Web red teaming · Direct HTTP control · Sandboxed execution

Professional Red-Teaming
for Every Team

You don't need to be a security expert to perform red-teaming. h5i gives your AI agent page automation and direct HTTP control to test web applications from an attacker's perspective.

curl -fsSL https://h5i.dev/install.sh | sh -s -- --websec
Apache 2.0 · Pure Rust, no Chromium or V8 · browser + websec plugin · read the manual · source
600+GitHub stars 60+forks 20+contributors Apache 2.0open source, no lock-in
The problem

Red Teaming is Expensive, Difficult, and Dangerous.

Hiring security specialists can be expensive, and existing tools make it difficult to give AI agents the capabilities and boundaries they need.

Security expertise is hard to find
Effective red teaming requires us to understand an application, form attack hypothesis, and verify findings. Many teams do not have someone who can do that regularly.
Outside assessments are expensive
A professional assesment can be valuable, but paying for one every time an application is out of reach for many teams.
Existing tools were build for people
Complex GUIs require agents to interpret screens and navigate menus. Agents need a direct way to navigate an application and work with its HTTP traffic.
AI agents may run out of control
An agent can make mistakes or follow malicious instructions in a page. Testing needs enforceable sandbox and a record of what the agent actually did.
What h5i gives you

Automate Red Teaming with Your AI Agent.

h5i combines automated browsing with its own HTTP client. It gives your AI agents direct access to captured requests and responses for web application penetration testing, CTFs, and red teaming. Use it only on applications you own or are authorized to test.

Explore the agent benchmark results →

one session, from page to traffic
$ h5i browser open https://target.example --capture --allow target.example      # keep every message
$ h5i browser snapshot                                                          # the page as an outline
$ h5i browser click @e7                                                         # drive it like a user

$ h5i websec requests --human                                                   # what the session sent
  #41 GET  /login            200  2.1 kB
  #42 GET  /api/item?id=123  200  1.4 kB
$ h5i websec show req_42 --raw                                                  # byte for byte, as it went out
  GET /api/item?id=123 HTTP/1.1
  host: target.example
$ h5i websec replay req_42 --set query.id=456                                   # resend with one field changed
  res_43  200  1.9 kB
$ h5i websec diff res_42 res_43 --human                                         # how the two answers differ
  status   : 200 → 200
  bytes    : 1412 → 1903 (+491)
  alike    : 0.712
$ h5i websec match res_43 --contains "not your item"                            # exits 0 when it holds
$ h5i websec sitemap --human                                                    # origins and endpoints reached
  target.example
  * /api/item                        GET      200          x3  ?id

# Optional: open a separate browser session inside a container.
$ printf '[profile.custom-sandbox]\nisolation = "container"\n' > .h5i/env.toml  # a container-isolation profile
$ h5i box --profile custom-sandbox --name custom-sandbox                        # create the box with it
$ h5i browser open https://docs.rs/ --in custom-sandbox                         # open the session inside that box
Explore your app automatically
Your agent can read pages, click, type, and extract data through compact snapshots. Pure Rust, no Chromium or V8: ~3× faster reads with ~86% less peak memory than headless Chromium in our simple-site benchmarks.
Test HTTP requests directly
Your agent can capture traffic, inspect and edit requests, replay them, and compare responses. Browser activity and HTTP testing share one interface, with no separate proxy or CA setup..
Sandboxed workflow
Sandbox the browser or the entire AI agent workflow, with configurable network and filesystem limits. Review recorded browser actions and blocked connections. Enforcement depends on the selected isolation tier.
The dashboard

Monitor agents, sessions, and blocked actions.

Monitor active sandboxes and browser sessions, inspect the pages agents see, review commands and network requests, and spot blocked actions or policy violations.

FAQ

Frequently asked questions

The short answers. The manual has the long ones.

What is h5i?
h5i is an open-source toolkit that lets your AI agent red-team your web application. It gives the agent page automation and direct HTTP control through the websec plugin, runs it inside sandbox and network limits you configure, and records every action for review. It runs locally and is written in Rust without Chromium or V8.
Do I need to be a security expert to use h5i?
No. You tell your agent what to check in plain language, for example whether one user can read another user's orders. The agent explores the app in the browser, captures the requests behind each action, then edits and replays them to test the idea. Every request and response is recorded, so you, or a security reviewer later, can check the evidence behind a finding. Only test applications you own or are authorized to test.
Is h5i an automated vulnerability scanner?
No. h5i does not run a fixed list of checks against a URL and hand back a report. It gives your agent the tools a professional tester uses, and the agent decides what to try. Once a finding is confirmed, h5i test can replay it as a flow in CI, so a fixed issue stays fixed.
Why use h5i instead of Playwright or Puppeteer?
Use Playwright or Puppeteer when maximum website compatibility is your priority. Use h5i when your AI agent needs page automation and direct HTTP testing through one interface, with configurable sandboxing, network policies, and a reviewable session record.
Why use h5i instead of Burp Suite?
Use Burp Suite when an experienced tester wants the deepest workbench: an intercepting proxy, Scanner, Intruder, extensions, and Burp's own agent. Use h5i when your own AI agent should run the test end to end. One session drives the browser and records its traffic, and the agent edits, replays, and compares requests through a CLI built for it, without a security specialist driving each step. See the full comparison.
Does h5i work on every website?
No. h5i works best for content-heavy websites and common browser interactions, but some browser APIs are not yet supported. For incompatible websites, you can run Chromium inside an h5i sandbox.
Is h5i sandboxed by default?
The browser uses lightweight process isolation when available. To restrict a red-teaming agent's other tools as well, sandbox the entire workflow and configure its network and filesystem policy. Available options include supervised isolation, containers, and microVMs; enforcement depends on the selected tier and host support.
Can h5i prevent prompt injection?
No. A tested application can still mislead an agent. h5i treats page content as untrusted, and configured network and filesystem restrictions can limit what the agent reaches. These controls reduce the impact; they do not guarantee safe actions on an allowed target.
Can the agent see my passwords or cookies?
The agent can reference a named credential without reading its value, or a human can take control to log in. The authenticated session continues without returning the password or cookie to the model.
Does h5i keep my data local?
h5i has no hosted service and stores its sessions locally. Browser traffic still goes to websites you allow, and model traffic goes to your configured model provider.

Let agents test like professional hackers.

Run authorized red teaming with configurable sandbox and network limits, and auditable browser sessions. Local-first, Apache 2.0, with no hosted service.

curl -fsSL https://h5i.dev/install.sh | sh -s -- --websec
Start your first session Star on GitHub