DEV Community: Burrowbox

ChatGPT agent works on its own computer. Build the same with the OpenAI Responses API

Burrowbox — Sun, 04 Oct 2026 02:49:54 +0000

What ChatGPT agent does

OpenAI started rolling out ChatGPT agent on July 17, 2025, for Pro, Plus and Team users. It combines Operator's ability to click around websites with deep research, and it can use a terminal. (TechCrunch)

How it uses a computer:

It works in its own isolated environment with a visual browser, a text browser and a terminal. (TechTarget)
When a site needs a password, the user switches to takeover mode and types it in themselves. (TechTarget)
It asks permission before consequential actions, such as purchases or sending emails. Users can also turn on watch mode to supervise it. (TechTarget)

On September 29, 2026, OpenAI added Dots: always-on agents in ChatGPT for Pro and Business Premium users. (TechCrunch) Each dot has its own cloud computer, and the user can view it while it works. Users set rules for what a dot does on its own and what needs their approval. (9to5Google)

The pattern

The agent has a computer of its own. The model never handles the password: a person signs in by taking over the screen. Risky steps wait for an explicit yes. To build this into your product, you need a machine per user, a way for the user to watch it and take control, and an approval step in your agent loop.

Build it with the Responses API and Burrowbox

Burrowbox isn't involved with OpenAI. Each Burrowbox machine has an MCP endpoint, and the OpenAI Responses API can call remote MCP servers directly, so the model can drive the machine with no MCP client on your side.

1. Create the machine

curl -X POST https://burrowbox.dev/api/machines \
  -H "Authorization: Bearer $BURROWBOX_KEY" -H "Content-Type: application/json" \
  -d '{"name": "sam", "size": "tiny", "externalId": "user_42", "ttlMinutes": 60}'
# → { "id": "2f6aeedcd3", "mcpUrl": "https://burrowbox.dev/api/machines/2f6aeedcd3/mcp", "mcpToken": "tmm_…", … }

2. Point the model at the machine's MCP endpoint

Reading tools run without asking. Everything else (clicks, form fills, shell commands) comes back as an approval request.

import OpenAI from "openai";
const openai = new OpenAI();

const machineTool = {
  type: "mcp",
  server_label: "burrowbox",
  server_url: process.env.MCP_URL,          // the machine's mcpUrl
  authorization: process.env.MCP_TOKEN,     // the machine's mcpToken
  require_approval: { never: { tool_names: ["browser_navigate", "browser_snapshot", "browser_screenshot", "screenshot"] } },
};

let resp = await openai.responses.create({
  model: "gpt-6-astra",
  tools: [machineTool],
  input: "Find a table for two on Friday at 7pm on example-bookings.com and get it ready to confirm.",
});

3. Ask the user before acting

for (const item of resp.output.filter((o) => o.type === "mcp_approval_request")) {
  const ok = await askUser(`Allow ${item.name}(${item.arguments})?`); // your UI
  resp = await openai.responses.create({
    model: "gpt-6-astra",
    tools: [machineTool],
    previous_response_id: resp.id,
    input: [{ type: "mcp_approval_response", approve: ok, approval_request_id: item.id }],
  });
}
console.log(resp.output_text);

This handles one round of approvals. A real loop repeats it until no requests are left.

4. Takeover for logins

When the agent reaches a login page, create an interactive live-view link and show it to the user. They type their password into the machine's browser, and it never goes through the model. Cookies are kept when the machine stops, so they usually only sign in once.

curl -X POST https://burrowbox.dev/api/machines/$MACHINE_ID/live-view \
  -H "Authorization: Bearer $BURROWBOX_KEY" -H "Content-Type: application/json" \
  -d '{"mode": "browser", "interactive": true, "ttlSeconds": 600, "allowedOrigins": ["https://app.example.com"]}'
# → { "url": "https://burrowbox.dev/embed/2f6aeedcd3?t=…", "iframe": "<iframe …>" }

For a watch mode, create the link with "interactive": false. Input is then blocked on the machine itself, not only in the page. To skip takeover entirely, store the login in the machine's vault, and the agent can use browser_login without seeing it.

