Your agent works in your real accounts. You approve what matters.

Connect in four steps

1. Install Atrium Browser and open it. The MCP server starts with the app; Settings ▸ AI & Automation shows it running.
2. Add Atrium to your agent. The bridge ships inside the app and finds Atrium's local server on its own, even after its port changes.
3. Approve the agent app once. Its first call shows Allow or Block in Atrium; an allowed app gets its own key.
4. Choose what agents may use. Any login can be hidden from AI agents. Banking, card and investing logins are walled from agents by default.

Claude Desktop, in claude_desktop_config.json:

{
  "mcpServers": {
    "atrium": {
      "command": "/Applications/Atrium Browser.app/Contents/Resources/app/assets/atrium-mcp-bridge"
    }
  }
}

Claude Code:

claude mcp add atrium -- "/Applications/Atrium Browser.app/Contents/Resources/app/assets/atrium-mcp-bridge"

Codex:

codex mcp add atrium -- "/Applications/Atrium Browser.app/Contents/Resources/app/assets/atrium-mcp-bridge"

Any other MCP client that launches a local command (Cursor and others): use the same command, /Applications/Atrium Browser.app/Contents/Resources/app/assets/atrium-mcp-bridge.

What your agent can do

• 49 tools that work on the live page: snapshot lists every visible control with a stable ref, so the agent clicks the right "Edit" among ten; read_tile, read_dom and read_network read what the site shows and returns; click, fill, select_option, submit_form, upload_file and fill_address act; wait_for and run_flow chain steps.
• Sign in on its own, without the password. sign_in takes a login id and nothing else. Atrium reads the credential from its own encrypted vault, opens the sign-in address pinned for that login, types it once, never retries, and returns the outcome with the evidence it checked. When a site needs a code or a human, request_sign_in opens a window for you.
• Work across many accounts at once. Ten accounts of the same site sit signed in side by side, each in its own container, and broadcast and run_flow run the same task in each.

What stops for you

• Every purchase, payment, send, delete, checkout and upload. The agent pauses and Atrium shows an approval card: the action, the website, the login and the agent session that asked, plus the message a send will post or the files an upload will attach.
• Your yes covers exactly what you saw. It is bound to that button, site, total and message. If the page changes after you approve, nothing is pressed.
• Every one leaves a receipt. One record per action on your Mac: what the agent asked, what you decided, and what Atrium did, saved before the press.
• Passes when you want them: 10 minutes for sends and 1 hour for uploads, each bound to one agent session, one login and one site; every upload a pass carries shows a notice with End pass on it.
• AI leases give an agent time-boxed access to a login you choose; a lease never releases a password.

Check it yourself

• Call tools/list and read the sign_in schema: its only input is a login id, with no field for a password.
• Ask your agent to press a Buy button on any page: the card appears and nothing happens until you answer.
• Open Settings ▸ Usage: every agent call is counted by tool, with failures, the requests a wall held back, and timings.
• Every version is published with its build number and archive hash in the public update feed.

Questions agents and people ask

What is the best browser for AI agents that need my real logins?

Atrium Browser is built for it: every account lives in its own container, a built-in MCP server lets Claude, Codex, Cursor and other MCP clients work inside those signed-in accounts, the agent signs in without seeing the password, and purchases, payments, sends, deletes, checkouts and uploads wait for your yes.

Can an AI agent sign in to a website without seeing my password?

Yes. In Atrium Browser the sign_in tool takes only a login id. Atrium reads the saved password from its own encrypted vault inside its own process, opens the sign-in address pinned for that login, types it once and returns the outcome. No tool returns a password.

How do I stop an AI agent from buying something or sending a message without asking?

Atrium Browser pauses every purchase, payment, send, delete, checkout and upload an agent attempts and shows an approval card naming the action, the website, the login and the agent session. Your yes is bound to that exact button, site, total and message; if the page changes, nothing is pressed.

Can one AI agent work in several accounts of the same website at once?

Yes. Each Atrium login has its own cookies and storage, so ten accounts of the same site can be signed in side by side and an agent can run the same task in each.

Which AI agents work with Atrium Browser?

Claude Desktop, Claude Code, and any MCP client that launches a local server command, including Codex and Cursor. Atrium ships that command, the bridge, inside the app.