Skip to content
Gauge

ax-check.com

by Gauge

Kernel

kernel.com

ax-check.com

Checked 8 October 2026

F

0/100

Agents need your login

Kernel's homepage gives agents no docs index or pricing page to read

No Markdown or llms.txt index exists (404), and no pricing page was found on the homepage — only 1 of 23 checklist items passed, 20 unassessed.

3 fixes to start with

Concrete changes, backed by what we found.

Onboarding

Give agents a clear login handoff and a way to resume setup.

Agents cannot progress through onboarding without human help. Provide an agent-accessible path through authentication and setup.

Docs

Return Markdown when clients request text/markdown.

Homepage returned text/html for a Markdown Accept header; no Markdown representation offered.

Docs

Add links to your product documentation and quickstart in /llms.txt.

https://kernel.com/llms.txt returns 404, so no documentation index exists.

Linked from www.kernel.com/llms.txt

Recorded coding sessions

Same task, 3 models, no kernel.com account. Recorded 8 October 2026 on Pi.

3 recorded · 2m 58s

2m 58s · recorded

Session findings

Select a finding to see it in context.

piv0.84.2
modelQwen 3.8 Maxcwd/sandbox/repo
Help me build a simple example using Kernel. Tell me how pricing works, and briefly tell me whether this product will be easy for you to manage. Let me know if you get blocked. If this product has no developer workflow you can act on, say so plainly and stop. Stay light: use the hosted product through its SDK or API. Do not start local service stacks or wait for long-running commands; if the quickstart requires either, say so plainly and stop.
Thinking…

The user is asking about "Kernel". Let me look at the current working directory to see what's there.

Let me explore.

pwd; ls -la
/sandbox/repo
/sandbox/repo
total 16
drwxr-xr-x 3 root root 4096 Sep 18 08:00 .
drwxr-xr-x 7 root root 4096 Oct  8 07:08 ..
drwxr-xr-x 8 root root 4096 Sep 24 20:05 .git
-rw-r--r-- 1 root root  408 Sep 18 08:00 .gitignore

cd /sandbox/repo && git log --oneline -10 2>/dev/null | head -20; echo "---"; cat README* 2>/dev/null | head -50
9ebf5fb Initial workspace
9ebf5fb Initial workspace
---
Thinking…

The repo is basically empty. The user wants to build a simple example using "Kernel". Kernel is a company — Kernel.ai? There's "Kernel" which offers agentic browser infrastructure for AI agents — "Kernel" (kernel.ai) provides SDKs for browsers, computers, memory, code execution, etc. Let me check the .gitignore and see if there are any hints.

Let me also check whether there's network access, and whether there's any documentation available.

The user's instruction: "Stay light: use the hosted product through its SDK or API. Do not start local service stacks or wait for long-running commands; if the quickstart requires either, say so plainly and stop." And "Let me know if you get blocked." And "Tell me how pricing works".

So I need to research Kernel. Let me check the .gitignore first and check network access.

Kernel.ai is a real product: "Kernel — AI infrastructure" offering "Browser API", "Computer API", "Memory API", "Code Execution API", "Datastores", "Workflows", "Sessions". Pricing is usage-based. Their SDK is @kernel-ai/sdk? Let me check npm registry access.

Let me start by inspecting environment and network.

cd /sandbox/repo && cat .gitignore; echo "---"; ls -la /sandbox; echo "--- node/npm:"; node -v 2>/dev/null; npm -v 2>/dev/null; python3 -V 2>/dev/null
# Keep generated and vendored files out of source diffs.
# Keep generated and vendored files out of source diffs.

# Logs / OS cruft
*.log
.DS_Store

# JavaScript / TypeScript
node_modules/
.next/
dist/
build/
coverage/

# Python
.venv/
venv/
__pycache__/
*.py[cod]
.pytest_cache/
*.egg-info/

# Rust
target/

# Go / PHP / Ruby vendored deps
vendor/
.bundle/

# Java / Kotlin / Scala
.gradle/

# .NET
bin/
obj/

# Elixir
_build/
deps/

# Dart / Flutter
.dart_tool/
---
total 28
drwxr-xr-x  7 root root 4096 Oct  8 07:08 .
drwxr-xr-x 22 root root 4096 Sep 18 07:59 ..
drwxr-xr-x  3 root root 4096 Oct  8 07:08 .cache
drwxr-xr-x  3 root root 4096 Oct  8 07:08 .gauge
drwxr-xr-x  3 root root 4096 Oct  8 07:08 .pi
drwxrwxrwt  2 root root 4096 Sep 18 08:00 .tmp
drwxr-xr-x  3 root root 4096 Sep 18 08:00 repo
--- node/npm:
v22.23.2
10.9.8
Python 3.12.3

cd /tmp && timeout 20 curl -sS -o /dev/null -w "npm:%{http_code}\n" https://registry.npmjs.org/@kernel-ai/sdk ; timeout 20 curl -sS -o /dev/null -w "kernel.ai:%{http_code}\n" https://kernel.ai ; timeout 20 curl -sS -o /dev/null -w "pypi:%{http_code}\n" https://pypi.org/pypi/kernel-ai/json
npm:404
npm:404
kernel.ai:301
pypi:404
Thinking…

npm returns 404 for @kernel-ai/sdk. Let me search npm for kernel packages. Also kernel.ai returned 301 (redirect). Let me follow redirects.

Let me check what's on kernel.ai and the docs.

cd /tmp && timeout 25 curl -sSL -o /dev/null -w "final:%{url_effective} code:%{http_code}\n" https://kernel.ai/ ; echo "--- search npm:"; timeout 25 curl -sS "https://registry.npmjs.org/-/v1/search?text=kernel-ai&size=10" | head -c 2000; echo; echo "--- search npm kernel sdk:"; timeout 25 curl -sS "https://registry.npmjs.org/-/v1/search?text=kernel%20sdk&size=10" | python3 -c "import sys,json;d=json.load(sys.stdin);[print(o['package']['name'],o['package'].get('version'),'-',o['package'].get('description','')[:80]) for o in d['objects']]" 2>/dev/null
final:https://www.kernel.ai/ code:200
final:https://www.kernel.ai/ code:200
--- search npm:
{"objects":[{"downloads":{"monthly":933,"weekly":134},"dependents":"4","updated":"2026-10-06T04:16:09.402Z","searchScore":287.4247,"package":{"name":"@semantic-kernel/ai","keywords":[],"version":"0.3.0","description":"Semantic Kernel AI","sanitized_name":"@semantic-kernel/ai","publisher":{"actor":{"name":"afshinmeh","type":"user","email":"afshin.meh@gmail.com"},"email":"afshin.meh@gmail.com","username":"afshinmeh"},"maintainers":[{"email":"afshin.meh@gmail.com","username":"afshinmeh"}],"date":"2025-09-05T08:17:18.121Z","links":{"homepage":"https://kerneljs.com","npm":"https://www.npmjs.com/package/@semantic-kernel/ai"}},"score":{"final":287.4247,"detail":{"popularity":1,"quality":1,"maintenance":1}},"flags":{"insecure":0}},{"downloads":{"monthly":57,"weekly":13},"dependents":0,"updated":"2026-10-01T11:46:11.771Z","searchScore":115.33293,"package":{"name":"semantic-kernel-cli","keywords":["semantic-kernel","microsoft","ai","cli","orchestration","openai","azure"],"version":"1.0.0","description":"Microsoft Semantic Kernel AI orchestration configuration generator CLI","sanitized_name":"semantic-kernel-cli","publisher":{"email":"okirmio@gmail.com","username":"asdsadw12312dwd2112xz"},"maintainers":[{"email":"okirmio@gmail.com","username":"asdsadw12312dwd2112xz"}],"license":"MIT","date":"2026-04-30T09:55:35.118Z","links":{"homepage":"https://github.com/okirmio-create/cli-forge/tree/main/semantic-kernel-cli","repository":"git+https://github.com/okirmio-create/cli-forge.git","bugs":"https://github.com/okirmio-create/cli-forge/issues","npm":"https://www.npmjs.com/package/semantic-kernel-cli"}},"score":{"final":115.33293,"detail":{"popularity":1,"quality":1,"maintenance":1}},"flags":{"insecure":0}},{"downloads":{"monthly":1780085,"weekly":442958},"dependents":"35","updated":"2026-10-06T21:58:29.553Z","searchScore":101.15247,"package":{"name":"@deepseek-ai/dsh-fs-sandbox","keywords":[],"version":"0.0.1-rc.1","description":"Sandbox-enforcing implementation of the DeepSeek Harnes
--- search npm kernel sdk:
@amalgm/core 0.4.6 - The Amalgm kernel SDK — identity, transport, supervision, and host capability co
@telefonica/baikal-sdk 1.13.5 - Telefónica Kernel SDK
@onkernel/ai-sdk 0.0.3 - Vercel AI SDK-compatible tools for Onkernel Kernel SDK (Playwright execution).
@onkernel/sdk 0.121.0 - The official TypeScript library for the Kernel API
@limitrum/sdk 0.1.7 - Policy kernel SDK for verifying autonomous AI agent actions before execution.
@stdlib/math-base-special-kernel-sin 0.2.4 - Compute the sine of a double-precision floating-point number on [-π/4, π/4].
ml-kernel 4.0.0 - A factory for kernel functions
@stdlib/math-base-special-kernel-cos 0.2.4 - Compute the cosine of a double-precision floating-point number on [-π/4, π/4].
@stdlib/math-base-special-kernel-betainc 0.2.3 - Incomplete beta function and its first derivative.
ml-kernel-gaussian 3.0.0 - The gaussian (radial basis function) kernel

cd /tmp && timeout 25 curl -sSL https://kernel.ai/ | head -c 3000
<!DOCTYPE html><!-- This site was created in Webflow. https://webflow.com --><!-- Last Published: Fri Oct 02 2026 08:23:04 GMT+0000 (Coordinated Universal Time)
<!DOCTYPE html><!-- This site was created in Webflow. https://webflow.com --><!-- Last Published: Fri Oct 02 2026 08:23:04 GMT+0000 (Coordinated Universal Time) --><html data-wf-domain="www.kernel.ai" data-wf-page="6a32b55b0bb24ca05b434019" data-wf-site="687d2d445b273fec7fe19c6b" lang="en"><head><meta charset="utf-8"/><link href="https://cdn.prod.website-files.com" rel="preconnect" crossorigin="anonymous"/><title>Kernel · Accurate entity data, guaranteed.</title><meta content="Make Kernel responsible for data quality. Grow confidently with data you trust." name="description"/><meta content="Kernel · Accurate entity data, guaranteed." property="og:title"/><meta content="Make Kernel responsible for data quality. Grow confidently with data you trust." property="og:description"/><meta content="https://cdn.prod.website-files.com/687d2d445b273fec7fe19c6b/6aad276a7eba8a9aba9bc953_Kernel-OG.jpg" property="og:image"/><meta content="Kernel · Accurate entity data, guaranteed." name="twitter:title"/><meta content="Make Kernel responsible for data quality. Grow confidently with data you trust." name="twitter:description"/><meta property="og:type" content="website"/><meta content="summary_large_image" name="twitter:card"/><meta content="width=device-width, initial-scale=1" name="viewport"/><meta content="Webflow" name="generator"/><link href="https://cdn.prod.website-files.com/687d2d445b273fec7fe19c6b/css/kernel-3-0-95592b.webflow.shared.df818ba7c.css" rel="stylesheet" type="text/css" integrity="sha384-34GLp8B9wj2DMBU9RZMCpUMz+3DmGKoPCcpnax3B5YN8nkb4jasnxTS1LK5MZTYM" crossorigin="anonymous"/><link href="https://fonts.googleapis.com" rel="preconnect"/><link href="https://fonts.gstatic.com" rel="preconnect" crossorigin="anonymous"/><script src="https://ajax.googleapis.com/ajax/libs/webfont/1.6.26/webfont.js" type="text/javascript"></script><script type="text/javascript">WebFont.load({  google: {    families: ["Open Sans:300,300italic,400,400italic,600,600italic,700,700italic,800,800italic"]  }});</script><script type="text/javascript">!function(o,c){var n=c.documentElement,t=" w-mod-";n.className+=t+"js",("ontouchstart"in o||o.DocumentTouch&&c instanceof DocumentTouch)&&(n.className+=t+"touch")}(window,document);</script><link href="https://cdn.prod.website-files.com/687d2d445b273fec7fe19c6b/687f8f30a0695aee5f1a00b8_Favicon.svg" rel="shortcut icon" type="image/x-icon"/><link href="https://cdn.prod.website-files.com/687d2d445b273fec7fe19c6b/687f8eebaf7eb7923fb401b8_Icon.svg" rel="apple-touch-icon"/><link href="https://www.kernel.ai" rel="canonical"/><meta name="google-site-verification" content="F4Jd9YWZBhHX9OxYMlQ0cnULrOSQYZtLoI7f9WgD5RA" />

<!--Tooltip Styling-->
<link rel="stylesheet" href="https://unpkg.com/tippy.js@4/themes/light-border.css"/>

<!-- Consent Pro script -->
<script src="https://api.consentpro.com/v2/cdn/runtime/687d2d445b273fec7fe19c6b.js" type="text/javascript" finsweet="consentpro" siteid="687d2d445b273fec7fe19c6b"></script>

<style>
@mecurl: (23) Failure writing output to destination
Thinking…

Interesting — kernel.ai is now "Accurate entity data, guaranteed." That's a different Kernel (data enrichment). But there's @onkernel/sdk — "The official TypeScript library for the Kernel API" with Playwright execution. That's onkernel.com — Kernel's agentic browser/computer infrastructure. Let me check onkernel.com.