5. Always on, like Dots

Set "ttlMinutes": null (PATCH /api/machines/{id}) to keep a machine running, or use a scheduled job with wakeIfStopped and stopAfter so it only runs (and bills) while it has work. A tiny machine costs $0.07 an hour while running. See Billing.

Create an account to try it.

Sources

TechCrunch, OpenAI launches a general-purpose agent in ChatGPT: https://techcrunch.com/2025/07/17/openai-launches-a-general-purpose-agent-in-chatgpt/
TechTarget, ChatGPT agent explained: https://www.techtarget.com/whatis/feature/ChatGPT-agents-explained
TechCrunch, OpenAI launches Dots: https://techcrunch.com/2026/09/29/openai-launches-dots-its-bubbly-agentic-avatar/
9to5Google, OpenAI launches Dots: https://9to5google.com/2026/09/29/openai-dots-agent/
OpenAI docs, MCP and connectors (Responses API): https://developers.openai.com/api/docs/guides/tools-connectors-mcp
Burrowbox docs: https://burrowbox.dev/docs

Originally published on the Burrowbox blog.

Claude computer use needs a computer. Give it one through the Claude API's MCP connector

Burrowbox — Sun, 04 Oct 2026 02:49:50 +0000

What Claude computer use does

Anthropic released computer use as a public beta on October 22, 2024. Claude looks at a screen and works it like a person, moving the cursor, clicking buttons and typing text. It's available through the Claude API, Amazon Bedrock and Google Cloud's Vertex AI. (Anthropic)

What matters here is where it runs. Claude doesn't come with a computer. It returns actions such as screenshot, left_click or type, your application carries them out in an environment you control, and the results go back to Claude. The loop repeats until the task is done. Anthropic's reference implementation is a Docker container with a virtual X11 display, a lightweight desktop and some preinstalled apps. (Claude docs)

Anthropic's docs also recommend some precautions (same source):

Use a dedicated virtual machine or container with minimal privileges.
Don't give the model sensitive data such as login credentials.
Limit internet access to an allowlist of domains.
Ask a human to confirm consequential actions.

The pattern

The model supplies the decisions, and you supply the computer. For a demo, that's a container on your laptop. For a product, you need one computer per user or per task, kept between sessions, with credentials the model doesn't see and a way for people to watch.

Build it with the Claude API and Burrowbox

A Burrowbox machine is a Linux desktop with its own MCP endpoint. Its tools include desktop control (screenshot, click, type_text, get_app_state), a persistent browser (browser_navigate, browser_snapshot, browser_login) and shell_run. With the Messages API's MCP connector, Claude calls these tools directly, so you don't need an MCP client or a tool loop of your own. Burrowbox isn't affiliated with Anthropic.

1. Create a machine

curl -X POST https://burrowbox.dev/api/machines \
  -H "Authorization: Bearer $BURROWBOX_KEY" -H "Content-Type: application/json" \
  -d '{"name": "ops-desk", "size": "small", "ttlMinutes": 30}'
# → { "id": "…", "mcpUrl": "https://burrowbox.dev/api/machines/…/mcp", "mcpToken": "tmm_…" }

