# MOAB Automations > A VS Code Copilot skill that turns any site you log in to into a dedicated AI agent - scaffolds an MCP server, two least-privilege agents, and Playwright-backed tools mined from the live page. No code required. - **Type:** MCP server - **Install:** `agentstack add mcp-zmustafa-moab-automations` - **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior - **Seller:** [zmustafa](https://agentstack.voostack.com/s/zmustafa) - **Installs:** 0 - **Category:** [Developer Tools](https://agentstack.voostack.com/c/developer-tools) - **Latest version:** 0.1.0 - **License:** MIT - **Upstream author:** [zmustafa](https://github.com/zmustafa) - **Source:** https://github.com/zmustafa/MOAB-Automations ## Install ```sh agentstack add mcp-zmustafa-moab-automations ``` Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent. ## About # Mother Of All Browser (MOAB) Automations [](https://github.com/zmustafa/MOAB-Automations/actions/workflows/ci.yml) [](LICENSE) [](moab-browser-automation/SKILL.md) > One skill → a purpose-built AI agent for every site you log in to. **MOAB** is a VS Code Copilot **skill** that turns a website you already sign in to — internal portal, SaaS dashboard, intranet tool — into a dedicated AI agent, without writing code. You give it a URL. It does reconnaissance on the site, opens a real browser so you can sign in, mines the authenticated page for what is automatable, asks which of those features you want, and then scaffolds an MCP server plus two VS Code agents wired to exactly those features. The agent uses its own dedicated browser profile, so single sign-on works once and keeps working. **The idea:** MOAB is a meta-agent — an AI that builds other AIs. One skill, installed once, lets you spin up an agent per site. --- ## What actually gets built ``` .vscode/mcp.json # registers the server with VS Code .github/agents/ .agent.md # runtime agent — read/search + its own tools. No terminal, no file edits. -builder.agent.md # privileged agent — used to add features, not for daily work -mcp-server/ index.js session-manager.js feature-runner.js ui-miner.js driver.js config.js platform.js safety.js redact.js rate-limiter.js retry.js errors.js bootstrap.js # one-time visible sign-in site.config.json # your settings features/*.json # one file per tool — the executable contract test/ # unit tests for redaction and input safety data// # gitignored: browser profile, captures. Auth material. ``` Every agent ships with the same standard toolkit, plus one tool per feature you picked: | Tool | What it does | |---|---| | `launch` | Open the site and capture the page (interactive sign-in when needed) | | `navigate` | Jump to any route within the site | | `interact` | Run a sequence of fill / select / click / press / wait steps | | `snapshot_ui` | Mine the live page for automatable elements and suggested selectors | | `get_page_content` | Read a previous capture from disk — no browser | | `list_sessions` | Show cached sessions and how fresh they are | The server code is **copied from tested templates**, not regenerated by the model, so every agent gets the same audited implementation. The only things authored per site are `site.config.json` and `features/*.json`. --- ## What makes it different - **Recon first, questions second.** The skill inspects the live site before it asks you anything, then asks one batched round of multiple-choice questions with defaults already filled in. - **Features are data, not generated code.** Each tool is a JSON file with selectors, an action sequence, and a smoke test. When a site redesign breaks a tool, you re-mine one `selectors` block instead of regenerating anything. - **Works with whatever SSO your site uses.** Entra ID, Google, Okta, Auth0, ADFS, Ping — if you can sign in once in the visible browser, the dedicated profile keeps it. - **Your real browser is never touched.** Each agent gets its own profile under `data//`. MOAB never reads your normal profile and never closes your windows. - **Least privilege by default.** The agent you talk to every day has no terminal and no file-editing tools, because it is the one that reads untrusted web pages. - **Cross-platform.** Windows, macOS, Linux. All OS-specific logic lives in one file. --- ## The flow 1. **Invoke the skill** from Copilot Chat. 2. **Give it a URL.** 3. It runs **reconnaissance** — SSO detection, SPA shape, bot-detection markers — and warns you if the site is behind a bot-detection stack. 4. It asks one **batched round of questions** (app name, data location, browser channel, rate limit, redaction), all with sensible defaults. 5. It **scaffolds** the server, registers it in `.vscode/mcp.json`, writes both agent files, and verifies `data/` is gitignored. 6. It runs `bootstrap.js`, which **opens a real browser window** so you sign in. It waits for you to press Enter — no guessing when you are done. 7. It **mines the authenticated page** and presents 4–8 candidate features as a multi-select menu. 8. It writes one **feature file** per selection and validates each one. 9. It **smoke-tests** every non-destructive tool once, then reports what works. --- ## Requirements - **VS Code** with GitHub Copilot Chat - **Node.js 20+** - **Google Chrome** or **Microsoft Edge** - **Playwright** — installed automatically during scaffolding --- ## Install 1. Copy the `moab-browser-automation/` folder into your workspace at `.github/skills/moab-browser-automation/`. 2. Run **Developer: Reload Window**. 3. In Copilot Chat, ask: *"Use the MOAB skill to build me an agent for `https://myapp.example.com/`."* --- ## New to VS Code? Five-minute setup 1. **Install VS Code** — [code.visualstudio.com/Download](https://code.visualstudio.com/Download). 2. **Install Chrome or Edge** if you do not have one. 3. **Sign in to GitHub Copilot** — account icon, bottom-left. No subscription yet? [github.com/features/copilot](https://github.com/features/copilot). 