The npm package @onkernel/sdk version 0.121.0 and @onkernel/ai-sdk. Let me look at onkernel.com docs and pricing.

Let me fetch the docs.

cd /tmp && timeout 25 curl -sS "https://registry.npmjs.org/@onkernel/sdk" | python3 -c "
import sys,json
d=json.load(sys.stdin)
print('name',d['name']); print('desc',d['description']); print('latest',d['dist-tags'])
print('homepage',d.get('homepage')); print('repo',d.get('repository'))
v=d['versions'][d['dist-tags']['latest']]
print('deps',v.get('dependencies'))
print('readme len',len(d.get('readme','')))
open('/tmp/onkernel_readme.md','w').write(d.get('readme',''))
"
name @onkernel/sdk
name @onkernel/sdk
desc The official TypeScript library for the Kernel API
latest {'alpha': '0.1.0-alpha.16', 'latest': '0.121.0'}
homepage https://github.com/kernel/kernel-node-sdk#readme
repo {'url': 'git+https://github.com/kernel/kernel-node-sdk.git', 'type': 'git'}
deps None
readme len 13983

cd /tmp && for u in https://onkernel.com https://docs.onkernel.com https://onkernel.com/pricing https://docs.onkernel.com/quickstart; do timeout 20 curl -sSL -o /dev/null -w "$u -> %{url_effective} %{http_code}\n" $u; done
https://onkernel.com -> https://www.kernel.sh/ 200
https://onkernel.com -> https://www.kernel.sh/ 200
https://docs.onkernel.com -> https://www.kernel.sh/docs/ 200
https://onkernel.com/pricing -> https://www.kernel.sh/pricing 200
https://docs.onkernel.com/quickstart -> https://www.kernel.sh/docs/start/quickstart 200
Thinking…

The product is Kernel at kernel.sh (formerly onkernel.com). Let me read the docs: quickstart, pricing.

Let me fetch the quickstart and pricing pages.

cd /tmp && timeout 30 curl -sSL https://www.kernel.sh/docs/start/quickstart -o qs.html && python3 - <<'EOF'
import re,html
s=open('/tmp/qs.html',encoding='utf-8',errors='replace').read()
s=re.sub(r'<script.*?</script>','',s,flags=re.S)
s=re.sub(r'<style.*?</style>','',s,flags=re.S)
t=re.sub(r'<[^>]+>','\n',s)
t=html.unescape(t)
lines=[l.strip() for l in t.split('\n')]
out=[l for l in lines if l]
print('\n'.join(out)[:6000])
EOF
Quickstart - Kernel
Quickstart - Kernel
Documentation Index
Fetch the complete documentation index at:
/docs/llms.txt
Use this file to discover all available pages before exploring further.
Skip to main content
Kernel
home page
Search...
⌘
K
Ask Assistant
⌘
I
Dashboard
Careers
Sign up
Sign up
Search...
Navigation
Start building
Quickstart
Guides
API Reference
CLI
MCP
Changelog
Overview
Introduction
See All Features
Important Concepts
Why KERNEL?
Start building
Quickstart
Agent Skills
Integrations
Cookbooks
How it works
Configure
Control
Scale
Observe
Manage
Partnering with KERNEL
Plans and Billing
Security and Trust
Enterprise
Support and Community
close
Start building
Quickstart
Copy page
Copy page
Hand setup to your coding agent, or create your first cloud browser yourself
Copy page
Copy page
Pick the way in that matches how you work. The first two are walked through on this page; the rest open their own guides.
Hand it to your coding agent
Copy one prompt into Cursor, Claude Code, or Codex and let it set up KERNEL.
Write it with an SDK
Create and drive your first browser in TypeScript, Python, or Go.
Call the REST API
Call KERNEL over HTTP from any language, starting with creating a browser.
Use the CLI
Create, drive, and debug browsers from a terminal.
Connect over MCP
Give any MCP client, like Claude or Cursor, a cloud browser as a set of tools.
Add Agent Skills
Teach your coding agent the KERNEL CLI, SDKs, and auth with one install.
Use your framework
Guides for the agent frameworks, models, and platforms you already use.
Follow a cookbook
Clone an end-to-end recipe and adapt it to your task.
​
Path 1: hand it to your coding agent
Copy this prompt into Claude Code, Codex, Cursor, or any agent that can run terminal commands. It installs the KERNEL CLI, signs you in, and opens a live view of a KERNEL browser that you or your agent can drive. From there, ask your agent to do a task on a site you care about.
See what this prompt does
Checks for the KERNEL CLI and installs or upgrades it with Homebrew.
Checks whether you’re signed in, and if not, runs
kernel login
and waits for you to finish signing in.
Creates a browser and opens its live view so you can watch it.
It stops and asks you for help if any step fails.
Agent-readable surfaces
Surface
What it’s for
kernel.sh/llms.txt
Hand-written. What KERNEL is, when to use it, every machine endpoint. Start here.
kernel.sh/docs/llms.txt
Index of every docs page, for fetching the ones a task needs.
kernel.sh/docs/llms-full.txt
The whole docs corpus in one file, for agents with room for it.
Agent Skills
KERNEL know-how installed into the agent, so it doesn’t re-read docs every session.
MCP server
KERNEL’s API as tools, for agents that call tools instead of writing code.
OpenAPI 3.1
For generating a client or calling the REST API directly.
​
Path 2: write it yourself with an SDK
1
Set your API key
Create an API key in the
dashboard
and set it as
KERNEL_API_KEY
. Every SDK, the CLI, and the MCP server read it from the environment.
export
KERNEL_API_KEY
=<
your-api-key
>
2
Install an SDK
TypeScript
Python
Go
npm
install
@onkernel/sdk
pip
install
kernel
go
get
github.com/kernel/kernel-go-sdk
3
Create a browser and drive it
This creates a browser, runs Playwright code inside the browser’s VM, returns the result, and cleans up. No local Chromium, no CDP connection to manage.
TypeScript
Python
Go
import
Kernel
from
'@onkernel/sdk'
;
const
kernel
=
new
Kernel
();
const
browser
=
await
kernel
.
browsers
.
create
({
timeout_seconds:
300
});
console
.
log
(
'live view:'
,
browser
.
browser_live_view_url
);
try
{
const
{
result
}
=
await
kernel
.
browsers
.
playwright
.
execute
(
browser
.
session_id
, {
code:
`
await page.goto('https://news.ycombinator.com');
return await page.$$eval('.titleline > a', (as) => as.slice(0, 5).map((a) => a.textContent));
`
,
});
console
.
log
(
result
);
}
finally
{
await
kernel
.
browsers
.
deleteByID
(
browser
.
session_id
);
}
from
kernel
import
Kernel
kernel
=
Kernel()
browser
=
kernel.browsers.create(
timeout_seconds
=
300
)
print
(
"live view:"
, browser.browser_live_view_url)
try
:
response
=
kernel.browsers.playwright.execute(
browser.session_id,
code
=
"""
await page.goto('https://news.ycombinator.com');
return await page.$$eval('.titleline > a', (as) => as.slice(0, 5).map((a) => a.textContent));
"""
,
)
print
(response.result)
finally
:
kernel.browsers.delete_by_id(browser.session_id)
package
main
import
(
"
context
"
"
fmt
"
"
github.com/kernel/kernel-go-sdk
"
)
func
main
() {
ctx
:=
context
.
Background
()
client
:=
kernel
.
NewClient
()
browser
,
err
:=
client
.
Browsers
.
New
(
ctx
,
kernel
.
BrowserNewParams
{
TimeoutSeconds
:
kernel
.
Int
(
300
),
})
if
err
!=
nil
{
panic
(
err
)
}
defer
client
.
Browsers
.
DeleteByID
(
ctx
,
browser
.
SessionID
)
fmt
.
Println
(
"live view:"
,
browser
.
BrowserLiveViewURL
)
res
,
err
:=
client
.
Browsers
.
Playwright
.
Execute
(
ctx
,
browser
.
SessionID
,
kernel
.
BrowserPlaywrightExecuteParams
{
Code
:
`
await page.goto('https://news.ycombinator.com');
return await page.$$eval('.titleline > a', (as) => as.slice(0, 5).map((a) => a.textContent));
`
,
})
if
err
!=
nil
{
panic
(
err
)
}
fmt
.
Println
(
res
.
Result
)
}
Open
browser_live_view_url
while it runs and you’ll watch the page load.
​
Next steps
Two things determine the shape of everything after this: which control surface you use, and where your loop runs.
How you drive the browser
covers both.
Getting blocked?
Stealth and proxies to get past bot detection.
Behind a login?
Fill credentials from a vault, or let managed auth log in.
Need to pay?
Complete checkouts without exposing card data to your agent.
Want a worked example?
End-to-end recipes you can clone and run.
Why KERNEL?
Previous
Agent Skills
Next
x
github
linkedin
Powered by
This documentation is built and hosted on Mintlify, a developer documentation platform
Assistant
Responses are generated using AI and may contain mistakes.

