A real computer boots in this tab. Your agent has hands on it.

Through WebMCP it gets this machine's terminal, files and processes, and a phone to test on. You sit at the same shell and hold the only key to anything irreversible.

Say to your agentclick a line to copy it

loading emulator…

click to type — you and the agent share this shell

How this works

A Linux 4.16 kernel boots on an emulated x86 (v86, WebAssembly) inside this page: a shell, a filesystem, processes, a VGA console. No server. It has no network, and it is erased when the tab closes.

The catalogue is generated from the machine

When a machine attaches it reports a capability manifest, and the WebMCP tool list is built from that. This box has no tmux, so there is no pane tool; no Codex, so no subagents. The page says which tools it did not register and why.

Lifetime is an AbortSignal

Every registration scope (always, session, view, warrant) is one AbortController passed to document.modelContext.registerTool(). Open the Changes tab and changes_review exists; close it and the tool is gone. Watch the count in the header.

The warrant is the registration

Writing to disk and running commands unattended are not gated handlers. Those tools are absent until you click Grant, and grant() requires transient user activation, which a tool call never has. The page ships the attack as a tool, warrant_force_grant, so you can watch it fail.

Two consoles

The terminal on this page is the serial console (ttyS0); you and the agent type into the same shell. Unattended commands run on a second, unwatched shell (ttyS1). The Screen tab shows the VGA text console, where the kernel's own init shell lives.

Nothing leaves the browser

After boot the page makes no request to its own origin. A PerformanceObserver counts; the number is in the footer and is a tool the agent can call.

state: booting

Each phone is a real browsing context held at that phone's viewport, pixel ratio, safe areas and platform hints, drawn in its frame the way an installed web app is shown: the status bar overlays the page, as with viewport-fit=cover.

Not iOS or Android. No Apple or Google code runs here. What a web app can observe is what is simulated, because that is what a web app is tested against.

Apps load from the machine's workspace with their CSS, scripts and SVGs inlined and env(safe-area-inset-*) replaced by the device's real insets, so a fix the agent commits on the Linux box is the fix on the phones. A foreign URL can be shown but not inspected, and the tools say so.

The machine above is disposable and lives in this tab. Bonnie's host runs on your real computer and pairs it to this page over a direct peer connection, with no relay and no account. Your agent then gets the same catalogue, generated from what that machine has: tmux terminals that outlive the tab, the real filesystem, the screen, Codex subagents.

git clone https://github.com/meshbergio/bonnie
cd bonnie && ./install.sh
bonnie pair          # prints a URL and a QR code — open it in this page

Same gate

Warranted tools do not exist until you grant them here, with a real click. A tool call cannot produce one.

Same record

Every call, warrant and command lands in an append-only ledger the agent can read back, including what happened while it was not looking.

Nothing in the middle

The page is static. Once paired it makes no requests to its own origin; the counter in the footer is the measurement.

Ask your agent for bonnie_install_plan and it will walk you through it.

An archive is the whole machine in one file: its memory and disk as the emulator saved them, plus the staged edits, the record, and what the phones had open. Resume it later and you are where you left off, including anything typed into the shell.

Authority does not survive a file. A live warrant or standing access is never archived and never restored; the agent starts a resumed session with exactly the tools it had at boot.

Drop a .bonnie archive here, or click to choose one

The agent can prepare an archive with session_archive, but the download needs your click. It can read what a loaded file contains with session_describe.

A real computer boots in this tab. Your agent has hands on it.

The agent is asking for capabilities.

Grant these once and stop being asked.