OpenSidekick

Your browser agent shouldn't be locked to one AI company.

OpenSidekick is an open-source AI agent that lives in Chrome's side panel, reads the page you're on, and acts on it — click, type, fill forms, navigate, work across tabs — using any model you choose. OpenRouter, OpenAI, Claude, Gemini, Groq, Venice AI, or a fully local model in Ollama / LM Studio. Your keys stay in your browser. MIT licensed. No account, no telemetry, no middleman.

How it compares

	OpenSidekick	Claude for Chrome	Perplexity Comet
Open source (MIT)	✅	❌	❌
Bring your own model	✅ any provider	❌ Claude only	❌ Perplexity only
Run a fully local model	✅ Ollama / LM Studio	❌	❌
Keys & data stay in your browser	✅	❌	❌
No account required	✅	❌	❌
Reads & acts on the page	✅	✅	✅
Cost	Free — your own API keys	Paid plan	Paid plan

Comparison reflects each product as of 2026; corrections welcome via PR.

---

Why this exists

Anthropic's "Claude for Chrome" is a capable agentic browser assistant, but it's tied to Claude, requires a paid Claude plan, and is closed source. Existing open-source alternatives each miss something: some are unmaintained, some can't use local models, and the best-maintained one (Page Assist) is a chat sidebar with no agentic control.

OpenSidekick aims to be the piece that's missing: maintained, MIT-licensed, genuinely agentic, and usable with any LLM — including fully local models.

Features

• Side-panel chat that's aware of the current page. Replies render Markdown: tables, lists, and code blocks with syntax colours and a Copy button.
• Agentic browser control — reads an accessible map of the page and clicks, types, selects, scrolls, hovers, double/right-clicks, drags, and presses keyboard shortcuts, all by element reference.
• Vision (on by default) — the agent can capture a screenshot so a multimodal model can see the page (images, canvas apps, visual layout). Turn it off in Settings if you use a text-only model.
• Optional developer tools — read the page's console messages and network requests to debug ("why is this page erroring?"), and a run-JavaScript escape hatch for when the other tools aren't enough. Both opt-in in Settings.
• Multi-tab — list, open, and switch tabs to complete a task.
• Any provider, any model via two protocols:
  • OpenAI-compatible (/chat/completions): OpenRouter, OpenAI, Google Gemini, Groq, Venice AI, Together, DeepSeek, Ollama, LM Studio, or any custom endpoint.
  • Anthropic Messages API (direct from the browser).
• Safety layer — three autonomy modes: plan-first (the agent proposes a plan and the sites it will use, and waits for your approval before acting), ask before acting, or auto — switchable in one click from the Approval selector right under the chat box (no trip to Settings). An only-allowed-sites mode locks the agent down to domains you trust: on any other site it won't even read the page without asking first (even in auto), and the site chip under the chat box shows the current site's rule with a two-click trust/block toggle. Plus a visible on-page activity indicator with a Stop button so you always see when it's acting; a re-check that blocks an action if the page changed origin since it was last read (defends against redirects / injected navigation); forced confirmation on purchase/delete-type clicks even in auto mode; and prompt-injection flagging of page content. Sensitive sites (banking, payments, crypto) always confirm per action.
• Smart checks (optional, beta) — a second opinion from TypeSafe's Jev decision model where the built-in patterns are thin: confirm risky actions before they happen (even in auto), classify page text for hidden instructions aimed at the agent, and let scheduled tasks notify you only when the result actually changed. Needs an OpenRouter or TypeSafe key, is off until you switch it on, and can only ever add a confirmation — the built-in checks stay in place either way.

Install

Easiest — Chrome Web Store: click Add to Chrome, then pin OpenSidekick and press Ctrl+E / Cmd+E to open the side panel.

From source (unpacked)

1. Clone or download this repository.
2. Open chrome://extensions in Chrome (or Edge / Brave — any Chromium 116+).
3. Turn on Developer mode (top-right).
4. Click Load unpacked and select this folder.
5. Pin OpenSidekick and click it (or press Ctrl+E / Cmd+E) to open the side panel.

The icons ship pre-generated. If you edit scripts/generate-icons.mjs, run npm run icons (Node only, no dependencies) to rebuild them.

