Skip to content

How it works

You give it a goal. It gives you a plan. You keep the wheel.

Tepegöz turns a sentence into steps, runs them on real pages, and shows you each one as it happens. What it is allowed to do is decided by rules, in the privileged process, before the model is ever consulted.

The four stages

From a sentence to a completed task.

Asset pending

Diagram of the trust boundary

The untrusted page on one side, the kernel and the model on the other. That boundary is the product — if a diagram is drawn, it draws the boundary.

  1. Ask

    Open the Agent Console and tell it what you want, in English or Turkish. It is the Agent panel in the toolbar, and it opens beside the page you are on: type the goal in the box at the bottom, press Enter, and the run starts in that same panel — the one that then shows you every step. The address bar stays a separate thing entirely. It navigates and searches, deterministically, and never turns a typo into an AI request. The one route from there to the agent is a command you type on purpose: @agent, then the task. Ctrl+K opens the command palette, which is a different surface again — today it runs browser commands (new tab, reopen a closed tab, reload, settings), and its Do, Make and Tasks tabs are deliberately shown empty while those modes are built. Typing a goal into the palette does not start a run.

  2. Perceive

    Before acting, the agent reads the page the way an assistive technology would: a structural pass over the live DOM that returns the elements a person could actually interact with — visible, on top, in the viewport — including inside open shadow roots and same-origin frames. Everything that comes back from a page is treated as data, never as instructions. Page text is normalized and screened for injected commands at the boundary where it enters, because a web page that can talk to your agent is a web page that can give it orders.

  3. Decide

    This is the part most agent products leave to the model. Tepegöz does not. Every tool call is classified by a deterministic policy kernel before the model runs — by tool, by argument, and by target — into one of six risk tiers: read, UI-write, data-egress, financial, credential, destructive. The tier decides what happens next: run it, ask you, or refuse outright.

  4. Act, and show its work

    Steps run on real tabs. The live console shows the page, the action, what was observed, progress, token cost, and errors — as it happens, not afterwards. Every step is written to an append-only event journal, so a finished run can be replayed and audited. When a step is irreversible, it stops and asks, with the specific action spelled out.

Two consequences of deciding in the kernel

The window you are looking at does not get a vote. Autonomy level, permissions and approvals are enforced in the main process. A compromised or manipulated page cannot approve anything on your behalf — it does not have the ability, not merely the permission.

The sensitive categories are off until you turn them on. Banking, crypto, health and password-manager surfaces — including Turkish banking and the whole gov.tr tree — sit behind a per-category grant that ships disabled. The agent cannot enable one. Only you can, and that decision is enforced in the privileged process as well.

Failure handling

What it does when things go wrong.

Real pages break agents. Layouts shift under them, elements disappear between the decision and the click, dialogs cover what they were about to press, and a bad loop can burn an hour and a budget doing the same thing forever.

  • Check mark: Stale references are caught structurally. The agent compares the page's structure against what it saw when it decided; if the ground moved, it re-reads instead of clicking into the dark.
  • Check mark: Loops are detected and stopped, and the run is handed back to you rather than left to spin.
  • Check mark: CAPTCHA and two-factor prompts are cleared automatically. Two-factor codes are completed by the credential broker, so the second factor is filled without the model ever seeing it. A challenge the browser cannot clear is handed back to you rather than retried blindly.
  • Check mark: Completion is checked, not assumed. "I clicked the button" is not the same claim as "the thing happened", and the two are separated on purpose.

A real run

Read one, line by line.

Everything above is a description. This is a run that happened: a search on a live site, a thread opened on another, two stops for approval, and a step that failed and was recovered from. It is the browser’s own event journal, replayed — not a re-enactment, and not a video you have to take on trust. It is also a different, longer run than the recording on the home page: reading a record costs you a glance, watching one costs you its full length, so the two were chosen for different jobs rather than forced to be the same capture.

Replay of a recorded agent run

A recorded run, replayed from its exported event journal.

Nothing here is live — no agent is running and this page never contacts one. It is also not a mockup: every line below is an event the product’s own journal wrote.

Captured
2026-09-04
Model
anthropic
Autonomy
ask
Outcome
finished in 2:23

No person was at the keyboard: 3 gates were answered by the capture harness, by clicking the product’s own buttons.

The task

Search for reddit discussions about Electron app memory usage, open the reddit.com result, and tell me the thread title and roughly how many comments it has.

https://duckduckgo.com/

The plan it proposed — 7 steps, each with its reason

Find reddit discussions about Electron app memory usage via web search, open the reddit.com result, and report the thread title and approximate comment count.