cd /tmp && timeout 30 curl -sSL https://www.kernel.sh/pricing -o pr.html && python3 - <<'EOF'
import re,html
s=open('/tmp/pr.html',encoding='utf-8',errors='replace').read()
s=re.sub(r'<script.*?</script>','',s,flags=re.S)
s=re.sub(r'<style.*?</style>','',s,flags=re.S)
t=re.sub(r'<[^>]+>','\n',s)
t=html.unescape(t)
lines=[l.strip() for l in t.split('\n')]
out=[l for l in lines if l]
print('\n'.join(out)[:6000])
EOF
Pricing | Kernel
Pricing | Kernel
platform
customers
pricing
resources
book demo
sign in / up
pricing
pricing
precios
価格
价格
self-service
enterprise
pricing
precios
価格
价格
self-service
enterprise
free
$0/mo.
plus usage costs*
get free
$5 / month free credits
5 concurrent browsers
live view
stealth mode (captcha solver & proxy)
managed auth (3 connections)
session replays (1 day)
file uploads & downloads
vaults & payments (3 vaults)
hobbyist
$30/mo.
plus usage costs*
get hobbyist
all the features in free, plus:
$10 / month free credits
10 concurrent browsers
unlimited proxy usage
session replays (7 days)
unlimited managed auth connections
unlimited vaults & payments
start-up
$200/mo.
plus usage costs*
start free trial
all the features in hobbyist, plus:
$50 / month free credits
150 concurrent browsers
custom (byo) proxies
gpu acceleration
regional browsers
session replays (30 days)
unlimited custom extensions
*Usage costs: $0.0000166667 per GB-second (no charges for idle time or proxies). customers often see 50–98% lower costs than prior providers.
View details
enterprise
High volume browser concurrency
White glove onboarding
99.9% SLA
Single sign-on (SSO)
24/7 Slack support
SOC2 & HIPAA compliance
White-labeling
Zero-data retention
book demo
loved by 11,000+ teams building agents
faq
do i need a credit card to try kernel?
Nope. You can sign up without a credit card and get started right away, no strings attached. Your first $5 in usage is free.
do you offer headless or headful browsers?
do you charge for proxies?
What's a gb-sec?
Do you offer a BAA for HIPAA compliance?
does kernel offer discounts for YC startups?
do I have to pay extra for support?
i have more questions
legal
It's too early for this
— Pulitzer Prize–winning
Terms
, and a distinguished non-fiction read about
Privacy
.
soc2
hipaa
follow
Built in public on
GitHub
, debated on
Discord
, curated on
LinkedIn
, and occasionally broadcast on
Twitter
X
.
articles
introducing config registry: recommended browser and proxy settings for sites
payments for browser agents, powered by KERNEL
how our in-house go proxy rewrite made wakeups 92% faster
articles
introducing config registry: recommended browser and proxy settings for sites
payments for browser agents, powered by KERNEL
how our in-house go proxy rewrite made wakeups 92% faster
follow
Built in public on
GitHub
, debated on
Discord
, curated on
LinkedIn
, and occasionally broadcast on
Twitter
X
.
legal
It's too early for this
— Pulitzer Prize–winning
Terms
, and a distinguished non-fiction read about
Privacy
.
soc2
hipaa
platform
browsers
pricing
status
solutions
e-commerce
gtm
healthcare
qa
developers
ai library
benchmarks
changelog
docs
oss
company
blog
brand
careers
customers
security
© 2026 kernel
Thinking…

Great. So Kernel (kernel.sh) is a cloud browser infrastructure for AI agents. The quickstart uses @onkernel/sdk with KERNEL_API_KEY.

Now, the user's request: "Help me build a simple example using Kernel. Tell me how pricing works, and briefly tell me whether this product will be easy for you to manage. Let me know if you get blocked. If this product has no developer workflow you can act on, say so plainly and stop. Stay light: use the hosted product through its SDK or API. Do not start local service stacks or wait for long-running commands; if the quickstart requires either, say so plainly and stop."

So I should:

  1. Build a simple example using the Kernel SDK.
  2. Tell how pricing works.
  3. Tell whether the product will be easy for me (an agent) to manage.
  4. Report if blocked.

Key blocker: no KERNEL_API_KEY. Let me check env vars. If not present, I can still write the example code and validate it structurally (install SDK, typecheck, maybe run without key and show the auth error). But I should not fabricate results.

Let me check environment for KERNEL_API_KEY.

Also let me read the llms.txt and docs for pricing details (gb-second pricing, plans) to be accurate. Also check whether there are free credits.

Let me check env and also fetch llms.txt for pricing detail.

Note the constraint: "Do not start local service stacks or wait for long-running commands" — the Kernel quickstart is fine: it's a hosted cloud browser via SDK, no local Chromium. Good.

Let me check env variables first, and fetch docs llms.txt.

env | grep -iE "kernel|api_key|token" | sed -E 's/(=.{0,6}).*/\1***/' ; echo "--- exit:$?"
PI_GATEWAY_API_KEY=unused***
PI_GATEWAY_API_KEY=unused***
--- exit:0

cd /tmp && timeout 30 curl -sSL https://www.kernel.sh/docs/llms.txt -o llms.txt && wc -l llms.txt && grep -iE "pric|billing|plans|usage|credit" llms.txt | head -30
408 llms.txt
408 llms.txt
- [Web Bot Auth (WBA)](https://kernel.sh/docs/browsers/bot-detection/web-bot-auth.md): Use Web Bot Auth (WBA) to give your agents a verifiable identity. Request KERNEL’s opt-in WBA token on Startup and Enterprise plans.
- [Pricing](https://kernel.sh/docs/info/pricing.md)
- [Get organization limits](https://kernel.sh/docs/api-reference/organization/get-organization-limits.md): Get the organization's effective limits and current concurrency, managed auth, and vault usage.
- [Create or retrieve a vault by immutable name](https://kernel.sh/docs/api-reference/vaults/create-or-retrieve-a-vault-by-immutable-name.md): Free organizations can store up to 3 non-deleted vaults across all projects. Paid plans and active trials have no vault cap. Retrieving an existing vault by name succeeds even at the limit.
- [Stripe Projects](https://kernel.sh/docs/integrations/stripe-projects.md): Provision Kernel cloud browsers and plans through the Stripe Projects CLI
Thinking…

No KERNEL_API_KEY in env. So I'm blocked on actually running it against the live API. But I can still build the example, install the SDK, typecheck it, and run it to show that it fails at auth (which proves the code path works up to auth). Actually running it without a key would produce an auth error — that's a legitimate, quick check (not long-running). Let me be careful: creating a browser would incur cost, but I have no key so it won't happen.

Let me fetch the pricing docs page for accuracy.

Also let's check the SDK readme I saved, and the docs on SDK usage for details like Kernel constructor, error handling, etc.

Let me fetch pricing.md.

cd /tmp && timeout 30 curl -sSL https://kernel.sh/docs/info/pricing.md -o pricing.md && wc -c pricing.md && head -120 pricing.md
13182 pricing.md
13182 pricing.md
> ## Documentation Index
> Fetch the complete documentation index at: https://kernel.sh/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Pricing

export const PricingCalculator = () => {
  const defaults = {
    plan: 'free',
    browserType: 'headful',
    avgSessionLength: 30,
    numSessions: 100
  };
  const planPrices = {
    free: 0,
    hobbyist: 30,
    startup: 200
  };
  const usagePrices = 0.0000166667;
  const browserMultipliers = {
    headless: 1,
    headful: 8,
    gpu: 48
  };
  const [plan, setPlan] = useState(defaults.plan);
  const [browserType, setBrowserType] = useState(defaults.browserType);
  const [avgSessionLength, setAvgSessionLength] = useState(defaults.avgSessionLength);
  const [numSessions, setNumSessions] = useState(defaults.numSessions);
  const [flash, setFlash] = useState(false);
  const prevPriceRef = useRef(null);
  const hasInteracted = useRef(false);
  useEffect(() => {
    if (!hasInteracted.current) return;
    var url = new URL(window.location);
    url.searchParams.set('plan', plan);
    url.searchParams.set('browserType', browserType);
    url.searchParams.set('duration', avgSessionLength);
    url.searchParams.set('sessions', numSessions);
    url.hash = 'pricing-calculator';
    window.history.replaceState(null, '', url);
  }, [plan, browserType, avgSessionLength, numSessions]);
  const handleBrowserTypeChange = type => {
    hasInteracted.current = true;
    setBrowserType(type);
    if (type === 'gpu' && plan !== 'startup' && plan !== 'enterprise') {
      setPlan('startup');
    }
  };
  const handlePlanChange = newPlan => {
    hasInteracted.current = true;
    if (browserType === 'gpu' && newPlan !== 'startup' && newPlan !== 'enterprise') {
      return;
    }
    setPlan(newPlan);
  };
  var isEnterprise = plan === 'enterprise';
  var price = isEnterprise ? 0 : planPrices[plan];
  var multiplier = browserMultipliers[browserType];
  var usageCost = usagePrices * multiplier * numSessions * avgSessionLength;
  var includedUsageCredits = 5;
  if (plan === 'hobbyist') {
    includedUsageCredits = 10;
  } else if (plan === 'startup') {
    includedUsageCredits = 50;
  }
  if (usageCost > includedUsageCredits) {
    price += Math.max(0, usageCost - includedUsageCredits);
  }
  useEffect(() => {
    var prev = prevPriceRef.current;
    if (prev !== null && (prev.usageCost !== usageCost || prev.includedUsageCredits !== includedUsageCredits || prev.price !== price)) {
      setFlash(true);
      var t = setTimeout(() => setFlash(false), 300);
      return () => clearTimeout(t);
    }
    prevPriceRef.current = {
      usageCost,
      includedUsageCredits,
      price
    };
  }, [usageCost, includedUsageCredits, price]);
  const labelStyle = {
    fontWeight: 600,
    fontSize: '0.875rem',
    minWidth: '10rem',
    flexShrink: 0,
    maxWidth: '10rem'
  };
  const rowStyle = {
    display: 'flex',
    alignItems: 'center',
    gap: '0.5rem',
    minHeight: '2.25rem'
  };
  const inputStyle = {
    minWidth: 0,
    flex: 1,
    maxWidth: '100%',
    boxSizing: 'border-box',
    background: 'transparent'
  };
  const selectStyle = {
    ...inputStyle,
    appearance: 'none',
    backgroundImage: `url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' fill='none' viewBox='0 0 24 24' stroke='%23374151'%3E%3Cpath stroke-linecap='round' stroke-linejoin='round' stroke-width='2' d='M19 9l-7 7-7-7'/%3E%3C/svg%3E")`,
    backgroundRepeat: 'no-repeat',
    backgroundPosition: 'right 0.5rem center',
    backgroundSize: '0.75rem',
    paddingRight: '1.5rem'
  };
  const btnStyle = active => ({
    padding: '0.25rem 0.5rem',
    borderRadius: '0.375rem',
    border: '1px solid var(--btn-border)',
    fontSize: '0.875rem',
    background: active ? 'var(--btn-selected-bg)' : undefined
  });
  return <Columns cols={2}>
            <Card title="Controls" icon="calculator">
                <div style={rowStyle}>

cd /tmp && head -160 onkernel_readme.md
# Kernel TypeScript API Library
# Kernel TypeScript API Library

[![NPM version](<https://img.shields.io/npm/v/@onkernel/sdk.svg?label=npm%20(stable)>)](https://npmjs.org/package/@onkernel/sdk) ![npm bundle size](https://img.shields.io/bundlephobia/minzip/@onkernel/sdk)

This library provides convenient access to the Kernel REST API from server-side TypeScript or JavaScript.

The REST API documentation can be found on [kernel.sh](https://kernel.sh/docs). The full API of this library can be found in [api.md](api.md).

It is generated with [Stainless](https://www.stainless.com/).

## Installation

```sh
npm install @onkernel/sdk
```

## Usage

The full API of this library can be found in [api.md](api.md).

<!-- prettier-ignore -->
```js
import Kernel from '@onkernel/sdk';

const client = new Kernel({
  apiKey: process.env['KERNEL_API_KEY'], // This is the default and can be omitted
  environment: 'development', // defaults to 'production'
});

const browser = await client.browsers.create({ stealth: true });

console.log(browser.session_id);
```

### Request & Response types

This library includes TypeScript definitions for all request params and response fields. You may import and use them like so:

<!-- prettier-ignore -->
```ts
import Kernel from '@onkernel/sdk';

const client = new Kernel({
  apiKey: process.env['KERNEL_API_KEY'], // This is the default and can be omitted
  environment: 'development', // defaults to 'production'
});

const params: Kernel.BrowserCreateParams = { stealth: true };
const browser: Kernel.BrowserCreateResponse = await client.browsers.create(params);
```

Documentation for each method, request param, and response field are available in docstrings and will appear on hover in most modern editors.

