Guard a browser-use agent’s tools. A stop comes back as the action’s error, with the rule and who to ask.
npx getclaros in your project installs claros-browser (uv, poetry, or pip into your virtualenv) and prints the two lines below with the file they go in. By hand: pip install claros-browser. Tested with browser-use 0.9.2–0.13.11.
from browser_use import Agent, Toolsfrom claros_browser import guard_toolstools = Tools()guard_tools(tools) # CLAROS_URL, CLAROS_KEY from the envagent = Agent(task="Refund order 1042", llm=llm, tools=tools)
The same in-page script as Playwright holds consequential clicks and submits. After each agent action the guard checks what was held (POST /v1/check/page, or the screen), replays what’s allowed and drops what’s stopped. The action then returns ActionResult(error=…) with the stop text, so the agent sees the rule, the owner’s words and who to ask, and can tell the user. A nudge lets the action through: its text (rule, the owner’s words, suggested fix) is appended to the action result’s extracted_content, which the agent keeps in memory, and logged as a warning.
guard_tools(tools, url=None, key=None, timeout=5.0, fail_open=False, actor=None, workflow_id=None, on_nudge=None, ask_wait=120.0). It returns the Guard, whose decisions, stops and nudges you can read after the run. On an ask the held action waits up to ask_wait seconds for the rule owner’s answer and is replayed only on an approval of that action (0: a stop at once).
