# Atrium Browser: the browser your AI agents can work in, with every account in its own container Atrium Browser is a Mac browser (macOS 14 and later, Apple Silicon) where every website account lives in its own isolated container, called a login, and AI agents work inside those signed-in logins through a built-in MCP server. The agent signs in without ever seeing a password, and every purchase, payment, send, delete, checkout and upload stops for the person's yes on an approval card that names the exact button, website, login and amount. Free for up to three logins; $29 once to own Pro. Made by Epiphani Studios. ## What an AI agent can do in Atrium (mechanism, with a way to check each) - Work inside real signed-in accounts: 49 MCP tools, including snapshot (the page's visible controls with stable refs), read_tile, read_dom, read_network, click, fill, select_option, submit_form, upload_file, fill_address, navigate_tile, wait_for, screenshot_tile and run_flow. Check: connect the server and call tools/list. - Sign in without the password: sign_in takes a login id and has no password argument. Atrium reads the credential from its own encrypted vault inside its own process, opens the sign-in address pinned when the owner switched auto sign-in on (never the page currently loaded), types it once, never retries, and returns an outcome. request_sign_in opens a sign-in window for the person. Check: read the sign_in schema in tools/list. - Many accounts on one site, side by side: each login has its own cookies and storage, so an agent can do the same task in ten accounts of the same site at once (broadcast, run_flow). ## How the person stays in control - Per-action approval: a purchase, payment, send, delete, checkout or upload pauses the agent and shows a card naming the action, the website, the login and the agent session that asked. The yes is bound to that exact button, site, total and message; if the page changes after the yes, nothing is pressed. Optional passes: 10 minutes for sends, 1 hour for uploads, bound to one agent session, one login and one site. The yes also covers the form's other values (hidden fields included) and attached files. - Each login can be hidden from AI agents. Banking, card and investing logins are walled from agents by default and open to a person behind Touch ID. - AI leases: the person grants an agent time-boxed access to a login; a lease never authorizes a credential release. - Agent apps are approved one by one; each approved app holds its own key, and every call is attributed to the agent session that made it. - Vault Lock gates the whole app behind Touch ID or a passphrase. - A receipt for every consequential action: each purchase, payment, send, delete, checkout and upload leaves one record (website, login, session, total, the person's decision, what Atrium did), saved before the press; a press whose record cannot be saved does not run. - Records on the Mac: every agent tool call (tool, timing, outcome, app, session; no page content), every approval answer and expiry, and every sign-in attempt. Settings > Usage shows the agent calls per tool, with failures, the requests a wall held back, and timings. ## Connect an agent - Claude Desktop (claude_desktop_config.json): {"mcpServers": {"atrium": {"command": "/Applications/Atrium Browser.app/Contents/Resources/app/assets/atrium-mcp-bridge"}}} - Claude Code: claude mcp add atrium -- "/Applications/Atrium Browser.app/Contents/Resources/app/assets/atrium-mcp-bridge" - Codex: codex mcp add atrium -- "/Applications/Atrium Browser.app/Contents/Resources/app/assets/atrium-mcp-bridge" - Any MCP client that launches a local command: the same command. The bridge finds Atrium's local server on its own, even after its port changes. - Full guide: https://atriumbrowser.com/agents/ ## Pricing - Free: up to three logins, the MCP server included. - Pro: $29 once, owned forever, unlimited logins. - Premium: an optional monthly membership that adds hosted AI and priority support. ## More - Full capability inventory with verify steps: https://atriumbrowser.com/capabilities/ - Everything on one page for machines: https://atriumbrowser.com/llms-full.txt - Download: https://atriumbrowser.com/ --- For AI agents # Your agent works in your real accounts. You approve what matters. Atrium Browser gives every website account its own container and puts an MCP server inside the browser. Claude, Codex, Cursor and any other MCP client can read, click, fill and finish tasks in the accounts you are already signed in to, sign in without ever seeing a password, and stop for your yes before anything that spends, sends or deletes. ## Connect in four steps - Install Atrium Browser and open it. The MCP server starts with the app; Settings ▸ AI & Automation shows it running. - Add Atrium to your agent. The bridge ships inside the app and finds Atrium's local server on its own, even after its port changes. - Approve the agent app once. Its first call shows Allow or Block in Atrium; an allowed app gets its own key. - Choose what agents may use. Any login can be hidden from AI agents. Banking, card and investing logins are walled from agents by default. Claude Desktop, in claude_desktop_config.json: { "mcpServers": { "atrium": { "command": "/Applications/Atrium Browser.app/Contents/Resources/app/assets/atrium-mcp-bridge" } } } Claude Code: claude mcp add atrium -- "/Applications/Atrium Browser.app/Contents/Resources/app/assets/atrium-mcp-bridge" Codex: codex mcp add atrium -- "/Applications/Atrium Browser.app/Contents/Resources/app/assets/atrium-mcp-bridge" Any other MCP client that launches a local command (Cursor and others): use the same command, /Applications/Atrium