tallylamp.GitHub

OPEN SOURCE. HUMAN IN THE LOOP.

Give your agent a real browser to come back to.

Full Chrome on your own server, with your logins and extensions saved. Its setup is designed to avoid unnecessary automation signals. When your agent hits a sign-in, take over and hand the same browser back.

Deploy on Railway View on GitHub

Free and open source. Runs on Railway or any Docker host.

01HOW IT WORKS

Real Chrome.
A session you keep.

Chrome DevTools MCP provides the browser tools. Tallylamp gives them one Chrome that stays signed in, on a server you run.

Persistent profiles

Sign in once. The profile saves itself, so cookies survive restarts and redeploys. Each site still decides when a login expires.

How profiles persist

Live takeover

Step in for sign-ins and 2FA. Watching is read-only. While you hold control, the agent can’t change anything until you hand the browser back.

The sign-in handoff

Guest links

Hand a sign-in to a colleague. A single-use link gives them one browser for 15 minutes to a day, long enough to clear a 2FA prompt on their phone. They can use every login saved in it, so share one that holds nothing else.

Share a browser

Agent permissions

One token per agent. Each has its own scopes and browser cap. Profile copies and tunnels stay off until you allow them.

Agent permissions

Standard Chrome

No headless build. Tallylamp starts standard Chrome with a display and no extra automation flags. Sites can still detect or block automation.

What the browser realism tests show

Your own browser

Share a tab from your own browser. Tallylamp Link works in Chrome, Edge and Brave. Agents you tick get that tab and no other.

Link your own browser

02YOUR EXTENSIONS

Bring your extensions.
They stay installed.

Switch to Full browser to see Chrome’s own window. Pin an extension there and a persistent browser keeps it through every restart. Shown here: Dray, in public beta.

03FROM DEPLOY TO FIRST HANDOFF

Make room
for your agent.

The Railway template sets up the service, HTTPS and a disk for profiles.

Deploy on RailwayRead the setup guide
  1. 01

    Deploy your own Tallylamp.

    Once the template is running, copy ADMIN_SECRET from its service variables and keep it as your dashboard password.

  2. 02

    Connect an agent.

    Sign in at your new domain, create an agent and paste its token into your client’s config. OAuth clients can skip the token.

    claude mcp add --transport http \
  --header "Authorization: Bearer YOUR_AGENT_TOKEN" \
  tallylamp https://YOUR_HOST/mcp

    Highlighted values are yours to replace. Client compatibility

  3. 03

    Try the first handoff.

    Ask your agent to open a site that needs a sign-in.

    Example session · results shortened
    1. tallylamp_create_browser { "name": "billing" }Browser billing is running. Its profile is saved.
    2. navigate_page { "url": "https://app.example.com" }Sign-in page. The agent asks you to take control.
    3. You choose Take control and sign in.
    4. click { "uid": "1_7" }browser is controlled by a human; retry later
    5. You choose Return to agent.
    6. navigate_page { "url": "https://app.example.com/billing" }Billing, signed in. The session stays in this profile.

04YOURS TO RUN

Open source.
Your server, your schedule.

Free under the MIT license. Your only bill is your host’s.

License

MIT

Free to run and change. Read every line before you trust it with a login.

Read the license

Memory

1–2 GB

Per active Chrome, plus the server. On Railway the 1,000-process limit usually runs out first. Pin the browser that must stay up, or add a worker for another 1,000.

Plan memory

Upgrades

Pinned

You choose when to upgrade. The template pins an image digest, so our pushes never reach your install.

How updates work

Docker

Prefer your own host? Run the image anywhere Docker runs. Keep the volume and you keep the profiles.

Self-host with Docker
Terminal
export ADMIN_SECRET="$(openssl rand -hex 32)"
# Save ADMIN_SECRET in your password manager.
docker run --rm --platform linux/amd64 \
  -p 127.0.0.1:8080:8080 \
  -e ADMIN_SECRET \
  -e TALLYLAMP_PUBLIC_URL=http://127.0.0.1:8080 \
  -v tallylamp-data:/data \
  ghcr.io/nxfi777/tallylamp:0.11.6

05BEFORE YOU DEPLOY

A few practical
questions.

Read the security model
Do I need to save my browser after signing in?

No. Profiles are saved by default, with no separate save step. Reuse the same browser and its cookies survive stops and redeploys, as long as the data volume stays attached. Sites can still expire a session.

What are profile templates?

A snapshot other browsers can start from. Saving one briefly pauses the browser. The copy carries every saved login but not proxy settings, and some sites will ask for a fresh sign-in. Agents need permission to use templates.

Can each browser use a different proxy?

Yes, HTTP or HTTPS, with optional credentials. Stop the browser before you change it. A failed proxy never falls back to a direct connection. SOCKS and PAC aren’t supported, and DNS resolves on the server. Proxy passwords sit unencrypted in SQLite, so protect the data volume and its backups.

Can the browser reach localhost or a dev server on my laptop?

Not by default. Chrome runs on your server, so localhost means the server. For a local OAuth callback, open a loopback tunnel from your machine to one host and port. It needs the browser:tunnel scope and expires after an hour. While it’s open, any page in that browser can reach that address, so close it when you’re done.

What should I know before using sensitive accounts?

An agent with control can use every account signed into its browser, and an installed extension can read those pages too. Browsers in one deployment share a container, so they’re less isolated than separate virtual machines. On Railway, Chrome’s renderer sandbox may be off. Read the security model first.

Can it get past a CAPTCHA or avoid detection?

No. Tallylamp doesn’t solve CAPTCHAs or hide automation, and sites can still block it. When a site wants a human, take control and do that step yourself.

Your agent’s next browser.
With you in the loop.

Deploy on Railway