Claude for Safari skill
A macOS skill: the agent sees and drives your real Safari through AppleScript, with no extension and no separate browser
- 107 ★ on the repository
- Last commit
- MIT
Broad access
Why this level
- The agent works in tabs where you are already signed in and can click, type and run arbitrary JavaScript in your name
- The terminal needs broad macOS permissions: Safari automation, Screen Recording and Accessibility
- Network observation and page reading expose the contents of your personal accounts to the agent
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add skills/claude-for-safariDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- The agent works in tabs where you are already signed in and can click, type and run arbitrary JavaScript in your name
- The terminal needs broad macOS permissions: Safari automation, Screen Recording and Accessibility
- Network observation and page reading expose the contents of your personal accounts to the agent
This is third-party code. Review the repository files before installing.
What it does
Claude for Safari is a skill that teaches an agent to drive Safari on a Mac through the system's own tools: AppleScript, page JavaScript and the `screencapture` utility. No extensions, proxies or background services are needed, and the agent works in the tabs where you are already signed in to your services. The agent lists windows and tabs with titles and addresses, reads page text, structured data and a simplified DOM, navigates, opens tabs, scrolls, waits for load, clicks elements and types. It captures the window so it can see the page and runs JavaScript in the open page's context. Forms have a separate safe path: the skill discovers fields, fills supported non-sensitive controls and verifies each field after writing. Network observation shows fetch and XHR request metadata with sensitive values redacted; bodies are included only on explicit request. While the agent changes a page, a control indicator is visible on it and is removed afterwards.
Who it is for. Mac owners who want Claude Code or Cursor to handle routine work in an already open Safari: read a page, fill a form, collect data from a dashboard.
Good fit when
- The page opens only after signing in, and the agent needs your live session
- The agent should read the tab list and say what is open in them
- A form of several dozen fields has to be filled from a file with every field verified
- You want to see which fetch and XHR requests a page sends when a button is pressed
- Playwright opens a separate browser without your sessions, and you need the working tab itself
Not a fit when
- The work is not on macOS or not in Safari: the skill relies on AppleScript and Safari only
- You need an unattended CI run without a screen: the skill drives your interactive browser
- The operation is irreversible, such as a payment, deletion or sending, and you are not ready to watch the agent
- The site blocks automation: helpers injected into a page can be detected by the site
Example request
Show which tabs are open in Safari right now and read the text of the tab with the sales reportLimitations
It works on macOS and Safari only. Three settings are needed: permission for the terminal to control Safari under Automation, the "Show features for web developers" option and "Allow JavaScript from Apple Events" in the Develop menu. Background window capture also needs Screen Recording access, and clicks and typing through System Events need Accessibility access. The optional window helper is compiled with `swiftc` from the Apple Command Line Tools. The last commit dates from August 2026.
How to disable. Delete the `claude-for-safari` skill folder from the agent's skills directory. Revoke the permissions given to the terminal (Safari automation, Screen Recording, Accessibility) in System Settings under Privacy & Security.
FAQ
How do I install Claude for Safari?
Run `npx skills add SDLLL/claude-for-safari`, then start `claude` and ask it to show the open Safari tabs. The agent tells you which permissions to enable, but you can grant them ahead of time in System Settings and in Safari's Develop menu.
Does the skill work with Chrome, Firefox or Arc?
No, Safari only: it is the one macOS browser with full AppleScript support. For other browsers the authors suggest Playwright MCP or Chrome ACP.
Is it safe to give an agent my browser?
The skill requires verifying the target before acting, keeps a site's confirmation dialogs, excludes sensitive form fields and asks permission before consequential actions. But the agent works inside your signed-in sessions, so the final protection is your agent's permission settings.
Why does the window flicker on a screenshot?
Without Screen Recording access the skill has to bring the Safari window to the front. Give the terminal or agent host the Screen Recording permission and capture works in the background without switching windows.
Which Safari and macOS settings are needed?
In System Settings let the terminal control Safari under Automation. In Safari turn on "Show features for web developers", then tick "Allow JavaScript from Apple Events" in the Develop menu. Screen Recording and Accessibility are needed only for background captures and typing through System Events.
Discussion
No questions or reviews yet.
Related
SkillsA separate browser for agents with a skill and MCP: Claude Code and Codex work in your logged-in accounts, and every session is recorded for replay
MCP server for Safari on macOS: an agent drives your real browser with your logins through 98 tools
An agent drives your real logged-in Chrome: a CLI, MCP and an extension with a separate tab group per session
The browse skill from the Stagehand repository teaches an agent to open, read and click pages through the browse CLI.
A skill connects an agent to your Chrome through an extension and CLI for reading pages, managing tabs and verifying actions.
A skill for Amp, Claude Code and Cursor: the agent drives your live Chrome with its open tabs and signed-in accounts through a single debugging toggle
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| Claude for Safari (this card) | no | 107 | ||
| Playwright MCP | yes | not required | 39,570 | opens a separate Playwright browser without your sessions rather than your Safari |
| applescript-mcp | no | not required | 396 | controls macOS calendar, mail and notes rather than web pages in Safari |
README in short
The README contrasts the skill with Playwright, which opens a separate browser, with a Chrome extension and with manual page copying. Then come a quick start, first-time permission setup, a table of capabilities with the mechanism of each, screenshot modes, a diagram of how it works and compatibility and safety questions.
README badge
Original SKILL.md
---
name: claude-for-safari
description: Control the user's real Safari browser on macOS through AppleScript, page JavaScript, screenshots, and carefully verified System Events input. Use when an agent needs to inspect or operate the user's existing Safari tabs and login sessions, including reading pages, navigating, clicking, filling non-sensitive forms, taking screenshots, observing page-level fetch/XHR metadata, or troubleshooting Safari-specific UI behavior.
---
# Claude for Safari
Operate the user's real Safari session with macOS-native tools. Preserve the user's tabs, login state, page data, and approval boundaries.
## Safety invariants
- Resolve and verify the exact Safari window and tab before every page-changing action.
- Stop on a missing, stale, or ambiguous target. Never guess by window title alone.
- Treat Safari AppleScript objects, Accessibility windows, and CoreGraphics window IDs as separate identity systems.
- Require explicit authorization before submitting forms, confirming destructive actions, navigating away from unsaved work, or closing tabs/windows.
- Never override `confirm()` to return `true`, suppress `beforeunload`, or silently answer a native dialog.
- Never include passwords, file uploads, one-time codes, payment-card data, tokens, or secrets in scripts, shell commands, transcripts, or returned JSON.
- Prefer DOM actions. Use System Events or coordinate interaction only after verifying focus, permissions, and the target.
For permission failures or native dialogs, read [references/troubleshooting.md](references/troubleshooting.md). For frames, private windows, or coordinate fallback, read [references/advanced.md](references/advanced.md) before acting.
## Preflight
Fail fast outside macOS:
```bash
[ "$(uname)" = "Darwin" ] || { echo "Claude for Safari requires macOS"; exit 1; }
```
Verify a real page-JavaScript call. Give the first call enough time for the macOS permission prompt:
```bash
osascript <<'APPLESCRIPT'
with timeout of 120 seconds
tell application "Safari"
if (count of windows) is 0 then error "Safari has no open window"
return do JavaScript "String(1 + 1)" in current tab of front window
end tell
end timeout
APPLESCRIPT
```
Expected output: `2`.
Diagnose these permissions independently: