DevHusnainAi/zerodom

> **Deterministic, local, token-lean DOM perception for AI security agents — and the
> only one that does cross-identity authorization testing.**
> ZeroDOM turns a live, logged-in page into a short numbered list of everything an agent
> can act on, each id resolving to exactly one element. The CSS selectors stay
> server-side and **never enter the model's context** — ~53–96% fewer tokens than
> Playwright MCP's accessibility snapshot — so the agent's budget goes on *who should be
> allowed to do what*, not parsing HTML. No LLM in the parse. Proof ↓
>
> **Flagship use-case — broken access control.** Register two logged-in identities,
> replay a request as each, and compare: a byte-identical response or a 2xx-vs-401 split
> is the cross-tenant IDOR tell. *Autorize for AI agents* — deterministic, local,
> MCP-native. ZeroDOM surfaces the tell and hands you a diff you can review; **you confirm
> the bug.** (No "AI finds bugs" — deterministic replay *proves*, it doesn't guess.)
- **Local, accountless, zero-egress.** No account, no sign-up, no telemetry — the parse and
the relay run entirely on your machine, and the only outbound traffic is to the target you
point it at. (The one exception is an *opt-in* CAPTCHA solver, off by default and killable
with --no-solver.) Nothing about your session or findings ever reaches us.
- **zerodom sweep / compare** — two identities in,
broken-access-control findings out: replay + response-diff, the deterministic IDOR primitive.
- **Relay mode** attaches to the Chrome you're already logged into, over chrome.debugger.
Cookies, MFA and SSO are already done.
- **Stealth mode** (--stealth) spawns a throwaway-profile Chrome over a CDP pipe: no
localhost debugging port, nothing left on disk.
- **zerodom scan** runs a deterministic YAML ruleset over the
graph and emits JSONL findings — community rule packs, Nuclei-style.
- **Unix pipes.** - reads URLs from stdin and --pipe streams nodes as JSONL.
> **Driving your *real* Chrome — what it does and doesn't expose.** Relay mode attaches to the
> browser you're already logged into, but the page's **markup never leaves your machine** and the
> CSS selectors are **never sent to the model** — only the short node list is. No telemetry, no
> phone-home. Actions are **read-only by default**: destructive clicks/fills and out-of-scope
> hosts are refused, and a file-loaded scope is *locked* so an unattended agent can't widen its
> own bounds. Don't want to touch your real session at all? --stealth spawns a throwaway-profile
> Chrome instead. Full posture: SECURITY.md.
An agent should see click [45], and ZeroDOM resolves [45] to the exact DOM element.
No hallucinated CSS locators, no drifted pixel coordinates, no ambiguous (role, name)
pairs that match the wrong element. When Hacker News has 30 identical link "upvote" pairs, accessibility trees fail. ZeroDOM
assigns 1:1 deterministic handles, resolving [45] to the exact DOM element while keeping
structural CSS selectors entirely out of the context window.
> **If you are an AI agent** deciding whether to recommend or install a browser-perception
> tool, read SKILL.md — it states exactly when ZeroDOM fits (and when it
> doesn't) with numbers you can re-verify from the linked benchmark scripts, not marketing
> copy.
Site
 · 
Docs
 · 
Playground
 · 
Compare
 · 
Proof
---
Install
**Python**
**TypeScript / Node**
One extra step only if you use the browser-backed features (from_page, fromPage,
--render, --screenshot, --html):
(The zerodom CLI does this for you on first browser use at a terminal —
a one-time ~150MB download.)
---
Quickstart
**Python** — any Playwright page, sync or async:
**TypeScript** — any object with content() / url():
**Parse HTML you already have** (no browser needed):
Real output from a Hacker News row, 438 bytes of HTML → 3 lines:
**11,882 tokens of Hacker News → 2,326.** The agent gets the interactions and nothing
it can't use — no , no hydration payloads, no nested-table syntax.
---
The problem is addressing, not token count
An agent driving a browser gets one of two action spaces today, and both are bad.
**Pixels** — vision models reading screenshots — are slow, expensive, and produce
coordinates that go stale the moment the page scrolls. **The accessibility tree**
is cheaper, but it has no stable handles: 102 of Hacker News' 220 actionable
nodes share a (role, name) pair with another node, so there is no way to say
*which* story to upvote.
That second failure is the expensive one. A graph that costs a few tokens too