OnlyRead

Look all you want. Touch nothing.

The read-only mode for AI agents in the browser. Hand any agent that drives your browser your real inbox, calendar and work tools: reads pass, and every send, post, like, edit, delete or settings change is refused before it leaves the browser.

Website · Quick start · How it works · Works with · Supported sites · Roadmap · Limits · Contributing

Why

Browser agents such as Claude in Chrome work inside your real, signed-in accounts. That is what makes them useful, and it is also the risk: one misread instruction, or one prompt injection hidden in an email or a web page, and the agent sends, posts, deletes or changes something in your name.

Asking the model to be careful is not a guarantee. OnlyRead enforces it below the model, at the network layer: the agent can read everything it needs, and what it tries to change is refused before it leaves the browser (what isn't covered yet).

Quick start

1. Add OnlyRead to Chrome. It works in any Chromium browser that installs Chrome extensions. Or download onlyread-<version>.zip from the latest release, unzip it, and load its onlyread/ folder unpacked in chrome://extensions (Developer mode). Each release lists the SHA-256 of both zips, the same build as the store's.
2. In the window that opens, choose the AI judge: sign in to OnlyRead Pro, or paste your own OpenRouter or Vercel AI Gateway key.
3. In the settings, switch on the sites your agent may use.

By default OnlyRead guards while an AI agent is working in the browser and stays out of the way otherwise. To guard all the time, choose Always under Security in the settings, and set a settings PIN.

	🔑 Your own key	⭐ OnlyRead Pro
💸 Cost	Free, you pay the gateway for what you use	1,000 free judged requests
⚙️ Setup	Paste an OpenRouter or Vercel AI Gateway key	Sign in
📡 Where uncertain requests go	The gateway you chose, on your key	The OnlyRead Pro service
🧠 Models	Jev decides, Claude reviews what Jev can't settle	The same two models and the same decision logic, run for you

How it works

flowchart TB
    A([Request to a guarded site]) --> R{1 · Rules}
    R -- other --> D{2 · Site decoder}
    D -- other --> C{3 · Verdict cache}
    C -- unknown --> J{4 · AI judge}
    R -- plain read, telemetry --> S([✅ Sent])
    C -- known read --> S
    J -- read --> S
    R -- write-only method, upload, socket --> X([❌ Refused])
    D -- write, by name --> X
    C -- known write --> X
    J -- "write, unsure or unavailable" --> X

1. Rules. Methods that only write, form posts that navigate, uploads and beacons are refused outright. Realtime sockets are decoded where OnlyRead knows the app's protocol, and refused when it can't. Plain reads and known telemetry pass.
2. Per-site decoders. Apps that send reads and writes through one endpoint (Google's sync channels, LinkedIn server actions, Facebook GraphQL) are decoded, so each operation is recognized by name.
3. Verdict cache. Every tested site ships with reviewed verdicts for the endpoints it uses, labeled from recorded test sessions.
4. The AI judge answers "does this request change data on the server?" for whatever is left. A second model reviews what the first can't settle. Unsure, or no judge reachable, means refused. The judge is tested on real requests recorded from the supported sites, but like any AI model it can still get one wrong. That is why rules, decoders and reviewed verdicts settle most requests before it is asked.

Most requests never reach a judge. The judge sees only the request in question (its address and a short preview of its body, with passwords, tokens and card numbers removed), never cookies, headers, responses or the page (PRIVACY.md). While an agent works, it can't switch OnlyRead off or lower its settings. OnlyRead sees requests through Chrome's debugger API, which is why Chrome shows its "started debugging this browser" banner while it is attached. Details in docs/ARCHITECTURE.md.

Works with

OnlyRead guards the browser, not a particular agent. Any agent that acts in a Chromium browser with OnlyRead installed is covered: agent extensions, AI browsers and automation frameworks alike.

Using another agent? If it drives a Chromium browser that installs Chrome extensions, it's covered. Tell us how it went.

Supported sites

OnlyRead doesn't depend on per-site rules to work. Every request to a guarded site goes through the same rules and AI judge, which ask one question: does this change data on the server? So a site we haven't tested is very likely to work too. You can guard any site from the settings page or with Guard this site in the popup.

This is the beginning of the README. Read the rest at the original. Read the full README ↗