案发现场 / Crime Scene

AI investigates the browser crime scene

Let AI drive the Chrome you already use — with your real login sessions — to navigate, click, type, screenshot, and read pages.

Quick startSee the 21 tools
curl -X POST 127.0.0.1:10088/command
>

Quick start

Get the extension from the Chrome Web Store or a GitHub Release. The daemon is always a prebuilt binary from Releases — no source build.

1. Install the extension from the Chrome Web Store:

Open Chrome Web Store

2. Install the local daemon and skills (skip the unpacked zip — the store already has the extension):

curl -fsSL https://raw.githubusercontent.com/ximing/csi/master/scripts/install.sh | bash -s -- --no-extension

3. Open the extension popup and confirm it shows “connected”.

Check it’s ready:

curl -s http://127.0.0.1:10088/status

Once installed, the skill auto-engages whenever you ask AI to interact with a site — no manual invocation.

Skills for other coding agents

The installer covers Claude Code. The same skills ship as thin plugin manifests for other coding tools:

Claude Code/plugin marketplace add ximing/csi /plugin install csi@csi
Codex App / CLIcodex plugin marketplace add ximing/csi codex plugin add csi@csi
Cursor/add-plugin csi
Grok Build CLIgrok plugin install csi@xai-official --trustxAI 官方市场收录 PR 审核中 / xAI official marketplace listing in review
Kimi Code/plugins install https://github.com/ximing/csi
OpenCode"plugin": ["csi@git+https://github.com/ximing/csi.git"] // opencode.json
Pipi install git:github.com/ximing/csi

The daemon is still required; the extension comes from the store or a Release zip — see the Coding Agent Skills section in the README.

Scenarios

Three typical scenarios — one toolkit, different jobs

#1

Agent inspects the browser

Read page structure, search, extract, answer questions

curl -X POST 127.0.0.1:10088/command
>
#2

Agent debugs a web page

Read the console, capture network, locate the bug

curl -X POST 127.0.0.1:10088/command
>
#3

E2E regression suites

Turn natural-language scenarios into replayable tests

1

Describe

The model writes e2e/cases/<name>.md: the URL under test + numbered steps with machine-checkable expectations.

2

Verify

It executes live in your real Chrome via the daemon, iterating until every expectation holds.

3

Solidify

What passed becomes e2e/suites/<name>.mjs — plain Node scripts over HTTP.

4

Replay

node e2e/run.mjs — no model involved, replay anytime.

Architecture

The daemon is an HTTP server for AI clients and a WebSocket server for the extension. The extension runs in your real Chrome and executes tools via CDP.

AI clientdaemon (Go)127.0.0.1:10088127.0.0.1 only · no auth (v1)Chrome extension (MV3)HTTP POST /commandWebSocket /ws

21 investigation tools

Covering the full browser interaction chain — exact contract in protocol.md §4

navigateOpen/switch tab, navigate to a URL
find_tabFind an open tab by title or URL
snapshotAccessibility tree with @e element refs
clickClick an element by @e ref
fillFill inputs or contenteditable
evaluateRun arbitrary JS in the page
networkMonitor/capture network requests
mouse_clickTrusted coordinate-level clicks
waitWait for text, an element, or a URL
scrollScroll the page or an element into view
hoverHover to open CSS :hover menus
key_typeType keys character by character
send_keysSend key events (with modifiers)
cdpRaw CDP passthrough
screenshotScreenshot, returns a file path
save_as_pdfSave page as PDF
uploadUpload a file
list_tabsList all open tabs
close_tabClose a specific tab
close_sessionClose all tabs in a session
list_framesList all frames; cross-origin marked isolated

Security notes

⚠ Warning

Loopback is the boundary

The daemon binds 127.0.0.1 only; v1 has no auth — loopback is the isolation boundary. Anything running as your user can drive your browser.

⚡ Capability

Designed capability

evaluate and cdp are arbitrary code execution channels in the page. That is a designed capability, not a bug — treat skill prompts accordingly.