dsh-cloudflare-browser-run
A DeepSeek Harness plugin that gives the agent real browser access: headless Chrome on Cloudflare's network, so JS-rendered pages, screenshots, and PDFs all just work.
Port of pi-cloudflare-browser-run, built to the dsh (Cordis) plugin spec.
Why
The built-in web_fetch is a plain HTTP fetch — JS pages come back empty and SSRF protection is deferred upstream. This plugin adds a real browser:
- clean markdown from any public page (SPA/JS included)
- screenshots (PNG) and PDFs
- login-capable sessions and WebMCP sites
Quick start
dsh plugin --profile web add dsh-cloudflare-browser-runConfigure credentials in your profile/settings layer:
- id: cloudflare-browser-run
name: dsh-cloudflare-browser-run
config:
cf_api_token: <your token>
cf_account_id: <your account id>Token: Cloudflare dashboard → API Tokens → Browser Rendering: Edit template. Account id: dash.cloudflare.com/<ACCOUNT_ID>/....
Tools
| tool | what it does | |
|---|---|---|
browse | fetch a public URL → clean markdown (default); action = screenshot \ | pdf |
screenshot | save the page as PNG locally, returns the file path | |
pdf | save the page as PDF locally, returns the file path |
Config
| key | required | meaning |
|---|---|---|
cf_api_token | ✅ | your API token (Browser Rendering:Edit) |
cf_account_id | ✅ | your Cloudflare account id |
cf_api_base | – | API base override |
output_dir | – | where screenshots/PDFs land (default OS temp) |
Privacy
- Public web only: every URL passes an SSRF guard (localhost / private IPs / IPv6 literals / userinfo rejected) before the API is called.
- The token lives only in your config file — never logged, never stored by the plugin.
- Browser Run identifies itself as a well-behaved bot, the compliant way to fetch.
Development
npm install
npm run typecheck
npm test # SSRF guard / config / API shape
npm run buildLive API test (not part of npm test):
DSH_TEST_CF_TOKEN=<token> DSH_TEST_CF_ACCOUNT=<account> node --import tsx tests/real/real-cf.mjsLicense
MIT