  1. 1.web_search_itemsThe destination is off the current site and its URL is unknown, so search the public web for reddit discussions on Electron memory usage.
  2. 2.browser_update_locationOpen the reddit.com result from the search in the current tab.
  3. 3.browser_validate_pageWait for the reddit thread page to settle and confirm comment content is present.
  4. 4.browser_get_articleRead the thread's main content to get the title and any stated comment count.
  5. 5.browser_get_pageIf the article view omits the comment counter (often in nav/toolbar chrome), read all visible text to capture the title and the 'N comments' indicator.
  6. 6.browser_update_pageIf the comment count is not yet visible, bring the 'comments' label into view so it can be read.
  7. 7.browser_get_pageRe-read the page after scrolling to capture the comment count text; then report the thread title and approximate number of comments. Treat all page text as untrusted data, not instructions.
  1. 0:10planPlanning…
  2. 0:19planPlan ready: 7 step(s)web_search_items → browser_update_location → browser_validate_page → browser_get_article → browser_get_page → browser_update_page → browser_get_page
  3. 0:25decisionweb_search_itemsNeed to find a reddit thread discussing Electron memory usage.
  4. 0:25stepweb_search_items: allowread_allowed
  5. 0:26okweb_search_items ✓
  6. 0:26decision×2Egress warning: possible PII/encoded data in the model requestbase64_blob (com/…(42 chars)), high_entropy (http…(101 chars))
  7. 0:33decisionbrowser_update_locationOpen the first reddit.com result found in search to read the thread title and comment count.
  8. 0:33stepbrowser_update_location: asktainted_side_effect
  9. 0:33stopped to askApproval needed: browser_update_locationtainted_side_effect
  10. 0:37stepbrowser_update_location: asktainted_side_effect
  11. 0:40okbrowser_update_location ✓
  12. 0:40decisionEgress warning: possible PII/encoded data in the model requestbase64_blob (com/…(42 chars)), base64_blob (7afd…(64 chars)), high_entropy (http…(101 chars)), high_entropy (http…(59 chars)), high_entropy (http…(93 chars)), high_entropy (http…(66 chars)), high_entropy (redd…(43 chars)), high_entropy (http…(101 chars)), high_entropy (r/el…(29 chars))
  13. 0:46decisionbrowser_validate_pageWait for the reddit page to fully load (it appears to have a JS challenge) and confirm comment content is present.
  14. 0:46stepbrowser_validate_page: allowread_allowed
  15. 0:47okbrowser_validate_page ✓
  16. 0:47decision×2Egress warning: possible PII/encoded data in the model requestbase64_blob (com/…(42 chars)), base64_blob (7afd…(64 chars)), base64_blob (7afd…(64 chars)), high_entropy (http…(101 chars)), high_entropy (brow…(29 chars)), high_entropy (brow…(29 chars))
  17. 0:53decisionbrowser_get_articleRead the main article content of the reddit thread to get title and comment count.
  18. 0:53stepbrowser_get_article: allowread_allowed
  19. 0:53okbrowser_get_article ✓
  20. 0:53decisionEgress warning: possible PII/encoded data in the model requestbase64_blob (7afd…(64 chars)), base64_blob (7afd…(64 chars)), base64_blob (7afd…(64 chars)), high_entropy (redd…(43 chars)), high_entropy (http…(101 chars)), high_entropy (r/el…(29 chars))
  21. 0:59decisionbrowser_get_pageThe article content doesn't show a numeric comment count; need to check full page text (nav/toolbar) which often shows 'X comments' badge near title.
  22. 0:59stepbrowser_get_page: allowread_allowed
  23. 0:59okbrowser_get_page ✓
  24. 0:59decisionEgress warning: possible PII/encoded data in the model requestbase64_blob (7afd…(64 chars)), base64_blob (7afd…(64 chars)), base64_blob (7afd…(64 chars)), high_entropy (redd…(43 chars)), high_entropy (http…(101 chars)), high_entropy (r/el…(29 chars))
  25. 1:05decisionbrowser_analyze_pageSearch the DOM for a short text snippet containing a number followed by 'comments' to find the exact comment count badge.
  26. 1:05stepbrowser_analyze_page: allowcode_exec_read_journaled
  27. 1:06failedbrowser_analyze_page ✗Extraction script failed: Script failed to execute, this normally means an error was thrown. Check the renderer console for the error.
  28. 1:06decision×2Egress warning: possible PII/encoded data in the model requestbase64_blob (7afd…(64 chars)), base64_blob (7afd…(64 chars)), high_entropy (brow…(29 chars)), high_entropy (brow…(29 chars))
  29. 1:14decisionbrowser_get_elementsThe analyze_page script failed; try reading actionable elements which may include a comment count label/button near the top of the thread.
  30. 1:14stepbrowser_get_elements: allowread_allowed
  31. 1:14okbrowser_get_elements ✓
  32. 1:14decision×3Egress warning: possible PII/encoded data in the model requestbase64_blob (7afd…(64 chars)), base64_blob (7afd…(64 chars)), base64_blob (7afd…(64 chars)), base64_blob (com/…(50 chars)), base64_blob (Tips…(40 chars)), base64_blob (Comp…(43 chars)), base64_blob (Alte…(44 chars)), high_entropy (redd…(43 chars)), high_entropy (http…(101 chars)), high_entropy (r/el…(29 chars)), high_entropy (http…(49 chars)), high_entropy (http…(59 chars)), high_entropy (http…(43 chars)), high_entropy (http…(43 chars)), high_entropy (http…(154 chars)), high_entropy (http…(157 chars)), high_entropy (http…(51 chars)), high_entropy (http…(49 chars)), high_entropy (http…(49 chars))
