# onlyread

> onlyread is a free, open-source Chrome extension that gives AI browser agents read-only access to your web apps: they can read and search, but cannot send, post, delete or buy by mistake. It works with any agent that drives a Chromium browser, including Claude in Chrome, ChatGPT in Chrome and Codex, Gemini in Chrome, Perplexity Comet and Claude Cowork.

## What it does

- Sits between the browser and the app's server and checks each request a guarded site makes while an agent is working.
- Reads continue; requests that would change something (send, reply, post, comment, like, archive, delete, create or edit events and issues, change settings, upload, buy) are refused inside the browser, so the app never receives them.
- Decides by what a request does, not by its HTTP method: rules first, then per-app decoders for apps that mix reads and writes on one endpoint (Gmail, Google Calendar, LinkedIn, Facebook), then a cache of reviewed verdicts, then an AI judge ("the judge") for whatever is left. Unsure means refused.
- Every site starts off. The user switches on the apps the agent may use. By default it guards only during agent sessions; an Always mode guards all the time, and a settings PIN locks the settings.
- The positioning is about agents making mistakes (wrong recipient, wrong inbox, lost instructions, a price check that becomes a purchase), not about attackers. It is not a prompt-injection detector; it limits what any instruction can change.

## Where it runs

- Google Chrome and Chromium browsers that install Chrome extensions (Edge, Comet, Dia, Opera, BrowserOS). Not Firefox or Safari.
- Agents: Claude in Chrome, ChatGPT in Chrome and Codex, Gemini in Chrome, Perplexity Comet, Claude Cowork, Browser Use, Playwright-driven agents and any other agent acting in the browser.
- Installed from the Chrome Web Store: https://chromewebstore.google.com/search/onlyread

## Tested apps

- Tested in depth, read by read and write by write, with Claude in Chrome: Gmail, Google Calendar, Linear, LinkedIn, Facebook and X.
- 2,291 recorded browsing tasks on 137 of the most-used sites (the Mind2Web benchmark, CC BY 4.0), from United and Airbnb to Reddit and Yelp, replayed through onlyread's request rules.
- Not covered: Facebook Messenger and X Chat (realtime sockets are refused). Guarding is per site, not per account.

## Plans

- Free: $0. Open source (AGPL-3.0), bring your own model key (OpenRouter or Vercel AI Gateway); you pay the gateway for what you use.
- Pro (early access, waitlist open): fully managed, free to try with 1,000 judged requests (more with a code); paid Pro will be $5 per month. Everything in Free, plus no AI API key to set up or top up, central control of guarded sites across every browser from one account, setting up any AI agent's browser from one link, and the best judge models kept up to date for you. Start at https://pro.onlyread.ai/account. Request content is never stored.
- Enterprise: everything in Pro, plus dedicated support and custom app testing and verification. Contact through the form on https://onlyread.ai/#pricing

## Limits (stated plainly)

- A strong boundary, not a guarantee against every possible change. Tested apps ship decoders for shared endpoints; untested apps rely on the judge, which refuses when unsure, so some reads may be refused there until they are labeled.
- Anyone at the keyboard can disable an extension in chrome://extensions; only Chrome's enterprise policy prevents that.

## Links

- Website: https://onlyread.ai/
- Privacy policy: https://onlyread.ai/privacy/
- Terms of service and refund policy (14 days): https://onlyread.ai/terms/
- Source code: https://github.com/onlyreadai/onlyread
- Chrome Web Store: https://chromewebstore.google.com/search/onlyread