2. Give Claude the machine (Python)

import os
import anthropic

client = anthropic.Anthropic()  # reads ANTHROPIC_API_KEY

response = client.beta.messages.create(
    model="claude-opus-5-5",
    max_tokens=16000,
    betas=["mcp-client-2025-11-20"],
    mcp_servers=[{
        "type": "url",
        "url": os.environ["MCP_URL"],                       # the machine's mcpUrl
        "name": "burrowbox",
        "authorization_token": os.environ["MCP_TOKEN"],     # the machine's mcpToken
    }],
    tools=[{
        "type": "mcp_toolset",
        "mcp_server_name": "burrowbox",
        # allowlist: only the tools this task needs
        "default_config": {"enabled": False},
        "configs": {t: {"enabled": True} for t in [
            "browser_navigate", "browser_snapshot", "browser_click", "browser_fill",
            "browser_login", "screenshot", "file_write",
        ]},
    }],
    messages=[{"role": "user", "content": "Log in to the supplier portal, download this month's invoices and save a summary to ~/invoices.md"}],
)

for block in response.content:
    if block.type == "text":
        print(block.text)

The token only works for this one machine. Claude's tool calls show up in the response as mcp_tool_use and mcp_tool_result blocks, which you can log.

3. How this lines up with Anthropic's precautions

Dedicated machine: every machine is its own isolated container with its own disk.
No credentials in the prompt: put the login in the machine's vault (PUT /api/machines/{id}/vault/{name}). browser_login fills the form without returning the password to Claude.
Human confirmation: embed the live view so a person can watch ("interactive": false) or take over ("interactive": true). For approval on each tool call, run your own tool loop instead of the connector.
Domain allowlist: Burrowbox doesn't filter a machine's outbound traffic. Enforce that in your own network layer if you need it.

4. Let Claude manage machines too

The platform MCP endpoint takes your API key. Through it, an agent can create, start, stop and destroy machines (machine_create, machine_stop, …) and call any machine tool with machine_call_tool:

claude mcp add --transport http burrowbox https://burrowbox.dev/mcp \
  --header "Authorization: Bearer $BURROWBOX_KEY"

A small machine (1 vCPU, 6 GB) costs $0.11 an hour while running, and state is kept when it's off. See Billing.

Create an account to try it.

Sources

Anthropic, Introducing computer use: https://www.anthropic.com/news/3-5-models-and-computer-use
Claude docs, Computer use tool: https://platform.claude.com/docs/en/docs/agents-and-tools/tool-use/computer-use-tool
Claude docs, MCP connector: https://platform.claude.com/docs/en/agents-and-tools/mcp-connector
Burrowbox docs, MCP: https://burrowbox.dev/docs/mcp

Originally published on the Burrowbox blog.

Manus gives every task its own cloud computer. Build it as a durable workflow on Vercel

Burrowbox — Sun, 04 Oct 2026 02:49:46 +0000

What Manus does

Manus is an agent that takes a goal and works on it by itself. Its January 2026 post on the Manus Sandbox explains the computing side (Manus):

Manus allocates a fully isolated cloud virtual machine for each task.
The sandbox works like a personal computer, with networking, a file system, a browser and software tools.
Files survive when the sandbox sleeps and wakes. Sandboxes that sit inactive are recycled after 7 days on the free plan and 21 days on Pro. After that, only artifacts and uploads are restored, not temporary files.

The pattern

A task gets a whole computer: the agent can install what it needs, write files and use a browser without touching anyone else's work. Tasks can run for a long time, so the code driving them has to survive retries and restarts, and it has to clean up when the task ends.

Build it with Burrowbox and the Vercel Workflow SDK

Vercel's Workflow SDK runs durable functions. Each "use step" function is retried automatically when it throws, and the workflow resumes where it left off. Below, each task claims a pre-built Burrowbox machine, runs an agent on it, saves the result and turns the machine off. Burrowbox isn't involved with Manus.

1. A warm pool with your tools preinstalled

Every pool machine runs this template before it counts as ready, so claimed machines don't spend time installing anything.

curl -X POST https://burrowbox.dev/api/pools \
  -H "Authorization: Bearer $BURROWBOX_KEY" -H "Content-Type: application/json" \
  -d '{"name": "tasks", "size": "small", "target": 2,
       "setup": [{"type": "tool", "tool": "apps_install", "arguments": {"kind": "apt", "packages": ["python3", "pandoc"]}}]}'

2. The workflow

npm i workflow ai @ai-sdk/mcp, then wrap next.config.ts with withWorkflow from workflow/next.