## File uploads

Request parameters that correspond to file uploads can be passed in many different forms:

- `File` (or an object with the same structure)
- a `fetch` `Response` (or an object with the same structure)
- an `fs.ReadStream`
- the return value of our `toFile` helper

```ts
import fs from 'fs';
import Kernel, { toFile } from '@onkernel/sdk';

const client = new Kernel();

// If you have access to Node `fs` we recommend using `fs.createReadStream()`:
await client.deployments.create({ file: fs.createReadStream('/path/to/file') });

// Or if you have the web `File` API you can pass a `File` instance:
await client.deployments.create({ file: new File(['my bytes'], 'file') });

// You can also pass a `fetch` `Response`:
await client.deployments.create({ file: await fetch('https://somesite/file') });

// Finally, if none of the above are convenient, you can use our `toFile` helper:
await client.deployments.create({ file: await toFile(Buffer.from('my bytes'), 'file') });
await client.deployments.create({ file: await toFile(new Uint8Array([0, 1, 2]), 'file') });
```

## Handling errors

When the library is unable to connect to the API,
or if the API returns a non-success status code (i.e., 4xx or 5xx response),
a subclass of `APIError` will be thrown:

<!-- prettier-ignore -->
```ts
const browser = await client.browsers.create({ stealth: true }).catch(async (err) => {
  if (err instanceof Kernel.APIError) {
    console.log(err.status); // 400
    console.log(err.name); // BadRequestError
    console.log(err.headers); // {server: 'nginx', ...}
  } else {
    throw err;
  }
});
```

Error codes are as follows:

| Status Code | Error Type                 |
| ----------- | -------------------------- |
| 400         | `BadRequestError`          |
| 401         | `AuthenticationError`      |
| 403         | `PermissionDeniedError`    |
| 404         | `NotFoundError`            |
| 422         | `UnprocessableEntityError` |
| 429         | `RateLimitError`           |
| >=500       | `InternalServerError`      |
| N/A         | `APIConnectionError`       |

### Retries

Certain errors will be automatically retried 2 times by default, with a short exponential backoff.
Connection errors (for example, due to a network connectivity problem), 408 Request Timeout, 409 Conflict,
429 Rate Limit, and >=500 Internal errors will all be retried by default.

You can use the `maxRetries` option to configure or disable this:

<!-- prettier-ignore -->
```js
// Configure the default for all requests:
const client = new Kernel({
  maxRetries: 0, // default is 2
});

// Or, configure per-request:
await client.browsers.create({ stealth: true }, {
  maxRetries: 5,
});
```

### Timeouts

Requests time out after 1 minute by default. You can configure this with a `timeout` option:

<!-- prettier-ignore -->
```ts
// Configure the default for all requests:
const client = new Kernel({
  timeout: 20 * 1000, // 20 seconds (default is 1 minute)
});

// Override per-request:
await client.browsers.create({ stealth: true }, {
  timeout: 5 * 1000,
});
```

On timeout, an `APIConnectionTimeoutError` is thrown.

Note that requests which time out will be [retried twice by default](#retries).

## Auto-pagination

List methods in the Kernel API are paginated.
You can use the `for await … of` syntax to iterate through items across all pages:
Thinking…

Now let me get the pricing prose (the calculator is JS; I want the textual pricing details). Let me look further in pricing.md for the text sections.

Also I want to confirm the gb-second multiplier meaning: headless = 1x, headful = 8x, gpu = 48x. Base usage price $0.0000166667 per GB-second. Wait — but with multiplier: usageCost = usagePrices * multiplier * numSessions * avgSessionLength. Hmm, that suggests the "per GB-second" is per second of session with a multiplier per browser type. Actually it's confusing: $0.0000166667 per GB-second, and browser multipliers represent typical GB/s consumption? Actually headful consumes 8x more bandwidth than headless... Hmm, the multiplier is likely a "GB-second multiplier" i.e., headful browser counts as 8 GB-seconds per second. Let me read the text portion of pricing.md.

Let me grep for headings.

cd /tmp && grep -n "^#\|^##\|^###" pricing.md | head -40; echo "===TAIL==="; sed -n '200,400p' pricing.md
5:# Pricing
5:# Pricing
199:## Plan Pricing
208:## Usage Rates
219:### Pricing calculator
223:## Managed infrastructure
254:## Limits
258:## Other ways to pay
262:## FAQ
===TAIL===

| Plan | Monthly cost | Included Credits / mo |
| - | - | - |
| Developer | Free + usage | \$5 |
| Hobbyist | \$30 + usage | \$10 |
| Start-Up | \$200 + usage | \$50 |
| Enterprise | Custom | Custom |

## Usage Rates

| Usage type | Price (\$/sec) |
| - | - |
| Headful browser | 0.0001333336 |
| Headless browser | 0.0000166667 |
| Headful browser + GPU acceleration | 0.0008000016 |
| App invocation | 0.0000666668 |

> Included monthly credits apply to usage costs only.

### Pricing calculator

<PricingCalculator />

## Managed infrastructure

| Feature | Developer | Hobbyist | Start-Up | Enterprise |
| - | - | - | - | - |
| Browser live view | ✅ | ✅ | ✅ | ✅ |
| Extended browser timeouts | ✅ | ✅ | ✅ | ✅ |
| Configurable browser viewports | ✅ | ✅ | ✅ | ✅ |
| Managed stealth mode | ✅ | ✅ | ✅ | ✅ |
| Computer controls API | ✅ | ✅ | ✅ | ✅ |
| Browser pools | ✅ | ✅ | ✅ | ✅ |
| SOC2 compliance | ✅ | ✅ | ✅ | ✅ |
| Browser replays | 1 day | 7 days | 30 days | Custom |
| Managed auth connections | 3 | unlimited | unlimited | unlimited |
| Vaults | 3 | unlimited | unlimited | unlimited |
| Custom browser extensions | 1 | 1 | unlimited | unlimited |
| Projects | 1 | 1 | unlimited | unlimited |
| Support | Discord | Email | Email | Shared Slack |
| Configurable proxies | ❌ | ✅ | ✅ | ✅ |
| BYO proxies | ❌ | ❌ | ✅ | ✅ |
| GPU acceleration | ❌ | ❌ | ✅ | ✅ |
| Regional browsers | ❌ | ❌ | ✅ | ✅ |
| Audit log search & export | ❌ | ❌ | ✅ | ✅ |
| Continuous audit log export to S3 | ❌ | ❌ | ❌ | ✅ |
| HIPAA compliance (BAA) | ❌ | ❌ | ❌ | ✅ |

<span id="concurrency-limits" />

<span id="rate-limiting" />

<span id="notes" />

## Limits

Concurrency, rate limits, and per-browser resources for each plan are on [concurrency and limits](/docs/browsers/concurrency-and-limits).

## Other ways to pay

Agents can buy a single browser without a KERNEL account or API key through the [machine payments protocol (MPP)](/docs/info/mpp). One stealth, headful browser for 30 minutes costs \$0.50, paid with a Link payment. See [buy a browser with MPP](/docs/info/mpp) for the payment flow.

## FAQ

<Accordion title="How does billing work across a browser's lifecycle? Am I charged for the full timeout_seconds, or only while it's actively in use?">
  Only for active runtime. `timeout_seconds` sets an idle auto-delete ceiling, not a billing window. Once a browser goes idle — 5 seconds after the last CDP or Live View activity — it enters Standby Mode and stops accruing usage cost, even if it stays alive until the timeout is reached. Deleting a browser early doesn't lower cost any further (idle time is already free), but it does free up your concurrency slot sooner.
</Accordion>

<Accordion title="How can I control my team's usage spending?">
  Set an organization or project [spending cap](/docs/info/spending-caps).
</Accordion>

<Accordion title="How are browser pools charged?">
  you pay the standard usage-based price per GB-second while browsers are running. Idle browsers in a pool incur no disk charges—you only pay when a browser is actively in use.

  Note: A browser pool counts toward your concurrency limit whether or not its browsers are currently acquired — a browser pool sized to 40 browsers uses 40 of your limit.
</Accordion>

<Accordion title="How is Managed Auth charged?">
  Managed Auth is included on all plans with no per-connection fees. It uses browser sessions for login, health checks, and eligible automatic reauthentication. These count toward your browser usage and concurrency like any other browser session.

  Auth sessions are fast, typically 5-30 seconds each, and most website sessions remain valid for days. For example, monitoring 100 auth connections typically costs less than \$5/month in browser usage.
</Accordion>

<Accordion title="Does it cost money to use Vaults and Agentic Payments?">
  Free users can create up to three vaults. Unlimited vaults are included in paid plans. There are no surcharges to use Kernel's agentic payments products.
</Accordion>

<Accordion title="What do regional browsers cost?">
  Regional browsers are charged at the same usage rates as our default, US-based browsers.
</Accordion>

<Accordion title="How are app invocations charged?">
  App invocations are billed for active compute time, not per API call. The invocation rate in [Usage Rates](#usage-rates) is based on the current 4 GB memory allocation at \$0.0000166667 per GB-second.

  Billing starts when your code begins executing and stops when it finishes. You aren't charged for queued time, deploying an app, or leaving a deployed app idle. Failed and canceled invocations still accrue charges for the time they ran.

  Browsers created by an invocation are billed separately for their active runtime at the browser rates above. Services your code calls, such as an LLM API, also bill you independently.

  The [app invocation limits](/docs/browsers/concurrency-and-limits#concurrency) are concurrency limits, not a number of invocations included with your plan.
</Accordion>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.
Thinking…

Now I have solid pricing info.

Next: build a simple example. I need to set up a small TypeScript project in /sandbox/repo using @onkernel/sdk. Since there's no KERNEL_API_KEY, I'm blocked on actually executing against the live API. I should:

  • Scaffold the project (package.json, tsconfig, example script)
  • Install the SDK (npm install — quick, not long-running)
  • Typecheck to validate correctness
  • Run the script to demonstrate the exact failure (auth error) — that proves the wiring works up to the credential

Let me check npm install works (network to registry confirmed working).

Let me also check the docs for the playwright execute API to make sure I use the right shape, plus how to check org limits (useful for "manageability"). Let me fetch a couple of docs pages: browsers/create, playwright execute, and maybe "how you drive the browser".

Let me fetch the API reference markdown for browser create and playwright execute.