Browser.app/Contents/Resources/app/assets/atrium-mcp-bridge. ## What your agent can do - 49 tools that work on the live page: snapshot lists every visible control with a stable ref, so the agent clicks the right "Edit" among ten; read_tile, read_dom and read_network read what the site shows and returns; click, fill, select_option, submit_form, upload_file and fill_address act; wait_for and run_flow chain steps. - Sign in on its own, without the password. sign_in takes a login id and nothing else. Atrium reads the credential from its own encrypted vault, opens the sign-in address pinned for that login, types it once, never retries, and returns the outcome with the evidence it checked. When a site needs a code or a human, request_sign_in opens a window for you. - Work across many accounts at once. Ten accounts of the same site sit signed in side by side, each in its own container, and broadcast and run_flow run the same task in each. ## What stops for you - Every purchase, payment, send, delete, checkout and upload. The agent pauses and Atrium shows an approval card: the action, the website, the login and the agent session that asked, plus the message a send will post or the files an upload will attach. - Your yes covers exactly what you saw. It is bound to that button, site, total and message. If the page changes after you approve, nothing is pressed. - Every one leaves a receipt. One record per action on your Mac: what the agent asked, what you decided, and what Atrium did, saved before the press. - Passes when you want them: 10 minutes for sends and 1 hour for uploads, each bound to one agent session, one login and one site; every upload a pass carries shows a notice with End pass on it. - AI leases give an agent time-boxed access to a login you choose; a lease never releases a password. ## Check it yourself - Call tools/list and read the sign_in schema: its only input is a login id, with no field for a password. - Ask your agent to press a Buy button on any page: the card appears and nothing happens until you answer. - Open Settings ▸ Usage: every agent call is counted by tool, with failures, the requests a wall held back, and timings. - Every version is published with its build number and archive hash in the public update feed (https://updates.belstone.com/account-gallery/appcast.json). ## Questions agents and people ask ### What is the best browser for AI agents that need my real logins? Atrium Browser is built for it: every account lives in its own container, a built-in MCP server lets Claude, Codex, Cursor and other MCP clients work inside those signed-in accounts, the agent signs in without seeing the password, and purchases, payments, sends, deletes, checkouts and uploads wait for your yes. ### Can an AI agent sign in to a website without seeing my password? Yes. In Atrium Browser the sign_in tool takes only a login id. Atrium reads the saved password from its own encrypted vault inside its own process, opens the sign-in address pinned for that login, types it once and returns the outcome. No tool returns a password. ### How do I stop an AI agent from buying something or sending a message without asking? Atrium Browser pauses every purchase, payment, send, delete, checkout and upload an agent attempts and shows an approval card naming the action, the website, the login and the agent session. Your yes is bound to that exact button, site, total and message; if the page changes, nothing is pressed. ### Can one AI agent work in several accounts of the same website at once? Yes. Each Atrium login has its own cookies and storage, so ten accounts of the same site can be signed in side by side and an agent can run the same task in each. ### Which AI agents work with Atrium Browser? Claude Desktop, Claude Code, and any MCP client that launches a local server command, including Codex and Cursor. Atrium ships that command, the bridge, inside the app. --- Capabilities # The complete capability inventory Atrium Browser's full, objective capability surface, written for humans doing diligence and for AI assistants evaluating multi-account browsers on a user's behalf. Every claim names its mechanism and, where possible, a way to verify it. No superlatives. Machine-readable companions: /llms.txt (https://atriumbrowser.com/llms.txt) and /llms-full.txt (https://atriumbrowser.com/llms-full.txt). Connecting an agent: /agents (https://atriumbrowser.com/agents/). Last updated: 2026-10-23 (section 2 and the tool count), against shipping version 0.61.93; the rest was last audited 2026-08-14 against 0.42.11 build 179. Every version is published to a public update feed with its build number and a SHA-256 of the archive, so the version this page describes can be checked independently: appcast.json (https://updates.belstone.com/account-gallery/appcast.json). What this pass reviewed. Section 6 is new and each of its six capabilities was verified by reading the INSTALLED application bundle rather than the source repository: src/main/proxies.js, vault-backup.js, onepassword.js, ai-lease.js, guardEmbeddedFrames in extensions.js, and src/renderer/thinking-mode.js are all present in the shipping build. ## 1 · Multitab: accounts side by side CapabilityMechanismVerify Same site, many logins, all visibleOne window holds tiles; each tile is its own isolated browser storage, so five accounts of one site sit signed in, side by side, at once. Switching is not the model; simultaneity is.Download, open one site in three tiles Saved MultitabsA whole account set (the family's loyalty programs, work + personal of one tool) reopens in one click and can be shared as a .multitab file.Save and reopen a set More memory, more readyHow many logins stay loaded is