// workflows/task.ts
import { generateText, isStepCount } from "ai";
import { createMCPClient } from "@ai-sdk/mcp";

const BB = "https://burrowbox.dev";
const bb = (path: string, init: RequestInit = {}) =>
  fetch(`${BB}${path}`, {
    ...init,
    headers: { Authorization: `Bearer ${process.env.BURROWBOX_KEY}`, "Content-Type": "application/json" },
  }).then((r) => r.json());

export async function runTask(userId: string, goal: string) {
  "use workflow";
  const machineId = await claimMachine(userId);
  try {
    const report = await runAgent(machineId, goal);
    await saveReport(userId, report);
  } finally {
    await stopMachine(machineId);
  }
}

async function claimMachine(userId: string) {
  "use step";
  const m = await bb(`/api/pools/${process.env.POOL_ID}/claim`, {
    method: "POST",
    body: JSON.stringify({ externalId: userId, ttlMinutes: 120 }), // stops itself after 2 h at the latest
  });
  return m.id as string; // keep the token out of workflow state
}

async function runAgent(machineId: string, goal: string) {
  "use step";
  const m = await bb(`/api/machines/${machineId}`); // includes mcpUrl and mcpToken
  const mcp = await createMCPClient({
    transport: { type: "http", url: m.mcpUrl, headers: { Authorization: `Bearer ${m.mcpToken}` } },
  });
  try {
    const { text } = await generateText({
      model: "anthropic/claude-sonnet-5.5",
      tools: await mcp.tools(), // shell_run, file_write, browser_navigate, …
      stopWhen: isStepCount(50),
      system: "Work in ~/task. Write the final report to ~/task/report.md, then reply with its contents.",
      prompt: goal,
    });
    return text;
  } finally {
    await mcp.close();
  }
}

async function stopMachine(machineId: string) {
  "use step";
  await bb(`/api/machines/${machineId}/stop`, { method: "POST" }); // files are kept for follow-ups
}

async function saveReport(userId: string, report: string) {
  "use step";
  await db.reports.insert({ userId, report }); // your database
}

Start it from a route:

// app/api/tasks/route.ts
import { start } from "workflow/api";
import { runTask } from "@/workflows/task";

export async function POST(req: Request) {
  const { userId, goal } = await req.json();
  await start(runTask, [userId, goal]);
  return Response.json({ ok: true });
}

Some notes:

Retries. If a step throws, it's retried. A retried claimMachine claims a second machine, so for strict once-only behavior, look up the user's machine first with GET /api/machines?externalId=….
Follow-ups go to the same machine. POST /api/machines/{id}/start restores its files, installed apps and (with "browser": "full") browser logins. When you're finished with it, DELETE /api/machines/{id}.
Watching. To watch a task live, create a live-view link for its machine.

What it costs

A small machine (1 vCPU, 6 GB) costs $0.11 an hour while running. A stopped machine costs $0.001 an hour. Idle pool machines are billed like running ones, so a pool of 2 small machines costs about $0.22 an hour. See Billing.

Create an account to try it.

Sources

Manus, Understanding Manus sandbox: https://manus.im/blog/manus-sandbox
Workflow SDK, Getting started with Next.js: https://workflow-sdk.dev/docs/getting-started/next
Workflow SDK, Workflows and steps: https://workflow-sdk.dev/docs/foundations/workflows-and-steps
AI SDK, MCP tools: https://ai-sdk.dev/docs/ai-sdk-core/mcp-tools
Burrowbox docs, Warm pools: https://burrowbox.dev/docs/pools

Originally published on the Burrowbox blog.

