You’re about to let Claude in Chrome, Codex, Gemini in Chrome, Comet or Grok Bot loose in your signed-in inbox to find an invoice. It should read everything and change nothing: no reply to the wrong person, no price check that becomes a purchase. Setting that up takes one extension and a quick test, and it has limits worth knowing before you start.
What can a read-only agent still do?
Anything that only reads, such as opening messages, searching and browsing, plus steps that prepare a change without making it, such as writing a draft or adding to a cart. OnlyRead checks every request the agent’s clicks send. Reads, drafts and carts go through, and changes stop in your browser before the app sees them.
| The agent asks to | What happens |
|---|---|
| Read a message or open a thread | Passes |
| Search, even when the search is sent as a POST | Passes |
| Browse a profile, a feed or a calendar | Passes |
| Write a draft or add to a cart | Passes |
| Send, reply, post, comment or like | Refused |
| Archive or delete, create or edit events and issues | Refused |
| Check out or buy | Refused |
| Change a setting | Refused |
Why not block every request that sends data?
Because many apps send a search and a change the same way. GraphQL, a common way for web apps to talk to their servers, names two kinds of request in its specification: a query, “a read-only fetch”, and a mutation, “a write followed by a fetch”.1 Its guide to serving over HTTP has servers take both with the same HTTP method, POST, at one shared address, usually /graphql.2 The method and the address are the same for both, so OnlyRead reads the request body, where the query or mutation is named.
Same method, same address: only the body tells them apart
/graphqlquery { search(text: "invoice") { … } }A query, “a read-only fetch”
Passes
/graphqlmutation { sendMessage(text: "…") { … } }A mutation, “a write followed by a fetch”
Refused
How do you set it up for the agent you already use?
Your agent, browser and prompts stay as they are. OnlyRead adds one extension to that browser.
- Add it to the browser the agent drives. Install OnlyRead from the Chrome Web Store.
- Choose the AI judge. In the window that opens, sign in to OnlyRead Pro or paste your own OpenRouter or Vercel AI Gateway key. Protection only switches on once a judge is set.
- Switch on the sites the agent may use. Every site starts off. Turn on the apps where a mistake would hurt (mail, calendar, messages, work tools) in the settings, or use Guard this site in the popup.
- Decide when it guards. By default, OnlyRead guards while an AI agent is working in the browser. Choose Always under Security if your agent controls the screen from outside the browser, or if pages should be guarded from the moment they load. Chrome then shows its debugging banner the whole time.
While an agent is working, nobody can switch OnlyRead off or loosen it from the settings, you included: those changes are refused until the agent finishes. A settings PIN adds a second lock.
How do you check that it is working?
Try one read and one small change you can undo, on a guarded site. Make a throwaway post or issue for the test rather than using real work, and never test with a payment, a message to someone else or a delete.
- Confirm it is on. Open OnlyRead’s popup on the site: the Protection switch should be on, and the site’s own switch set to On.
- Ask your agent to read something, for example: “Find the latest post from a friend on X and summarize it.” The post should load as usual.
- Ask your agent to make a harmless change, such as liking your own test post or changing the priority of a throwaway issue in Linear. The page should show OnlyRead’s notice, such as “OnlyRead kept X read-only”, naming the stopped change. Details shows why.
- Reload and look again. The like should not be there.
- Read the activity list in the settings page’s Activity: recent decisions with the method, address, verdict and reason.
The quickest version is Try the demo, under Overview on the settings page: it walks you through one refused change on a tested site you’re signed in to.
Which agents and browsers does it work with?
OnlyRead guards the browser itself, so an agent acting in a browser with OnlyRead installed is covered on the sites you switch on, once OnlyRead notices it. By default that means the agent’s debugging connection to the tab. An agent that drives the screen from outside the browser is only covered in Always mode (see what read-only mode doesn’t cover). It works with these agents and browsers:
- Agents: Claude in Chrome, ChatGPT in Chrome and Codex, Gemini in Chrome, Perplexity Comet, Claude Cowork and xAI’s Grok Bot, plus frameworks such as Browser Use and Playwright.
- Browsers: Google Chrome and other Chromium-based browsers (built on the same open-source core) that install Chrome extensions, such as Edge, Comet, Dia, Opera and BrowserOS. Not Firefox or Safari.
You can switch on other sites too, but only eight apps were tested in depth, read by read and write by write: Gmail, Google Calendar, Linear, LinkedIn, Facebook, X, Telegram and WhatsApp. The public test notes list, app by app, the reads that work and the writes refused.3 On other sites you switch on, rules and the AI judge decide, without app-specific checks.
Want an app tested in depth? Request it on GitHub.
How is it different from instructions, approvals or read-only tools?
