{"audit":{"version":"1.5","generated_at":"2026-09-17T07:41:46.312435+00:00","generated_by":"Agenstry","report_url":"https://agenstry.com/agents/humanbrowser.cloud","methodology_url":"https://agenstry.com/methodology","verifier_jwks_url":"https://agenstry.com/.well-known/jwks.json","subject":{"domain":"humanbrowser.cloud","name":"humanbrowser","url":"https://humanbrowser.cloud/.well-known/agent-card.json"}},"identity":{"provider":{"organization":"Virix Labs","url":"https://humanbrowser.cloud"},"registry_verification":null,"signature":{"signed":false,"signature_valid":null}},"protocol":{"version":"0.3.0","supports_streaming":true,"supports_push_notifications":true},"operational":{"live_state":"auth_required","live_responds":false,"last_status_code":200,"last_elapsed_ms":143,"last_error":null},"track_record":{"first_seen":"2026-09-17T04:20:15.909487+00:00","last_checked":"2026-09-17T04:20:15.909487+00:00","last_seen_ok":"2026-09-17T04:20:15.909487+00:00","checks_total":1,"checks_ok":1,"uptime_pct":100.0,"uptime_window_days":30,"uptime_probes":1,"archived":false,"archived_reason":null},"conformance":{"score":51,"grade":"D","summary":"D-grade: significant issues, auth-gated, partially broken, or stale.","criteria":[{"key":"valid_card","label":"Valid AgentCard","points":10,"max_points":10,"status":"pass","detail":"Parseable AgentCard returned by the well-known endpoint (Agenstry readiness signal; not an official TCK certification)."},{"key":"live_responds","label":"Live JSON-RPC","points":15,"max_points":25,"status":"partial","detail":"Endpoint requires auth, real agent but not anonymously callable."},{"key":"protocol_version","label":"Protocol version","points":5,"max_points":10,"status":"partial","detail":"Declares pre-1.0 A2A 0.3.0 (Google preview). Upgrade to v1.x for full points."},{"key":"signature","label":"JWS signature","points":0,"max_points":10,"status":"info","detail":"Card is unsigned (most published agents are)."},{"key":"uptime","label":"Uptime track record","points":0,"max_points":15,"status":"info","detail":"Only 1 probe so far, need ≥5 for an uptime grade."},{"key":"skills","label":"Skill declaration","points":10,"max_points":10,"status":"pass","detail":"Declares 9 skills with structured metadata."},{"key":"verified_identity","label":"Verified Identity","points":5,"max_points":10,"status":"partial","detail":"Provider declared: Virix Labs (https://humanbrowser.cloud). Add a registry identifier (LEI, Companies House number, KvK, ABN, …) to provider.legalEntity for full verified-business credit."},{"key":"freshness","label":"Freshness + modern flags","points":4,"max_points":5,"status":"pass","detail":"seen in upstream source within 0d"},{"key":"security","label":"Security declaration","points":2,"max_points":5,"status":"partial","detail":"Declares 1 security scheme(s) but none use PKCE or mTLS."}]},"card_read":{"findings":[],"clean":true,"source_url":"https://humanbrowser.cloud/.well-known/agent-card.json"},"skills":[{"id":"browser_task","name":"Browser Task","description":"Execute a free-form natural-language web automation task. The agent navigates, clicks, fills forms, scrolls and reads pages on a stealth browser with a residential IP. Returns natural-language answer + structured findings. The response includes a live viewer URL (viewer_url metadata + first artifact) at https://humanbrowser.cloud/a/s_<id>?k=...; surface it to the end user when human intervention may be useful.","tags":["browser","automation","scraping","navigation","stealth"],"examples":["Find the cheapest flight from Bangkok to Tokyo next weekend on skyscanner.com","Open polymarket.com and report current odds on the top US politics market","Visit reddit.com/r/programming and list the top 5 post titles"],"inputModes":["text/plain","application/json"],"outputModes":["text/plain","application/json"]},{"id":"login_and_scrape","name":"Login and Scrape","description":"Login to a website using provided credentials (TextPart + DataPart sensitive=true with {login,password,totp?}), then perform a scraping/data-extraction task on the authenticated session. Credentials are injected at execution time and never echoed in artifacts or logs. Login flows often need human intervention (CAPTCHA, 2FA, device-trust prompts), so relaying the response's viewer URL to the end user is typically helpful for this skill.","tags":["browser","login","scraping","authenticated"],"examples":["Login to quora.com with the provided credentials and list questions in my feed","Login to reddit.com and read my notifications inbox"],"inputModes":["text/plain","application/json"],"outputModes":["text/plain","application/json"]},{"id":"meta_business_workflow","name":"Meta Business Workflow","description":"Drive Meta Business Suite / Facebook Ads Manager / Meta-owned web properties on behalf of a specific Meta account, using customer-supplied cookies+proxy+UA bundled into a