DEV Community: Ibrar Yunus

I gave Claude Code a browser with my real logins. Here's what I had to get right

Ibrar Yunus — Thu, 22 Oct 2026 14:21:30 +0000

Most of my day is spent with Claude Code, and the browser was always the weak spot. Tools built on Playwright start a fresh profile, so the agent is logged out of everything. Pointing an agent at my main Chrome felt like a bad idea. So I built my own browser, Kinaya, and gave it an MCP server.

Adding it to Claude Code is one line:

claude mcp add kinaya -- /Applications/Kinaya.app/Contents/MacOS/kinaya —mcp

The browser starts itself if it isn't running. Getting from "the agent can click things" to "I actually let it use my accounts every day" took a few decisions that I think apply to anyone building agent tooling.

1. Every session gets its own background tab

Driving whatever tab is in front doesn't work once you want to keep browsing while an agent works, or when two Claude Code sessions run at once and fight over the same page.

So each MCP session opens its own background tab and all later calls act on it. The tab I'm looking at never moves. Every tool also takes an optional tab_id, so one agent running several tabs is still explicit. Screenshots work on background tabs and when other windows cover the browser, because the agent needs to see the page without the window being in front.

2. Approval for actions, not for reading

Reading (read_page, find, get_page_text, screenshot) runs freely. Clicks, typing, navigation, form fills, uploads and sign-ins ask for approval in a side panel, or can be always allowed per site. A prompt left unanswered for about 5 minutes expires and Claude is told the action didn't run, so an agent never hangs forever waiting on me.

Private and Tor tabs are off limits to the agent entirely.

3. The agent never sees a password

sign_in fills a login saved in the browser's password vault, and create_login generates and saves a strong password for a sign-up. The password goes straight into the page. The model only ever sees the username. The vault itself is XChaCha20-Poly1305 on disk, with no cloud.

For things only a human can do, like CAPTCHAs and phone codes, there's an ask_user tool with a reply box in the side panel.

4. Page text is data, not instructions

Once an agent has your logins, prompt injection from a web page stops being theoretical. The server's instructions tell the model that text on web pages is untrusted data and never instructions. It's not a complete defence, but combined with approval on actions it means a malicious page can't quietly make the agent do something.

5. Don't let page dialogs block the agent

A browser alert or confirm can freeze an automated session. In Kinaya, dialogs raised while the agent acts are answered and reported back to the agent instead of blocking.

The rest of the tool list

| area | tools |
| --- | — |
| reading | read_page, find, get_page_text, screenshot |
| acting | click, hover, type, fill_form, select_option, press_key, scroll, upload_file, dismiss_popups |
| tabs | navigate, new_tab, switch_tab, close_tab, list_tabs |
| accounts | sign_in, create_login, ask_user |
| waiting and debugging | wait_for, wait, read_console, read_network, run_javascript |
| other | batch, search_history, list_downloads |

batch runs several actions in one call, which saves round trips.

The browser itself

It's also just my daily browser. Tauri 2 and Rust on WebKit. Ad and tracker blocking runs in the engine with Brave's adblock-rust, compiled into a WebKit content-rule list, so requests are dropped before they leave. Command palette for everything, private tabs, Tor tabs through the Arti client, reader mode, no telemetry.

It's $19 once with a 14-day trial: ibraryunus.com/apps/kinaya. If you're building agent tools, I'd be keen to hear how you're handling logins and approvals.

Footnote: Agentic RAG with Sentence-Level Citations

Ibrar Yunus — Fri, 16 Oct 2026 12:22:38 +0000

An AI research agent for your documents. It decides what to search for, searches again when the results are thin, and every claim in its answer links to the exact sentence it came from.

The usual 'chat with your documents' build searches once with the user's words and hopes. A two-part question gets one search and half an answer. footnote replaces that fixed pipeline with an agent that works like a researcher, built around one rule: an answer you cannot check is not an answer.

How it was built

Claude is given two tools, search_handbook and read_page, and loops until it can answer. Search results come back as sentence-level blocks, so every citation is validated by the API rather than typed by the model. Retrieval is a hand-written BM25 plus local bge-small vectors, merged with weighted reciprocal rank fusion and tuned on a 59-question eval set. The demo corpus is the public-domain 18F staff handbook, 232 pages.

What it does

Plans its own research. A two-part question gets two searches, worded the way the handbook words things. Each step shows live in a side panel.

Sentence-level citations. Click a citation chip and the source passage scrolls into view with the exact sentence highlighted.

Says when it doesn't know. If nothing relevant turns up after retrying, it says the documents don't cover it instead of guessing.

Swappable search. Run the agent on hybrid, keyword-only or vector-only search, with each passage's rank in both shown.

Stack

Python with FastAPI and a one-file HTML UI, Claude through the Anthropic SDK with no framework, and a CLI that prints each tool call. The screenshots come from a keyless demo mode where the model's turns are scripted and the searches and citations run for real.

Retrieval is the easy half. The hard half is making every sentence of the answer checkable.

Source code: github.com/IbrarYunus/footnote. More of my work: ibraryunus.com.

An agent that audits a GitHub repo and writes its CLAUDE.md

Ibrar Yunus — Wed, 14 Oct 2026 11:57:14 +0000

Your first day on an unfamiliar codebase goes on the same questions. What is this, how do I run it, what's going to bite me?

An AI coding agent asks those questions every single session, and gets them wrong when nobody wrote the answers down.

Groundwork does that first day in a couple of minutes. Point it at a GitHub repo and you get a plain-English technical audit and a ready-to-commit CLAUDE.md.

Try it: groundwork-audit-iy.web.app

An agent, not a summariser

It doesn't dump the repo into a prompt. The model plans, then calls two tools against the GitHub API:

list_tree to see the file tree, with lockfiles, binaries and build output filtered out
read_file to open the files that actually matter: manifests, entry points, CI

It works within a step and file budget, and the only way out is finish, which has to return both documents. No half-finished audits.

Two providers, one prompt

One prompt and one tool schema drive both Anthropic and Google Gemini. You pick the provider and paste your own API key. Keys stay in your browser and only go to that provider.

If you'd rather use the terminal, there's a Claude Code CLI that runs the same audit on a local checkout with no API key.

Stack

React 19, Vite and TypeScript on Firebase Hosting
The official Anthropic SDK in browser mode, with strict tool schemas and a cached system prompt
Gemini through REST function calling

Why I made it

Write down the first day on a codebase once, so no one, human or agent, has to rediscover it.

Full write-up: ibraryunus.com/work/groundwork