Configure a model

Open Settings (the ⚙ in the side panel, or the extension's options page) and add a provider:

Provider	Base URL	Notes
OpenRouter (recommended)	https://openrouter.ai/api/v1	One key, hundreds of models.
OpenAI	https://api.openai.com/v1
Anthropic	https://api.anthropic.com/v1	Uses the direct-browser access header.
Google Gemini	https://generativelanguage.googleapis.com/v1beta/openai	OpenAI-compatible endpoint.
Groq	https://api.groq.com/openai/v1	Very fast open-weight models.
Venice AI	https://api.venice.ai/api/v1	Privacy-focused; open-weight + frontier models.
TypeSafe (Jev)	https://api.typesafe.ai/v1/systemone	Smart checks only — a decision model, not a chat model; set it up in Settings → Smart checks (see below).
Ollama (local)	http://localhost:11434/v1	No key. Needs OLLAMA_ORIGINS, see Using a local model.
LM Studio (local)	http://localhost:1234/v1	No key. See Using a local model.
Custom	your URL	Anything speaking /chat/completions.

Paste your API key, click Fetch models (or type a model id), select the provider, and you're ready.

Under the Model field, each preset shows up to two Suggested models as one-click chips that fill the field (muted when the provider's fetched list doesn't include them). A chip also runs the model test when the provider has an API key or a local (loopback) base URL; otherwise it shows a hint to add your key. The suggestions are as of October 2026; the live list is at opensidekick.app/models. The side panel shows the active model and provider as a chip under the top bar; click it to open Settings.

Tool use / agentic actions require a model that supports function calling. Most hosted models do. For local models via Ollama, pick a tool-capable model (e.g. qwen3-vl:8b-instruct, llama3.1). Models without tool support still work for chat and summarization.

Using a local model (Ollama, LM Studio)

Ollama refuses requests from browser extensions until you allow them. The sign: Fetch models or the model test in Settings fails with a 403, even though http://localhost:11434 opens in a tab and says "Ollama is running". Set OLLAMA_ORIGINS where Ollama runs, then restart it:

How you run Ollama	Do this
macOS app (menu bar)	launchctl setenv OLLAMA_ORIGINS "chrome-extension://*", then quit and reopen Ollama (again after each reboot)
Windows app (tray)	Quit Ollama from the tray → search the Start menu for "environment variables" → Edit environment variables for your account → under User variables click New…, name OLLAMA_ORIGINS, value chrome-extension://* → start Ollama again
Linux (systemd)	sudo systemctl edit ollama.service, add [Service] and Environment="OLLAMA_ORIGINS=chrome-extension://*", then sudo systemctl daemon-reload && sudo systemctl restart ollama
Terminal (macOS/Linux)	Quit the Ollama app if it is running, then OLLAMA_ORIGINS="chrome-extension://*" ollama serve
Docker	add -e OLLAMA_ORIGINS="chrome-extension://*" to your docker run

To allow only OpenSidekick, use its id instead of *: chrome-extension://idffinkmnnajgpjjonpmmaikjbpjmngk is the Web Store build (an unpacked build has its own id, shown on chrome://extensions). Separate several values with commas and no spaces; they add to Ollama's defaults. Reference: the Ollama FAQ.

When the Settings test or Fetch models gets the 403, it now says that Ollama blocked the extension and points here.

Pick the instruct build. On Ollama, the plain qwen3-vl, qwen3-vl:8b and qwen3-vl:30b tags are the thinking builds. They spend the whole reply thinking, so OpenSidekick gets no answer and no tool call, and the Settings test says "spent the whole budget thinking". Pull qwen3-vl:8b-instruct (about 6 GB) or qwen3-vl:30b-a3b-instruct (about 20 GB) instead, for example ollama pull qwen3-vl:8b-instruct. Thinking can't be switched off on the thinking builds (ollama/ollama#16945).

LM Studio: start the server in the Developer tab. If Fetch models or the model test fails while the server is running, switch on Enable CORS in the server settings, or start the server with lms server start --cors.

Smart checks (optional)

Settings → Smart checks turns on optional yes/no safety verdicts from TypeSafe's Jev decision model. Pick a key source — one of your OpenRouter providers' keys (requests go to openrouter.ai/api/alpha/decisions), or a TypeSafe key from console.typesafe.ai (requests go to api.typesafe.ai/v1/systemone) — switch on the checks you want (risky-action confirmation, page-text injection classifier, change-only notifications for scheduled tasks), and press Test to see a live request answer. Everything is off by default; if a check is off, fails, or times out, the built-in checks apply unchanged. PRIVACY.md lists what each check sends.

How it works

 Side panel (chat UI)
        │  user task
        ▼
 Service worker ──► Agent loop ──► your LLM provider (streaming)
        │                │  tool calls
        │                ▼
        │           Tools (navigate, tabs) + Content script (read/act on page)
        ▼
 Permission prompts ◄────┘  (for actions on new / sensitive sites)

1. You type a task. The service worker sends it to your model with a set of browser-control tools.
2. The model calls tools like read_page (which returns a compact map of interactive elements, each with a numeric ref) and then click_element, type_text, navigate, etc.
3. The content script executes those actions on the page and returns results.
4. Mutating actions on a new site trigger a permission prompt (unless you're in "auto" mode); sensitive sites always ask per action.
5. The loop continues until the model calls finish or has nothing left to do.