4. **Create a dedicated folder** (e.g. `C:\dev\my-agents`) and open it with *File → Open Folder…*. Use a folder set aside for this, not your main repo. 5. **Open Copilot Chat** — `Ctrl+Alt+I` (Windows/Linux) or `Cmd+Ctrl+I` (Mac) — and pick **Agent** from the mode dropdown. 6. **Turn on auto-approve while building.** Scaffolding installs packages and runs commands, so auto-approve saves a lot of clicking. > **Turn auto-approve back off before daily use.** It is genuinely useful while building and > genuinely risky at runtime, when the agent is reading live web pages. See > [Security](#security--responsible-use). --- ## Using your agent 1. Open Copilot Chat, click the agent dropdown, pick your new agent (e.g. `myapp`). 2. Talk to it in plain English: - *"Export the last 90 days of records to CSV and group them by category."* - *"What changed on the dashboard since yesterday?"* - *"Pull every open ticket assigned to me and summarize the blockers."* 3. **The first call opens a browser window.** By default every call does, so you can handle MFA and consent prompts. Once an agent has been stable for a while you can set `"alwaysInteractive": false` in `site.config.json` to allow silent headless runs. 4. **Adding a feature later**: switch to the `-builder` agent and ask. It re-mines the page, writes a new feature file, validates it, and restarts the server. No code edits. --- ## Security & responsible use MOAB caches a live authenticated browser session and feeds third-party web content into an AI agent. Both halves deserve attention — the full threat model is in [SECURITY.md](SECURITY.md). - **Prompt injection is the main risk.** Everything captured from a page is wrapped in `` delimiters and both agents are instructed to treat it as data, never as instructions. The runtime agent has no terminal or file-editing tools, so a successful injection has a much smaller blast radius. Nothing makes this risk zero — keep auto-approve off for daily use. - **`data/` is auth material.** It holds the browser profile. Scaffolding refuses to continue unless `data/` is gitignored, writes a second ignore file inside it, and restricts its permissions. Treat it like a password. Delete it when you are done with an agent. - **Captured content is redacted** — JWTs, GitHub/AWS/Slack tokens, private keys, bearer headers, assigned API keys, and Luhn-valid card numbers — at the tool boundary as well as on disk, with an audit log at `data//redaction-log.jsonl`. Regexes are best-effort, not a guarantee. - **Destructive tools require explicit confirmation** on every call and are never smoke-tested. - **Authorized use only.** Use this on sites you are allowed to automate, and respect their terms. MOAB rate-limits per host (750 ms default) and retries transient failures with backoff. - **Stealth is opt-in.** The default driver is stock Playwright. The stealth driver exists for sites behind aggressive WAFs that you are authorized to automate — not for circumventing access controls. See [reference/patchright.md](moab-browser-automation/reference/patchright.md). --- ## Limitations & known issues Worth knowing before you start: - **Sites with hard bot detection may never work silently.** If Cloudflare, Akamai, Datadome or a captcha is in the path, expect a visible browser and a human on every run. - **Selectors drift.** A site redesign breaks features. That is why they are JSON — recovery is re-mining one block, not rebuilding the agent. - **Conditional access can force re-authentication** regardless of cached session state. That is the policy working as intended and cannot be solved headlessly. - **Redaction has false positives and false negatives.** Card-number detection can match long numeric IDs; hex-blob redaction is off by default because it destroyed git SHAs. Check the audit log. - **Canvas-heavy and deeply custom UIs mine poorly.** Accessibility and DOM mining need real elements; a vision fallback exists but coordinate clicks are fragile. - **Downloads that require OS-level dialogs are not handled.** - **Only Chromium-based channels are supported.** Firefox and WebKit are out. --- ## Telemetry Zero. MOAB and every agent it generates send nothing to the author, to Microsoft, to GitHub, or to anyone else. A generated agent talks to exactly two places: the site it automates, and whatever you explicitly tell it to call. If you fork this, please keep it that way. --- ## Contributing Issues, ideas, and pull requests welcome — see [CONTRIBUTING.md](CONTRIBUTING.md) for the ground rules and repository layout. Before opening a PR: ```bash cd moab-browser-automation/templates/mcp-server && node --test node moab-browser-automation/scripts/validate-feature.mjs moab-browser-automation/examples/features ``` Both run in CI on Linux, macOS, and Windows, along with a scaffold smoke test. Please do not add telemetry, and do not grant the runtime agent `execute` or `edit` tools. Changes are tracked in [CHANGELOG.md](CHANGELOG.md). Licensed under [MIT](LICENSE). ## Source & license This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code. - **Author:** [zmustafa](https://github.com/zmustafa) - **Source:** [zmustafa/MOAB-Automations](https://github.com/zmustafa/MOAB-Automations) - **License:** MIT Install and usage instructions live in the source repository linked above. ## Pricing - **Free** — Free ## Security capabilities Automated source analysis of v0.1.0 — what this tool can access: - **Network access:** no - **Filesystem access:** no - **Shell / process execution:** no - **Environment & secrets:** no - **Dynamic code execution:** no *"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.* ## Versions - **0.1.0** — security scan: passed — Imported from the upstream source. ## Links - Listing page: https://agentstack.voostack.com/l/mcp-zmustafa-moab-automations - Seller: https://agentstack.voostack.com/s/zmustafa - Browse the marketplace: https://agentstack.voostack.com/browse --- Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.