# Give your coding agent bounded access to the web

Wrench is a local CLI and TypeScript SDK that lets an agent read public pages, archive media, and take supported actions in the services you’ve signed into. You keep the model, the keys, and the browser.

Ask your agent to read this page as Markdown, archive one YouTube video with its transcript, and list your recent Beeper conversations.

[Install Wrench](https://wrench.rip/#start)

[See how it works](https://wrench.rip/#how-it-works)

Free and MIT licensed. Runs on macOS and Linux with Bun 1.3.14. Release v0.16.11.

The complete output of one `wrench read` for a public page: a short record of what was captured and how, then the page as Markdown. Nothing was saved. Wrench v0.16.11, run on September 5, 2026

**Read**

Turn a public URL into Markdown your agent can inspect on the spot or keep in a local knowledge base.

**Archive**

Preserve one media item you’re allowed to access, with its source bytes, transcript, manifest, and SHA-256 records.

**Act**

Use named actions in 20 services you’ve signed into, from Beeper and Gmail to YouTube. If an action isn’t listed, Wrench doesn’t offer it.

## Install the verified local release.

Wrench requires Bun 1.3.14 and runs on macOS and Linux. Install the CLI and SDK from the [`@hraness/wrench` package on npm](https://www.npmjs.com/package/@hraness/wrench/v/0.16.11), then run the doctor before you connect a service.

Add the Agent Skill

npx skills add hraness/wrench\#v0.16.11

Add Wrench’s capture, archive, provider, and publishing guide to your agent. With Bun, run `bunx skills add hraness/wrench#v0.16.11` instead. [View the Wrench Agent Skill on skills.sh.](https://skills.sh/hraness/wrench)

```
bun add --global @hraness/wrench@0.16.11
wrench doctor
wrench read https://example.com/article
wrench capabilities --json
```

Or ask an agent that can run commands

“Install Wrench v0.16.11, run `wrench doctor`, then use it to read this URL: …”

## Your agent asks for an outcome, not a browser.

Every request resolves to one named action with typed inputs and a typed result. The service session, cookies, and provider plumbing stay inside a local kernel the agent never touches.

1. **Name the job**The agent asks for an outcome, such as reading an inbox or preserving one video.
2. **Match one action**Wrench resolves one installed, supported action. There is no general browser or request tool to fall back on.
3. **Check the account**The kernel binds the exact service, account, transport, contract version, and risk level before anything runs.
4. **Run one exchange**Credentials stay opaque to the caller and can reach only the endpoints that action declares.
5. **Return the result**The caller gets a typed result, an explicit note of what is incomplete, or a durable record that the outcome is still unsettled.

## Reviewed operations across 20 supported services.

These cards summarize capability families and access methods, then link to the named actions supported in this release. If an action is not listed there, Wrench does not offer it.

### [Beeper](https://wrench.rip/providers/beeper/)

**32 supported actions**

Accounts · Bridges · Contacts · Conversations · Messages · Presence · Reactions

Local app

32 reviewed actions: 26 through one pinned CLI and 6 fixed Desktop reads; writes are previewed and uncertain outcomes stay unretriable.

### [Bluesky](https://wrench.rip/provider-capabilities/#provider-bluesky)

**8 supported actions**

Comments · Content · Feeds · Media · Posts · Profiles

Signed-in web session

### [ClasificadosOnline](https://wrench.rip/provider-capabilities/#provider-clasificados)

**1 supported action**

Listings

Signed-in web session

### [Facebook](https://wrench.rip/provider-capabilities/#provider-facebook)

**1 supported action**

Feeds

Signed-in web session

### [Facebook Groups](https://wrench.rip/provider-capabilities/#provider-facebook-group)

**1 supported action**

Feeds

Signed-in web session

### [Facebook Marketplace](https://wrench.rip/provider-capabilities/#provider-facebook-marketplace)

**2 supported actions**

Feeds · Listings

Signed-in web session

### [GitHub](https://wrench.rip/provider-capabilities/#provider-github)

**2 supported actions**

Organizations · Profiles

Signed-in web session

### [Gmail](https://wrench.rip/provider-capabilities/#provider-gmail)

**3 supported actions**

Contacts · Messages

Official API

### [Hacker News](https://wrench.rip/provider-capabilities/#provider-hacker-news)

**3 supported actions**

Comments · Feeds · Posts

Signed-in web session

### [Instagram](https://wrench.rip/provider-capabilities/#provider-instagram)

**8 supported actions**

Comments · Contacts · Content · Feeds · Media · Messages · Posts · Profiles

Signed-in web session

### [iMessage](https://wrench.rip/provider-capabilities/#provider-imessage)

**5 supported actions**

Conversations · Messages

Local app

### [LinkedIn](https://wrench.rip/provider-capabilities/#provider-linkedin)

**12 supported actions**

Articles · Comments · Contacts · Feeds · Organizations · Posts · Profiles · Reactions · Replies

