The browser that does the work.
Tepegöz understands a page, plans the steps, and carries them out across real tabs — while every action stays visible, reversible, and yours to stop. Your own AI key. Your own machine. No account required.
Pre-release. Builds are signed and downloadable, but this is early software: there has been no independent security audit, and the automation has not been independently benchmarked. What that means
Transcript
One take of a real run, on live websites. Nothing here is staged.
The task goes into the Agent Console, in plain language.
The plan comes first: every tool it means to call, and the reason for it. Uncheck a step and it never runs.
It searches, finds the thread, and stops before opening it.
That address came from text the agent read, not from the person who asked. The kernel calls that a tainted side effect, and will not act on it quietly.
Approved, it opens the page, checks what actually loaded, and answers. Your key, your machine, your rules.
ask autonomy — nothing sped up and nothing cut. It stops once, because the address it was about to open came from text it had read rather than from the person who set the task. The gates were answered by the capture harness, not by a person. A longer run is replayed in full — a different capture, which also fails a step and recovers.The problem
Most "AI browsers" bolt a chat panel onto Chromium.
You still do the clicking. The assistant summarizes the page you are already reading and hands the work back to you. When one of them does act, you usually cannot see what it did, cannot stop it mid-step, and find out it went wrong when something has already been sent, bought, or deleted.
Tepegöz is built the other way around: an agentic core that can drive the browser end to end, inside a deterministic security kernel so that autonomy never means losing control.
Three commitments
Promises the product can be held to.
Each one is a mechanism you can read in the source, not a value statement.
Local-first
The full experience runs on your machine with your own AI key — Anthropic, OpenAI, Gemini, Kimi, or a model running entirely offline on your own hardware. There is no managed backend to depend on and no account to create. A hosted tier may exist later; it will never be required.
Security by design
Web pages and the renderer are treated as untrusted. A rule-based policy kernel classifies every tool call before the model runs, an egress firewall blocks data from leaving to places it should not, and banking, crypto, health and password-manager sites ship switched off, and only you can enable them.
Observable and reversible
Every action lands in an append-only event journal. Irreversible steps — money, credentials, deletion — stop and ask you first, and the decision is enforced in the privileged process, not in the window you are looking at. You can always see what happened and why.
What it actually does
Ask, review the plan, watch it run.
Ask in plain language.
Open the Agent Console — the Agent panel in the toolbar — and describe the goal in the box at the bottom, in English or Turkish.
See the plan before it runs.
Steps are laid out and labelled by what they touch: read, state-changing, destructive, financial.
Watch it work.
The live console shows the page it is on, the action it took, what it observed, and what it cost.
Keep the wheel.
Anything irreversible stops and asks. You can interrupt at any step, and the whole run is replayable afterwards.
A chaptered recording: a confirmation gate firing, and a recovery from failure
The recording at the top of this page is a real run, but it is a fully autonomous one — the mode in which, by design, nothing stops to ask. What is still owed is a longer capture of a task on a real site, chaptered against the four steps above: the plan before it runs, an irreversible step stopping for a decision, and the agent carrying on after something breaks. The clean run is the easier one to record and the less honest one to show, so this stays until the harder one exists.
A browser, first
Not an assistant bolted on.
Tepegöz is a browser first, and it behaves like one. Tabs and tab groups, bookmarks with a real manager, history, a download manager with quarantine, find-in-page, profiles, native context menus. The address bar is deterministic — it navigates or searches, and it never quietly starts an AI conversation because it thought that is what you meant.
Nine first-party extensions ship with it: ad and tracker blocking, macros, translation, writing assistance, a strict popup blocker, a user-agent switcher, a unified video player, scheduled tasks, and the agent itself.
Privacy
A mechanism, not a promise.
Telemetry is off. Your API keys are encrypted by the operating system's own keychain and never leave the privileged process — not into a log, not into a bundle, not into a prompt. And a tab or an entire tab group can be routed through its own WireGuard tunnel or through Tor, including Tor over VPN, with a fail-closed kill switch: if the tunnel drops, that tab stops rather than quietly falling back to your real connection.
Open source
And the licence means it.
Tepegöz is AGPL-3.0. The whole browser — the security kernel, the agent runtime, the extensions — is readable, forkable, and auditable. The licence is deliberately strong: nobody gets to take this, close it, and run it as a service without giving the same freedom back.
Where this is honest
What we have not proven yet.
Every capability of the agent competence program is built and none of it is independently measured — the benchmark spend has not been paid, and until it is, "our agent is better" is a sentence this project will not write. No independent security audit has been performed. Several capabilities ship deliberately switched off.
All of it is written down, per phase, with what is missing and why.
The name
Named for a giant with one eye.
Tepegöz is the one-eyed giant of Turkic mythology, the monster of the Book of Dede Korkut. The single eye is the point: one agent, one focused gaze on the page, acting deliberately instead of blindly.
Build it, break it, tell us what broke.
Tepegöz is pre-release and built in the open. The most valuable thing you can do right now is run it and report what fails.