Meta's Muse gives every user a cloud computer. Here's how to do the same for your customers

Burrowbox — Sun, 04 Oct 2026 02:49:42 +0000

What Muse does

Meta announced Muse on September 8, 2026. It's a personal agent that sends email, books travel, fills out forms and makes purchases for people. (Meta)

From Meta's own posts, here's how it uses computing:

One machine per user. Each user's agent runs on its own virtual machine in Meta's cloud, the "Muse Secure VM". No other user's agent can reach it. (Meta)
A real computer. The agent has a file system, a terminal and a full web browser, and its memory carries over between conversations. (How We Designed Muse)
Secrets it can't see. Passwords and payment details go into secure storage, so Muse can use them without seeing them. A separate Sentinel agent on the same machine has to approve anything that reaches the internet. (Meta) The agent runs in an isolated container and only gets stand-in tokens. Real credentials are added as a request leaves the machine. (Meta engineering)
People approve and audit. Muse checks with the user before sensitive actions, such as sending an email or making a purchase, and keeps a full record of what it has done. (Meta)

The pattern

Each user gets a persistent computer. The agent works there with a browser and files and uses stored logins without seeing them. The user can watch what it does. If your product runs agents for your customers, this is the setup you want, and you don't have to build the machines yourself.

Build it with Burrowbox and the Vercel AI SDK

Burrowbox gives each customer a persistent Linux machine with a browser that stays signed in, an encrypted vault and its own MCP endpoint. Burrowbox isn't involved with Muse. Below, a Next.js app gives each user their own machine.

1. A machine per user (REST)

// lib/burrowbox.ts
export const bb = (path: string, body?: unknown) =>
  fetch(`https://burrowbox.dev${path}`, {
    method: body ? "POST" : "GET",
    headers: { Authorization: `Bearer ${process.env.BURROWBOX_KEY}`, "Content-Type": "application/json" },
    body: body ? JSON.stringify(body) : undefined,
  }).then((r) => r.json());

// Returns the user's machine, running, with its mcpUrl and mcpToken.
export async function machineFor(user: { id: string; machineId?: string }) {
  if (user.machineId) {
    await bb(`/api/machines/${user.machineId}/start`, { ttlMinutes: 30 }); // resumes where it left off
    return bb(`/api/machines/${user.machineId}`);
  }
  const m = await bb("/api/machines", { size: "tiny", browser: "full", ttlMinutes: 30, externalId: user.id });
  await db.users.update(user.id, { machineId: m.id }); // your database
  return m;
}

externalId tags the machine with your user's id. browser: "full" (Chromium) keeps the browser's logins across restarts. When ttlMinutes runs out, the machine turns off and keeps its files, apps and browser cookies, and start brings it back still signed in.

2. Their logins go into their machine's vault

curl -X PUT https://burrowbox.dev/api/machines/$MACHINE_ID/vault/airline \
  -H "Authorization: Bearer $BURROWBOX_KEY" -H "Content-Type: application/json" \
  -d '{"url": "https://airline.example.com/login", "username": "sam@example.com", "password": "…"}'

The agent calls browser_login, which fills and submits the form without returning the password to the model. See Vault.

3. Run the agent on the user's machine (AI SDK + MCP)

The AI SDK's MCP client connects to the machine's MCP endpoint with the machine-scoped token, so this agent can't reach any other machine.

// app/api/agent/route.ts
import { generateText, isStepCount } from "ai";
import { createMCPClient } from "@ai-sdk/mcp";
import { machineFor } from "@/lib/burrowbox";

export async function POST(req: Request) {
  const { prompt } = await req.json();
  const user = await currentUser(); // your auth
  const machine = await machineFor(user);

  const mcp = await createMCPClient({
    transport: { type: "http", url: machine.mcpUrl, headers: { Authorization: `Bearer ${machine.mcpToken}` } },
  });
  try {
    const { text } = await generateText({
      model: "anthropic/claude-sonnet-5.5",
      tools: await mcp.tools(), // browser_navigate, browser_login, shell_run, file_write, …
      stopWhen: isStepCount(25),
      prompt,
    });
    return Response.json({ text });
  } finally {
    await mcp.close();
  }
}