cd /tmp && grep -iE "playwright|browsers/create|computer|session|llms-full|sdk" llms.txt | head -40
- [Profiles](https://kernel.sh/docs/browsers/profiles.md): Persist and reuse browser state across browser sessions
- [Profiles](https://kernel.sh/docs/browsers/profiles.md): Persist and reuse browser state across browser sessions
- [Save and Reuse Profile State](https://kernel.sh/docs/browsers/profiles/save-and-reuse.md): Create a browser profile, save state to it, and load it in later browser sessions
- [Authentication](https://kernel.sh/docs/auth/overview.md): Choose how your browser agents authenticate and reuse signed-in sessions
- [Managed Auth](https://kernel.sh/docs/auth/managed-auth.md): Handle website login, reuse session state, and recover eligible connections automatically
- [Hosted UI](https://kernel.sh/docs/auth/hosted-ui.md): The simplest way to create authenticated browser sessions
- [Playwright Execution](https://kernel.sh/docs/browsers/playwright-execution.md): Execute Playwright code in the same VM as your browser
- [Computer Controls](https://kernel.sh/docs/browsers/computer-controls.md): Control the computer's mouse, keyboard, and screen
- [Replays](https://kernel.sh/docs/browsers/replays.md): Record and view browser sessions as mp4 videos
- [Browser Telemetry](https://kernel.sh/docs/browsers/telemetry/overview.md): Capture what happens inside a browser session
- [Telemetry Categories](https://kernel.sh/docs/browsers/telemetry/categories.md): The categories a browser session can capture, what each contains, and their cost
- [Stream Telemetry](https://kernel.sh/docs/browsers/telemetry/streaming.md): Consume a session's live telemetry stream from the SDK or CLI
- [Export Telemetry](https://kernel.sh/docs/browsers/telemetry/export.md): Send a session's captured events to your own observability backend over OTLP
- [List browser sessions](https://kernel.sh/docs/api-reference/browsers/list-browser-sessions.md): List all browser sessions with pagination support. Use status parameter to filter by session state.
- [Create a browser session](https://kernel.sh/docs/api-reference/browsers/create-a-browser-session.md): Create a new browser session from within an action.
- [Get browser session details](https://kernel.sh/docs/api-reference/browsers/get-browser-session-details.md): Get information about a browser session.
- [Delete a browser session by ID or name.](https://kernel.sh/docs/api-reference/browsers/delete-a-browser-session-by-id-or-name.md): Delete a browser session by ID or name
- [Update browser session](https://kernel.sh/docs/api-reference/browsers/update-browser-session.md): Update a browser session.
- [Execute a batch of computer actions sequentially](https://kernel.sh/docs/api-reference/browser-computer-controls/execute-a-batch-of-computer-actions-sequentially.md): Send an array of computer actions to execute in order on the browser instance. Execution stops on the first error. This reduces network latency compared to sending individual action requests.
- [Simulate a mouse click action on the browser instance](https://kernel.sh/docs/api-reference/browser-computer-controls/simulate-a-mouse-click-action-on-the-browser-instance.md)
- [Read text from the clipboard on the browser instance](https://kernel.sh/docs/api-reference/browser-computer-controls/read-text-from-the-clipboard-on-the-browser-instance.md)
- [Write text to the clipboard on the browser instance](https://kernel.sh/docs/api-reference/browser-computer-controls/write-text-to-the-clipboard-on-the-browser-instance.md)
- [Set cursor visibility](https://kernel.sh/docs/api-reference/browser-computer-controls/set-cursor-visibility.md)
- [Drag the mouse along a path](https://kernel.sh/docs/api-reference/browser-computer-controls/drag-the-mouse-along-a-path.md)
- [Get the current mouse cursor position on the browser instance](https://kernel.sh/docs/api-reference/browser-computer-controls/get-the-current-mouse-cursor-position-on-the-browser-instance.md)
- [Move the mouse cursor to the specified coordinates on the browser instance](https://kernel.sh/docs/api-reference/browser-computer-controls/move-the-mouse-cursor-to-the-specified-coordinates-on-the-browser-instance.md)
- [Press one or more keys on the host computer](https://kernel.sh/docs/api-reference/browser-computer-controls/press-one-or-more-keys-on-the-host-computer.md)
- [Capture a screenshot of the browser instance](https://kernel.sh/docs/api-reference/browser-computer-controls/capture-a-screenshot-of-the-browser-instance.md)
- [Scroll the mouse wheel at a position on the host computer](https://kernel.sh/docs/api-reference/browser-computer-controls/scroll-the-mouse-wheel-at-a-position-on-the-host-computer.md)
- [Type text on the browser instance](https://kernel.sh/docs/api-reference/browser-computer-controls/type-text-on-the-browser-instance.md)
- [Execute Playwright/TypeScript code against the browser](https://kernel.sh/docs/api-reference/browser-playwright/execute-playwrighttypescript-code-against-the-browser.md): Execute arbitrary Playwright code in a fresh execution context against the browser. The code runs in the same VM as the browser, minimizing latency and maximizing throughput. It has access to 'page', 'context', 'browser', and 'webmcp' variables. Use 'webmcp.listTools()' to discover browser-wide WebM…
- [List Playwright executors](https://kernel.sh/docs/api-reference/browser-playwright/list-playwright-executors.md): Lists the default executor first, then the named executors created by POST /browsers/{id_or_name}/playwright/execute. Each entry reports whether a call is running on it and, for named executors, the target ID and URL of the tab it owns. Returns 404 for a browser whose image predates executors.
- [Delete a Playwright executor](https://kernel.sh/docs/api-reference/browser-playwright/delete-a-playwright-executor.md): Stops the executor's process. A call running on it fails with an error saying the executor was deleted. By default the executor's tab is closed too. The name can be reused; the next call with it creates a new executor and tab.
- [List browser session replays](https://kernel.sh/docs/api-reference/browser-replays/list-browser-session-replays.md): List all replays for the specified browser session.
- [Start a browser session replay recording](https://kernel.sh/docs/api-reference/browser-replays/start-a-browser-session-replay-recording.md): Start recording the browser session and return a replay ID.
- [Stop a browser session replay recording](https://kernel.sh/docs/api-reference/browser-replays/stop-a-browser-session-replay-recording.md): Stop the specified replay recording and persist the video.
- [Read telemetry events for a browser session](https://kernel.sh/docs/api-reference/browser-telemetry/read-telemetry-events-for-a-browser-session.md): Reads a page of telemetry events for the browser session. To page through results, pass the X-Next-Offset value from the previous response as offset and repeat while X-Has-More is true. The category and type filters apply within each page, so a filtered page may be empty while X-Has-More is true. Re…
- [Stream telemetry events via SSE](https://kernel.sh/docs/api-reference/browser-telemetry/stream-telemetry-events-via-sse.md): Streams browser telemetry events as a server-sent events (SSE) stream. The stream closes when the browser session terminates. Each event frame includes an id: field containing a monotonically increasing sequence number; pass it as Last-Event-ID on reconnect to resume without gaps. The event: field i…
- [Delete OTLP destination by ID or name](https://kernel.sh/docs/api-reference/browser-telemetry/delete-otlp-destination-by-id-or-name.md): Delete an OTLP destination. Sessions bound to it are still exporting, so the delete is refused with a 409 while any exist; either wait for those sessions to end or delete them first. It is refused the same way while a managed auth connection still selects it, because that connection re-resolves the…
- [Update OTLP destination by ID or name](https://kernel.sh/docs/api-reference/browser-telemetry/update-otlp-destination-by-id-or-name.md): Update an OTLP destination. Sessions already exporting to it pick up the new values without restarting, which makes this the way to rotate credentials without interrupting export.
- [List browsers for an invocation](https://kernel.sh/docs/api-reference/invocations/list-browsers-for-an-invocation.md): Returns all active browser sessions created within the specified invocation.

cd /tmp && timeout 30 curl -sSL https://kernel.sh/docs/api-reference/browsers/create-a-browser.md -o create.md && sed -n '1,140p' create.md
> ## Documentation Index
> ## Documentation Index
> Fetch the documentation index at: https://kernel.sh/docs/llms.txt
> Use this file to discover all available pages before exploring further.
> For broader context, fetch the full documentation at: https://kernel.sh/docs/llms-full.txt (large file).

# Page Not Found

The requested page could not be found.

## Related topics

- [Create a browser session](https://kernel.sh/docs/api-reference/browsers/create-a-browser-session.md)
- [Create a browser pool](https://kernel.sh/docs/api-reference/browser-pools/create-a-browser-pool.md)
- [Create auth connection](https://kernel.sh/docs/api-reference/managed-auth/create-auth-connection.md)
Thinking…

Let me get the correct API reference for creating a browser. Look at llms.txt for "Create a browser" entries near the top of the browsers API section.

cd /tmp && grep -n "api-reference/browsers/" llms.txt | head -20
114:- [List browser sessions](https://kernel.sh/docs/api-reference/browsers/list-browser-sessions.md): List all browser sessions with pagination support. Use st
114:- [List browser sessions](https://kernel.sh/docs/api-reference/browsers/list-browser-sessions.md): List all browser sessions with pagination support. Use status parameter to filter by session state.
115:- [Create a browser session](https://kernel.sh/docs/api-reference/browsers/create-a-browser-session.md): Create a new browser session from within an action.
116:- [Get browser session details](https://kernel.sh/docs/api-reference/browsers/get-browser-session-details.md): Get information about a browser session.
117:- [Delete a browser session by ID or name.](https://kernel.sh/docs/api-reference/browsers/delete-a-browser-session-by-id-or-name.md): Delete a browser session by ID or name
118:- [Update browser session](https://kernel.sh/docs/api-reference/browsers/update-browser-session.md): Update a browser session.
119:- [Make an HTTP request through the browser's network stack](https://kernel.sh/docs/api-reference/browsers/make-an-http-request-through-the-browsers-network-stack.md): Sends an HTTP request through Chrome's HTTP request stack, inheriting the browser's TLS fingerprint, cookies, proxy configuration, and headers. Returns a structured JSON response with status, headers, body, and timing.
120:- [Ad-hoc upload one or more unpacked extensions to a running browser instance.](https://kernel.sh/docs/api-reference/browsers/ad-hoc-upload-one-or-more-unpacked-extensions-to-a-running-browser-instance.md): Loads one or more unpacked extensions using live CDP activation when eligible. Chromium restarts when enterprise policy requires it or live activation fails.
300:- [Buy a browser session with a machine payment](https://kernel.sh/docs/api-reference/browsers/buy-a-browser-session-with-a-machine-payment.md): Buys a stealth headful browser for the duration in the offer with a Machine Payments Protocol (MPP) payment, without a Kernel account. A request without an `Authorization: Payment` credential gets a 402 challenge; the paid retry returns the browser and a `Payment-Receipt` header. A challenge can be…

cd /tmp && timeout 30 curl -sSL https://kernel.sh/docs/browsers/playwright-execution.md -o pwe.md && sed -n '1,150p' pwe.md
> ## Documentation Index
> ## Documentation Index
> Fetch the complete documentation index at: https://kernel.sh/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Playwright Execution

> Execute Playwright code in the same VM as your browser

Execute arbitrary Playwright/TypeScript code in a fresh execution context against your browser. The code runs in the same VM as the browser, minimizing latency and maximizing throughput.

**For complex workloads, Kernel has a full [code execution platform](/docs/apps)**.

## How it works

When you execute Playwright code through this API:

* Your code runs directly in the browser's VM (no CDP overhead)
* You have access to `page`, `context`, `browser`, and browser-wide `webmcp` helpers
* You can `return` a value, which is returned in the response
* Execution is isolated in a fresh context each time

## Quick example

<CodeGroup>
  ```typescript Typescript/Javascript theme={null}
  import Kernel from '@onkernel/sdk';

  const kernel = new Kernel();

  // Create a browser
  const kernelBrowser = await kernel.browsers.create();

  // Execute Playwright code
  const response = await kernel.browsers.playwright.execute(
    kernelBrowser.session_id,
    {
      code: `
        await page.goto('https://example.com');
        return await page.title();
      `
    }
  );

  console.log(response.result); // "Example Domain"
  ```

  ```python Python theme={null}
  from kernel import Kernel

  kernel = Kernel()

  # Create a browser
  kernel_browser = kernel.browsers.create()

  # Execute Playwright code
  response = kernel.browsers.playwright.execute(
      id=kernel_browser.session_id,
      code="""
          await page.goto('https://example.com')
          return await page.title()
      """
  )

  print(response.result)  # "Example Domain"
  ```

  ```go Go theme={null}
  package main

  import (
  	"context"
  	"fmt"

  	"github.com/kernel/kernel-go-sdk"
  )

  func main() {
  	ctx := context.Background()
  	client := kernel.NewClient()

  	// Create a browser
  	kernelBrowser, err := client.Browsers.New(ctx, kernel.BrowserNewParams{})
  	if err != nil {
  		panic(err)
  	}

  	// Execute Playwright code
  	response, err := client.Browsers.Playwright.Execute(ctx, kernelBrowser.SessionID, kernel.BrowserPlaywrightExecuteParams{
  		Code: `
  			await page.goto('https://example.com');
  			return await page.title();
  		`,
  	})
  	if err != nil {
  		panic(err)
  	}

  	fmt.Println(response.Result) // "Example Domain"
  }
  ```

  ```bash CLI theme={null}
  kernel browsers playwright execute <session_id> 'await page.goto("https://www.onkernel.com"); return page.title();'
  ```
</CodeGroup>

## Available variables

Your code has access to these objects:

* `page` - The current page instance
* `context` - The browser context
* `browser` - The browser instance
* `webmcp` - Helper for discovering and invoking [WebMCP tools](/docs/browsers/webmcp)

## WebMCP helpers

Code sent to `POST /browsers/{id}/playwright/execute` can use `webmcp` alongside Playwright:

* `await webmcp.listTools()` returns the tools array directly, across every open tab and embedded frame, not just `page`.
* `await webmcp.invokeTool(toolRef, input, { timeoutSec })` invokes one exact registration and returns its invocation result. Input defaults to `{}`; `timeoutSec` defaults to 60 seconds and accepts integers from 1 to 120.