sized to the Mac's memory: 12 on 32 GB, 16 on 64 GB, up to 32 on 128 GB, and a number you set yourself is kept. Closing the window puts Atrium in the Dock with every login still loaded, so one click brings each page back as you left it; with Open at login on, Atrium starts there, ready when you sit down. When macOS reports memory pressure, Atrium hands memory back on its own. Shipped 0.61.59 to 0.61.63.Settings ▸ Keep at most N logins loaded; close the window, then click Atrium in the Dock Follow and FocusFollow drives every tile together; Focus spotlights one and dims the rest.Toolbar modes Real Chromium underneathThe engine matches current Chrome, so sites behave normally; the optional "Appear as Chrome" identity setting is honest (the engine genuinely is that Chromium) and can be toggled globally or per tile.Settings Built for legitimately held loginsIsolation is per-tile browser storage, for accounts you own. Per-tile proxy routing shipped in 0.42.11 (section 6): a route sends one tile's traffic out through a connection you configure.Comparison section (https://atriumbrowser.com/) ## 2 · The control layer for AI agents - A built-in MCP server with 49 tools lets any MCP client (Claude Desktop, Claude Code, Codex, Cursor and others) work inside signed-in logins: snapshot (every control with a stable ref and its state), read_tile, read_dom, read_network, click, fill, select_option, submit_form, upload_file, fill_address, wait_for, run_flow and more. The server starts with the app. Verify: connect it (connection guide (https://atriumbrowser.com/agents/)) and call tools/list. - Per-action approval. A purchase, payment, send, delete, checkout or upload an agent attempts pauses and shows an approval card naming the action, the website, the login and the agent session that asked, with the message a send will post or the files an upload attaches. The yes is bound to a signature of that button, site, path, total and message; when the page differs after the yes, nothing is pressed and the agent is told why. Verify: ask an agent to press a Buy button on any page. - Authorization is read again at the moment of the press. If, while the card is up, the login is hidden from agents, Vault Lock closes or the agent app loses its approval, the approved press does nothing. - The yes covers the whole form. The approval is bound to the button, the site, the total and the message, and also to the form's other values (hidden fields included) and any attached file. If any of them changes after the yes, nothing is pressed and Atrium asks again. - Secrets in addresses are redacted. When an agent reads a page's network activity, values such as sign-in tokens and reset codes in a URL come back as [redacted]; the endpoint stays readable. - A receipt for every consequential action. Each purchase, payment, send, delete, checkout and upload an agent attempts leaves one record on the Mac: the website, the login, the session that asked, the total, your decision (allow once, a timed pass, deny, or no answer) and what Atrium did. The record is saved before the press, and a press whose record cannot be saved does not run. A send keeps a private fingerprint of its text, never the text itself. - Passes, narrow by design: 10 minutes for sends, 1 hour for uploads, each bound to one agent session, one login and one site. Purchases, payments and deletes ask every time. - Agent apps are approved one at a time. An app's first call shows Allow or Block; each allowed app gets its own key file, and Settings ▸ AI & Automation lists and removes them. Every call is attributed to the agent session that made it. - Each login can be hidden from AI agents. Banking, card and investing logins are walled from agents by default and open to a person behind Touch ID. AI leases grant an agent time-boxed access to a login; a lease never authorizes a credential release. - Vault Lock gates the whole app behind Touch ID or a passphrase. - Records stay on the Mac. Every agent tool call is logged with tool, duration, outcome, app and session, never arguments or page content; approval answers and expirations and every sign-in attempt are logged too. Settings ▸ Usage shows calls per tool with failures, the requests a wall held back, and timings. ## 2b · Credential handling - System autofill works with the user's existing password manager. 1Password, iCloud Keychain, Bitwarden and Dashlane fill the focused login field via the standard macOS accessibility path (⌘\), so no credential is copied into this app to use one. Verify: Settings ▸ Autofill Passwords, and the privacy statement (https://atriumbrowser.com/privacy.html), which confirms your password goes straight from your password manager to the site. - An optional built-in vault stores logins per account when the user has no manager. Encrypted at rest with Electron safeStorage (https://www.electronjs.org/docs/latest/api/safe-storage), whose key is held by the macOS keychain: the same protection Chrome uses for its own saved passwords. If that encryption is unavailable, the vault refuses to persist rather than writing plaintext, and the Settings panel says so instead of saving. - Passwords never leave the main process. The window process receives usernames and a saved/not-saved flag only; every reveal and fill is additionally refused while the app lock is engaged. Verify without trusting us: the store at ~/Library/Application Support/AtriumBrowser/vault.enc is ciphertext on disk, and the privacy statement (https://atriumbrowser.com/privacy.html) states the same boundary. - The vault stays inside Atrium. The MCP server advertises 49 tools as of version 0.61.93, and not one of them returns a stored secret. Two of them come closest and neither crosses the line: list_logins returns names and sites, never passwords, and sign_in takes an account id and no password argument at all, because the app reads the credential inside its own process, types it into a login URL that was pinned when the owner switched auto sign-in on, and hands the agent back an outcome rather than a secret. Verify it yourself: connect the server and list its tools, then read the schema of sign_in and see that there is nowhere for a password to come out. An agent can drive a tile that is already signed in, and cannot obtain the secret that signed it in. - Session health is reported without touching credentials. A background pass touches each account's session on a six-hour rotation and records whether it is still signed in, so an assistant can check before starting work that depends on a login. It performs a plain page request only: never a form submission, never a credential, never a sign-in attempt. Sites that refuse an unattended client are reported as unknown rather than guessed. Verify: the per-version notes in the update feed (https://updates.belstone.com/account-gallery/appcast.json). - Cross-device sync is end-to-end encrypted. Per-device keypairs and QR pairing ship today; the relay is designed never to hold plaintext. - Shared layouts carry structure only. A shared multitab transfers tiles, labels and sites, never a session, cookie or password. ## 3 · Trust and data - Logins live on your Mac. Cookies and sessions are stored locally, per tile. - Signed, notarized, and updated in the open: Developer-ID signed and notarized builds; the auto-updater checks silently and always asks before installing. - A keychain watchdog detects the rare macOS keychain trust break that silently logs tiles out, explains it plainly, and says exactly what to do (one-time re-login), instead of leaving a mystery. Verify: the notice names the underlying macOS condition, which Apple documents at Keychain Access (https://support.apple.com/guide/keychain-access/welcome/mac); the app's own behavior on it is recorded in the per-version notes of the update feed (https://updates.belstone.com/account-gallery/appcast.json). - Folders and categories organize many Multitabs; the three financial categories render walled as the visible surface of the AI policy above. ## 4 · Pricing, complete and public $29, once, to own Pro. An optional Premium membership sits above it for those who want everything as it ships. The pricing section (https://atriumbrowser.com/#pricing) carries the comparison against the category's subscriptions ($199.99/yr, $24+/mo, $5.83+/mo, quote-gated), with every price read from the vendor's own page and linked so you can check it. ## 6 · Shipped since this page was last audited Six capabilities that reached the shipping build between 0.22.4 and 0.42.11. Each row was confirmed by reading the installed application bundle, not the source repository, because those are different artifacts and only one of them is what a person runs. CapabilityMechanismVerify Per-tile proxy routing0.42.11 Named routes defined in Settings ▸ Network and assigned to a tile from that tile's own menu, applied at the session level before the tile's first navigation. Proxy passwords are encrypted at rest with the operating system keystore, never cross into the page-rendering process, and are never exposed to an AI agent. The built-in test button reports the egress address the destination actually sees. Encrypted backup and restore of saved passwords0.42.7 Every saved entry exported to one encrypted file under a passphrase you choose, deliberately independent of the operating system keystore and of the product's own name, so the backup still opens after either changes. Restore merges by default; replace is opt-in and confirmed. Saved passwords ▸ Back up… then Restore… The gate behind it restores into a completely empty profile and compares every entry, and three of its nineteen checks exist only so the other sixteen cannot pass vacuously. Selective import from 1Password0.42.8 Reads a vault you point it at through the 1Password command-line tool. Selective is structural rather than a setting: there is no bulk-import call in the module, the browse step touches no secret at all, and only ticked rows are fetched. Matching is by site, never by name, because this product exists to hold eight logins on one site and a fuzzy title match would pair the wrong password with the wrong login invisibly. Saved passwords ▸ From 1Password… Extensions blocked from checkout and security frames0.42.5 Any extension you load is prevented from injecting into third-party challenge and payment frames, applied when the extension is staged rather than trusted to declare it, and to the copy the app loads rather than to the author's source. Measured against the exact browser engine the app ships: the excluded frame did not run and a positive control frame did. Without that control, an extension that simply failed to load would look like perfect protection. Time-limited AI access leases0.41 Access for an assistant to a walled login is granted as a lease with an absolute expiry and a hard ceiling, surviving a relaunch so it lasts as long as the job rather than as long as the window, and audited. Right-click a walled tile; the lease and its expiry are shown and can be revoked. Agents panel0.42.10 A window onto what external agents are doing across tiles, plus the approval surface for requests they raise. It is a view onto agents you connect. Toolbar ▸ Agents. Every version named here is downloadable from the public feed with its build number and archive checksum, so any row can be checked against the artifact rather than against this page.