4. Let the user watch

Create a short-lived live-view link on the server and show it in an iframe. With interactive: false, input is blocked on the machine itself.

const view = await bb(`/api/machines/${machine.id}/live-view`, {
  mode: "browser", interactive: false, ttlSeconds: 900, allowedOrigins: ["https://app.example.com"],
});
// <iframe src={view.url} style={{ width: "100%", aspectRatio: "16/10", border: 0 }} />

Burrowbox doesn't filter outbound traffic the way Sentinel does. Your agent decides which steps need the user's confirmation. See Embed the live view.

What it costs

A tiny machine costs $0.07 an hour while running and $0.001 an hour while stopped. A user who runs their agent 30 minutes a day costs about $1.05 a month in running time plus $0.72 for storage. See Billing.

Create an account to try it.

Sources

Meta, Introducing Muse: https://about.fb.com/news/2026/09/introducing-muse-personal-ai-agent/
Meta, How We Designed Muse: https://introducing.muse.ai/
Meta, How We Built Safety Into Muse: https://research.meta.ai/blog/security-and-safety-for-ai-agents-our-approach-with-muse
AI SDK, MCP tools: https://ai-sdk.dev/docs/ai-sdk-core/mcp-tools
AI SDK, tool calling and stop conditions: https://ai-sdk.dev/docs/ai-sdk-core/tools-and-tool-calling
Burrowbox docs: https://burrowbox.dev/docs

Originally published on the Burrowbox blog.

Comet puts an assistant in your browser. Put one in a cloud browser that works on a schedule

Burrowbox — Sun, 04 Oct 2026 02:49:38 +0000

What Comet does

Perplexity launched Comet on July 9, 2025. It's a web browser with Perplexity's search built in and an assistant in a sidebar. The Comet Assistant can summarize emails and calendar events, manage tabs and navigate web pages for the user, with the page they're viewing as context. At launch it was open to subscribers of the $200-a-month Max plan and people invited from a waitlist. (TechCrunch)

The pattern

A browsing agent is most useful in a browser that's already signed in to your accounts. Comet does that by living in the browser you use. The other option is a browser in the cloud that stays signed in. It works when your laptop is closed, can run on a schedule, and reports back when it's done. That suits recurring research: a morning digest of a dashboard, a weekly price check, a report from an inbox.

Build it with Burrowbox: schedules and event webhooks

A Burrowbox machine has one persistent browser. Sign in once (yourself, through an interactive live view, or with vault credentials and browser_login), and its cookies survive stops and restarts. Create the machine with "browser": "full" (Chromium); that's the mode that keeps logins across restarts. Burrowbox wakes the machine on a schedule and tells your server when it's ready. Your server runs the agent and turns the machine off again. Burrowbox isn't involved with Perplexity.

1. Wake the machine every weekday morning

The scheduled job starts the machine if it's off and opens the dashboard in its signed-in browser. Cron times are in UTC.

curl -X POST https://burrowbox.dev/api/machines/$MACHINE_ID/schedules \
  -H "Authorization: Bearer $BURROWBOX_KEY" -H "Content-Type: application/json" \
  -d '{
    "name": "Morning digest",
    "cron": "0 7 * * mon-fri",
    "action": { "type": "tool", "tool": "browser_navigate", "arguments": { "url": "https://analytics.example.com/overview" } },
    "wakeIfStopped": true
  }'
# The response includes the next three run times in "upcoming".