Official API + Signed-in web session

### [Reddit](https://wrench.rip/provider-capabilities/#provider-reddit)

**11 supported actions**

Comments · Content · Feeds · Flair · Media · Messages · Posts · Profiles

Signed-in web session

### [Substack](https://wrench.rip/provider-capabilities/#provider-substack)

**10 supported actions**

Articles · Comments · Content · Feeds · Media · Messages · Organizations · Posts · Profiles

Signed-in web session

### [Threads](https://wrench.rip/provider-capabilities/#provider-threads)

**4 supported actions**

Feeds · Media · Posts · Profiles

Signed-in web session

### [TikTok](https://wrench.rip/provider-capabilities/#provider-tiktok)

**3 supported actions**

Comments · Feeds · Profiles

Signed-in web session

### [Twitch](https://wrench.rip/provider-capabilities/#provider-twitch)

**1 supported action**

Profiles

Signed-in web session

### [WhatsApp](https://wrench.rip/providers/whatsapp/)

**4 supported actions**

Contacts · Media · Messages

Linked device

### [X](https://wrench.rip/provider-capabilities/#provider-x)

**16 supported actions**

Articles · Comments · Content · Feeds · Likes · Messages · Posts · Profiles · Replies · Threads

Official API + Signed-in web session

### [YouTube](https://wrench.rip/provider-capabilities/#provider-youtube)

**5 supported actions**

Comments · Feeds · Media · Posts · Profiles

Signed-in web session

Provider names identify compatible services and do not imply endorsement. Counts are for release v0.16.11.

[Browse every supported action](https://wrench.rip/provider-capabilities/)

## The same boundary from three surfaces.

Wrench does not publish a hosted API or MCP server. Its public interfaces stay local and versioned, so what your agent can do is the same from a skill, a terminal, or typed code.

### Agent Skill

Add the release-matched capture, archive, provider, and publishing guide to an agent that can run commands.

```
npx skills add hraness/wrench#v0.16.11
```

### CLI

Use stable human output or JSON from a terminal, a script, or an agent tool call.

```
wrench capabilities --json
```

### TypeScript SDK

Import side-effect-free validators and types without starting the CLI or inspecting local state.

```
import { isProviderPluginId } from "@hraness/wrench"
```

## Nothing leaves your machine unless you ask it to.

Wrench is infrastructure around the accounts and tools you already have, not a service in front of them.

**Your sign-ins stay here**

Connected accounts live in encrypted local state. Your agent receives a named action and its result, never cookies, tokens, or a browser it can steer.

**Only the traffic you asked for**

Wrench contacts the page or service the action names and nothing else. The CLI and SDK send no analytics anywhere.

**Reads you can open later**

Account-bound reads are kept as encrypted snapshots on your machine. A failed refresh or a changed service does not erase the last verified state.

**Writes happen once or stay flagged**

Consequential changes need a short preview and a confirmation. An indeterminate write is never blindly retried and remains unsettled until separate exact evidence can reconcile it.

**Change fails closed**

When a service changes its shape, the affected action becomes unavailable until its contract is reviewed again. Wrench never switches silently to a browser fallback.

**Bring your own agent**

Wrench ships no model, planner, approval screen, or app. It works with the coding agent you already use and stays out of its way.

## Use Wrench with the tools you already have.

Wrench owns a narrow local layer: named actions and the records they leave behind. Hosted integration catalogs, cloud Actors, and managed browsers solve broader jobs at other layers.

| Approach | Best fit | Wrench boundary |
| --- | --- | --- |
| [Pipedream Connect](https://pipedream.com/docs/connect) | Hosted integration breadth and managed end-user authentication across thousands of APIs and prebuilt tools | A smaller local set whose provider operations and implementations are reviewed before they run |
| [Apify MCP](https://docs.apify.com/integrations/mcp) | Discovering and running eligible Apify Store Actors through a hosted MCP service, with access to results and storage | Each provider operation and implementation must be named and reviewed before it can run |
| [Browserbase](https://docs.browserbase.com/platform/browser/observability/session-recording) | Parallel browser automation on managed cloud sessions, with live inspection and video recording by default | No remote browser runtime and no hidden browser fallback when a named operation is missing or drifted |
| Wrench | Narrow local capabilities whose exact identities, account realms, and risks need review | Encrypted provider snapshots and projections, mutation previews and receipts, and fail-closed contract drift |

## Before you install.

### Does Wrench need an account?

No. Install the CLI and read a public page. You connect a service only when you want its actions, and each connection is stored on your machine. There is no Wrench account and no Wrench server in the loop.

