Web

You choose which sites agents may open. A site is a single host, such as docs.example.com, or a domain with its subdomains, such as *.example.com. Only * allows every site. Endings shared by many owners, such as *.com, *.co.uk or *.github.io, cannot be allowed; allow the one site instead, such as alice.github.io. A block on a domain wins over access to a wider one.

Your organization’s admins can also limit the Web to a list of domains under Allowed apps. A domain such as wikipedia.org covers the domain and every subdomain. Members then choose sites only within that list, and nothing they allow goes beyond it: allowing every site means every site in the list, and a page on another domain is refused before anything is opened.

Permissions

Permission	Chosen per	What agents can do
Open in browser	Site	Open a page in Cloudflare’s browser, which runs the page’s scripts, and read it as text or look at a picture of it.

Opening a page is a visit

Minerva opens every page in Cloudflare Browser Run, a browser that runs the page’s scripts as any visitor’s browser would. Allowing a site allows agents to visit it, not only to read it. A visit can change things on the site:

• The page’s scripts run. They can send requests to the site, including forms, so a page that confirms, approves, unsubscribes or submits something when it loads does so.
• Sign-in links work. A link that signs its visitor in, such as one from an email, signs Minerva’s browser in for that visit, and the agent reads that account’s pages.
• A visit can happen more than once. Reading a long page in parts, a retry after a failure and a second look each open the page again, and anything the page does when it loads happens again.

Risks to weigh

• Agents can send information out through the addresses they open. An address can carry any text the agent puts in it. The site receives it, and so does any site the page redirects to, since redirects and the page’s own scripts can move Minerva’s browser to another site. Every site agents may open, and every site it redirects to, is a place where information can go, so allow only sites you trust. Allowing every site lets information go anywhere.
• Pages are written by others. A page can contain text meant to steer the agent, and reading it as text does not remove that.
• Pages are opened by Cloudflare. Browser Run receives each address and page, and may process them outside the EU. It discards the page after each visit, and does not say how long it keeps the addresses. The text or picture the agent got stays in the conversation.

How pages are opened

• Every page opens over https. An http address opens as https on the same host, so a site without https cannot be opened.
• The browser loads what a page needs only from the page’s own host. Scripts, styles, frames and data from any other host are blocked, including another subdomain of the same domain: www.example.com cannot load from static.example.com, even when you allowed *.example.com. A page whose content or code comes from elsewhere, such as a content delivery network or api.example.com, can therefore come back empty, and a picture of it can look unstyled.
• When a page read as text ends on another host, or on plain http, agents get its new address, not its content, and need Open in browser on that site to open it. A move made by the page’s own scripts or forms is not detected, so that page comes back as if it were the allowed site’s.
• A picture shows wherever the browser ended, another site’s page or an error page included, since Minerva cannot tell that it moved.
• Cloudflare starts each visit with an empty browser, so no cookies or sign-ins are kept from one visit to the next.
• Sites see Cloudflare’s browser, identified as an automated visitor, not the person using Minerva.
• Minerva refuses IP addresses and local names, such as localhost, before anything is opened.

Limits

• Minerva waits 15 seconds for a page, and reads at most 3 MB of its text. Agents read a long page in parts, and each part opens the page again, so it can change in between.
• One answer opens at most 100 pages, pictures included.
• A picture shows only the first screen of a page, 1280 by 800 pixels, and only agents whose model reads images can see it. Cloudflare’s browser plays no video or WebGL.

What agents cannot do

Agents cannot click, type or fill in forms themselves. Pages behind bot protection, such as CAPTCHAs, cannot be opened. Agents read web pages and text files, not PDFs or images by their address.