How do you handle credentials and sessions for sites behind a login, like the bank and insurance portals you mention? Is the user's password or session cookie stored on your side, or does the generated MCP run against a session the user keeps locally?
Related: page content is untrusted input that now flows straight into an agent's context. Do the deterministic tools return only structured fields you've extracted, or can arbitrary page text (reviews, messages, product descriptions) pass through? That seems like the main prompt-injection surface for anything that can also perform actions like checkout.
For our hosted version, the session runs in our hosted browser. For the open source, it runs on a local browser.
In the hosted version, users can choose to pass logins at runtime or store them in our vault. Once a user logs in, we keep their session as a Chrome profile and attach it to a sticky IP, so that they stay logged in for longer.
Deterministic tools return only the structured fields, and don't parse the whole browser DOM. Since tools are deterministic, we also reduce the risk of prompt injections.
Printing Press is a great project! At a philosophical level, Pomerado is meant to be more autonomous - it's a standalone harness that you can run, and it's meant to require as little review as possible after the first request. If there are questions about the site or intent, we have coding agents with application context answer those questions.
We find this integrates into automated software development workflows a lot better, and my Openclaw can basically create new MCPs for me with little supervision required.
In terms of mechanisms, Pomerado uses a mix of HTTP requests and generated Playwright code. Printing Press has a far greater emphasis on making HTTP requests to the site's backend. We've found for some sites this latter approach can create issues around triggering anti-bot and can fail for more complicated forms and writes, so we use Playwright for those instances.
Pomerado's approach to researching the website is also a bit different - we solely focus on exploring the website itself, while Printing Press has your agent explore the web for documentation, SDKs, etc. There's a tradeoff of prompt injection security vs convenience there. Because we try to emphasize autonomous builds we limit the agent to the website for security.
A big pain point for us with existing approaches was using them for cloud agents (e.g., my Openclaw on my VPS). Cloud starts running into a lot of issues around hosting, authentication, and anti-bot, which is why we started offering a free hosted version of the open source, where we handle cloud browsers, proxy rotation, credential storage, CAPTCHAs, etc.
We're planning to roll out support for CLIs down the line! And the PR for non-OpenAI models + codex exec is in the works :)
Hmm, I've also built a self healing system for agents to get data from various services. Do you have any sort of dashboard showing integration maintenance?
Great that you're building as well, we think it's a really interesting space.
We don't have a maintenance-specific dashboard. We do maintenance at execution time, so the dashboard paradigm doesn't apply as well. Instead of proactively checking for site changes, we check at execution time and repair integrations on-the-fly, when necessary.
Curious how this handles session isolation and rate-limiting when converting dynamic DOM heavy pages into MCPs.
If an agent hits a heavy SPA with infinite scroll or aggressive bot protection, does Pomerado handle edge-caching or proxy-level deduplication, or is it parsing raw DOM on every tool call?
Hi! Unlike traditional scrapers we don't parse the entire DOM on every tool call. Because we build custom integrations for every site, we can be more targeted in our approach, like only checking specific fields.
We don't edge-cache or deduplicate calls, to give users live data.
For session isolation, we give each worker its own browser, cookies, and IP to isolate user sessions and prevent rate limiting.
Related: page content is untrusted input that now flows straight into an agent's context. Do the deterministic tools return only structured fields you've extracted, or can arbitrary page text (reviews, messages, product descriptions) pass through? That seems like the main prompt-injection surface for anything that can also perform actions like checkout.
In the hosted version, users can choose to pass logins at runtime or store them in our vault. Once a user logs in, we keep their session as a Chrome profile and attach it to a sticky IP, so that they stay logged in for longer.
Deterministic tools return only the structured fields, and don't parse the whole browser DOM. Since tools are deterministic, we also reduce the risk of prompt injections.
The obvious differences I can see are:
- generates an MCP server instead of a CLI
- at 'minting' time, uses OpenAI API keys, instead of coding agent subscription
- tries to solve for a particular use case, instead of all the site provides
We find this integrates into automated software development workflows a lot better, and my Openclaw can basically create new MCPs for me with little supervision required.
In terms of mechanisms, Pomerado uses a mix of HTTP requests and generated Playwright code. Printing Press has a far greater emphasis on making HTTP requests to the site's backend. We've found for some sites this latter approach can create issues around triggering anti-bot and can fail for more complicated forms and writes, so we use Playwright for those instances.
Pomerado's approach to researching the website is also a bit different - we solely focus on exploring the website itself, while Printing Press has your agent explore the web for documentation, SDKs, etc. There's a tradeoff of prompt injection security vs convenience there. Because we try to emphasize autonomous builds we limit the agent to the website for security.
A big pain point for us with existing approaches was using them for cloud agents (e.g., my Openclaw on my VPS). Cloud starts running into a lot of issues around hosting, authentication, and anti-bot, which is why we started offering a free hosted version of the open source, where we handle cloud browsers, proxy rotation, credential storage, CAPTCHAs, etc.
We're planning to roll out support for CLIs down the line! And the PR for non-OpenAI models + codex exec is in the works :)
We don't have a maintenance-specific dashboard. We do maintenance at execution time, so the dashboard paradigm doesn't apply as well. Instead of proactively checking for site changes, we check at execution time and repair integrations on-the-fly, when necessary.
If an agent hits a heavy SPA with infinite scroll or aggressive bot protection, does Pomerado handle edge-caching or proxy-level deduplication, or is it parsing raw DOM on every tool call?
We don't edge-cache or deduplicate calls, to give users live data.
For session isolation, we give each worker its own browser, cookies, and IP to isolate user sessions and prevent rate limiting.