
Security News
Ruby's Bundler 4.0.18 Extends Cooldown to bundle lock and bundle cache
The supply chain control that delays freshly published gems now covers lockfile generation and gem vendoring in Ruby projects.
web-task-api
Advanced tools
Browser-task runtime for MCP and HTTP automation with runs, sessions, and recipes.
web-task-api is a generalized browser-task runtime for projects that want to treat websites like programmable APIs.
For MCP discovery and host UI, the human-facing title should be Web Task. The package and registry IDs stay web-task-api for compatibility because the same package ships both the HTTP API and the MCP server.1
It exposes one API for:
The same runtime now ships in two surfaces:
.nvmrcpackage.json#packageManager6.0.x.git-hooks/This rollout intentionally treats the Node 24 line as the checked support floor.
Standard commands:
./scripts/bootstrap.sh
./scripts/check.sh
./scripts/fix.sh
./scripts/test.sh
./scripts/bootstrap.sh installs dependencies and Playwright.
Instead of building one brittle adapter per website, this project uses an agent-first browser runtime:
That gives a more future-proof foundation for “API for any site” style automation.
For Dexscreener/GMGN, treat the shipped recipes as starter recipes, not guaranteed turnkey integrations yet. A warmed persistent browser source is often required because fresh headless sessions can hit Cloudflare or similar anti-bot checks. The runtime now fails fast for these protected-site recipes unless you provide one of:
request.profileBROWSER_USER_DATA_DIRsessionId for a warmed session that already preserves browser storage across tasksInstall dependencies:
./scripts/bootstrap.sh
Start the HTTP API:
npm run dev
Or start the MCP server:
npm run dev:mcp
Run the demo flow:
npm run demo
The package now exposes the MCP server binary directly:
npx -y web-task-api
That launches the stdio MCP server.
The HTTP runtime remains available separately:
npx -y -p web-task-api web-task-api-http
webtask_run — start a new browser task from a goal and optional URLwebtask_get_task — inspect one persisted task runwebtask_list_tasks — discover recent persisted task runs before fetching one in detailwebtask_list_models — inspect the catalog-backed planner models and supported variantswebtask_list_recipes — list reusable starter recipes before a runwebtask_create_session — create continuity for related taskswebtask_list_sessions — list saved continuity sessionswebtask_get_session — inspect one saved session and its recent historywebtask_update_session — update session metadata like name, notes, or defaultswebtask_health — inspect runtime readiness, planner availability, and inventory countsTool-selection guidance follows MCP best practice: use human-readable titles/descriptions, make the “when should I use this tool?” boundary explicit, and publish accurate behavior hints instead of vague marketing copy.3
examples/claude.mcp.jsonexamples/opencode.jsonPOST /v1/tasks/runRuns a browser task synchronously and returns structured results.
Example request is in examples/demo-task.json.
GET /v1/tasks/:taskIdReturns the persisted run record with step trace and artifact paths.
GET /v1/tasksLists recent persisted task summaries with optional status, sessionId, and limit filters.
GET /v1/recipesLists registered recipes.
GET /v1/modelsLists the catalog-backed planner models and supported thinking variants. On this machine the runtime prefers the shared work-atlas catalog when present and falls back to the bundled snapshot otherwise.
POST /v1/sessionsCreates a reusable session for connected tasks. Sessions can carry:
GET /v1/sessionsLists saved sessions.
GET /v1/sessions/:sessionIdReturns session metadata and recent task history.
PATCH /v1/sessions/:sessionIdUpdates session metadata like notes, default start URL, or the bound profile for an existing profile-mode session. Guest sessions cannot be rebound into named profiles by patch.
GET /healthReturns a readiness snapshot with planner availability, storage roots, defaults, and recipe/session/task counts.
Software can use the bundled client:
import { WebTaskApiClient } from "web-task-api";
const client = new WebTaskApiClient({ baseUrl: "http://127.0.0.1:4317" });
const session = await client.createSession({
name: "axiom trader",
mode: "profile",
profile: "axiom",
notes: "Authenticated Axiom trading session",
});
const result = await client.runTask({
goal: "Extract token name and price",
startUrl: "https://example.com",
sessionId: session.id,
agent: { kind: "auto" },
});
const recent = await client.listTasks({ sessionId: session.id, limit: 5 });
const health = await client.health();
Sessions let related web tasks share:
Example pattern:
axiom profilesessionIdGuest sessions also work: create a mode: "guest" session and repeated tasks will preserve browser storage between runs under that session ID.
For protected recipes, that guest session still needs to be warmed first before you rely on it as a continuity source.
