Tutorial 3: Automating a browser

In this tutorial you give malac its own browser profile, log in to a site once by hand, and then have malac collect data from the logged-in site into a CSV file. The login stays in the profile for later sessions.

The example site is quotes.toscrape.com, a public sandbox built for scraping practice. Its login form accepts any username and password.

You need Chrome, Chromium, Brave or Edge installed, and malac from tutorial 1.

Check the control service

Make sure malac-control is installed. Every install method installs it next to malac.

malac-control --help

Computer and browser control over MCP

Usage: malac-control [OPTIONS] <COMMAND>
...

Check that malac connects to it.
```
malac mcp
```
```
● control (28 tools)

computer_screenshot, computer_click, …, browser_profiles, browser_open, …
```
control is the control service: 12 computer_* tools and 16 browser_* tools. malac mcp started its own copy for this check; your interactive sessions use the one the daemon connects when it starts. If you see ✗ control, the error below it says why. This tutorial only uses the browser, so the macOS desktop permissions are not needed.

Create a profile

Add a profile for the site. Each profile is its own Chrome instance with its own data directory, so this login never mixes with your other browsing. Add to ~/.malac/control.toml (create the file if needed):
```
[browser.profiles.quotes]
```
List the profiles.
```
malac-control profiles
```
```
Profiles:
- default: managed, /Users/you/.malac/browser/default
- quotes: managed, /Users/you/.malac/browser/quotes

System browser profiles (usable as clone_from):
- …
```
The second list shows your own Chrome profiles. malac cannot drive those directly (Chrome does not allow remote control of your everyday profile), but a malac profile can copy one with clone_from.

Log in once

Start a session in an empty directory.
```
mkdir quotes && cd quotes
malac
```
Ask malac to open the login page.
```
Open https://quotes.toscrape.com/login in the quotes browser profile, then stop.
```
malac asks before browser_open or browser_navigate, like any action. Choose Always so the browser tools you approve do not ask again this session. A Chrome window opens with the login page.
```
● browser_open profile=quotes url=https://quotes.toscrape.com/login
  ⎿ …
```
Log in yourself, in that window. Type any username and password and click Login. The page now shows a Logout link.

Don’t put passwords in prompts. Everything you type to malac is stored in the session transcript and sent to the model. Logging in by hand inside the profile keeps the credentials out of both.

Scrape the site

Describe what you want.

Using the quotes profile, collect every quote on the first three pages of
https://quotes.toscrape.com with its author and tags, and save them to
quotes.csv with the columns quote, author, tags. Then tell me how many
quotes you saved and which author appears most often.

Follow along. malac navigates, reads each page as a text outline with browser_snapshot, follows the Next link, and writes the file:

● browser_navigate profile=quotes url=https://quotes.toscrape.com/
● browser_snapshot profile=quotes
  ⎿ Quotes to Scrape — https://quotes.toscrape.com/ …
● browser_click profile=quotes ref=31
● browser_snapshot profile=quotes
● browser_click profile=quotes ref=33
● browser_snapshot profile=quotes
● write quotes.csv
  ⎿ Created quotes.csv (31 lines)
Saved 30 quotes from pages 1–3 to quotes.csv. …

browser_snapshot tags links and buttons with refs such as [31], which browser_click uses. Snapshots and screenshots are read-only and never ask. The agent may also use browser_eval to extract the data with JavaScript; that is an Execute tool and asks first.

Check the file.

head -n 3 quotes.csv && wc -l quotes.csv

quote,author,tags
"…",Albert Einstein,"change,deep-thoughts,thinking,world"
"…",J.K. Rowling,"abilities,choices"
      31 quotes.csv

Logins persist

Close the browser. Ask “close the quotes browser” (browser_close). Quitting the terminal UI does not close it: the daemon keeps the control service, and its browsers, running. The control service closes the browsers it launched when it stops, for example with malac daemon stop.
Come back later. In a new session:
```
Open https://quotes.toscrape.com in the quotes profile. Am I logged in?
```
malac reports a Logout link: the session cookie lives in ~/.malac/browser/quotes and survives restarts.

Variations

Copy an existing login. Seed a profile from one of your Chrome profiles on its first launch:

[browser.profiles.work]
clone_from = "Profile 1"   # a name from `malac-control profiles`

Attach to a browser you started. Start Chrome with --remote-debugging-port=9222 and a separate --user-data-dir, then:
```
[browser.profiles.debug]
cdp_url = "http://127.0.0.1:9222"
```
No window. Set browser.headless = true in control.toml to run managed browsers in the background, once their logins are set up.
Pre-approve browsing. allow = ["browser_*"] in [permissions] lets the agent browse without asking; add deny = ["browser_eval"] to keep JavaScript evaluation off.
A shared service. malac-control serve runs the service on its own; every malac session, and any other MCP client with the token, can use the same browsers.

See Computer and browser control and the tool reference.

Next: Long-term memory with Milvus.

malac is created by lobirus and released under the MIT license. About malac