Webhands agent scrapes API-less portals and refuses unconfirmed write actions

An agent for portals that never got an API

A developer posting on dev.to as royalpinto007 has released Webhands, an open-source computer-use agent built around a specific annoyance: business tools such as seller centers, supplier portals and third-party logistics dashboards that expose data only through a logged-in web interface. Webhands drives those dashboards in a real headless browser and returns structured JSON, but it will not perform any action that changes state unless the caller confirms it deliberately.

Reads are free, writes are gated

Users drive the tool by POSTing a "recipe": an entry URL, an optional sequence of login and navigation steps, and an extraction spec. According to the dev.to post, a step can be one of four actions — goto, type, click, or waitFor — and only a click can carry a write: true flag. That flag is the entire safety model: typing, waiting, navigating and reading are treated as inherently non-mutating, while a click marked as a write is refused unless the request also includes confirm: true.

The check runs before a browser is provisioned at all. If a recipe contains a write step and confirmation is missing, the tool returns an error and never launches anything, so there is no window in which a write has partially executed before being caught. To run the mutation, the caller resends the identical recipe with the confirm flag set.

What a run returns

A successful run produces three artifacts. First, the extracted data as JSON, gathered one of two ways: by supplying CSS selectors and fields, which involves no model at all, or by giving a natural-language extraction prompt, in which case the page text is handed to a Claude Haiku model via Anthropic's Messages API and asked for JSON. Second, a base64-encoded PNG screenshot showing exactly what the browser rendered, as evidence of the run. Third, a log of the steps the agent actually took.

The extraction path is built to degrade rather than fail: with no Anthropic key configured, the prompt-based extractor returns a raw text slice so development can continue, and if JSON parsing fails, the unparsed text is returned instead of being discarded.

Dry mode for cheap iteration

Webhands runs on Cloudflare Workers with Browser Rendering. In live mode, a browser binding is present and the agent drives a real headless browser through Cloudflare's Puppeteer integration. In dry mode, the binding is absent and the tool returns the plan it would have executed, clearly labelled, without running anything — which lets developers author and test recipes without paying for a browser binding. Quota exhaustion or unprovisioned bindings degrade into a clean error rather than a crash, the post says.

The gate trusts the label, not the button

The author is explicit about the limits of the design. Webhands cannot tell what a given click actually does; the write flag is set by whoever writes the recipe. A destructive button that is mislabelled, or simply not marked, will be clicked without any confirmation, because an unmarked click is treated as navigation. The gate is described as a forcing function for deliberate writes, not a classifier that detects danger on its own. The post also concedes the usual fragility of automating real interfaces: selectors break when dashboards change, logins get challenged, and slow pages can time out — the reasons the screenshot and step log exist. The code is published on GitHub under the AgentPostmortem/Webhands repository.

Why it matters

Computer-use agents inherit everything a logged-in human can do, and most automation frameworks treat every click identically, which makes an agent pointed at a production dashboard one mislabelled button away from issuing a refund or cancelling an order. Webhands demonstrates a small, easily copied pattern: separate reads from writes at the recipe level, and evaluate the gate deterministically before any browser starts. It will not replace intent detection, and the author says so plainly, but for the common case of pulling data from portals with no API, it offers a way to automate the scraping without automating the mutations.