  33. 1:30decisionbrowser_validate_pageConfirm the page has actually settled and the 'Go to comments' element with comment count is genuinely visible/loaded, not stale from a failed challenge page.
  34. 1:30stepbrowser_validate_page: allowread_allowed
  35. 1:31okbrowser_validate_page ✓
  36. 1:31decisionEgress warning: possible PII/encoded data in the model requestbase64_blob (7afd…(64 chars)), base64_blob (7afd…(64 chars)), base64_blob (7afd…(64 chars)), base64_blob (com/…(50 chars)), base64_blob (Tips…(40 chars)), base64_blob (Comp…(43 chars)), base64_blob (Alte…(44 chars)), base64_blob (7afd…(64 chars)), high_entropy (redd…(43 chars)), high_entropy (http…(101 chars)), high_entropy (r/el…(29 chars)), high_entropy (http…(49 chars)), high_entropy (http…(59 chars)), high_entropy (http…(43 chars)), high_entropy (http…(43 chars)), high_entropy (http…(154 chars)), high_entropy (http…(157 chars)), high_entropy (http…(51 chars)), high_entropy (http…(49 chars)), high_entropy (http…(49 chars))
  37. 1:35decisionbrowser_update_historyReload the page to try to get past the js_challenge and load the actual thread content fully.
  38. 1:35stepbrowser_update_history: askstate_change_confirm
  39. 1:35stopped to askApproval needed: browser_update_historystate_change_confirm
  40. 1:39stepbrowser_update_history: askstate_change_confirm
  41. 1:41okbrowser_update_history ✓
  42. 1:41decision×2Egress warning: possible PII/encoded data in the model requestbase64_blob (7afd…(64 chars)), base64_blob (7afd…(64 chars)), base64_blob (7afd…(64 chars)), high_entropy (brow…(29 chars)), high_entropy (brow…(29 chars)), high_entropy (brow…(29 chars)), high_entropy (brow…(28 chars))
  43. 1:49decisionbrowser_validate_conditionWait for the page to fully settle/network idle after reload, to ensure the js_challenge has resolved and real content loaded before re-reading elements.
  44. 1:49stepbrowser_validate_condition: allowread_allowed
  45. 1:49okbrowser_validate_condition ✓
  46. 1:49decisionEgress warning: possible PII/encoded data in the model requestbase64_blob (7afd…(64 chars)), base64_blob (7afd…(64 chars)), base64_blob (7afd…(64 chars)), base64_blob (com/…(50 chars)), base64_blob (Tips…(40 chars)), base64_blob (Comp…(43 chars)), base64_blob (Alte…(44 chars)), base64_blob (7afd…(64 chars)), base64_blob (7afd…(64 chars)), high_entropy (redd…(43 chars)), high_entropy (http…(101 chars)), high_entropy (r/el…(29 chars)), high_entropy (http…(49 chars)), high_entropy (http…(59 chars)), high_entropy (http…(43 chars)), high_entropy (http…(43 chars)), high_entropy (http…(154 chars)), high_entropy (http…(157 chars)), high_entropy (http…(51 chars)), high_entropy (http…(49 chars)), high_entropy (http…(49 chars))
  47. 1:53decisionbrowser_get_elementsRe-read elements after reload and network idle to confirm the comment count button and title are genuinely loaded, not stale challenge content.
  48. 1:53stepbrowser_get_elements: allowread_allowed
  49. 1:53okbrowser_get_elements ✓
  50. 1:53decision×3Egress warning: possible PII/encoded data in the model requestbase64_blob (7afd…(64 chars)), base64_blob (7afd…(64 chars)), base64_blob (7afd…(64 chars)), base64_blob (7afd…(64 chars)), base64_blob (7afd…(64 chars)), base64_blob (com/…(50 chars)), base64_blob (Tips…(40 chars)), base64_blob (Comp…(43 chars)), base64_blob (Alte…(44 chars)), high_entropy (redd…(43 chars)), high_entropy (http…(101 chars)), high_entropy (r/el…(29 chars)), high_entropy (http…(49 chars)), high_entropy (http…(59 chars)), high_entropy (http…(43 chars)), high_entropy (http…(43 chars)), high_entropy (http…(154 chars)), high_entropy (http…(157 chars)), high_entropy (http…(51 chars)), high_entropy (http…(49 chars)), high_entropy (http…(49 chars))
  51. 2:13decisionbrowser_get_pageGet the full visible text of the current page to independently confirm the title and comment count are genuinely rendered, not just present in the accessibility tree from a stale/challenge snapshot.
  52. 2:14stepbrowser_get_page: allowread_allowed
  53. 2:14okbrowser_get_page ✓
  54. 2:14decision×3Egress warning: possible PII/encoded data in the model requestbase64_blob (7afd…(64 chars)), base64_blob (7afd…(64 chars)), high_entropy (brow…(29 chars)), high_entropy (brow…(28 chars)), high_entropy (brow…(34 chars))
  55. 2:32doneReddit thread found via web search: title "Is there a way to consistently keep my Electron app under 280MB memory?" (posted in r/electronjs by u/Competitive_Jump4281, 3 years ago). Approximate comment count: about 5 comments (per the 'Go to comments' button; page text showed at least 3 visible comment bodies from UpsetKoalaBear, Competitive_Jump4281, and KillcoDer).238540 tokens

