
Security News
Open VSX Unblocks Extension IDs Used in Malware Campaign
Open VSX has removed three extension IDs from its malicious-extension list as the legitimate publishers they impersonated move to claim the names for themselves.
@agentrhq/webcmd
Advanced tools
Turn websites, browser sessions, desktop apps, and local tools into deterministic CLI surfaces for humans and AI agents.
Self-learning browser infra for AI agents.
Webcmd learns the navigational context of websites as agents use them, then compiles that knowledge into deterministic commands for faster, cheaper, more reliable browser automation. The goal is simple: stop making agents rediscover the same sites on every run and cut browser-agent token spend by up to 90%.
On top of live browser control, Webcmd adds 3 layers of learnings. Each layer collapses cost and variance for the layer above it.
| Layer | Scenario | What Webcmd Helps With |
|---|---|---|
| 0. Live browser control | The site is unfamiliar. | Use webcmd browser to inspect, click, type, extract, capture network calls, and complete the task in a real browser. |
| 1. Sitemap memory | The site is familiar, but the action space is not fully known. | Capture an agent-facing sitemap of observed pages, states, actions, workflows, APIs, pitfalls, and fallback paths. |
| 2. CLI authoring | The action space is known, but the path is still too variable for one fixed sequence. | Explicitly author a reusable webcmd <site> adapter with structured output, so future agents spend tokens on the task instead of navigation. |
| 3. Extend existing CLIs | The workflow is deterministic enough to stop browsing. | Extend the webcmd <site> adapter with a tailored command so the workflow runs instantly with the least amount of tokens. |
For local, multi-step browser exploration, agents can send one sandboxed Playwright-style program to an existing CloakBrowser session:
webcmd browser work run --file explore.js
printf 'const page = await browser.currentPage(); return await page.title();' \
| webcmd browser work run --stdin
https://github.com/user-attachments/assets/04eceadc-d398-4303-984d-ae3197bfa664
In Codex, open Plugins, choose Add plugin marketplace, and enter either
agentrhq/webcmd or https://github.com/agentrhq/webcmd. Install Webcmd
from that marketplace, then start a new task. On first use, the plugin installs
the npm CLI automatically if webcmd is missing.
The plugin includes all seven bundled Webcmd skills. Do not also add those
skills with webcmd skills add in Codex.
Webcmd requires Node.js 20.6+.
npm install -g @agentrhq/webcmd
The npm package ships the Webcmd core and browser commands, but no site adapters. Search the plugin catalog and explicitly install the adapter you need:
webcmd plugin search <site> -f json
webcmd plugin install <installSource-from-search>
webcmd skills add
When prompted, choose Claude, Codex, another supported harness, or a custom skills path.
In your agent harness, load or tag webcmd-usage, then describe the outcome you want.
Use webcmd to research the latest discussions about browser automation across Hacker News and Reddit, then return a concise comparison with source links.
work profile to summarize unread LinkedIn messages from the last seven days and return the sender, subject or opening text, received time, and conversation URL.”webcmd reddit popular --limit 10 and keep returning the title, subreddit, score, comment count, and URL.”Use webcmd with my logged-in `social` profile to collect my recent X bookmarks and return the author, text, and URL.
The agent explores the X workflow once using the logged-in profile. It creates a stable command that returns the requested bookmark fields. Later agents reuse that command instead of repeating browser exploration; learn the pattern in X → CLI.
Beyond website adapters, Webcmd can work through authenticated browser sessions, APIs, desktop apps, and local tools.
| Group | Supported surfaces | Representative outcomes |
|---|---|---|
| research and communities | Hacker News, Reddit, PubMed | Compare current discussions, find primary research, and return concise summaries with source links. |
| social and professional | X/Twitter, LinkedIn, TikTok | Collect bookmarks, monitor public posts, or research people and creators with a named profile when needed. |
| AI tools | ChatGPT, Claude, Gemini, NotebookLM | Retrieve conversations, research outputs, notebooks, and generated materials from the tools you already use. |
| shopping and bookings | Amazon, Blinkit, Zepto, BigBasket, District, Practo | Compare products, availability, prices, appointments, events, and delivery options. |
This list is illustrative; availability comes from installed plugins. Ask your agent to search and install the relevant plugin when a site is not installed.
Webcmd Cloud can run supported commands and browser sessions on hosted infrastructure. It is in active development and is not yet stable.
| Plugin | Description | Author |
|---|---|---|
pypi | Inspect public Python package metadata, downloads, and releases from PyPI | Kemal Kaya |
skyscanner | Skyscanner flight search commands for Webcmd | Rishabh |
See CONTRIBUTING.md.
Released under the terms in LICENSE.
FAQs
Turn websites, browser sessions, desktop apps, and local tools into deterministic CLI surfaces for humans and AI agents.
The npm package @agentrhq/webcmd receives a total of 2,023 weekly downloads. As such, @agentrhq/webcmd popularity was classified as popular.
We found that @agentrhq/webcmd demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Open VSX has removed three extension IDs from its malicious-extension list as the legitimate publishers they impersonated move to claim the names for themselves.

Product
Socket’s PHP and Composer support is now in Beta for all customers, with PHP reachability analysis generally available.

Product
Socket is bringing experimental protection to Firefox, scanning 97,000+ extensions in Mozilla's official directory for malware and risky updates.