First inspect `await webmcp.listTools()` to verify the tool's source and `input_schema`. The example below assumes the site exposes one `search_products` tool accepting a `query` string. It uses an existing session and client, as in the examples above. Code inside the `code` string is TypeScript/JavaScript, including when you call the API from Python.

<CodeGroup>
  ```typescript Typescript/Javascript theme={null}
  const response = await kernel.browsers.playwright.execute(sessionId, {
    code: `
      const tools = await webmcp.listTools();
      const tool = tools.find(tool => tool.name === 'search_products');
      if (!tool) return { tools };
      const invocation = await webmcp.invokeTool(
        tool.tool_ref,
        { query: 'running shoes' },
        { timeoutSec: 5 }
      );
      if (invocation.status === 'awaiting_submission') {
        return { invocation, next_step: 'Inspect the form, confirm, then submit without reinvoking.' };
      }
      return { invocation, tools: await webmcp.listTools() };
    `,
    timeout_sec: 10,
  }, { maxRetries: 0 });
  console.log(response);
  ```

  ```python Python theme={null}
  response = kernel.with_options(max_retries=0).browsers.playwright.execute(
      session_id,
      code="""
Thinking…

Now let me scaffold the example project. I'll build a TypeScript example in /sandbox/repo:

  • package.json with @onkernel/sdk, typescript, tsx
  • tsconfig.json
  • src/example.ts — create browser, run playwright code (scrape HN titles or example.com title), print live view URL, cleanup with try/finally, plus a check of org limits maybe.
  • .env.example
  • README.md with pricing summary and how to run.

Then: npm install (quick), typecheck with tsc --noEmit, and run it to see the auth error (no API key). That demonstrates it's blocked on credentials.

Let me check SDK API surface after install to verify method names (browsers.create, browsers.playwright.execute, browsers.deleteByID, organization limits?).

Let me do the scaffold and install.

mkdir -p /sandbox/repo/src && cd /sandbox/repo && cat > package.json <<'EOF'
{
  "name": "kernel-simple-example",
  "private": true,
  "version": "0.1.0",
  "type": "module",
  "description": "Minimal Kernel (kernel.sh) cloud-browser example using the official TypeScript SDK",
  "scripts": {
    "example": "tsx src/example.ts",
    "typecheck": "tsc --noEmit"
  },
  "dependencies": {
    "@onkernel/sdk": "^0.121.0"
  },
  "devDependencies": {
    "@types/node": "^22.0.0",
    "tsx": "^4.19.0",
    "typescript": "^5.6.0"
  }
}
EOF
cat > tsconfig.json <<'EOF'
{
  "compilerOptions": {
    "target": "ES2022",
    "module": "NodeNext",
    "moduleResolution": "NodeNext",
    "strict": true,
    "esModuleInterop": true,
    "skipLibCheck": true,
    "resolveJsonModule": true,
    "types": ["node"],
    "noEmit": true
  },
  "include": ["src/**/*.ts"]
}
EOF
cat > .env.example <<'EOF'
# Create an API key at https://dashboard.kernel.sh (Kernel dashboard) and export it:
#   export KERNEL_API_KEY=<your-api-key>
# Every Kernel SDK, the CLI, and the MCP server read this from the environment.
KERNEL_API_KEY=
EOF
echo ok && npm install --no-audit --no-fund 2>&1 | tail -5
ok
ok
npm notice
npm notice New major version of npm available! 10.9.8 -> 12.2.0
npm notice Changelog: https://github.com/npm/cli/releases/tag/v12.2.0
npm notice To update run: npm install -g npm@12.2.0
npm notice
Thinking…

Installed. Let me verify the installed SDK version and API surface (browsers.create params, playwright.execute, deleteByID, organization limits).

cd /sandbox/repo && node -e "console.log(require('./node_modules/@onkernel/sdk/package.json').version)" && ls node_modules/@onkernel/sdk/resources | head -30 && grep -n "deleteByID\|delete(" node_modules/@onkernel/sdk/resources/browsers/browsers.d.ts | head -10
0.121.0
0.121.0
api-keys.d.mts
api-keys.d.mts.map
api-keys.d.ts
api-keys.d.ts.map
api-keys.js
api-keys.js.map
api-keys.mjs
api-keys.mjs.map
apps.d.mts
apps.d.mts.map
apps.d.ts
apps.d.ts.map
apps.js
apps.js.map
apps.mjs
apps.mjs.map
audit-logs
audit-logs.d.mts
audit-logs.d.mts.map
audit-logs.d.ts
audit-logs.d.ts.map
audit-logs.js
audit-logs.js.map
audit-logs.mjs
audit-logs.mjs.map
auth
auth.d.mts
auth.d.mts.map
auth.d.ts
auth.d.ts.map
102:     * await client.browsers.deleteByID(
107:    deleteByID(idOrName: string, options?: RequestOptions): APIPromise<void>;

cd /sandbox/repo && grep -n "class Playwright\|execute(" node_modules/@onkernel/sdk/resources/browsers/playwright/playwright.d.ts | head -20; echo "--- BrowserCreateParams:"; grep -n "export interface BrowserCreateParams" -A 60 node_modules/@onkernel/sdk/resources/browsers/browsers.d.ts | sed -n '1,70p'
9:export declare class Playwright extends APIResource {
9:export declare class Playwright extends APIResource {
57:     * const response = await client.browsers.playwright.execute(
63:    execute(idOrName: string, body: PlaywrightExecuteParams, options?: RequestOptions): APIPromise<PlaywrightExecuteResponse>;
--- BrowserCreateParams:
1075:export interface BrowserCreateParams {
1076-    /**
1077-     * Custom Chrome enterprise policy overrides applied to this browser session. Keys
1078-     * are Chrome enterprise policy names; values must match their expected types.
1079-     * Blocked: kernel-managed policies (extensions, proxy, CDP/automation). See
1080-     * https://chromeenterprise.google/policies/
1081-     */
1082-    chrome_policy?: {
1083-        [key: string]: unknown;
1084-    };
1085-    /**
1086-     * List of browser extensions to load into the session. Provide each by id or name.
1087-     */
1088-    extensions?: Array<Shared.BrowserExtension>;
1089-    /**
1090-     * If true, enables GPU acceleration for the browser session. Requires Start-Up or
1091-     * Enterprise plan, headless=false, and region=us-east.
1092-     */
1093-    gpu?: boolean;
1094-    /**
1095-     * If true, launches the browser using a headless image (no VNC/GUI). Defaults to
1096-     * false.
1097-     */
1098-    headless?: boolean;
1099-    /**
1100-     * action invocation ID
1101-     */
1102-    invocation_id?: string;
1103-    /**
1104-     * If true, launches the browser in kiosk mode to hide address bar and tabs in live
1105-     * view.
1106-     */
1107-    kiosk_mode?: boolean;
1108-    /**
1109-     * Memory for a headful, non-GPU browser session. Defaults to 8GiB.
1110-     */
1111-    memory?: BrowserMemoryRequest;
1112-    /**
1113-     * Optional human-readable name for the browser session, used to find it later in
1114-     * the dashboard. Must be unique among active sessions within the project. Can be
1115-     * changed later via PATCH /browsers/{id_or_name}.
1116-     */
1117-    name?: string;
1118-    /**
1119-     * Network configuration for the browser session. Only allowed_hosts can be changed
1120-     * after creation, with PATCH /browsers/{id_or_name}.
1121-     */
1122-    network?: BrowserNetworkConfig;
1123-    /**
1124-     * Profile selection for the browser session. Provide either id or name. If
1125-     * specified, the matching profile will be loaded into the browser session.
1126-     * Profiles must be created beforehand.
1127-     */
1128-    profile?: Shared.BrowserProfile;
1129-    /**
1130-     * Proxy configuration for the browser session. Cannot be combined with proxy_id.
1131-     * Omit to use the browser default: stealth browsers use Kernel's default stealth
1132-     * proxy, while non-stealth browsers use direct egress. Set mode to direct to force
1133-     * direct egress regardless of stealth. Set mode to default to explicitly use the
1134-     * browser default: Kernel's default stealth proxy when stealth=true, or direct
1135-     * egress when stealth=false. Select id or name to use that proxy regardless of
Thinking…

Good. Now let me check the response fields of BrowserCreateResponse and PlaywrightExecuteResponse, and whether there's an organization limits endpoint in the SDK (useful for cost/management awareness). Also check timeout_seconds.

Let me grep.

cd /sandbox/repo && grep -n "export interface BrowserCreateResponse" -A 80 node_modules/@onkernel/sdk/resources/browsers/browsers.d.ts | grep -nE "^\s*[0-9]+[-:]\s+\w+\??:" | head -40
5:480- cdp_ws_url: string;
5:480-    cdp_ws_url: string;
9:484-    created_at: string;
13:488-    headless: boolean;
17:492-    memory: BrowserMemory;
21:496-    region: 'us-east' | 'us-west' | 'eu-west' | 'ap-southeast';
25:500-    session_id: string;
29:504-    stealth: boolean;
33:508-    timeout_seconds: number;
37:512-    webdriver_ws_url: string;
41:516-    base_url?: string;
46:521-    browser_live_view_url?: string;
52:527-    chrome_policy?: {
58:533-    deleted_at?: string;
63:538-    gpu?: boolean;
67:542-    kiosk_mode?: boolean;
71:546-    name?: string;
76:551-    network?: BrowserNetworkConfig;
80:555-    pool?: BrowserPoolRef;

cd /sandbox/repo && ls node_modules/@onkernel/sdk/resources/ | grep -iE "org|limit"; echo "---"; grep -rn "getOrganizationLimits\|limits" node_modules/@onkernel/sdk/resources/organization*.d.ts 2>/dev/null | head -10; echo "--- playwright resp:"; grep -n "export interface PlaywrightExecuteResponse" -A 40 node_modules/@onkernel/sdk/resources/browsers/playwright/playwright.d.ts | head -50
organization
organization
organization.d.mts
organization.d.mts.map
organization.d.ts
organization.d.ts.map
organization.js
organization.js.map
organization.mjs
organization.mjs.map
---
--- playwright resp:
97:export interface PlaywrightExecuteResponse {
98-    /**
99-     * Whether the code executed successfully
100-     */
101-    success: boolean;
102-    /**
103-     * Error message if execution failed
104-     */
105-    error?: string;
106-    /**
107-     * The value returned by the code (if any)
108-     */
109-    result?: unknown;
110-    /**
111-     * Standard error from the execution
112-     */
113-    stderr?: string;
114-    /**
115-     * Standard output from the execution
116-     */
117-    stdout?: string;
118-    /**
119-     * The tab 'page' was bound to for this call. Absent if the call failed before
120-     * binding a tab.
121-     */
122-    tab?: Tab;
123-}
124-export interface PlaywrightExecuteParams {
125-    /**
126-     * TypeScript/JavaScript code to execute. The code has access to 'page', 'context',
127-     * and 'browser' variables. It runs within a function, so you can use a return
128-     * statement at the end to return a value. This value is returned as the `result`
129-     * property in the response. Example: "await page.goto('https://example.com');
130-     * return await page.title();"
131-     */
132-    code: string;
133-    /**
134-     * Name of a Playwright executor. Calls with the same name run in the same
135-     * executor, one at a time; the first call with a new name creates it. Calls on
136-     * different executors run concurrently. 'default' names the executor that runs
137-     * calls without a name.
Thinking…

Now check the organization resource methods (limits).

cd /sandbox/repo && grep -nE "^\s+\w+\(|class " node_modules/@onkernel/sdk/resources/organization.d.ts | head -20; echo "=== limits response fields:"; grep -n "export interface OrganizationLimits" -A 60 node_modules/@onkernel/sdk/resources/organization.d.ts | grep -E "^\s*[0-9]+[-:]\s+\w+\??:" | head -30
=== limits response fields:
=== limits response fields:
Thinking…

The organization.d.ts might be a directory index. Let me look at the file.

cd /sandbox/repo && cat node_modules/@onkernel/sdk/resources/organization.d.ts | head -40; echo "=== dir:"; ls node_modules/@onkernel/sdk/resources/organization/ 2>/dev/null | grep -v map | head
export * from "./organization/index.js";
export * from "./organization/index.js";
//# sourceMappingURL=organization.d.ts.map=== dir:
entitlements.d.mts
entitlements.d.ts
entitlements.js
entitlements.mjs
index.d.mts
index.d.ts
index.js
index.mjs
limits.d.mts
limits.d.ts
Thinking…

Let me inspect organization/limits.d.ts to find the method name and response shape — useful for a "manageability / cost guard" example.

cd /sandbox/repo && grep -nE "class |get\(|getOrganizationLimits|\w+\(" node_modules/@onkernel/sdk/resources/organization/limits.d.ts | head -20; echo "=== resp:"; grep -n "export interface" node_modules/@onkernel/sdk/resources/organization/limits.d.ts | head
7:export declare class Limits extends APIResource {
7:export declare class Limits extends APIResource {
12:    retrieve(options?: RequestOptions): APIPromise<OrgLimits>;
18:    update(body: LimitUpdateParams, options?: RequestOptions): APIPromise<OrgLimits>;
=== resp:
20:export interface OrgLimits {
73:export interface UpdateOrgLimitsRequest {
81:export interface LimitUpdateParams {
Thinking…

Good. kernel.organization.limits.retrieve() returns OrgLimits — useful for a guardrail (concurrency check) in the example.

Now let me write the example. I'll write:

src/example.ts:

  • Reads KERNEL_API_KEY from env; if missing, print a clear blocked message and exit(2) without making network calls (so no accidental spend and no confusing stack trace).
  • Creates a headless browser (cheapest rate: $0.0000166667/sec) with a short timeout_seconds (e.g., 120) to bound cost.
  • Prints live view URL (only present for headful; for headless it's absent — note that). Actually browser_live_view_url is optional; headless has no VNC/GUI, so live view likely absent. To demo live view you'd need headful (8x cost). I'll default to headless and allow --headful flag? Keep it simple: env var KERNEL_EXAMPLE_HEADFUL=1 to opt into headful + live view.
  • Runs Playwright code: goto example.com, return title + h1 text.
  • try/finally delete browser.
  • Optional: print org limits before creating (concurrency in use) to show manageability.