2. Get told when it ran

curl -X POST https://burrowbox.dev/api/event-webhooks \
  -H "Authorization: Bearer $BURROWBOX_KEY" -H "Content-Type: application/json" \
  -d '{"url": "https://api.example.com/burrowbox/events", "events": ["run.succeeded", "run.failed"]}'
# → { "id": "…", "secret": "whsec_…" }   (the secret is shown once)

3. Verify the event, run the agent, turn the machine off

// npm i express ai @ai-sdk/mcp
import crypto from "node:crypto";
import express from "express";
import { generateText, isStepCount } from "ai";
import { createMCPClient } from "@ai-sdk/mcp";

const BB = "https://burrowbox.dev";
const auth = { Authorization: `Bearer ${process.env.BURROWBOX_KEY}` };

function verify(rawBody, header, secret, toleranceSeconds = 300) {
  const parts = Object.fromEntries(header.split(",").map((p) => p.split("=")));
  const expected = crypto.createHmac("sha256", secret).update(`${parts.t}.${rawBody}`).digest("hex");
  const ok = parts.v1 && parts.v1.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(parts.v1), Buffer.from(expected));
  return ok && Math.abs(Date.now() / 1000 - Number(parts.t)) <= toleranceSeconds;
}

const app = express();
app.post("/burrowbox/events", express.raw({ type: "application/json" }), async (req, res) => {
  if (!verify(req.body, req.get("Burrowbox-Signature") ?? "", process.env.BURROWBOX_WHSEC)) return res.sendStatus(400);
  res.sendStatus(200); // answer within 10 s, then do the work
  const event = JSON.parse(req.body);
  if (event.type !== "run.succeeded") return;

  const id = event.data.machine.id;
  const machine = await fetch(`${BB}/api/machines/${id}`, { headers: auth }).then((r) => r.json());
  const mcp = await createMCPClient({
    transport: { type: "http", url: machine.mcpUrl, headers: { Authorization: `Bearer ${machine.mcpToken}` } },
  });
  try {
    const { text } = await generateText({
      model: "anthropic/claude-sonnet-5.5",
      tools: await mcp.tools(),
      stopWhen: isStepCount(20),
      prompt: "The browser is on the analytics overview. Read it with browser_snapshot and write a 5-bullet digest of what changed since yesterday.",
    });
    await sendDigest(text); // email, Slack, …
  } finally {
    await mcp.close();
    await fetch(`${BB}/api/machines/${id}/stop`, { method: "POST", headers: auth }); // state kept, billing drops to storage
  }
});
app.listen(3000);

Events can arrive more than once, so deduplicate on event.id before sending anything. run.failed events include the first 2,000 characters of the run's output, which is useful for alerts.

What it costs

The machine runs only between the schedule waking it and your handler stopping it. A few minutes a day on a tiny machine ($0.07 an hour) comes to well under a dollar a month, plus $0.72 a month to store it while it's off. See Billing.

Create an account to try it.

Sources

TechCrunch, Perplexity launches Comet: https://techcrunch.com/2025/07/09/perplexity-launches-comet-an-ai-powered-web-browser/
AI SDK, MCP tools: https://ai-sdk.dev/docs/ai-sdk-core/mcp-tools
AI SDK, tool calling and stop conditions: https://ai-sdk.dev/docs/ai-sdk-core/tools-and-tool-calling
Burrowbox docs, Scheduled jobs & webhooks: https://burrowbox.dev/docs/automations
Burrowbox docs, Event webhooks: https://burrowbox.dev/docs/events

Originally published on the Burrowbox blog.

Project Mariner runs ten tasks at once on cloud VMs. Fan out your own agents with LangChain

Burrowbox — Sun, 04 Oct 2026 02:49:34 +0000

What Project Mariner does

Project Mariner is Google's agent that browses and acts on websites for people. At I/O in May 2025, Google said the new version runs on virtual machines in the cloud. That lets it handle up to 10 tasks at once while people get on with other work. It launched first for U.S. subscribers to the $249.99-a-month AI Ultra plan. (TechCrunch)

The pattern

When the agent runs in the user's own browser, it does one thing at a time, and it stops when the laptop closes. Moving it to cloud machines means one machine per task. Tasks run side by side, can't interfere with each other, and keep going in the background. The machines have to be ready quickly, though, or the parallelism goes into waiting for boots.

