Tepegoz Browser

Overview

Tepegöz is a desktop AI browser that treats autonomy and control as equal partners. Instead of bolting a chat sidebar onto Chromium, it is built the other way around: an agentic core that can drive the browser end-to-end, wrapped in a deterministic security kernel so that autonomy never means losing control. You give it a goal in plain language; it turns that into an editable plan, executes it step by step across real tabs, and shows every URL visited, action taken, and token spent in a live, replayable console. The full experience runs locally with your own AI key — no managed backend required. (The name is the one-eyed giant of Turkish mythology: one agent, one focused gaze on the page.)

The problem

Most "AI browsers" hand a language model direct control over the page and hope for the best — which means autonomy and safety are in permanent tension. Letting an LLM classify its own permissions is a security hole; running every task serially through one tab is slow; and a long automation that crashes halfway leaves side effects half-applied with no safe way to resume. On top of that, most tools are locked to a managed cloud, sending your browsing and keys off-device. Tepegöz separates the two concerns entirely: a rule-based Policy Kernel decides what is allowed before the model runs, the renderer and all web content are treated as untrusted, and every action is recorded in an append-only journal that makes the agent observable and reversible.

What it does

• Agentic automation — a Command Palette (Ctrl+K) with Chat / Do / Make / Tasks modes; an editable plan preview where each step is tagged read / state-changing / destructive / financial with a cost estimate before anything runs.
• Parallel, durable execution — independent steps fan out to isolated browser contexts via a DAG scheduler; checkpoint/resume with an idempotent Effect Ledger (fencing tokens) so a resumed task never double-acts, plus cross-agent (even cross-model) handoff.
• Deterministic security kernel — a Policy Kernel classifies every tool call, an Egress Firewall blocks exfiltration, sensitive sites (banking, health, password managers) are locked out of automation by default, and irreversible actions require human confirmation.
• Real-world task completion — official-API-first integration adapters (Gmail / Drive / Calendar, Canva via MCP) with a logged-in browser fallback; Tepegöz is both an MCP client and server, exposing its browser/tab/DOM tools to external clients behind Bearer auth and the same policy gate.
• Trustworthy daily driver — ad/tracker blocking, Google Safe Browsing v5 (URLs never sent), an on-device AgentThreatShield, and graceful human handoff for CAPTCHA / 2FA (never auto-solved).
• Provider choice & i18n — a provider-agnostic Model Gateway (Claude default, OpenAI/Gemini adapters; keys encrypted in the main process only), with English-first, Turkish-first-class UI and a dedicated Turkish IME pipeline.

Architecture

        ┌──────────────── L9 Browser UI  ·  L10 Safe Browsing ────────────────┐
        │        Command Palette · Live Agent Console · Adblock/Shield         │
        └──────────────────────────────────┬──────────────────────────────────┘
                                            │ typed, validated IPC
   ┌────────────────────────────────────────────────────────────────────────────┐
   │  L8 Security Kernel  — Policy Kernel · Capability Broker · Egress FW · HITL  │  ← every tool
   ├────────────────────────────────────────────────────────────────────────────┤     call passes
   │  L3 Orchestrator (intent→DAG, scheduler, loop detect) → L4 Perception (CDP)  │     through here
   │  L5 Capability Plane (tool gateway, MCP client+server) → L6 Adapters, L7 AI  │
   ├────────────────────────────────────────────────────────────────────────────┤
   │  L2 Durability & Memory  ·  L1 Persistence (SQLite WAL + Event Journal)      │
   ├────────────────────────────────────────────────────────────────────────────┤
   │  L0 Core Shell — secure Electron windowing, fuses, sandboxing               │
   └────────────────────────────────────────────────────────────────────────────┘

A layered, modular monorepo where layers communicate only through typed, Zod-validated contracts — direct cross-layer imports are forbidden and enforced in CI. The security kernel is a single policy enforcement point that every tool call routes through, so the model is used for understanding and ambiguity, never to grant itself permissions. State is event-sourced into an append-only journal, giving replay, audit, and reversibility for free.

Tech stack

Electron (secure factory + fuses) · React + TypeScript (strict) · pnpm workspaces + Turborepo + electron-vite · better-sqlite3 (WAL) + FTS5 + sqlite-vec · Chrome DevTools Protocol · provider-agnostic AI gateway (Anthropic Claude default, OpenAI, Gemini) · MCP client + server · type-safe i18n (EN ⇄ TR) · Vitest + Playwright _electron · (later: ONNX Runtime + DirectML, Rust via napi-rs)

Outcome

The target is a browser where autonomy and safety are decoupled by design: a deterministic kernel decides what's allowed, an LLM decides only how to do it, and every action stays observable and reversible. Heavy tasks run in parallel and survive crashes through checkpointed, idempotent execution; integrations prefer official APIs and fall back to the browser only when they must; and the entire agentic experience runs on-device with your own key — the cloud is always optional, never required. AI automation becomes something you can hand real work to without handing over control.