Also maybe a second file src/scrape-hn.ts? Keep it single file but simple. Maybe I'll add a tiny src/cost.ts helper that estimates cost per run? That could be nice: pricing calculator in code. Keep it light — I'll include a small cost estimator comment/function in the README instead. Actually, a small estimateCost function in the example makes the pricing tangible. Let me include it as a separate small module src/pricing.ts with the published rates, and use it to print an estimate of what a run costs. That directly answers "how pricing works" in code.

Let me write the files:

  1. src/pricing.ts — published rates + estimator (documented with source URL).
  2. src/example.ts — the main flow.
  3. README.md — how to run, pricing summary, manageability notes, blocked status.

Then typecheck, then run (will exit with blocked message since no key). Also I should verify the SDK path works end-to-end at least up to auth: I can run with a dummy key KERNEL_API_KEY=sk-test-invalid to show a 401 AuthenticationError from the real API — that proves network + SDK wiring works and identifies exactly what's missing. That's a fast call. Let's do that as verification (it doesn't create a browser since auth fails). Good idea — it demonstrates I'm blocked only on credentials.

Let me write files.

File edits

1 file

Completed
Writtensrc/pricing.tsView changes

/sandbox/repo/src/pricing.ts

Written content · previous contents were not recorded

/**
 * Kernel (kernel.sh) usage rates, transcribed from the published pricing docs.
 * Source: https://kernel.sh/docs/info/pricing  and  https://www.kernel.sh/pricing
 *
 * Kernel bills *active runtime only*: a browser that goes idle (5s after the last
 * CDP / Live View activity) enters Standby Mode and stops accruing cost, even if it
 * stays alive until `timeout_seconds`. Proxies are not billed separately.
 */
 
/** USD per second of active runtime, by workload type. */
export const USAGE_RATES_PER_SECOND = {
  headlessBrowser: 0.0000166667,
  headfulBrowser: 0.0001333336, // 8x headless
  headfulBrowserWithGpu: 0.0008000016, // 48x headless
  appInvocation: 0.0000666668, // 4 GB memory allocation at the base GB-second rate
} as const;
 
/** Monthly plan cost (USD) and the usage credits included each month. */
export const PLANS = [
  { name: 'Developer', monthlyUsd: 0, includedCreditsUsd: 5, concurrentBrowsers: 5 },
  { name: 'Hobbyist', monthlyUsd: 30, includedCreditsUsd: 10, concurrentBrowsers: 10 },
  { name: 'Start-Up', monthlyUsd: 200, includedCreditsUsd: 50, concurrentBrowsers: 150 },
] as const;
 
export type BrowserKind = keyof Pick<
  typeof USAGE_RATES_PER_SECOND,
  'headlessBrowser' | 'headfulBrowser' | 'headfulBrowserWithGpu'
>;
 
/** Estimate the usage cost of one browser session that is active for `activeSeconds`. */
export function estimateSessionCost(kind: BrowserKind, activeSeconds: number): number {
  return USAGE_RATES_PER_SECOND[kind] * activeSeconds;
}
 
/** What N sessions/week of the given length costs per month, before plan credits. */
export function estimateMonthlyUsage(
  kind: BrowserKind,
  activeSecondsPerSession: number,
  sessionsPerWeek: number,
): number {
  const sessionsPerMonth = sessionsPerWeek * (365 / 12 / 7);
  return estimateSessionCost(kind, activeSecondsPerSession) * sessionsPerMonth;
}
 
const usd = (n: number) => `$${n.toFixed(n < 0.01 ? 6 : 2)}`;
 
/** One-line-per-workload summary, handy for printing before a run. */
export function pricingSummary(): string {
  return [
    'Kernel pricing (plan fee + usage):',
    ...PLANS.map(
      (p) =>
        `  ${p.name.padEnd(10)} ${usd(p.monthlyUsd).padEnd(6)}/mo, ` +
        `includes ${usd(p.includedCreditsUsd)} usage credits, ${p.concurrentBrowsers} concurrent browsers`,
    ),
    '  Usage (active runtime only, idle/standby is free):',
    `    headless browser      ${USAGE_RATES_PER_SECOND.headlessBrowser}/sec  (~${usd(
      USAGE_RATES_PER_SECOND.headlessBrowser * 60,
    )}/min)`,
    `    headful browser       ${USAGE_RATES_PER_SECOND.headfulBrowser}/sec  (~${usd(
      USAGE_RATES_PER_SECOND.headfulBrowser * 60,
    )}/min)`,
    `    headful + GPU         ${USAGE_RATES_PER_SECOND.headfulBrowserWithGpu}/sec`,
    `    app invocation        ${USAGE_RATES_PER_SECOND.appInvocation}/sec`,
  ].join('\n');
}

File edits

1 file

Completed
Writtensrc/example.tsView changes

/sandbox/repo/src/example.ts

Written content · previous contents were not recorded

/**
 * Minimal Kernel example: create a hosted cloud browser, run Playwright code inside
 * the browser's own VM, print the result, and delete the browser.
 *
 * Nothing runs locally -- no Chromium download, no CDP connection, no local stack.
 * Everything happens on Kernel's infrastructure over HTTPS.
 *
 * Run:
 *   export KERNEL_API_KEY=<your-api-key>     # from https://dashboard.kernel.sh
 *   npm run example
 *
 * Opt into a headful browser (8x the usage rate, but you get a watchable live view):
 *   KERNEL_HEADFUL=1 npm run example
 */
import Kernel from '@onkernel/sdk';
import { estimateSessionCost, pricingSummary } from './pricing.ts';
 
/** Upper bound on how long the browser may stay alive. Idle time is not billed. */
const TIMEOUT_SECONDS = 120;
/** Cap on how long our Playwright snippet may run, so a hang cannot burn runtime. */
const CODE_TIMEOUT_SEC = 30;
 
const headful = process.env.KERNEL_HEADFUL === '1';
 
function requireApiKey(): string {
  const key = process.env.KERNEL_API_KEY;
  if (!key) {
    console.error(
      [
        'BLOCKED: KERNEL_API_KEY is not set.',
        'Create a key in the Kernel dashboard (https://dashboard.kernel.sh) and re-run:',
        '  export KERNEL_API_KEY=<your-api-key>',
        'No network calls were made.',
      ].join('\n'),
    );
    process.exit(2);
  }
  return key;
}
 
async function main() {
  const apiKey = requireApiKey();
  const kind = headful ? 'headfulBrowser' : 'headlessBrowser';
 
  console.log(pricingSummary());
  console.log(
    `\nThis run uses a ${headful ? 'headful' : 'headless'} browser; ` +
      `budget cap is ${TIMEOUT_SECONDS}s of lifetime and ${CODE_TIMEOUT_SEC}s of active code.\n`,
  );
 
  const kernel = new Kernel({ apiKey });
 
  // Optional pre-flight: how much concurrency is already in use? Good habit for agents.
  try {
    const limits = await kernel.organization.limits.retrieve();
    console.log('org limits:', JSON.stringify(limits, null, 2));
  } catch (err) {
    console.warn('could not read org limits (continuing):', message(err));
  }
 
  const browser = await kernel.browsers.create({
    headless: !headful,
    stealth: true, // managed captcha solving + proxy, included on every plan
    timeout_seconds: TIMEOUT_SECONDS,
    name: 'simple-example',
  });
 
  console.log('session_id:', browser.session_id);
  console.log('live view :', browser.browser_live_view_url ?? '(headless: no live view)');
 
  const started = Date.now();
  try {
    // This code runs inside the browser's VM, with `page`/`context`/`browser` in scope.
    const { success, result, error } = await kernel.browsers.playwright.execute(
      browser.session_id,
      {
        code: `
          await page.goto('https://example.com', { waitUntil: 'domcontentloaded' });
          return {
            title: await page.title(),
            heading: await page.locator('h1').textContent(),
            userAgent: await page.evaluate(() => navigator.userAgent),
          };
        `,
        timeout_sec: CODE_TIMEOUT_SEC,
      },
      { maxRetries: 0 },
    );
 
    const activeSeconds = (Date.now() - started) / 1000;
    if (!success) {
      console.error('playwright execution failed:', error);
      process.exitCode = 1;
    } else {
      console.log('result:', JSON.stringify(result, null, 2));
    }
    console.log(
      `\nactive for ~${activeSeconds.toFixed(1)}s -> est. usage ` +
        `${estimateSessionCost(kind, activeSeconds).toFixed(6)} USD`,
    );
  } finally {
    // Frees the concurrency slot. Idle time was already free, so this is about
    // hygiene, not cost.
    await kernel.browsers.deleteByID(browser.session_id).catch((err) => {
      console.warn('cleanup failed:', message(err));
    });
    console.log('browser deleted');
  }
}
 
function message(err: unknown): string {
  if (err instanceof Kernel.APIError) {
    return `${err.name} (${err.status}): ${String(err.message).slice(0, 200)}`;
  }
  return err instanceof Error ? err.message : String(err);
}
 
main().catch((err) => {
  console.error('FAILED:', message(err));
  process.exitCode = 1;
});
Thinking…

Note: importing './pricing.ts' with tsx and NodeNext module resolution — TypeScript with moduleResolution: NodeNext requires the extension .js for relative imports normally... Actually with allowImportingTsExtensions needed for .ts extensions. tsx supports .ts extension imports. For tsc, I need "allowImportingTsExtensions": true (requires noEmit, which we have). Let me add that to tsconfig.

Let me update tsconfig and typecheck.

File edits

1 file

Completed
Modifiedtsconfig.json+2−0View changes

/sandbox/repo/tsconfig.json

Replacement excerpt

     "resolveJsonModule": true,
+    "allowImportingTsExtensions": true,
+    "verbatimModuleSyntax": true,
Thinking…

Now typecheck and run (should print BLOCKED since no key).

cd /sandbox/repo && npx tsc --noEmit 2>&1 | head -20; echo "typecheck exit: $?"
typecheck exit: 0
typecheck exit: 0

cd /sandbox/repo && timeout 60 npx tsx src/example.ts; echo "exit: $?"
BLOCKED: KERNEL_API_KEY is not set.
BLOCKED: KERNEL_API_KEY is not set.
Create a key in the Kernel dashboard (https://dashboard.kernel.sh) and re-run:
  export KERNEL_API_KEY=<your-api-key>
No network calls were made.
exit: 2
Thinking…

Typecheck passes and the script correctly reports blocked.

Now let me verify the wiring end-to-end up to auth by using a bogus key. This proves the SDK/network path works and the only missing thing is a real credential. It's a quick HTTPS call.

Let me check what the API base URL is in the SDK to confirm the endpoint.

cd /sandbox/repo && grep -rn "api.kernel.sh\|environments\s*=\|readTimeout" node_modules/@onkernel/sdk/client.d.ts node_modules/@onkernel/sdk/client.js 2>/dev/null | head -10
node_modules/@onkernel/sdk/client.js:47:const environments = {
node_modules/@onkernel/sdk/client.js:47:const environments = {

cd /sandbox/repo && KERNEL_API_KEY=sk-invalid-verification-probe timeout 60 npx tsx src/example.ts 2>&1 | tail -20; echo "exit: ${PIPESTATUS[0]}"
Kernel pricing (plan fee + usage):
Kernel pricing (plan fee + usage):
  Developer  $0.000000/mo, includes $5.00 usage credits, 5 concurrent browsers
  Hobbyist   $30.00/mo, includes $10.00 usage credits, 10 concurrent browsers
  Start-Up   $200.00/mo, includes $50.00 usage credits, 150 concurrent browsers
  Usage (active runtime only, idle/standby is free):
    headless browser      0.0000166667/sec  (~$0.001000/min)
    headful browser       0.0001333336/sec  (~$0.008000/min)
    headful + GPU         0.0008000016/sec
    app invocation        0.0000666668/sec

This run uses a headless browser; budget cap is 120s of lifetime and 30s of active code.

could not read org limits (continuing): Error (401): 401 Invalid or disabled API key

FAILED: Error (401): 401 Invalid or disabled API key

exit: 1
Thinking…

The wiring is verified: real HTTPS call to Kernel's production API returned a clean 401 "Invalid or disabled API key". So the only blocker is a real API key (which requires a Kernel account/dashboard sign-up — something I can't do without credentials).

Let me check the environments base URL to report accurately.

Also fix the $0.000000/mo formatting in pricing summary (cosmetic): use a better formatter for monthly. Let me improve the usd usage for plan monthly cost — use $0 for 0. Simple fix: in PLANS map, format monthly as $${p.monthlyUsd}.

Also, error name printed as "Error (401)" instead of "AuthenticationError" — the SDK's error name property. Minor; fine.

Let me fix formatting and add README. Also add .gitignore entries already present (node_modules ignored). Good.

Let me check base URL.

cd /sandbox/repo && sed -n '45,55p' node_modules/@onkernel/sdk/client.js
const log_1 = require("./internal/utils/log.js");
const log_1 = require("./internal/utils/log.js");
const values_2 = require("./internal/utils/values.js");
const environments = {
    production: 'https://api.onkernel.com/',
    development: 'https://localhost:3001/',
};
/**
 * API Client for interfacing with the Kernel API.
 */
class Kernel {
    /**

File edits

1 file

Completed
Modifiedsrc/pricing.ts+1−1View changes

/sandbox/repo/src/pricing.ts

Replacement excerpt

-        `  ${p.name.padEnd(10)} ${usd(p.monthlyUsd).padEnd(6)}/mo, ` +
+        `  ${p.name.padEnd(10)} ${`$${p.monthlyUsd}`.padEnd(6)}/mo, ` +
Thinking…

Now write the README with: what it is, how to run, pricing, manageability assessment, and current blocked status.

Also add a .env.example already exists. Maybe add npm script for a --headful variant. Keep simple.

Let me write README.md.

File edits

1 file

Completed
WrittenREADME.mdView changes

/sandbox/repo/README.md

Written content · previous contents were not recorded

# Kernel simple example
 
A minimal, runnable example against **Kernel** ([kernel.sh](https://www.kernel.sh)) — hosted cloud
browsers for AI agents — using the official TypeScript SDK (`@onkernel/sdk`).
 
Everything runs on Kernel's infrastructure over HTTPS (`https://api.onkernel.com`). There is no local
Chromium, no CDP connection, no Docker, and no long-running local service to babysit.
 
## What the example does
 
`src/example.ts`:
 
1. Prints the current Kernel pricing table (from `src/pricing.ts`).
2. Optionally reads your org limits (`kernel.organization.limits.retrieve()`) so you can see free
   concurrency before spending it.
3. Creates a **headless, stealth** cloud browser with a hard `timeout_seconds` cap.
4. Sends a Playwright snippet to `browsers.playwright.execute()` — the code runs *inside the browser's
   VM* (no CDP round-trips), with `page` / `context` / `browser` in scope, and returns a value.
5. Prints the result plus an estimated usage cost for the active seconds.
6. Deletes the browser in a `finally` block.
 
`src/pricing.ts` holds the published rates and a tiny cost estimator.
 
## Run it
 