persistent AdsPower-backed Chromium profile. Use this when the goal requires touching an authenticated Meta surface (pulling campaign performance, dispatching ad creation, reading Page inbox, exporting audience reports) and the end-user has a Meta account they already operate manually. Credentials go in a DataPart with metadata.sensitive=true carrying {cookies, user_agent, proxy:{host,port,user,pass}}; on message/send pass metadata.engine='adspower' and metadata.profile=<account_slug> so the same fingerprint is reused across follow-up tasks. Surcharge: +$0.05/session. Login flows on Meta routinely trip 2FA / checkpoint / device-trust prompts, so relaying the response viewer URL to the end user is typically helpful. Since 2026-09-07: Meta's div[role=button] controls that ignored synthetic clicks (Create a business portfolio, Save changes, Post, I accept) are clicked with a real OS mouse automatically when the first click changes nothing; avatar/cover uploads take an attached FilePart or a public URL; cover repositioning uses a real drag. A named profile (metadata.profile) keeps the Facebook login between tasks — do not pass force_new for follow-up work on the same account.","tags":["browser","meta","facebook","ads-manager","business-suite","multi-account","adspower"],"examples":["Open Meta Ads Manager for the supplied account and report last-7-day spend + CPM per active campaign","In Meta Business Suite, read unread Page inbox messages for the supplied account and summarise them","Duplicate the top-performing ad set in campaign <id> with budget +20%, paused"],"inputModes":["text/plain","application/json"],"outputModes":["text/plain","application/json"]},{"id":"fill_form","name":"Fill Form","description":"Open a URL and fill the form with the provided structured data (DataPart with field map). Submit and report the resulting URL/message. The response includes a viewer URL — useful to relay if a field may need human input (CAPTCHA, validation popups).","tags":["browser","form","submit"],"examples":["Open https://example.com/contact and submit { name, email, message }"],"inputModes":["text/plain","application/json"],"outputModes":["text/plain","application/json"]},{"id":"scrape_url","name":"Scrape URL","description":"URL in, structured data + clean text out. Send a TextPart of the form 'Scrape <url> and return {fields...}' or 'Extract product name, price and availability from <url>'. The agent renders the page in real Chromium (JS-executed, cookies live, residential IP), extracts the requested fields, and returns them as JSON in artifacts[0].data. Use for pages that a plain HTTP fetch cannot render (SPAs, JS-heavy dashboards, login-walled content, geo-restricted views). For bulk static-content ingest at 100k+ pages/month a dedicated scraping API (Firecrawl-class) is typically cheaper per page — HB is the right fit when the URL sits behind auth, geo-block, or an anti-bot wall (Cloudflare Managed Challenge / PerimeterX / DataDome / Turnstile).","tags":["browser","scraping","url-to-json","structured-extraction"],"examples":["Scrape https://example.com/product/123 and return {name, price, in_stock, rating}","Extract the article title, author, date, and body text from https://blog.example.com/post-slug","Return the top-10 job listings visible on https://careers.example.com/search?q=engineer as a JSON array"],"inputModes":["text/plain","application/json"],"outputModes":["text/plain","application/json"]},{"id":"relay_reverse_api","name":"Relay (reverse-API)","description":"Route the task through a pre-mapped reverse-API recipe instead of driving a browser. When the target domain is in our recipe catalog (property portals — dotproperty, renthub, fazwaz, hipflat; hotel aggregators — agoda, booking, airbnb; marketplaces — kaidee; plus authenticated dashboards we've mapped), we call the site's own JSON/GraphQL endpoints directly with cookies from the profile pool. ~$0.0001 per call vs $0.005-0.02 per browser task, 10x-30x faster, zero captcha exposure. Pass metadata.engine='relay' on message/send. If the domain has no recipe, server returns a 404 with hint {engine:'browser'} — retry without the engine override. Discover mapped domains via GET /relay/recipes.","tags":["reverse-api","relay","fast-path","no-browser","cost-optimized"],"examples":["engine=relay: List 20 rentals on Renthub for Sukhumvit district under 30000 THB/month","engine=relay: Fetch DotProperty listing details for URL https://dotproperty.co.th/en/property/123456","engine=relay: Return current price for Agoda cityId 15843 checkin 2026-08-01 checkout 2026-08-03 room=1 pax=2"],"inputModes":["text/plain","application/json"],"outputModes":["application/json"]},{"id":"hostile_site_solver","name":"Hostile Site Solver","description":"The task explicitly targets a site protected by an interactive anti-bot wall — Cloudflare Managed Challenge, PerimeterX press-and-hold, DataDome, Cloudflare