How AI Agent Harnesses Browse the Web (2026)

Every agent harness answers the same question differently: when the model needs a web page, what does it call? In October 2026 there are three answers. A built-in browser tool the harness owns (OpenClaw, Hermes Agent). A CLI inside the agent's sandbox driven through a shell (NanoClaw ships agent-browser in its container). And external tools the harness loads: MCP servers or a plain HTTP tool. NemoClaw adds a fourth concern on top of OpenClaw: a sandbox that decides which sites any of these may reach.

This page compares the four harnesses on that one axis, dated and sourced, and measures what each access pattern costs an agent in context. It replaces our separate notes on these projects with one reference. It is part of our guide to giving AI agents web vision.

Checked: 2026-10-15 against each project's own documentation and repository. Measurements: 2026-10-15 on macOS 27.0.1, Node 22.18.0, with agent-browser 0.39.1, @playwright/mcp 0.0.83, chrome-devtools-mcp 1.10.1 and @browserbasehq/mcp-server-browserbase 2.4.3. We did not run the four harnesses end to end, because each needs model credentials and, for some features, paid cloud accounts. The protocol for that run is at the end.

The three access patterns

The four harnesses

OpenClaw

OpenClaw is an open-source, self-hosted assistant built around a gateway that connects chat channels to agents. For the web, its docs describe one agent tool, browser, with actions for status, start and stop, tabs, open, focus, close, snapshot, screenshot, navigate, act, requests, errors, text and emulate.

• Snapshots: an "AI" format with numeric refs when Playwright is installed, or an ARIA tree for inspection. act clicks and types by ref; CSS selectors are intentionally not supported for actions.
• Screenshots: full page, a single element by ref, or --labels, which overlays snapshot refs on the image and returns their bounding boxes.
• Dependency: navigation, actions, AI snapshots, element screenshots and PDF need Playwright; without it those endpoints return a 501 error.
• External tools: MCP servers go under mcp.servers in ~/.openclaw/openclaw.json, as stdio commands or remote Streamable HTTP or SSE URLs, with per-server tool filters.

Sources: docs.openclaw.ai, pages "Browser agent tools" and "Connect MCP servers", checked 2026-10-15.

Hermes Agent

Hermes Agent, from Nous Research, is an agent-first runtime. Its docs describe a browser toolset with interchangeable backends: Browser Use CLI as the default local driver, plus Browserbase, Browser Use cloud, Firecrawl cloud and Camofox. It can also attach to your own Chrome, Brave or Edge over CDP with /browser connect. browser_navigate must run before the other browser tools.

• Backend choice: set in configuration (browser.cloud_provider); credentials alone do not switch providers once a selection exists.
• External tools: MCP servers go under mcp_servers in ~/.hermes/config.yaml, with tools.include allowlists per server, OAuth support and a per-call default timeout of 120 seconds. hermes import-agent claude-code migrates a Claude Code mcpServers block.

Sources: hermes-agent.nousresearch.com, "Browser Automation" and "MCP" pages, checked 2026-10-15.

NanoClaw

NanoClaw is a small alternative to OpenClaw. It runs agents on Anthropic's Claude Agent SDK inside Linux containers (Apple Container on macOS, or Docker), and an agent sees only what is mounted into its container. Its container image ships Chromium and the agent-browser CLI, and the repository includes an agent-browser skill. So NanoClaw's agent browses with shell commands inside its own container, and the Claude Agent SDK's MCP support is available for external tools.

Sources: github.com/nanocoai/nanoclaw and its container/skills/agent-browser folder, checked 2026-10-15.

NemoClaw

NemoClaw is NVIDIA's packaging of OpenClaw inside an NVIDIA OpenShell sandbox. Browsing works through OpenClaw's tools, but the sandbox runs a deny-by-default network policy: the agent can reach only endpoints listed in a declarative YAML policy, and OpenShell intercepts requests to anything else and asks the operator to approve or deny them. Policies change statically in openclaw-sandbox.yaml or at runtime with openshell policy set. NVIDIA's docs describe the project as alpha.

The practical consequence: whatever access pattern you choose (browser, MCP server, HTTP API), each destination has to be in the policy. An HTTP screenshot tool needs one host on the list; a browser that visits arbitrary sites needs a broad egress rule, which is exactly what the sandbox exists to avoid.

Sources: docs.nvidia.com/nemoclaw, "Network Policies" and "Customize the Sandbox Network Policy", checked 2026-10-15.

Side by side

What each pattern costs: measured

We could not put a model in the loop for every harness, but we could measure the parts that every harness pays for: the tool definitions the model reads on every turn, and the size of what comes back. The browser underneath is Chrome in every case, so these are the numbers that differ.

Tool definitions (fixed cost per turn)

A harness's own built-in browser tool also has a schema; OpenClaw's single browser tool with many actions is one definition, not twenty. We did not extract those schemas from the running harnesses.

Results (variable cost per call)

Measured on our homepage, a 5,657 px tall marketing page:

Two findings carry across harnesses:

1. The image costs the same everywhere. Visual tokens depend on pixel size. Pick the viewport for the job and the access pattern stops mattering for image cost. Details in our screenshot vs DOM vs accessibility tree study.
2. The text views and the tool lists are where context goes. A browser MCP server can cost more context before the first call than a screenshot costs after it. Our browser MCP server benchmark has the full data and the script.

Which pattern for which job

Safety: the same rules in every harness

Any pattern that brings page content into the model brings the page author's text with it. Our prompt injection in screenshots fixture found hidden instructions in 8 of 11 cases through the accessibility tree and in 3 of 11 through a screenshot. Whatever the harness:

• keep browsing and acting in separate steps or agents;
• restrict destinations (NemoClaw's policy, agent-browser's --allowed-domains, Hermes' per-server tools.include for MCP);
• return failures as tool results, not exceptions, so the agent stops cleanly;
• never let the model choose cookies, headers or credentials for a capture.

Troubleshooting across harnesses

How we will run the harness test

To compare harnesses end to end without guessing, the next edition will run each one with the same model, the same three tasks (capture our homepage at 1280x800; report the price on a fixture product page; find a link and follow it), five runs each, and record: completed or not, tool calls made, input and output tokens from the provider's usage report, and wall time. We will publish the transcripts.

The HTTP option

If your agents mostly need captures rather than interaction, an HTTP tool is the smallest thing you can give any of these harnesses: a 532-byte definition, one call per capture, and a public link for the report. RenderScreenshot (our product) is one such API; the tool definition and per-framework wiring are on our agents page, and the same request works from an OpenClaw or Hermes MCP wrapper, a NanoClaw shell command, or a NemoClaw sandbox with one allowed host. Get a free API key to try it.

Related guides

• Best MCP servers for web browsing: measured on the same tasks
• agent-browser screenshots: the CLI that NanoClaw ships
• Prompt injection in screenshots: what a page can tell your agent
• AI agents use case: architecture and cost for screenshot-based agents