Back to docs

Constitutional Safety

CBrowser's most unique feature. No other browser automation tool has built-in ethical boundaries.

The Problem

Other AI automation tools will execute any command you give them:

  • "Click Delete All Data" ✅ Done
  • "Submit this $10,000 transfer" ✅ Done
  • "Accept all terms and conditions" ✅ Done

This is dangerous. AI agents can be tricked, make mistakes, or misread context.

The Solution: Action Zones

CBrowser classifies every action into one of five safety zones:

Zone Color Actions Behavior
Green 🟢 Navigate, read, screenshot, scroll Auto-execute immediately
Yellow 🟡 Click buttons, select options Log and proceed
Orange 🟠 Fill forms, smart-click, session management, persona creation, cognitive journeys Allowed with caution warning
Red 🔴 Submit forms, delete, purchase, account changes Requires verification
Black ⬛ Bypass authentication, inject scripts, violate ToS Never executes

How It Works

Green Zone (Safe)

These actions cannot cause harm:

# All auto-execute without prompts
npx cbrowser navigate \
  https://example.com
npx cbrowser screenshot
npx cbrowser extract links

Yellow Zone (Logged)

Interactive but low-risk actions:

# Executes but logs the action
npx cbrowser click "Add to Cart"

Every yellow action is logged with:

  • Timestamp
  • Action type
  • Target element
  • Screenshot before/after

Orange Zone (State-Modifying)

Actions that modify state but are generally safe:

# Proceeds with caution message
npx cbrowser fill "email" "[email protected]"
npx cbrowser smart-click "Sign In"
npx cbrowser session save "my-session"

Orange zone covers: form fills, smart clicks, session management, persona creation, cognitive journeys, test generation/repair, and marketing tools.

Red Zone (Verification Required)

Potentially destructive or irreversible:

# Refused: prints the reason, exits 1
npx cbrowser click "Delete Account"
npx cbrowser click "Place Order"
npx cbrowser click \
  "Submit Application"

To run it anyway (use carefully):

npx cbrowser click "Delete Account" --force

Over MCP the tools click, smart_click, press_key, type_text, drag and evaluate_script take force: true instead. Since 20.0 a refusal from any of them is a tool error with one shape, so a client can tell it from a result:

{
  "success": false,
  "tool": "click",
  "zone": "red",
  "message": "Red zone action ...",
  "howToRun":
    "Re-run with force: true..."
}

The response is marked isError: true. On the hosted servers a refused call is refunded, since nothing ran.

Black Zone (Never Allowed)

CBrowser will refuse these actions entirely:

  • Attempting to bypass login screens
  • Injecting JavaScript into pages
  • Automating CAPTCHA solving
  • Violating robots.txt
  • Scraping personal data without consent

The Five Laws

CBrowser follows five constitutional principles:

1. Transparency

Every action is logged with timestamps and screenshots. You can always review what happened.

MCP tool calls are written to a daily audit log, audit/tool-invocations-<date>.json in the CBrowser data directory (~/.cbrowser unless CBROWSER_DATA_DIR says otherwise).

2. Verification

Destructive actions need explicit confirmation. No accidental deletions.

3. Privacy

  • Credentials are never logged
  • Personal data is automatically redacted in logs
  • Screenshots blur sensitive fields

4. Politeness

  • Respects robots.txt
  • Adds delays between actions (no flooding servers)
  • Identifies itself as automation (never pretends to be human)

5. Fallback

When uncertain, CBrowser asks. When dangerous, it stops.

Configuration

Adjusting Zone Classifications

The MCP server reads per-tool zones from tool-permissions.json in the CBrowser data directory:

{
  "toolPermissions": {
    "chaos_test": "black",
    "fill": "red"
  },
  "lastUpdated":
    "2026-10-21T00:00:00Z"
}

A tool set to black is always refused. A tool set to red is refused only when the server runs with CBROWSER_ENFORCE_RED_ZONE=true. These are whole-tool zones; the element check on clicks and key presses described above applies either way.

Overriding the Red Zone

There is no setting that turns the element check off. Each call opts in: --force on the CLI, or force: true on the MCP tools listed above.

Why This Matters

As AI agents become more autonomous, safety becomes critical:

  1. Mistakes happen - AI can misinterpret commands
  2. Attacks happen - Prompt injection can manipulate agents
  3. Context is lost - Agents don't understand consequences

Constitutional safety limits damage even when things go wrong.

Copyright: (c) 2026 Alexa Eden.

License: MIT License

Contact: [email protected]

From the Blog