The harness that heals itself

Browser Harness is 592 lines of Python. It also lets agents edit that Python mid-task — a design bet that the right abstraction is no abstraction at all.

When Gregor Zunic shipped Browser Harness, he forgot to implement upload_file(). He found out from a git diff.

The agent using his open-source CDP harness had hit a file input, grepped the helpers file, found nothing, and wrote the missing function itself. Zunic didn't ask it to do this. He just gave it the same tools any Claude Code user has: read, edit, rerun. "The agent does what any Claude Code user would do," he wrote in the blog post explaining the design. "It greps helpers.py, adds the function, reruns."

Browser Harness has accumulated 8,800 GitHub stars in roughly two weeks of public availability. It is, by any measurement of attention, a niche developer tool. What makes it worth watching is the specific architectural bet it embodies: the agent is better off with raw CDP access and the ability to write its own helpers than with a pre-built abstraction layer. Zunic calls this the self-healing property. The harness improves itself every run.

The bitter lesson, applied twice

The name is a deliberate callback to Rich Sutton's The Bitter Lesson — the observation that AI methods that leverage computation tend to outperform methods that encode human structure, and that researchers keep making the same mistake of betting on structure. Browser Use's first bitter lesson was about LLM wrappers: don't wrap the model in abstractions, give it maximal action space. Their second bitter lesson is about tools: don't wrap Chrome DevTools Protocol in helper functions either.

"Every click(), type(), scroll() helper is an abstraction you decided the model needs," Zunic wrote. "Every one of them is a constraint the RL'd model has to fight around."

The conventional wisdom in browser automation is that you wrap CDP in ergonomic helpers because CDP is too low-level for agents to use reliably. Browser Harness argues the opposite: LLMs already know CDP. They were trained on millions of tokens of Page.navigate, DOM.querySelector, Runtime.evaluate. Hiding CDP behind a click(x, y) helper is not helping the agent. It is just hiding the parameters it might need.

The concrete example is Input.dispatchMouseEvent, which has 14 parameters — button, clickCount, modifiers, pointerType, force, tangentialPressure, and more. A click() wrapper that exposes three of them quietly limits what the agent can do. CDP is the protocol. If Chrome can do it, the agent can call it.

The architecture

Browser Harness is minimal by design. Four files:

run.py — 13 lines, runs Python with helpers preloaded

helpers.py — 192 lines, thin wrappers around CDP that the agent edits

daemon.py — 220 lines, keeps the CDP websocket alive

SKILL.md — tells the agent how to use the above

Total: roughly 600 lines. One WebSocket to Chrome, nothing between.

The self-heal loop works like this: agent hits a missing capability, reads the error, edits helpers.py to add the function, retries. The agent is not writing code from first principles. It is writing the one function that was missing, the same way it would fix a missing import on any codebase.

A second documented case: the agent tried to upload a 12MB file, hit CDP's 10MB websocket payload limit, read the error, switched to a chunked upload pattern, and completed the transfer. Zunic's blog post calls this out specifically. The agent identified the constraint and worked around it without being told to.

Cloudflare validated the thesis independently

On April 15, Cloudflare shipped Browser Run — a renamed and expanded version of its Browser Rendering product — with a direct CDP endpoint. The announcement explicitly frames this as giving agents maximum control over the browser. It also increased concurrency from 30 to 120 concurrent browser sessions, added MCP client support for Claude Desktop, Cursor, and OpenCode, and introduced session recording and human-in-the-loop handoff for cases where the agent needs help.

The timing matters. Cloudflare did not build Browser Harness. Browser Use did not build Browser Run. Two independent teams, building in isolation, converged on the same architectural conclusion: agents need direct CDP access, not another abstraction layer.

Browser Use also shipped a JavaScript port — browser-harness-js, built on Bun, targeting Cloudflare Workers and Vercel. Where the Python version lets agents edit helpers.py at runtime, the JS version exposes all 652 CDP methods as typed wrappers generated directly from Chrome's protocol JSON. No helpers at all. Every helper is a lie about what CDP already gives you, the README reads.

The blast radius question nobody is asking

The self-healing property solves one class of brittleness. It creates another.

Every production agent deployment built on Playwright, Puppeteer, or any wrapper-based framework assumes the harness is fixed. Monitoring tools, safety guardrails, audit logs — all of them are built on the premise that the agent's tool interface is a static contract. Browser Harness breaks that contract by design. The agent's helpers at runtime may differ from the helpers it started with.

This is not a hypothetical concern. The monitoring and observability stack for AI agents — LangSmith, AgentOps, Helicone, and their enterprise counterparts — was not designed for agents that modify their own scaffolding mid-execution. A logged helper call at step 10 may reference a function that did not exist at step 1. Existing debugging and audit tooling will struggle to reconstruct what actually executed.

Browser Harness is not yet deployed at the scale that makes this a production emergency. At 8,800 stars, it is still a developer tool with a free tier and no named enterprise customers. The upload_file() case is a single documented anecdote, not a pattern. Zunic offered a Mac Mini to anyone who finds a task it fails on. Confidence or marketing depends on your priors.

But the trajectory is clear. The JavaScript port targets Cloudflare Workers. Cloudflare's Browser Run exposes CDP directly. The pattern is being productized at infrastructure scale. The blast radius question is not academic.

What the wire missed

The original signal was Dan McAteer's post on X — a developer sharing a tool he found interesting, 69 likes from 22,800 followers. The wire read it as another GPT killer and killed it. That was wrong. The real story is not the stars. It is the architectural argument: raw CDP access with agent-authored helpers beats wrapper layers, for the same reason that learned methods beat hard-coded structure in the model itself.

Every wrapper that shields an agent from CDP is making the same bet that early AI researchers made about symbolic AI — that structure encoded at design time beats learning at runtime. Browser Harness and Cloudflare Browser Run are both betting against that. The self-healing harness is not a feature. It is a stance about where the complexity belongs.

---

Browser Harness is open source at github.com/browser-use/browser-harness. Browser Run is available via Cloudflare Browser Run.