Control web traffic. Sandbox workflows.

h5i combines automated browsing with its own HTTP client. It gives AI agents direct access to captured requests and responses for web application penetration testing, CTFs, and red teaming. Use it only on applications you own or are authorized to test.

Explore the agent benchmark results →

one session, from page to traffic
$ h5i browser open https://target.example --capture --allow target.example      # keep every message
$ h5i browser snapshot                                                          # the page as an outline
$ h5i browser click @e7                                                         # drive it like a user

$ h5i websec requests --human                                                   # what the session sent
  #41 GET  /login            200  2.1 kB
  #42 GET  /api/item?id=123  200  1.4 kB
$ h5i websec show req_42 --raw                                                  # byte for byte, as it went out
  GET /api/item?id=123 HTTP/1.1
  host: target.example
$ h5i websec replay req_42 --set query.id=456                                   # resend with one field changed
  res_43  200  1.9 kB
$ h5i websec diff res_42 res_43 --human                                         # how the two answers differ
  status   : 200 → 200
  bytes    : 1412 → 1903 (+491)
  alike    : 0.712
$ h5i websec match res_43 --contains "not your item"                            # exits 0 when it holds
$ h5i websec sitemap --human                                                    # origins and endpoints reached
  target.example
  * /api/item                        GET      200          x3  ?id

# Optional: open a separate browser session inside a container.
$ printf '[profile.custom-sandbox]\nisolation = "container"\n' > .h5i/env.toml  # a container-isolation profile
$ h5i box --profile custom-sandbox --name custom-sandbox                        # create the box with it
$ h5i browser open https://docs.rs/ --in custom-sandbox                         # open the session inside that box
Automated browsing
Read pages, click, type, and extract data through compact snapshots with @ref handles. Pure Rust, no Chromium or V8: ~3× faster reads with ~86% less peak memory than headless Chromium in our simple-site benchmarks.
Direct HTTP capture and editing
Capture requests and responses, inspect headers and bodies, edit and replay requests, and compare results through the websec plugin. No separate MITM proxy or CA setup.
Sandboxed workflow
Sandbox the browser or the entire AI agent workflow, with configurable network and filesystem limits. Review recorded browser actions and blocked connections. Enforcement depends on the selected isolation tier.
The dashboard

Monitor agents, sessions, and blocked actions.

Monitor active sandboxes and browser sessions, inspect the pages agents see, review commands and network requests, and spot blocked actions or policy violations.

FAQ

Frequently asked questions

The short answers. The manual has the long ones.

What is h5i?
h5i is an open-source red-teaming browser built for AI agents. It combines page automation with direct HTTP control through the websec plugin, configurable sandboxing, and auditable sessions. It runs locally and is written in Rust without Chromium or V8.
Why use h5i instead of Playwright or Puppeteer?
Use Playwright or Puppeteer when maximum website compatibility is your priority. Use h5i when your AI agent needs page automation and direct HTTP testing through one interface, with configurable sandboxing, network policies, and a reviewable session record.
Does h5i work on every website?
No. h5i works best for content-heavy websites and common browser interactions, but some browser APIs are not yet supported. For incompatible websites, you can run Chromium inside an h5i sandbox.
Is h5i sandboxed by default?
The browser uses lightweight process isolation when available. To restrict a red-teaming agent's other tools as well, sandbox the entire workflow and configure its network and filesystem policy. Available options include supervised isolation, containers, and microVMs; enforcement depends on the selected tier and host support.
Can h5i prevent prompt injection?
No. A tested application can still mislead an agent. h5i treats page content as untrusted, and configured network and filesystem restrictions can limit what the agent reaches. These controls reduce the impact; they do not guarantee safe actions on an allowed target.
Can the agent see my passwords or cookies?
The agent can reference a named credential without reading its value, or a human can take control to log in. The authenticated session continues without returning the password or cookie to the model.
Does h5i keep my data local?
h5i has no hosted service and stores its sessions locally. Browser traffic still goes to websites you allow, and model traffic goes to your configured model provider.

Let agents test like professional hackers.

Run authorized red teaming with configurable sandbox and network limits, and auditable browser sessions. Local-first, Apache 2.0, with no hosted service.

curl -fsSL https://h5i.dev/install.sh | sh -s -- --websec
Start your first session Star on GitHub