These controls sit in different places and combine well.
| Approach | Where it holds | What it stops | The trade-off |
|---|---|---|---|
| Telling the agent to only read | The model’s instructions | Nothing for certain | Free, but a misread or lost instruction can still cause a change |
| Approval prompts | The agent, before an action | Actions you decline | Works if you read every prompt |
| Read-only tools | The agent’s tool list | Any action the tools leave out | Strong, but you build or configure the agent yourself |
| A separate browser profile | Which accounts the agent can reach | Changes in accounts that profile isn’t signed in to | Simple and strong, but the agent can’t read those accounts either |
OnlyRead | Each request to a guarded site | Requests judged as changes, and anything unsure | Works with your agent, but only on guarded sites, and it can misjudge |
If you build the agent, developer tools go further: OpenAI’s browser-driver guide suggests exposing only read methods and enforcing a network policy too,4 and Quilzo checks each request in a sandboxed browser with declared read and write hosts.5
Can it get a request wrong?
It can, though most requests are settled before any model is asked:
- RulesPlain reads pass, DELETE is refused
- App decodersShared addresses, read by operation
- Reviewed verdictsHand-checked on tested sites
- AI judgeThe rest, refused when unsure
- Rules. Request types that can only change data (such as DELETE), uploads, and form posts that load a new page are refused. Plain reads and known usage tracking pass.
- Per-app decoders. Where an app sends reads and writes to one shared address (Gmail, Google Calendar, LinkedIn, Facebook), OnlyRead reads which operation each request names.
- Reviewed verdicts. Tested sites ship hand-checked verdicts from recorded sessions.
- The AI judge. Whatever is left gets one question: does this request change data on the server? A second model reviews what the first can’t settle. Unsure, or no judge reachable, means refused.
The judge, like any AI model, can still get one wrong, so refusing when unsure is deliberate. A missed read costs a retry, but a missed write can be hard or impossible to undo.
What does read-only mode not cover?
It is a strong boundary, though no guarantee. These are its limits:
- A site you haven’t switched on isn’t checked.
- If your agent also reaches an app through a connector or an API, those actions happen outside the browser, where OnlyRead can’t see them.
- By default, guarding starts when OnlyRead notices an agent’s debugging connection to a tab (an open DevTools counts too). What a page sends before the agent’s first action isn’t checked, and a live connection opened before then stays open until you reload. Always mode closes the gap, and also covers agents that drive the screen from outside the browser.
- Guarding is set per site, so every tab of a guarded site is guarded, whichever account is signed in.
- Someone at the computer can turn it off in
chrome://extensions. Only Chrome’s enterprise policy prevents that.
The agent can still read everything in the accounts it reaches. OnlyRead also doesn’t detect hidden instructions, though it still limits what any instruction can change.
Where does your data go, and which plan fits?
The extension is open source on every plan. Your settings and decision log stay in your browser, and most requests are decided on your device. Only a request nothing local can classify is described to a model: its method and address (with query parameter names, and short values for requests that can change data or that name the operation), its body’s structure with a preview of up to 2 KB, and the interface action that triggered it. Cookies, request headers, page content and passwords you type are never sent, though the preview can hold personal data.
- Free ($0). Your own OpenRouter or Vercel AI Gateway key, and you pay the gateway. Descriptions go only to that provider. We receive nothing unless you choose to send us a report.
- Pro (free in early access). No key: 1,000 judged requests, no credit card. Paid Pro will be $5 a month. Descriptions go to our service, which never stores the request content or uses it for training, and your guarded sites are kept on your account.
- Enterprise (on request). Team-wide agent activity, integrations and custom app testing: contact us.
Questions
Is OnlyRead another AI agent?
No. It never browses, writes or answers anything itself. It only checks the requests your existing agent’s browser sends to the sites you guard.
Can I still use guarded sites myself?
Yes, in the default mode, which refuses changes only while an agent is at work (while one is, your own changes on guarded sites are refused too). In Always mode they are refused at any time, so switch a site off before you post or reply there.
What if I want the agent to write somewhere?
Switch that one site off before the task starts, and watch what the agent does there. Your other guarded sites stay read-only.
Can I see how it decides?
Yes. You can inspect OnlyRead’s source, and the terms set out its limits and the early-access conditions.
Sources
- GraphQL specification, section 2.3: Operations, GraphQL Foundation, October 2021 edition.
- Serving over HTTP, GraphQL Foundation, retrieved Nov 8, 2026.
- Tested sites: what was tested, OnlyRead on GitHub, Nov 2026.
- Browser and desktop drivers, OpenAI API documentation, retrieved Nov 8, 2026.
- AI agent browser use with read and write hosts and approvals, Quilzo, retrieved Nov 8, 2026.