Skip to content
Burtson Labs

Bandit Stealth for Chrome

A browser extension that connects the Bandit coding agent on your computer to your browser. When you ask Bandit to do something on a web page, such as reproduce a bug on your staging site, read a dashboard you are signed in to, or fill in a form, it does it in browser tabs you can see, on sites you have allowed.

Install

The extension needs the Bandit CLI on the same computer, with Node.js 20 or later.

  1. Install Bandit Stealth for Chrome from your browser's extension store.
  2. Install the Bandit CLI: npm i -g @burtson-labs/bandit-stealth-cli
  3. Register the extension with the CLI: bandit chrome install
  4. Reopen the browser.

Interactive bandit sessions connect to the extension by themselves; /chrome connect attaches a session that is already running. The same extension works in Microsoft Edge, Brave and other Chromium browsers. Incognito windows are not supported.

How it works

  • The agent, the model and the approval prompts run in the Bandit CLI on your computer. The extension is the browser side: it reads pages, clicks, types and selects, and shows what it is doing.
  • It talks to the CLI through the browser's native messaging. The extension makes no network requests of its own: no analytics, no crash reporting, no relay server.
  • Page content the agent reads goes to the CLI, which sends it to the model provider you chose in Bandit. With a local model (Ollama), nothing leaves your computer.

What you control

  • Sites: no site is granted at install. You grant sites one at a time in the side panel, and revoke them there.
  • Tabs: the agent works only in its own tab group, named "Bandit", and cannot see or touch your other tabs.
  • Approvals: the CLI asks before the first visit to a new host and before clicks and typing on a site, until you allow that site. Sending, submitting, paying, publishing and deleting ask every time.
  • Stop: a Stop Bandit control on the page and in the side panel ends the current task at once.
  • The extension never reads or types into password, one-time-code or payment fields, and never clicks Allow on sign-in or consent screens.

Details of what the extension reads, where it goes and what is stored are in the privacy policy for Bandit Stealth for Chrome.

Support

Email team@burtson.ai with the browser and its version, the output of bandit --version, and what happened. Security issues: see Security and trust.

Bandit is made by Burtson Labs. The CLI and the extension are Apache-2.0. More about Bandit Stealth is on burtson.ai/stealth.