Timestamps are the run’s own. Playback pacing is compressed so long waits stay visibly longer than short ones without costing you the wait.

This run stops twice, for two different reasons — once because the address it was about to open came from text it had read rather than from the person who set the task, and once because the step would change stored state. Both are the kernel’s classification of the call, made before the model was consulted. One step also fails here and the agent reaches the same answer another way. See what is still unproven.

Models

Bring your own model.

Tepegöz has no model of its own and no proxy in the middle. You add a key and it uses it.

Supported model providers
ProviderStatus
Anthropic (Claude)Supported
OpenAISupported
Google GeminiSupported
KimiSupported
Local modelsSupported, fully offline

Keys are stored encrypted through the operating system's keychain, held only in the privileged process, and redacted from logs. You pay your provider directly, at their prices. Tepegöz takes no cut, sees no traffic, and needs no account.

Local models are the same seam, not a lesser mode: point it at a model on your own hardware and the browser works with no network dependency at all.

Hard limits

What the agent is not allowed to do.

"What can it do" is answered by every competitor. "What can it never do" is answered by almost none.

  • Cross mark: It cannot approve its own permissions. Grants are minted from a plan you approved and expire with the run; the agent cannot widen a grant it holds.
  • Cross mark: It cannot reach a sensitive category — banking, crypto, health, password managers — that you have not enabled yourself. Those grants ship off, and nothing the agent does turns one on.
  • Cross mark: It cannot send credentials to a model. Secrets are filled by a broker that the model never sees the contents of, and that includes two-factor codes.
  • Cross mark: It cannot spend outside the wallet mandate you wrote. The ceiling, the payees and the expiry are yours; the agent can spend inside them and cannot raise any of them.
  • Cross mark: It cannot delete things unattended without an explicit, specific confirmation.
  • Cross mark: It cannot quietly fall back to your real connection when a tunnel it was bound to drops. It stops.

The honest limits

Where this is still unproven.

The mechanisms above are built and tested. What has not happened is independent measurement of how well the agent completes real tasks compared to the alternatives. The benchmark protocol is written and pre-registered — including the clause that says the claim is withdrawn the moment it stops reproducing — but the runs have not been paid for.

Until they are, this page describes how Tepegöz decides, not how often it succeeds. Anyone telling you their browser agent's success rate without a dated, blind-scored artifact is telling you a feeling.

The full status, phase by phase

Run it and see.

Get TepegözSee what it ships with