Safety & privacy

• Your keys never leave your browser except in the request to the provider you configured. There is no OpenSidekick server and no analytics.
• Chat history (on by default) keeps your messages and the replies in this browser only; anything you paste into a prompt, such as a password, is saved with the chat, so delete that chat afterwards. Continuing a saved chat sends its earlier messages to the model you are using now. Turn it off in Settings → Chat history.
• Smart checks (optional, off by default): switching them on in Settings → Smart checks adds a second destination for short page extracts — the decision endpoint you pick, either https://openrouter.ai/api/alpha/decisions (with one of your OpenRouter keys) or https://api.typesafe.ai/v1/systemone (with a TypeSafe key). Nothing goes there until you add a key and turn a check on, and PRIVACY.md lists exactly what each check sends. A check can only ever ask you to confirm something the built-in rules would have let through — it can't relax a confirmation, unblock a site, or override the built-in prompt-injection patterns. If one is off, fails, or times out, the agent behaves exactly as it does with Smart checks disabled. The page-text check never runs on a site matched by the built-in sensitive-site list, and "only notify when the result changed" is beta: it compares the model's own wording of a scheduled task's result, so a reworded but unchanged answer can still count as a change.
• The agent uses your real logged-in sessions, like any human clicking in your browser. Start on trusted sites, watch what it does, and use "ask" mode.
• Prompt-injection awareness: the system prompt instructs the model to treat page content as untrusted and never follow instructions embedded in pages. This is a mitigation, not a guarantee — review actions on important sites.
• Sensitive sites (banks, payment processors, crypto exchanges) always require per-action confirmation and can't be "always allowed."
• The agent will not attempt to bypass logins or CAPTCHAs — it pauses and asks you to handle them.

See PRIVACY.md for the full data-handling statement.

Limitations (v0.1)

• Actions are DOM-based (synthesized events), which works on most sites but can miss elements inside closed shadow DOM, cross-origin iframes, or <canvas> apps.
• Restricted pages (chrome://, the Chrome Web Store, PDFs) can't be read or acted on.
• Scheduled/long tasks depend on the service worker staying alive; very long idle waits can be suspended by Chrome.

Roadmap

Shipped since the first cut:

• Vision — on-demand screenshots for multimodal models (Settings toggle)
• Fuller action set — hover, double-click, right-click, drag, keyboard shortcuts
• Run-JavaScript escape hatch (opt-in)
• Read console errors + network requests via Chrome's debugger (opt-in)
• On-page activity indicator with a Stop button
• Prompt-injection flagging + pre-action domain re-check + sensitive-action confirmation
• Plan-approval mode (agent proposes steps + sites, you approve before it acts)
• Saved prompts / slash commands (/)
• Scheduled and recurring tasks (with result notifications)
• Workflow recording & replay
• Connect to MCP tool servers (extend beyond the browser)
• Prompt-injection classifier on untrusted content (optional Smart check, Jev)

Planned, to reach and exceed feature parity with vendor-locked assistants:

• Upload files into file inputs (via the debugger)
• CDP-based trusted input for tougher sites
• Firefox (WebExtensions) build

Contributions welcome — see CONTRIBUTING.md.

Development

No build step and no npm runtime dependencies. Everything is plain ES modules loaded directly by Chrome. The two vendored libraries, markdown-it and Prism, are plain files in src/common/vendor/.

npm run icons   # regenerate PNG icons (Node only)
npm run check   # syntax-check all JS
npm run zip     # package a store-ready zip

Project layout:

manifest.json                 MV3 manifest
src/common/constants.js       shared config, presets, message types
src/common/markdown.js        chat Markdown: markdown-it + the link/image policy
src/common/vendor/            vendored libraries, pinned and byte-verified
src/background/
  service-worker.js           message routing, conversation state
  agent.js                    the agentic tool-calling loop
  providers.js                OpenAI + Anthropic adapters, SSE streaming
  tools.js                    browser-control tool defs + execution
  permissions.js              per-site permission logic
  storage.js                  chrome.storage wrapper
  sessions.js                 chat history: what is saved, caps, titles (pure)
src/content/content-script.js page reading (element map) + action execution
src/sidepanel/                chat UI
src/options/                  settings UI
scripts/generate-icons.mjs    dependency-free PNG icon generator

License

MIT © OpenSidekick contributors.