### Does it use my credentials?

It uses a sign-in you already have for a service, on this machine, and keeps it out of your agent’s hands. The agent calls a named action and gets a typed result. It never receives cookies, tokens, a shell, or a browser it can steer.

### What does it cost?

Nothing. Wrench is free and MIT licensed, with no hosted tier and no paid plan. You pay your model provider and any service subscriptions you already have.

### Does it phone home?

No. The CLI and SDK send no analytics to wrench.rip; they make only the network requests the action you chose requires. This website counts page views with cookieless analytics and honors Do Not Track. The [privacy page](https://wrench.rip/privacy/) explains both.

### Which platforms does it run on?

macOS and Linux with Bun 1.3.14. Actions that read iMessage or Apple Photos need macOS. Beeper actions need Beeper Desktop on the same machine, and WhatsApp reads need a linked device.

### Is Wrench an AI agent?

No. Wrench is a CLI and an SDK. Your agent owns the model, the plan, approvals, and the interface. Wrench gives it a set of actions it can call and a record of what happened.

### Does it bypass login, paywalls, access controls, or DRM?

No. Media archiving is limited to one item you are authorized to access that is finite and not protected by DRM. Wrench does not bypass payment, authentication, access controls, or DRM.

### What happens when a service changes?

The affected action becomes unavailable until its contract is updated, reviewed, and tested. Wrench does not switch to a browser fallback silently, so a changed page never turns into a guessed action.

### Why does Wrench refuse to retry some writes?

If a request left the machine and its response was lost, the effect may already exist. Wrench keeps that uncertainty visible and reconciles it from separately obtained evidence instead of sending the request again.

### What does release v0.16.11 include?

Page capture, media archives, encrypted reads, and 139 supported actions across 20 services. `wrench capabilities` is the source of truth for what is installed and available on your machine, and the [provider list](https://wrench.rip/provider-capabilities/) names every action in this release.

### Who made it?

Ben Guo, a musician and builder who was a founder and engineering leader at companies including Venmo and Stripe, and who now builds from Puerto Rico. Wrench is published in the open under the Hraness GitHub organization.

## Ben Guo

Wrench is built by Ben Guo, a musician and builder, formerly a founder and engineering leader at companies including Venmo and Stripe, now building from Puerto Rico. He publishes it in the open with the rest of his projects at hraness.com.

- [hraness.com](https://hraness.com/)
- [@hraness](https://x.com/hraness)
- [GitHub](https://github.com/hraness/wrench)

## Precise web capabilities for the agent you already use.

Install the CLI, read one public page, and connect a service only when you need its actions.

[Install Wrench](https://wrench.rip/#start)

Free and MIT licensed. Runs on macOS and Linux with Bun 1.3.14. Release v0.16.11.

## Arguments and comparisons

These essays compare named, attested operations with browser control, account identity, virtual machines, device policy, rumour-driven agentic search, and desktop privilege grants.

[Browser-using agents and named operations Why Wrench exposes named operations instead of falling back to general browser control.](https://wrench.rip/compare/personal-agents-browser-use/)

[Agentic-web spoofing and outbound operations Why a failed inbound identity check does not establish a safe outbound operation.](https://wrench.rip/agentic-web-spoofing/)

[Virtual machines and attested operations Why a virtual machine around an agent does not define a safe web operation.](https://wrench.rip/vms-cannot-contain-agents/)

### [Read about PayPal and GrapheneOS attestation](https://wrench.rip/paypal-grapheneos-attestation/)

PayPal crashed on GrapheneOS after a root-detection check. Device-policy attestation is not a named web operation.

### [Read about rumour and named operations](https://wrench.rip/rumour-is-the-exploit/)

A rumour of a bug can be enough for agentic search. A search direction is not a named web operation.

### [Read about Omarchy and named operations](https://wrench.rip/omarchy-root-escalation/)

Omarchy’s default desktop let any user process escalate to root. A host privilege grant is not a named web operation.

## Start with the outcome you need.

These guides describe the current release, the commands to use, and the limits that stay in force.

### [Install and verify Wrench](https://wrench.rip/getting-started/)

Pin the current release, run the doctor, capture a first URL, and inspect local capabilities.

### [Capture URLs and archive media](https://wrench.rip/capture-and-archives/)

Choose between an inspection, durable Markdown capture, or one verified finite-item media archive.

### [Check provider support](https://wrench.rip/provider-capabilities/)

See every provider action available in the current release and the access method it uses.

### [Understand the security boundary](https://wrench.rip/security/)

Review local custody, account binding, encrypted state, risk levels, and fail-closed drift behavior.

### [Author a provider plugin](https://wrench.rip/plugins/)

Define one operation, prove its contract, then check, test, pack, trust, and install the exact code.