Policy beats prompts.

1. Browser

   Gambit stays the browser.

   Tabs, profiles, the page you can see. The model uses this window through Gambit MCP.

2. Gambit MCP

   The interface runs beside it.

   Sessions, tabs, browser_snapshot, find, navigate. Then click, type, fill, scroll, open or close a tab — on agent profiles. Choose read-only, supervised, or Autopilot when the session starts.

3. Policy

   Policy stays in the host.

   Isolated profiles and an audit trail. Banking and mail origins deny. Password fields refuse fill.

Pair an outside client next. Connect Cursor, Claude, Codex, or Gemini CLI.

{
  "mcpServers": {
    "gambit": {
      "type": "stdio",
      "command": "/Applications/Gambit.app/Contents/MacOS/gambit-mcp",
      "args": ["--stdio"],
      "env": { "GAMBIT_MCP_TOKEN": "<pairing token shown once>" }
    }
  }
}

claude mcp add --transport stdio gambit \
  --env GAMBIT_MCP_TOKEN='<pairing token shown once>' \
  -- /Applications/Gambit.app/Contents/MacOS/gambit-mcp --stdio

codex mcp add gambit \
  --env GAMBIT_MCP_TOKEN='<pairing token shown once>' \
  -- /Applications/Gambit.app/Contents/MacOS/gambit-mcp --stdio

[mcp_servers.gambit]
command = "/Applications/Gambit.app/Contents/MacOS/gambit-mcp"
args = ["--stdio"]

[mcp_servers.gambit.env]
GAMBIT_MCP_TOKEN = "<pairing token shown once>"

{
  "mcpServers": {
    "gambit": {
      "command": "/Applications/Gambit.app/Contents/MacOS/gambit-mcp",
      "args": ["--stdio"],
      "env": { "GAMBIT_MCP_TOKEN": "<pairing token shown once>" }
    }
  }
}

command: /Applications/Gambit.app/Contents/MacOS/gambit-mcp
args:    ["--stdio"]
env:     GAMBIT_MCP_TOKEN=<pairing token shown once>

If Gambit is closed, gambit-mcp still answers tools/list. Browser tools return BROWSER_UNAVAILABLE until you open the app. Closing the sidecar does not quit Gambit.

1. read_only

   Observe the page.

   Snapshots, find, and same-origin navigate inside the grant. No click, type, or fill.

2. supervised

   Act with approval.

   Same tools as research Ask. Click, type, and fill wait for a native Allow / Deny. Scroll may proceed under policy.

3. autopilot

   Act after one grant.

   Same actuation catalog as supervised. After you Allow the session, policy ask becomes allow for that grant. Banking and mail origins still deny. Password fields refuse fill. Uploads still open an approval so the file path stays visible. Settings → Connections Autopilot MCP applies the same ask→allow rule to supervised sessions when you turn it on.

Autopilot mode is not the AutoPilot profile. Profile id agent-approved is labelled AutoPilot in chrome. Session mode autopilot is a grant choice on agent-research or agent-approved.

• Local first

  On this Mac by default.

  Current-page text, memory, task logs, and default Ask stay on the device. Gambit MCP is local. Ask defaults to Ollama or MLX. OpenRouter is a Settings choice ¹.

• Separate identity

  The agent does not inherit your sessions.

  Personal cookies, passwords, and passkeys stay in Personal. Agent Research cannot see them. Isolation is a profile boundary, not a prompt.

• Fail closed

  No unrestricted browser privileges.

  A native policy engine validates proposed actions. Ambiguity, cross-origin jumps, and sensitive data stop the run.

• personal

  Your browsing.

  Passwords, passkeys, import, autofill, and the downloads manager live here. Models cannot drive this profile.

• agent-research

  Supervised research.

  Isolated from Personal. Ask starts supervised. MCP may request read-only, supervised, or Autopilot. Banking and mail origins deny.

• agent-approved

  AutoPilot profile.

  Chrome label for authenticated agent work. Same MCP tools as Research. Sessions may be supervised or Autopilot; Personal passwords and passkeys stay locked out.

Passkeys stay in Apple Passwords / iCloud Keychain. Unsigned local builds can request Keychain authorization; third-party sites that require Apple’s browser entitlement will keep offering their usual fallback.

¹ Default Ask is local. OpenRouter is a Settings → Models choice. It only receives page text if you enable that session’s export checkbox. A paired MCP client (Cursor, Claude Desktop, Inspector) may send granted tab titles, URLs, and — only if you enable page-text export — sanitized page text to that client’s model.