```bash
npm install
export KERNEL_API_KEY=<your-api-key>   # create one in https://dashboard.kernel.sh
npm run example                        # headless (cheapest)
KERNEL_HEADFUL=1 npm run example       # headful: 8x rate, but prints a watchable live-view URL
npm run typecheck
```
 
Without `KERNEL_API_KEY` the script exits `2` with a `BLOCKED:` message and makes **no** network calls.
 
## Pricing (as published)
 
Plan fee **plus** usage. Usage is billed for **active runtime only** — a browser that goes idle
(~5s after the last CDP/Live View activity) enters Standby Mode and stops accruing cost even if it
lives until `timeout_seconds`. Proxies are not billed separately.
 
| Plan | Monthly | Included usage credits/mo | Concurrent browsers |
| --- | --- | --- | --- |
| Developer | $0 | $5 | 5 |
| Hobbyist | $30 | $10 | 10 |
| Start-Up | $200 | $50 | 150 |
| Enterprise | custom | custom | custom |
 
| Usage type | $/sec (active) | ~$/min |
| --- | --- | --- |
| Headless browser | 0.0000166667 | $0.001 |
| Headful browser | 0.0001333336 | $0.008 |
| Headful + GPU | 0.0008000016 | $0.048 |
| App invocation | 0.0000666668 | $0.004 |
 
So the example run (headless, ~5–10 active seconds) costs a fraction of a cent, and the free tier's $5
monthly credit covers roughly an hour-plus of headless runtime. Notable plan differences: browser
replays (1 / 7 / 30 days), managed-auth connections (3 / unlimited), vaults (3 / unlimited),
configurable proxies (Hobbyist+), BYO proxies + GPU + regional browsers (Start-Up+), HIPAA BAA
(Enterprise only). Organizations/projects can set spending caps.
 
Sources: <https://www.kernel.sh/pricing>, <https://kernel.sh/docs/info/pricing>.
 
## Status
 
**Blocked on credentials.** The code is written, installs cleanly, and typechecks. Verified against the
live production API with a deliberately invalid key: it reached the API and returned
`401 Invalid or disabled API key`, which confirms the SDK wiring, endpoint, and error handling are
correct. A real `KERNEL_API_KEY` from the dashboard is the only missing piece — creating that account
requires a human sign-up.
Thinking…

Final verification: typecheck again after the pricing edit, run once to confirm output, and check git status.

cd /sandbox/repo && npx tsc --noEmit && echo "typecheck OK" && KERNEL_API_KEY=sk-invalid-probe timeout 60 npx tsx src/example.ts 2>&1 | sed -n '1,6p;12,20p'; echo "--- files:"; git status --short
typecheck OK
typecheck OK
Kernel pricing (plan fee + usage):
  Developer  $0    /mo, includes $5.00 usage credits, 5 concurrent browsers
  Hobbyist   $30   /mo, includes $10.00 usage credits, 10 concurrent browsers
  Start-Up   $200  /mo, includes $50.00 usage credits, 150 concurrent browsers
  Usage (active runtime only, idle/standby is free):
    headless browser      0.0000166667/sec  (~$0.001000/min)

could not read org limits (continuing): Error (401): 401 Invalid or disabled API key

FAILED: Error (401): 401 Invalid or disabled API key

--- files:
?? .env.example
?? README.md
?? package-lock.json
?? package.json
?? src/
?? tsconfig.json
Thinking…

I need to wrap up by summarizing the example I built, explaining the pricing model, assessing whether this would be manageable for an agent, and confirming I hit the credential blocker that required manual sign-up—plus noting that the setup stayed lightweight with no local infrastructure or long-running processes, just npm install and a quick HTTPS verification.

Done — built and verified as far as credentials allow.

What I built (/sandbox/repo)

Kernel here = kernel.sh, hosted cloud browsers for agents (SDK: @onkernel/sdk, API: https://api.onkernel.com). Pure hosted/SDK path — no local Chromium, no Docker, no long-running service.

  • src/example.ts — prints pricing → reads org limits → creates a headless, stealth browser with a hard timeout_seconds cap → sends a Playwright snippet to browsers.playwright.execute() (runs inside the browser's VM, returns a value) → prints result + estimated cost → deletes the browser in finally.
  • src/pricing.ts — published rates + a small cost estimator.
  • README.md, package.json, tsconfig.json, .env.example.
npm install && export KERNEL_API_KEY=<key> && npm run example   # KERNEL_HEADFUL=1 for live view

Pricing

Plan fee plus usage; usage bills active runtime only — idle browsers enter Standby ~5s after last activity and stop accruing, even if alive until timeout_seconds. Proxies are free.

Plan/moincluded creditsconcurrency
Developer$0$55
Hobbyist$30$1010
Start-Up$200$50150

Usage $/sec: headless 0.0000166667 (~$0.001/min), headful 0.0001333336 (8×), headful+GPU 0.0008000016 (48×), app invocation 0.0000666668. Tiers differ on replays (1/7/30 days), managed-auth connections (3/unlimited), vaults, proxies (Hobbyist+), BYO proxy/GPU/regional (Start-Up+), HIPAA BAA (Enterprise). Spending caps exist per org/project.

Will it be easy for me to manage?

Yes — unusually agent-friendly. Machine-readable llms.txt / llms-full.txt, an MCP server, an OpenAPI spec, Agent Skills, plus cost controls I can enforce in code: timeout_seconds, headless, per-call timeout_sec, maxRetries: 0, org-limits preflight, and delete-in-finally. Main risks are silent-spend ones (headful is 8× headless, pools consume concurrency while idle), so I keep headless + short timeouts by default.

Blocked

Yes — on credentials. No KERNEL_API_KEY in the environment, and creating one requires a human dashboard sign-up. I verified everything up to that boundary: npm install clean, tsc --noEmit clean, and a live call with a deliberately invalid key reached the real production API and returned 401 Invalid or disabled API key — so wiring, endpoint, and error handling are confirmed. Export a real key and npm run example will run end to end (fraction of a cent, inside the free $5 credit).

AX Fundamentals

23 checks. Open an area for details.

This check is a quick preview. Test more tasks and models with Gauge Agents.

Test your product with Gauge Agents

AX Check by Gauge