Add receipts to a Browser Use agent: a run record a stranger can check

Route 1: the MCP client, through a local bridge

Browser Use agents can import tools from external MCP servers: create an MCPClient, register its tools, and the agent uses them like its built-in actions. The current client launches local stdio servers, and the Browser Use docs are plain about its limits: a connection budget of roughly ten seconds, one tools/list response read, and no direct connection to HTTP or SSE endpoints yet. Zambo is a hosted endpoint, so it reaches the agent through a local stdio bridge, mcp-proxy:

from browser_use import Agent, Tools
from browser_use.mcp.client import MCPClient

tools = Tools()
zambo = MCPClient(
    server_name="zambo",
    command="uvx",
    args=["mcp-proxy", "https://zambo.dev/mcp"],
)
await zambo.register_to_tools(tools)

agent = Agent(task="your real task here", llm=llm, tools=tools)
await agent.run()
await zambo.disconnect()

Two details from the docs decide whether this works on the first try. Keep the connection open until the agent finishes, then disconnect it, and create a fresh client for a new run. And the one-page tools/list read is why the default surface matters: the endpoint's default surface is 36 tools, the working set an agent needs, out of 153 in total. Calls the agent makes through the registered tools return a receipt inside the response itself, with a public URL at https://zambo.dev/run/ that anyone can open.

Route 2: the endpoint in the host that drives the browser

If your browser work runs from an MCP-capable host, the setup Browser Use documents for its own cloud MCP server, add https://zambo.dev/mcp to the same host as a second server. The agent's session then holds both: Browser Use's tools for the browsing, and Zambo's tools for the record: save what the run extracted, check a claim against its source, and wrap the finished job into a handover with its receipts attached, so the next agent, or the client, picks it up with the proof included. No bridge is needed on this route; the host speaks to the hosted endpoint directly.

What gets receipted, and what does not

The honest edge, stated the same way on every page in this series: the browser steps themselves, the navigation, clicks, and typing, are the agent's own actions and are not receipted by this route. A replay remains the right tool for debugging them. What the receipts cover is the layer a third party actually adjudicates: the calls the agent made to record, check, and hand over its work, each fixed at execution time and checkable afterward. A run whose evidence steps are receipted can be reviewed by someone who was never in the session. A run with only a replay can only be re-watched.

Verify one yourself before you rely on it

Take any receipt from your first run and check it at zambo.dev/verify. The verifier recomputes the commitment from the saved bytes and compares it with the commitment fixed when the call ran. A match means the saved record is the record made at execution. Then do the negative test every evidence system should survive: change one character in a copy of the record and check again. It fails, plainly, in public. A record system that cannot fail in public cannot pass in a way that means anything.

And keep the claim honest when you present it: a receipt proves the saved call record was not changed after it was saved. It does not prove the agent browsed well. Review still matters; the receipt just makes the review about the real calls instead of about a summary of them.

Questions, answered