Turnstile, Akamai Bot Manager, or Kasada. Pass metadata.engine='cua' (or leave unset for auto-router). The server picks the execution path that historically defeats that vendor: CDP-Patches + human-motion CDP input (patchright fingerprints leak too many CDP signals for these targets), plus a Computer-Use-Agent path (xdotool + scrot on Xvfb driving real Chromium) for canvas-heavy challenges. Interactive challenge solving billed at $0.005/solve on success only — no charge if the site accepts the pattern without a challenge. Typical cost $0.13-$0.30 per successful task on hostile sites vs the $0.05 baseline. Use this skill when you know the target site is hostile (extraction APIs like Firecrawl's Stealth Mode $0.05/page often fail on these).","tags":["anti-bot","cloudflare","turnstile","perimeterx","datadome","cua","hard-target"],"examples":["Search for 'senior software engineer' on linkedin.com/jobs (US) and return top 10 results (hostile: LinkedIn bot detection)","Fetch product listing from etsy.com/shop/StoreName sorted by newest — full titles, prices, thumbnails (hostile: PerimeterX press-and-hold)","Open realtor.com and return top-20 listings for zip 90210 sorted by price (hostile: DataDome managed challenge)"],"inputModes":["text/plain","application/json"],"outputModes":["text/plain","application/json"]},{"id":"email_verified_signup","name":"Email-Verified Signup","description":"Fully-autonomous signup on sites that require Cloudflare Turnstile + email OTP verification (Hunter.io, Apollo.io, ZeroBounce, Findymail, Snov, most modern SaaS with double opt-in). Requires a DataPart with metadata.sensitive=true carrying {email, password, imap:{host,port,user,pass}} — the agent registers, solves Turnstile via CapSolver/2captcha race, polls the mailbox via IMAP for the verification email, extracts the OTP or magic link (context-aware — avoids grabbing CSS hex codes or unrelated 6-digit strings), completes verification, and returns the resulting API key / dashboard URL / account_id as an artifact. ~5 minutes end-to-end, ~$0.16 per successful signup ($0.06 solver + $0.10 LLM). See humanbrowser.cloud/blog/turnstile-otp-fully-unattended for the technical walkthrough.","tags":["signup","onboarding","email-otp","turnstile","hunter","apollo","zerobounce"],"examples":["Sign up to hunter.io with the provided email/password and return the API key from the dashboard","Register on apollo.io with the provided credentials, verify the OTP from the inbox, and return the workspace ID","Create an account on snov.io using the credentials + IMAP details supplied and return the free-tier API token"],"inputModes":["text/plain","application/json"],"outputModes":["text/plain","application/json"]},{"id":"network_discovery","name":"Network endpoint discovery","description":"Open ANY URL through a residential browser and deterministically capture its browser network traffic (XHR/fetch), then return a de-duplicated list of the site's API endpoints with freshness signals (ids/timestamps like id/created_at/list_time). No LLM, no per-step billing; credential headers (cookie/authorization) are stripped. Use to reverse-engineer a site's private/data APIs — often fresher and richer than its public search — for any dynamic site (marketplaces, classifieds, SPAs). Params: url (required), country, duration_ms (<=90000, default 45000), scroll, reload, match_url (host/substring filter; omit to capture cross-host APIs), freshness_fields[].","tags":["browser","network","reverse-api","discovery","api-scout"],"examples":[],"inputModes":["text/plain","application/json"],"outputModes":["application/json","text/plain"]}],"provenance":[{"source":"manifests","first_seen":"2026-09-17T04:20:15.909487+00:00"}],"recent_probes":[{"fetched_at":"2026-09-17T04:20:15.909487+00:00","ok":true,"status_code":200,"error":null,"elapsed_ms":143,"live_responds":false}],"catalog_attestation":null,"operator_revenue_evidence":{"evidence_class":"operator_submitted","authenticity":{"rung":"no_operator_evidence","rank":0,"why":"No verifiable operator evidence has been submitted for this agent.","thresholds":{"min_independent_payers":3,"min_verified_usd":25.0},"engine_table":"agent_authenticity","merge_rule":"max(existing_rank, rank)"},"metric_metadata":{"provenance":"operator_submitted_evidence","confidence":"attested","coverage":{"numerator":0},"as_of":"2026-09-17T07:41:46.321266+00:00","definition":"Revenue proofs submitted by the verified owner and re-checked by Agenstry against the settlement chain or the operator's own Stripe account. Only independently confirmed proofs are counted."},"counts":{"retained":0,"verified":0,"unverifiable":0},"verified":{"gross_usd":0.0,"transactions":0,"independent_payers":0},"detail_url":"https://agenstry.com/api/agents/humanbrowser.cloud/evidence","dispute_url":"https://agenstry.com/agents/humanbrowser.cloud/dispute"},"verification_history":[]}