To create a reusable login profile:
npm run profile:login -- --id my-profile --url https://example.com/login
This opens a real persistent browser profile. Log in manually or solve bot challenges, then press Enter in the terminal. The runtime saves a reusable Chromium user-data directory at <data-root>/profiles/<id>/user-data-dir and later tasks can use "profile": "my-profile".
This matters for sites like Dexscreener or GMGN that may block fresh headless sessions behind Cloudflare or similar anti-bot checks.
If you want the runtime to behave as closely as possible to your normal local Chrome, you can also point it at an existing browser profile:
BROWSER_USER_DATA_DIR=/path/to/your/chrome/profileThat is the closest match to “it works in my Chrome already”.
By default the runtime keeps mutable data out of the ambient working directory:
~/.local/share/web-task-api~/Library/Application Support/web-task-api%LOCALAPPDATA%\web-task-apiUnder that data root the runtime writes:
profiles/<id>/user-data-dirruns/<taskId>/...sessions/<sessionId>.jsonBundled starter recipes are read from the installed package's recipes/ directory, not from the current shell cwd.
Useful overrides:
WEB_TASK_API_DATA_DIR — custom mutable data rootWEB_TASK_API_RECIPES_DIR — custom recipes directoryWEB_TASK_API_TEMP_DIR — custom temp root used when the incoming temp env points at your home/cwdThis is the default non-mock path for the local stack.
Useful environment variables:
WEB_TASK_API_MODEL — shared default planner model, default deepseek/deepseek-v4-flashWEB_TASK_API_VARIANT — shared default planner thinking variant, default highWEB_TASK_API_PI_URL — default http://127.0.0.1:8793WEB_TASK_API_PI_MODEL — optional PI-specific model overrideWEB_TASK_API_PI_VARIANT — optional PI-specific thinking variant overrideExample:
{
"agent": {
"kind": "pi"
}
}
CLIProxyAPI is treated as a multi-provider router, not a single-provider API key wrapper. You can point this product at any model alias/provider path exposed by your CLIProxy setup.
Useful environment variables:
CLIPROXY_BASE_URL — default http://127.0.0.1:8317/v1CLIPROXY_AUTH_TOKEN — optional client token if your CLIProxy instance requires oneCLIPROXY_MODEL — planner model alias/name exposed by your proxy, for example whatever provider/model mapping you configured thereExample:
{
"agent": {
"kind": "cliproxy"
}
}
autoIf you want the runtime to pick the best available planner automatically, use:
{
"agent": {
"kind": "auto"
}
}
auto probes the local PI engine first. If that lane is unavailable, it falls back to CLIProxy when reachable and model-configured, then to OpenCode as the last compatibility path. Catalog-backed provider/model selections stay on the PI/OpenCode lane instead of being reinterpreted as CLIProxy aliases. This path is verified locally against the fixture flow; for real sites, treat it as the recommended runtime path, not a guarantee that every protected site will work without profile warmup.
If you already run OpenCode headless and want to reuse that stack, the project also supports an OpenCode planner adapter.
Useful variables:
OPENCODE_BASE_URLOPENCODE_MODEL — optional OpenCode-specific model override, defaulting to WEB_TASK_API_MODELThen use:
{
"agent": {
"kind": "opencode"
}
}
Per-call overrides stay available through the API, client, and MCP tools. Example:
{
"agent": {
"kind": "opencode",
"model": "openai/gpt-5.4",
"variant": "high"
}
}
docs/design.md — architecture, decisions, and implementation plandocs/releasing.md — tag-driven release flow and MCP registry packaging notessrc/ — server, runtime, agent, browser, and storage codetests/ — end-to-end verification with a local fixture sitescripts/ — demo runner and profile bootstrapserver.json is the MCP registry metadata source of truth; package.json carries the npm package and executable metadata. ↩
docs/design.md for the detailed system design, tradeoffs, and roadmap. ↩
Model Context Protocol, "Tools" specification and tool-annotation guidance — titles, descriptions, JSON Schema field descriptions, and accurate hints improve host UX and tool selection. ↩
FAQs
Browser-task runtime for MCP and HTTP automation with runs, sessions, and recipes.
The npm package web-task-api receives a total of 38 weekly downloads. As such, web-task-api popularity was classified as not popular.
We found that web-task-api demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The supply chain control that delays freshly published gems now covers lockfile generation and gem vendoring in Ruby projects.

Security News
During a UK cyber test, a Mythos 5 agent used sockpuppets, social engineering, and prompt injection to try to get a maintainer to merge malware.

Company News
Socket is now in the AWS Security Hub Extended plan. Adopt it through AWS, apply committed spend, and block malicious open source packages.