Build it with LangChain and Burrowbox

Here, a Python job takes a list of tasks, claims a ready Burrowbox machine for each one, and runs a LangChain agent on each machine at the same time. Burrowbox isn't involved with Google.

1. Keep machines warm

A warm pool keeps booted machines waiting, so a claim returns one instantly. You can also give it a template, so each machine is already set up (here, the browser is already open on the site).

curl -X POST https://burrowbox.dev/api/pools \
  -H "Authorization: Bearer $BURROWBOX_KEY" -H "Content-Type: application/json" \
  -d '{"name": "browse", "size": "tiny", "target": 5,
       "setup": [{"type": "tool", "tool": "browser_navigate", "arguments": {"url": "https://shop.example.com"}}]}'
# → { "id": "pool_3fa91c", "ready": 0, "warming": 5, … }

2. Fan out

pip install langchain-mcp-adapters langgraph "langchain[anthropic]" httpx

import asyncio, os
import httpx
from langchain_mcp_adapters.client import MultiServerMCPClient
from langchain.agents import create_agent

BB = "https://burrowbox.dev"
POOL_ID = os.environ["POOL_ID"]
auth = {"Authorization": f"Bearer {os.environ['BURROWBOX_KEY']}"}

async def run_task(http: httpx.AsyncClient, task: str) -> str:
    # A fresh machine for this task; it's deleted afterwards (and destroyed on expiry as a backstop).
    m = (await http.post(f"{BB}/api/pools/{POOL_ID}/claim", headers=auth,
                         json={"ttlMinutes": 30, "onExpire": "destroy"})).json()
    try:
        mcp = MultiServerMCPClient({
            "machine": {
                "transport": "http",
                "url": m["mcpUrl"],
                "headers": {"Authorization": f"Bearer {m['mcpToken']}"},
            }
        })
        agent = create_agent("anthropic:claude-opus-5-5", await mcp.get_tools())
        result = await agent.ainvoke({"messages": task})
        return result["messages"][-1].content
    finally:
        await http.delete(f"{BB}/api/machines/{m['id']}", headers=auth)

async def main():
    tasks = [
        "Find the price of the 2 kg bag of espresso beans on shop.example.com",
        "Check whether shop.example.com ships to Portugal and what it costs",
        "List the three newest grinders on shop.example.com with prices",
    ]
    async with httpx.AsyncClient(timeout=120) as http:
        for task, answer in zip(tasks, await asyncio.gather(*(run_task(http, t) for t in tasks))):
            print(f"## {task}\n{answer}\n")

asyncio.run(main())

Each agent gets the machine's tools (browser_navigate, browser_snapshot, browser_click, browser_fill, shell_run, …), scoped to that machine by its token.

Some details from the docs:

Claims never reuse a machine. A claimed machine is brand new, and the pool refills itself in the background. If the pool is empty, the claim boots a new machine in a few seconds ("fromPool": false).
Tag claims with externalId if the tasks belong to different customers. GET /api/usage?groupBy=externalId then shows what each customer cost.
To watch a run, create a live-view link for any machine. Use mode: "browser" to see just the browser.

What it costs

Idle pool machines are billed like running ones: a pool of 5 tiny machines costs about $0.35 an hour. Each task machine costs $0.07 an hour, charged by the minute, until you delete it. Set the pool's target to match how many tasks you usually run at once, or 0 outside working hours (PATCH /api/pools/{id}). See Billing.

Create an account to try it.

Sources

TechCrunch, Google rolls out Project Mariner: https://techcrunch.com/2025/05/20/google-rolls-out-project-mariner-its-web-browsing-ai-agent/
langchain-mcp-adapters README: https://github.com/langchain-ai/langchain-mcp-adapters
Burrowbox docs, Warm pools: https://burrowbox.dev/docs/pools

Originally published on the Burrowbox blog.